20

I have generated RSA private key using below command:

openssl genrsa -out privkey.pem 2048

And created a self signed certificate using below command:

openssl req -new -x509 -key privkey.pem -out cacert.pem -days 3650

Now I am trying to convert cacert .pem file to certificate .cer

Any ideas?

Devarshi
  • 357
  • 1
  • 3
  • 11
  • 1
    According to https://support.ssl.com/Knowledgebase/Article/View/19/0/der-vs-crt-vs-cer-vs-pem-certificates-and-how-to-convert-them `.pem` is an encoding and `.cer` is an extension. Shortly: a `.cer` file may contain both a `PEM` or a `DER` encoding. What exactly do you need? (The link should help you.) – Fabian May 21 '14 at 14:14
  • I found command to create self signed certificate from this link: https://www.openssl.org/docs/HOWTO/certificates.txt Here is the complete text: If you don't want to deal with another certificate authority, or just want to create a test certificate for yourself. This is similar to creating a certificate request, but creates a certificate instead of a certificate request. – Devarshi May 21 '14 at 14:26
  • This does not really answer what you need: What is the purpose of the certificate you generate? Maybe an HTTPS server? Or personal authentication for some application? But I think you already got enough good answers below for what you asked. – Fabian May 21 '14 at 14:28
  • Scenario is: we are creating public-private key pair at android app and we need to share public key to an iOS app, the only way which I have found to share it is through self signed certificate. iOS apis extract public key from certificate with this extension (an example): some_certificate.cer . For now I am trying to generate some_certificate.cer through terminal and validate if it is able to extract public key from it, and perform encryption using the same. – Devarshi May 21 '14 at 14:39
  • I cant' help you with iOS stuff. But my understanding is that the .cer extension is only used by Microsoft. If the answers below do not help you, you might want to ask in an iOS programming related place. – Fabian May 21 '14 at 14:48

3 Answers3

50

You can use the following command:

openssl x509 -inform PEM -in cacert.pem -outform DER -out certificate.cer
cioby23
  • 3,219
  • 17
  • 11
4

The actual extension does not matter for certificates. Usually .pem files have an x509 certificate in base64 encoded form. .cer files may be base64 or DER encoded (Windows will recognise either). Depending on your application you will need to find out which certificate format the application requires.

To convert between base64 (PEM) and DER encoding:

openssl x509 -in cert.pem -outform pem -outform der -out cert.cer
mtak
  • 1,274
  • 10
  • 13
4

.cer is a filetype for either DER or Base64 encoding, if I recall correctly.

openssl x509 -in cacert.pem -out cacert.cer -inform pem -outform der for DER format.

Mark
  • 96
  • 2