Why convert PEM to KEY?
Web servers, load balancers, and TLS configuration tools often expect the certificate and private key in separate files - the certificate as .crt or .pem, the private key as .key. Splitting a combined .pem into a .key file lets each server directive point at the correct file without ambiguity.
How to convert PEM to KEY
OpenSSL FREE
Run openssl pkey -in combined.pem -out private.key to extract the private key; verify with openssl pkey -in private.key -check. OpenSSL is FREE and runs on Windows, macOS, and Linux.
About these formats
.PEM
PEM - Base64-encoded certificate / key container (X.509, PKCS)
A PEM file is a text container for cryptographic data - most often an SSL/TLS certificate, a private key, or both. Open it in any text editor to see what the BEGIN line says, then use…
Open .PEM details →
.KEY
Apple Keynote Presentation
A .key file is an Apple Keynote presentation, the Mac counterpart to PowerPoint. On a Mac or iPhone/iPad, Keynote opens it directly (free). On Windows, use Keynote for iCloud at iCloud.com…
Open .KEY details →Quality & what to watch
- If the
.pemcontains only a private key (-----BEGIN PRIVATE KEY-----or-----BEGIN RSA PRIVATE KEY-----), renaming it to.keyis sufficient - no conversion is needed. - On Linux and macOS, set strict file permissions after extraction:
chmod 600 private.key- the key is as sensitive as a password. - Never upload a private key to an online converter; perform the extraction locally only.
Frequently asked questions
Do I need OpenSSL to extract a private key from a combined PEM?
.pem in a text editor, copy only the key block, and paste it into a new file saved as .key.My `.pem` starts with `-----BEGIN CERTIFICATE-----`. What does that mean?
-----BEGIN PRIVATE KEY----- block.What is the difference between `-----BEGIN PRIVATE KEY-----` and `-----BEGIN RSA PRIVATE KEY-----`?
openssl pkey to extract either.
