Convert, chain and inspect certificates — offline
CertConvert is a self-contained desktop app for X.509 certificates. Convert PEM to PFX without OpenSSL, order and validate a certificate chain, inspect any certificate, key or bundle, and generate keys, CSRs and self-signed certificates — all on your own machine, with no shell commands to memorise.
Open source (MIT) — on the Mac App Store & Microsoft Store, or build it yourself. Runs fully offline; your keys never leave your machine.
One tool for the certificate jobs OpenSSL is overkill for
Formats are detected from file content, not extensions, so the .cer that is secretly PEM just works. Everything runs locally — there is no online converter to paste your key into.
⇄ Convert formats
PEM, DER (.cer/.der), PKCS #7 (.p7b) and PKCS #12 (.pfx/.p12), in both directions — including a p7b to pem converter that works offline.
🔗 Order & verify chains
Drop root, intermediate and device certs in any order; this certificate chain order tool sorts them automatically, validates the chain offline and exports a PEM bundle, P7B or PFX.
🔍 Inspect anything
Read subject, issuer, validity, SANs, key usage and fingerprints from any certificate, key, CSR or bundle. Drag it in and read it.
🔑 Keys
Convert private-key formats (PKCS #8, PKCS #1, SEC 1, encrypted or not) and check whether a key matches a certificate.
➕ Generate
Create keys, CSRs and self-signed certificates (RSA or ECDSA) with SANs and CA options — the openssl req workflows, without OpenSSL.
🔒 Offline by design
No uploads, no account, no telemetry. CertConvert makes no network connections at all — your certificates and private keys never leave the machine.
Your keys never leave your machine
Unlike an online certificate converter, CertConvert does its work entirely on your own computer. It never uses the network on its own — no telemetry, no outbound connection of any kind. The single exception is an optional check for a newer version on GitHub, which is off by default.
All cryptography is the .NET platform’s own libraries. There is no third-party crypto code, and private keys are handled in process — never imported into the operating-system key store.
Read the security postureWhat leaves your machine
Nothing, unless you ask for an update check.
- No telemetry or analytics in the app
- Certificates and keys are never uploaded
- Only files you explicitly save are written
- One small local settings file, nothing sensitive
Open source
CertConvert is MIT-licensed — read the source and build it yourself for free, or get a signed, auto-updating build on the Mac App Store or Microsoft Store.