Is there a utility that is available in standard windows 7 installations, that allows me to convert DER-encoded certificates to PEM-encoded certificates or shows me the ASN.1 text of a DER-encoded certificate?
Not exactly an "utility", but you can import PEM certificates into Windows Certificate Store and export them back as DER.
In fact, Windows supports PEM-encoded certificates just fine, it just doesn't recognize the
.pem extension – you can rename the file to
name.cer, then you can open it and see all information.
"PEM encoded" means nothing more than Base64-encoded DER, between "begin"/"end" headers. You can use any Base64 decoder for this.
For example, PowerShell has
You can also use OpenSSL for Windows:
openssl x509 -in foo.pem -out foo.der -outform der
openssl asn1parse -in foo.pem openssl asn1parse -in foo.der -inform der
or this online ASN.1 decoder.
You can export to PEM from the Certificate dialog that is built into Windows. The export format is called "Base-64 encoded X.509 (.CER)" and that produces a valid PEM file with a .CER file extension.
- Open any certificate by double-clicking a certificate file in Windows Explorer, inspecting one in your web browser of choice, or from the Certificate Manager Tool (certmgr)
- Switch to the Details tab of the Certificate dialog
- Click the Copy to File... button
- Click Next in the Certificate Export Wizard window
- Select "Base-64 encoded X.509 (.CER)" on the Export File Form screen, and click Next.
- Click Browse... or enter a File name, and click Next
- Click Next and Finish
The extension of the exported file may be .CER but the file format is valid PEM.