How To Convert Certificates from .pem to .der format

Converting PEM to DER certificate formats is essential when working with embedded systems that require binary certificate encoding.

There are two main methods for encoding certificate data – “.pem” and “.der”.

• DER = Binary encoding for certificate data
• PEM = The base64 encoding of the DER-encoded certificate, with a header and footer lines added.

When to Use DER vs PEM Format

Understanding when to use each certificate format is crucial for successful implementation:

Use DER Format When:

• Working with embedded systems – ESP8266, NodeMCU, and similar microcontrollers cannot process Base64 encoding efficiently
• Memory-constrained devices – DER format is more compact, using less storage space
• Java applications – Many Java crypto libraries prefer binary DER format
• Mobile applications – iOS and Android apps often require DER for certificate pinning
• Legacy systems – Older systems may only support binary certificate formats

Use PEM Format When:

• Web servers – Apache, Nginx, and most web servers use PEM format
• Manual inspection needed – PEM’s text format allows easy viewing and editing
• Certificate chains – Multiple certificates can be concatenated in a single PEM file
• OpenSSL operations – Many OpenSSL commands default to PEM format

To use certificates with a ESP8266 or NodeMCU, we need to convert them from .pem to .der format. ESP8266 does not understand base64 encoding.

Certificate File Structure Differences

Before converting, it’s helpful to understand what each format looks like:

PEM Format Example:

-----BEGIN CERTIFICATE-----
MIIDxTCCAq2gAwIBAgIJAKlqaGN0BKxpMA0GCSqGSIb3DQEBBQUAMHkxCzAJBgNV
BAYTAlVTMQswCQYDVQQIDAJDQTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEhMB8G
A1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMSIwIAYJKoZIhvcNAQkBFhNz
...more base64 encoded data...
-----END CERTIFICATE-----

DER Format Example:

DER format is binary data that cannot be displayed as readable text. When viewed in a hex editor, it appears as:

30 82 03 C5 30 82 02 AD A0 03 02 01 02 02 09 00
A9 6A 68 63 74 04 AC 69 30 0D 06 09 2A 86 48 86
F7 0D 01 01 05 05 00 30 79 31 0B 30 09 06 03 55
...binary data continues...

This tutorial is part of the series to connect NodeMCU with AWS IoT Core. In the previous post we saw how to Create a “Thing” in AWS IoT and downloaded the certificates

We will use a tool called OpenSSL to do the conversions

Installing OpenSSL

We first need to install OpenSSL. It is an opensource tool that provides an open-source implementation of SSL and TLS protocols. Moreover, it helps convert the certificate files into the most popular X.509 v3 based formats.

In this particular tutorial we will use it to convert the .pem files to .DER.

OpenSSL on Linux

If you’re using Linux, you can install OpenSSL with the following YUM console command:

In case distribution is based on APT instead of YUM, you can use the following command instead:

For other Linux distributions, you might need:

# For Fedora/CentOS 8+
$ dnf install openssl

# For Arch Linux
$ pacman -S openssl

# Verify installation
$ openssl version

OpenSSL on Windows

If you’re using Windows, you can install one of the many OpenSSL open-source implementations. I would recommend Win32 OpenSSL by Shining Light Production, available as light or full version, both compiled in x86 (32-bit) and x64 (64-bit) modes. You can install any of these versions, as long as your system supports them.

IMPORTANT: OpenSSL for Windows requires the Visual C++ 2008 Redistributables runtime in order to work.

OpenSSL is a console application, meaning that we’ll use it from the command-line.

After installing, it’s important to check that the installation folder (C:Program Filesinstalled_softsOpenSSL-Win64bin in my case) has been added to the system PATH (Control Panel > System> Advanced > Environment Variables). If not, you can add it to the systems path to avoid typing the complete path of the executable.

In windows, the OpenSSL tool is also visible in the start menu. So, you can click on the start menu and search for openSSL. Then click on “Win64 OpenSSL Command Prompt” or a similar name.

Now open the folder where all the certificates are downloaded. The AWS certificate will be something like this “xxxxxxxxxx-certificate.pem.crt.txt” So now just rename that document to “xxxxxxxxxx-certificate.pem.crt”.

Convert the Certificates from .pem to .der

The following commands will convert the downloaded device certificate files to the correct format for this script.

> openssl x509 -in xxxxxxxxxx-certificate.pem.crt -out cert.der -outform DER 
> openssl rsa -in xxxxxxxxxx-private.pem.key -out private.der -outform DER
> openssl x509 -in AmazonRootCA1.pem -out ca.der -outform DER

Replace “xxxxxxxxxx” with your certificate name and AmazonRootCA1 with the name of the Amazon Root CA file.

Example:

> openssl x509 -in 3c675stf21-certificate.pem.crt -out cert.der -outform DER
> openssl rsa -in 3c675stf21-private.pem.key -out private.der -outform DER
> openssl x509 -in AWSRootCA.pem -out ca.der -outform DER

3c675stf21-certificate.pem.crt – Thing certificate
3c675stf21-private.pem.key – my private key
AWSRootCA.pem is the name of the Amazon Root CA certificate

Additional Conversion Options

For different key types or certificate formats, you might need these variations:

# For EC (Elliptic Curve) private keys
> openssl ec -in ec-private.pem -out ec-private.der -outform DER

# For PKCS#8 private keys
> openssl pkcs8 -in pkcs8-key.pem -out pkcs8-key.der -outform DER -nocrypt

# To verify the conversion worked
> openssl x509 -in cert.der -inform DER -text -noout

Troubleshooting Common Conversion Errors

Here are the most common errors you might encounter and their solutions:

Error: “unable to load certificate”

Cause: File path is incorrect or certificate file is corrupted.

Solution:

• Verify the file path and ensure the certificate file exists
• Check that the file has the correct PEM format with proper headers
• Try opening the file in a text editor to ensure it’s not corrupted

# Verify certificate format first
> openssl x509 -in certificate.pem -text -noout

Error: “bad decrypt”

Cause: Private key is encrypted and requires a password.

Solution:

• Add the -passin pass:yourpassword parameter
• Or use -passin file:passfile.txt to read password from a file

# For encrypted private keys
> openssl rsa -in encrypted-private.pem -out private.der -outform DER -passin pass:mypassword

Error: “nested asn1 error”

Cause: The input file might already be in DER format or has invalid ASN.1 structure.

Solution:

• Try specifying the input format explicitly with -inform PEM
• Check if the file is already in DER format

# Specify input format explicitly
> openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER

Error: “No such file or directory”

Cause: OpenSSL cannot find the input file.

Solution:

• Use full file paths instead of relative paths
• Ensure you’re in the correct directory
• Check file permissions

# Use full path
> openssl x509 -in "C:\Users\YourName\Documents\certificate.pem" -out "C:\Users\YourName\Documents\cert.der" -outform DER

Verification Commands

After conversion, verify your certificates are working correctly:

# Check DER certificate details
> openssl x509 -in cert.der -inform DER -text -noout

# Verify private key matches certificate
> openssl x509 -in cert.der -inform DER -pubkey -noout > cert-pubkey.pem
> openssl rsa -in private.der -inform DER -pubout > private-pubkey.pem
> diff cert-pubkey.pem private-pubkey.pem

After executing the commands, the certificates will be placed in the same folder with a .der extension. We can now install the certificates and key in the NodeMCU.

You can use this method to convert other certificates also, not necessarily only AWS certificates.

In the next post, we will Connect the NodeMCU to the AWS IoT Core using these certificates

Vivek Bhageria

Vivek Bhageria — Lead Firmware R&D Engineer, 12+ years. Ex-Bosch (automotive powertrain), MusicTribe (real-time audio), medical devices. M.Tech BITS Pilani. I write at NerdyElectronics — practical, register-level embedded systems for engineers who want to understand what’s actually happening under the hood.

nerdyelectronics.com/about/