Convert certificate .pem to .der/.cer

Question

Hi, I'm trying convert .pem to .cer using OpenSSL...

openssl x509 -inform PEM -in root.pem -outform DER -out root.cer

But, I don't know how to install the certificate on IIS 7.0 over Win Server 2008.

I read some tutorials about it and tried to install the cert in IIS 7.0

Server Certificates -> complete certificate request ->

The following error appears

Cannot find the certificate request associated with this certificate file. A certificate request must be completed on the computer where it was created.

The installation of the certificate to IIS fails.

Any suggestions on how to proceed installing the .cer in IIS 7?

Answer 1

It looks like you're trying to convert a partial certificate (one that hasn't been signed), and not a complete PEM certificate. Normally it's something like:

1. Make a private key
2. Make a CSR (certificate request)
3. Submit the CSR somewhere
4. Get the response
5. Attach the response to the private key
6. Profit

You should be able to convert the completed certificate to whatever format you like. You can combine many of those steps if you want to do a self-signed certificate, too.

Answer 2

A certificate request is a distinct thing from the certificate. It's part of the process of obtaining a certificate, which, put simply, is:

1. Generate key pair (private & public key)
2. Generate certificate request, which is basically the public key wrapped in a digital signature along with your requested certificate information (e.g. you name).
3. Send certificate request to CA
4. Do CA-specific vetting process
5. CA generates certificate using information from certificate request and send back to requester.

Normally once you have the certificate, the certificate request can be discarded since it's no longer needed (except maybe for audit purposes).

I am not familiar with IIS, but I would assume the option you are selecting ("complete certificate request") is trying to start the above process at steps 1/2, but you have a certificate already (i.e. step 5). You need to look for something akin to "Import Certificate".