Documentation

A quick tour of the app, the command-line verbs with worked examples, and answers to the common snags. Run certconvert --help for the full CLI list.

How-to guides

Step-by-step answers to the most common certificate jobs, in the app and on the command line:

Using the app

CertConvert opens on a sidebar with seven views — Inspect, Convert, Chain, Keys, Generate, Sign and About. Most jobs are drag-and-drop: point a view at a file and it detects the format from the file’s content, not its extension.

Inspect

Open or drag in any certificate, key, CSR or bundle. CertConvert decodes it and shows the subject, issuer, validity, serial, public-key algorithm, SANs, key usage and SHA-256 / SHA-1 fingerprints. A signing request is decoded the same way, down to the SANs and usages it requests. Use Copy PEM or Copy SHA-256 to grab either. If the file is a password-protected PFX or key, type the password and choose Unlock.

Every certificate and request also carries a health check — findings marked Critical, Warning or Note, each with an explanation — and a Does This Cover A Host Name? box that tells you whether a certificate is valid for a given host and why.

Convert

Load a file, pick the target format — PEM, DER (.cer), PKCS #7 (.p7b) or PKCS #12 (.pfx) — and save. To build a PFX you can supply the matching private key and set an export password.

Chain

Add your root, intermediate and device certificates in any order. CertConvert arranges them into a valid chain, validates it offline and reports pass or fail with a reason. Export the assembled chain as a PEM bundle, a P7B, or a PFX with the key attached.

Keys

Convert a private key between PKCS #8, PKCS #1 and SEC 1 formats, add or remove a passphrase, or check whether a key matches a certificate — CertConvert compares their public keys and tells you yes or no.

Generate

Create a new RSA or ECDSA key, a certificate signing request, or a self-signed certificate. Fill in the subject fields, add SANs (DNS names and IP addresses) and set CA options and a validity period, then export in whatever format you need.

Sign

Load your CA certificate and its private key (two files, or a single PFX) and a certificate signing request, then issue an end-entity certificate that chains to your CA. Choose a TLS server or client profile, confirm the subject and the SANs to include, and export the issued certificate on its own or bundled with the CA chain. A request’s own extensions are never trusted — the result is always an end-entity certificate whose validity cannot outlast the CA.

Command-line reference

A copy built from source is a CLI when given arguments and a GUI when not. A few worked examples:

The Mac App Store and Microsoft Store editions are sandboxed and are the graphical app only — a sandboxed process cannot open files named on the command line, so those editions ship without the CLI. Build from source to use it.

certconvert inspect device.pem
certconvert inspect device.pem --hostname www.example.com   # does it cover this host?
certconvert check chain.pem                             # health check; non-zero exit on any critical finding
certconvert convert device.pem -o device.cer            # PEM → DER
certconvert convert bundle.p7b -o bundle.pem            # PKCS#7 → PEM
certconvert chain build device.pem ca.pem root.pem -o chain.pfx \
            --key device.key --out-password secret
certconvert chain verify chain.p7b
certconvert key convert device.key -o device_pkcs8.key --to pkcs8
certconvert key match --cert device.pem --key device.key
certconvert gen selfsigned --new-key p256 --key-out dev.key \
            --cn device.local --dns device.local -o dev.pem
certconvert ca sign --csr device.csr --ca-cert ca.pem --ca-key ca.key \
            --type server --dns device.local -o device.pem   # sign a CSR with your CA

A password typed on the command line is saved in your shell history and can be seen by other processes while the command runs. The command line has no other way to take one, and deleting the history line afterwards does not undo that exposure. For a password that matters, use the app.

Exit codes: 0 success, 1 usage error, 2 failure (including an invalid chain or a key that does not match). That makes CertConvert easy to drop into a build pipeline or a shell script.

Troubleshooting

macOS: “CertConvert can’t be opened”

This applies only to a copy you compiled yourself, which is unsigned: right-click the app and choose Open (one time), or allow it under System Settings → Privacy & Security. The Mac App Store edition is signed and opens normally.

Windows: “Windows protected your PC”

SmartScreen on an unsigned binary — again, only a copy you compiled yourself. Choose More info → Run anyway (one time). The Microsoft Store edition is signed and installs without a warning.

“…is password-protected”

The file is an encrypted PFX or key. Type the password in the password field and use Unlock in the app, or --password on the CLI. Errors always name the file that needs it.

Windows CLI output interleaves with the prompt

The executable is a GUI program attaching to your console, so output can arrive after the prompt returns. Press Enter to get the prompt back.

Which build am I running?

Run certconvert --version; it prints the version plus the exact git commit it was built from.

How updates arrive

The Mac App Store and Microsoft Store editions update through their store, like any other app you bought there. A copy you built from source has no auto-update — pull the latest source and rebuild.

Still stuck? Get in touch, or raise it on the GitHub issue tracker.