Certificate Toolbox

Convert, chain and inspect certificates — offline

CertConvert is a self-contained desktop app for X.509 certificates. Convert PEM to PFX without OpenSSL, order and validate a certificate chain, inspect any certificate, key or bundle, and generate keys, CSRs and self-signed certificates — all on your own machine, with no shell commands to memorise.

Open source (MIT) — on the Mac App Store & Microsoft Store, or build it yourself. Runs fully offline; your keys never leave your machine.

CertConvert inspecting a certificate: subject, issuer, validity, SANs, key usage and SHA-256 fingerprint decoded from a PEM file
Why CertConvert

One tool for the certificate jobs OpenSSL is overkill for

Formats are detected from file content, not extensions, so the .cer that is secretly PEM just works. Everything runs locally — there is no online converter to paste your key into.

Convert formats

PEM, DER (.cer/.der), PKCS #7 (.p7b) and PKCS #12 (.pfx/.p12), in both directions — including a p7b to pem converter that works offline.

🔗 Order & verify chains

Drop root, intermediate and device certs in any order; this certificate chain order tool sorts them automatically, validates the chain offline and exports a PEM bundle, P7B or PFX.

🔍 Inspect anything

Read subject, issuer, validity, SANs, key usage and fingerprints from any certificate, key, CSR or bundle. Drag it in and read it.

🔑 Keys

Convert private-key formats (PKCS #8, PKCS #1, SEC 1, encrypted or not) and check whether a key matches a certificate.

Generate

Create keys, CSRs and self-signed certificates (RSA or ECDSA) with SANs and CA options — the openssl req workflows, without OpenSSL.

🔒 Offline by design

No uploads, no account, no telemetry. CertConvert makes no network connections at all — your certificates and private keys never leave the machine.

Security posture

Your keys never leave your machine

Unlike an online certificate converter, CertConvert does its work entirely on your own computer. It never uses the network on its own — no telemetry, no outbound connection of any kind. The single exception is an optional check for a newer version on GitHub, which is off by default.

All cryptography is the .NET platform’s own libraries. There is no third-party crypto code, and private keys are handled in process — never imported into the operating-system key store.

Read the security posture

What leaves your machine

Nothing, unless you ask for an update check.

  • No telemetry or analytics in the app
  • Certificates and keys are never uploaded
  • Only files you explicitly save are written
  • One small local settings file, nothing sensitive

Open source

CertConvert is MIT-licensed — read the source and build it yourself for free, or get a signed, auto-updating build on the Mac App Store or Microsoft Store.