Converting SSL-certificates from CRT format to PEM
Dovecot, for example, seems to expect pem-files, while RapidSSL only issues crt-files. The solution? Use OpenSSL to convert (via the DER-format) to pem:
openssl x509 -in input.crt -out input.der -outform DER
then
openssl x509 -in input.der -inform DER -out output.pem -outform PEM
November 4th, 2008 at 19:02
Thanks, your steps also worked for Network Solution’s CRT files.
June 2nd, 2009 at 21:30
Tried this on a GoDaddy certificate. The first command worked, but the second one returned:
unable to load certificate
12085:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: TRUSTED CERTIFICATE
(OpenSSL 0.9.8k)
June 3rd, 2009 at 09:00
Hi James,
This seems to imply that the file you use for input does not
contain a “—–BEGIN CERTIFICATE—–”-line, which means
the previous command didn’t work or that your syntax is
incorrect. Could you paste the exact commands that you ran and what your original filenames were?
November 18th, 2009 at 16:55
Thanks for your help. It function now….
December 1st, 2009 at 20:55
CRT is just a common extension, but the format is PEM in both cases. For a prove of that just take a CRT certificate, apply the commands listed above and compare the resultant file with the original. You will see that they are exactly the same.
January 30th, 2010 at 20:59
Leandro, that’s not necessarily true. Some CRT files might even use DER format
March 3rd, 2010 at 21:28
Many thanks
July 20th, 2010 at 22:41
Thanks for the blog. Not sure that you need to do this in two stages though?
Just specifying “-outform PEM” in the first command created an identical file to doing it in two stages.
August 20th, 2010 at 17:49
It outputs to the same file for me, at least when following @Twirrim’s instructions, but it still works.