In DevOps environments, server administration, application integration or service migration, the need for fast and reliable SSL/TLS certificate conversion between different formats appears very frequently. Various servers and applications require different file structures – Apache prefers PEM, Windows IIS uses PFX, Java/Kafka require P7B, and many network appliances only support DER.
To streamline the work of administrators, developers and system integrators, we are introducing a new tool in the HEXSSL Tools suite:

HEXSSL – SSL Converter

Professional X.509 certificate conversion between the most popular formats: PEM ↔ DER ↔ P7B ↔ PFX (PKCS#12).
The tool is available for free, in three languages (PL, EN, DE) and operates entirely on the HEXSSL server – without the need to install any software, scripts or OpenSSL locally.

Why did we create the SSL Converter?

In daily certificate operations, the following issues often arise:

• a system requires the .cer (DER) format while only PEM is available,
• a Windows server requires .pfx, but the developer only received a separate certificate and private key,
• Java applications expect P7B, while the test environment only has PEM,
• a full certificate chain needs to be extracted quickly from P7B,
• PFX → PEM conversion is required to deploy a certificate on an Nginx/Apache server.

In such cases, manual OpenSSL handling, parameter selection or debugging formatting errors can be time-consuming. The SSL Converter automates the process and eliminates the risk of mistakes.

HEXSSL – SSL Converter features

The tool enables:

✔ Conversion PEM → DER (.cer)

Ideal for network appliances (firewalls, load balancers, appliances).

✔ Conversion DER → PEM

Useful when importing certificates into OpenSSL, web servers and automation tools.

✔ Export of a full chain P7B → PEM

Automatically extracts the certificate, intermediate CAs and chain.

✔ Generation PEM → P7B

Used by Java/JKS-based applications, IIS and enterprise systems.

✔ Packaging PEM (cert + key) → PFX (.pfx)

With password handling and compatibility with IIS, Exchange, RDS and Windows Server.

✔ Export PFX → PEM (cert + key + CA bundle)

Allows installation of the certificate on Linux systems (Nginx/Apache).

Conversion security

The tool operates fully stateless:

• certificates and private keys are not stored,
• all operations are executed exclusively in RAM,
• no data is logged or buffered.

All conversions use native OpenSSL functions, ensuring full compatibility with X.509 / PKCS#7 / PKCS#12 standards.

Language versions: PL / EN / DE

SSL Converter automatically detects the language version based on the domain:

• hexssl.pl → Polish version
• hexssl.com → English version
• hexssl.de → German version

All messages and conversion outputs are dynamically translated.

Modern HEXSSL Tools interface

The tool uses the new UI designed for the HEXSSL Tools series:

• Dark / Light mode switch,
• modern, responsive panel,
• consistent design with other tools (CSR Generator, SSL Monitor, SSL Checker etc.),
• action buttons, icons, result/output boxes,
• download option for converted files (.pem, .pfx, .p7b, .cer).

FAQ and technical documentation

We have also prepared a complete FAQ set in three languages (PL/EN/DE) covering:

• supported formats,
• PFX and private-key requirements,
• operation security,
• X.509 structure,
• PEM/DER/P7B/PFX conversions in practice,
• certificate formatting requirements.

Access to the tool

The tool is available here:
👉 SSL Converter
The SSL Converter is another tool in our suite designed to simplify the daily work of administrators, developers and IT teams dealing with SSL/TLS certificates.
Together with the other HEXSSL tools, it forms a complete set for:

• generating CSR,
• validating certificates,
• decoding,
• expiry monitoring,
• and now – X.509 format conversion.

It is the tool that has been missing from the HEXSSL package – and one that significantly improves PKI operations.