Download

Everything X.509, without OpenSSL

Five focused jobs — inspect, convert, chain, keys and generate — in one self-contained app. Nothing to install beyond the app itself.

Inspect

Read any certificate, key or bundle

Drag in a certificate, private key, CSR or bundle and CertConvert decodes it: subject, issuer, validity, serial, public-key algorithm, SANs, key usage, extended key usage and SHA-256 / SHA-1 fingerprints. Formats are detected from file content, so a misnamed .cer that is really PEM opens without complaint.

  • Works on PEM, DER, PKCS #7 and PKCS #12 input
  • Copy the PEM or the SHA-256 fingerprint with one click
  • Password-protected PFX and keys prompt for the password
CertConvert Inspect view showing a decoded certificate: subject, issuer, validity, SANs, key usage and fingerprints
Convert

Between every common format

Convert PEM, DER (.cer/.der), PKCS #7 (.p7b) and PKCS #12 (.pfx/.p12) in both directions. Turn a .pem into a .cer, run a p7b to pem conversion offline, or bundle a key and certificate into a .pfx — the jobs you would otherwise reach for OpenSSL to do.

Round trips it handles

  • PEM ↔ DER (.cer)
  • PKCS #7 (.p7b) ↔ PEM
  • PKCS #12 (.pfx) ↔ PEM / key + certs
  • Certificate + key → PFX, with an export password
Chain

Build and verify a chain, in any order

Drop your root, intermediate and device certificates in whatever order you have them. CertConvert orders them into a valid root → intermediate → device chain automatically, validates it offline, then exports it as a PEM bundle, a P7B, or a PFX with the matching key.

  • Automatic chain ordering — no more guessing the sequence
  • Offline validation, with a clear pass or fail and the reason
  • Export the assembled chain as PEM, P7B or PFX

A certificate chain order tool

Getting the order wrong is the classic reason a server rejects a bundle. CertConvert sorts the certificates by their issuer/subject relationships so the exported bundle is always correctly ordered.

Keys

Convert key formats and check a match

Convert private-key formats between PKCS #8, PKCS #1 and SEC 1, encrypted or not. And when you are staring at a certificate and a key wondering whether they belong together, check whether a key matches a certificate — CertConvert compares the public keys and tells you.

Key jobs

  • PKCS #8 ↔ PKCS #1 / SEC 1
  • Add or remove key encryption (a passphrase)
  • Confirm a key matches a certificate
Generate

Keys, CSRs and self-signed certificates

Generate a new RSA or ECDSA key, produce a certificate signing request, or mint a self-signed certificate — with subject fields, SANs (DNS names and IP addresses) and CA options. These are the openssl req workflows, in a form you fill in rather than a command you look up.

  • RSA or ECDSA (for example P-256) keys
  • CSRs with a full subject and SANs
  • Self-signed certificates with a validity period and CA flag

Good for lab and IoT certs

Spin up a self-signed device certificate with the right DNS and IP SANs for a test rig or an internal service in seconds, then export the key and certificate in whatever format you need.

Command line (build from source)

The same binary, scriptable

Build CertConvert from source and the same executable runs as a CLI when you pass it arguments — ideal for build pipelines and one-off shell work. Every GUI job has a verb: inspect, convert, chain, key and gen.

The Mac App Store and Microsoft Store editions are sandboxed and are the graphical app only — a sandboxed process cannot open files named on the command line, so those editions ship without the CLI. Build from source to get it.

Exit codes make it easy to script: 0 success, 1 usage error, 2 failure (including an invalid chain or a key that does not match). See the CLI reference for worked examples.

certconvert convert device.pem -o device.cer
certconvert convert bundle.p7b -o bundle.pem
certconvert chain build device.pem ca.pem root.pem \
            -o chain.pfx --key device.key \
            --out-password secret
certconvert key match --cert device.pem --key device.key
Security posture

Built for a tool that handles private keys

For software that touches key material, the dependency surface is the whole story. CertConvert keeps it as small as it can.

Platform crypto only

All cryptography is the .NET platform’s own libraries. There is no third-party crypto code — the only other dependencies are the UI framework and an MVVM helper, neither of which touches key material.

No network of its own

No telemetry, no outbound connection. The one exception is checking GitHub for a newer version, which is off by default and otherwise happens only when you ask. Your certificates and keys are never uploaded.

Keys stay in memory

Keys loaded from PKCS #12 files are handled in process and never imported into the operating-system key store. The app writes only the files you ask it to, plus one small settings file.

Ready to try it?

Open source (MIT). Get it on the Mac App Store or Microsoft Store — nothing else to install.

Download CertConvert