On Ubuntu, I cannot convert certificate using openssl successfully.

vagrant@dev:/vagrant/keys$ openssl pkcs7 -print_certs -in a.p7b -out a.cer 
unable to load PKCS7 object <blah blah>:PEM
routines:PEM_read_bio:no start line:pem_lib.c:696:Expecting: PKCS7

Have you seen this error before?

  • Are you sure the file is a p7b?
    – Zoredache
    Aug 13 '12 at 19:52
  • Was the file moved between servers or uploaded via FTP? If it is indeed the correct format, it seems as though it may have become corrupted. Try re-transferring the file to the server in binary mode (if using FTP) or re-copy it from the source.
    – Garrett
    Aug 13 '12 at 20:01
  • I say it's a p7b based on the file's suffix. I re-downloaded it via Firefox, but I still got the same OpenSSL error... Aug 13 '12 at 20:30
  • 1
    @Kevin What does file a.p7b give you?
    – user89350
    Aug 13 '12 at 20:37
  • @NicYoung - I just get the above error message. No output. Aug 13 '12 at 20:45

Try this:

$ openssl pkcs7 -inform der -in a.p7b -out a.cer

If it doesn't work, brings to a Windows machine and export follow this guide.

  • 13
    Note the the OP had the parameter -print_certs in its command. It impacts the output format: with it you get a PEM format (starting with -----BEGIN CERTIFICATE-----), and without it you get a PKCS#7 format (-----BEGIN PKCS7-----)
    – Sylvain B
    Mar 14 '18 at 16:36
  • This only works if I drop the -inform der part. Note also that while exporting a key from Windows Cert Manager, DER and P7B are two distinct options.
    – jpaugh
    Oct 17 '19 at 20:03
  • If you can open the p7b with a text editor and see ----- BEGIN PKCS7 ----- then you have a pem formatted p7b. In this case, you dont want to use -inform der because that tells openssl to expect a binary file, but this is in text (base64) format. You can read more about the differences between PEM and DER here.
    – Rex Linder
    Mar 10 at 21:49

So to combine the above answers, the command is:
openssl pkcs7 -in cert.p7b -inform DER -print_certs -out cert.pem

Verified to be working on Windows, using OpenSSL-Win64

/Thanks Bogdan for spotting the error


I followed this guide that instructs you to change the header/footer lines from




Then run the command openssl pkcs7 -in foo.modified.crt -print_certs -out foo.certs (where foo.modified.crt is the file that you saved the modified version into). This gave me the same results as running through a Windows certificate export as suggested in other answers.


As far as I know, the following should convert a pkcs7 cert to a pem

openssl pkcs7 -in certificate_file.p7b -print_certs -out cert.pem
  • 1
    Why do you mean this answer is related to this thread ? Because as you see. It's same as above.
    – M. S.
    Jun 8 '18 at 9:40
  • You did not answer why OP is getting an error. Feb 10 '20 at 22:15

quick solution in my case (a lot of files with missing header/footer) :

base64 -d $FILE | openssl pkcs7 -inform DER -print_certs

  • 2
    I had a base64 encoded certificate and I knew nothing more about it and the base64 -d command saved me a lot of trouble. This solution should be more readily available in search results. Thank you!
    – user391905
    Mar 21 '17 at 8:49
  • You just saved a man from suicide Nov 20 '20 at 8:36

I had this problem too. I was going to verify a p7b file I copied from a Win7 host.

I found out that gnome keyring can import the certificate. From there it's easy to export to DER

# Decode base64 encoded string into DER-encoded binary
base64 --decode signature > signature.cer
# Convert DER-encoded binary to PEM-encoded P7B
openssl pkcs7 -inform der -in signature.cer -out signature.p7b
# Convert PEM-encoded P7B to PEM-encoded CRT
openssl pkcs7 -print_certs -in signature.p7b -out signature.crt

# OR: Convert DER-encoded binary to PEM-encoded CRT
openssl pkcs7 -print_certs -inform der -in signature.cer -out signature.crt
# signature.p7b
-----BEGIN PKCS7-----
-----END PKCS7-----
# signature.crt
# Read contents in PEM-encoded CRT
keytool -printcert -file signature.crt

openssl pkcs7 -print_certs -in intermediates.p7b -out intermediates.cer

My source file was in text with -----BEGIN PKCS7----- as the header... This method worked for me while others did not.

  • Is this an Answer or a Comment?
    – djdomi
    Jul 15 at 4:50
  • Does this belong here at all? This is exactly what the OP said did not work. Saying it worked for you is not very helpful. Jul 15 at 14:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.