I have a cetificate chain in .pem format from Letsencrypt, called fullchain.pem

It has 2 certificates in the chain:

keytool -printcert -v -file fullchain.pem |grep "Certificate fingerprints" |wc -l

When I convert it to .der using

openssl x509 -in fullchain.pem -out cert.der -outform DER

it only exports the last one

keytool -printcert -v -file cert.der |grep "Certificate fingerprints" |wc -l

is this a bug in openssl? Am I missing a param?


You cannot have DER encoded chains by concatenating them the way you can with PEM format.

A chain in a binary format would be in PKCS#7 format. To convert a PEM chain to PKCS#7, use:

openssl crl2pkcs7 -nocrl -certfile fullchain.pem -out fullchain.p7b

Then, to see the contents:

openssl pkcs7 -in fullchain.p7b -print_certs -noout

Add -text to see all the certificate details.

If the input PEM file also contained a private key a better format would be PKCS#12 as this format can be secured with a passphrase.

  • Great! This also solves it. – ArticIceJuice Sep 1 '17 at 5:21
  • Btw, they say it is actually possible to concatenate .der certificates to import them later, see this Java snippet gist.github.com/spicydog/84fa0e74d8524fba1fbb – ArticIceJuice Sep 1 '17 at 5:43
  • @ArticIceJuice - I think you may well be correct :-) generateCertificates accepts a stream of DER encoded certs. As I can't find a standard that defines certificate chains, this may well be implementation specific. – garethTheRed Sep 1 '17 at 10:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.