On Ubuntu, I cannot convert certificate using openssl successfully.

vagrant@dev:/vagrant/keys$ openssl pkcs7 -print_certs -in a.p7b -out a.cer 
unable to load PKCS7 object <blah blah>:PEM
routines:PEM_read_bio:no start line:pem_lib.c:696:Expecting: PKCS7

Have you seen this error before?

  • Are you sure the file is a p7b? – Zoredache Aug 13 '12 at 19:52
  • Was the file moved between servers or uploaded via FTP? If it is indeed the correct format, it seems as though it may have become corrupted. Try re-transferring the file to the server in binary mode (if using FTP) or re-copy it from the source. – Garrett Aug 13 '12 at 20:01
  • I say it's a p7b based on the file's suffix. I re-downloaded it via Firefox, but I still got the same OpenSSL error... – Kevin Meredith Aug 13 '12 at 20:30
  • 1
    @Kevin What does file a.p7b give you? – user89350 Aug 13 '12 at 20:37
  • @NicYoung - I just get the above error message. No output. – Kevin Meredith Aug 13 '12 at 20:45

Try this:

$ openssl pkcs7 -inform der -in a.p7b -out a.cer

If it doesn't work, brings to a Windows machine and export follow this guide.

| improve this answer | |
  • 9
    Note the the OP had the parameter -print_certs in its command. It impacts the output format: with it you get a PEM format (starting with -----BEGIN CERTIFICATE-----), and without it you get a PKCS#7 format (-----BEGIN PKCS7-----) – Sylvain B Mar 14 '18 at 16:36
  • This only works if I drop the -inform der part. Note also that while exporting a key from Windows Cert Manager, DER and P7B are two distinct options. – jpaugh Oct 17 '19 at 20:03

So to combine the above answers, the command is:
openssl pkcs7 -in cert.p7b -inform DER -print_certs -out cert.pem

Verified to be working on Windows, using OpenSSL-Win64

/Thanks Bogdan for spotting the error

| improve this answer | |

I followed this guide that instructs you to change the header/footer lines from




Then run the command openssl pkcs7 -in foo.modified.crt -print_certs -out foo.certs (where foo.modified.crt is the file that you saved the modified version into). This gave me the same results as running through a Windows certificate export as suggested in other answers.

| improve this answer | |

As far as I know, the following should convert a pkcs7 cert to a pem

openssl pkcs7 -in certificate_file.p7b -print_certs -out cert.pem
| improve this answer | |
  • 1
    Why do you mean this answer is related to this thread ? Because as you see. It's same as above. – M. S. Jun 8 '18 at 9:40
  • You did not answer why OP is getting an error. – pacoverflow Feb 10 at 22:15

quick solution in my case (a lot of files with missing header/footer) :

base64 -d $FILE | openssl pkcs7 -inform DER -print_certs

| improve this answer | |
  • 2
    I had a base64 encoded certificate and I knew nothing more about it and the base64 -d command saved me a lot of trouble. This solution should be more readily available in search results. Thank you! – user391905 Mar 21 '17 at 8:49
  • You just saved a man from suicide – Sayka Nov 20 at 8:36

I had this problem too. I was going to verify a p7b file I copied from a Win7 host.

I found out that gnome keyring can import the certificate. From there it's easy to export to DER

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.