Convert PEM to PDF

A certificate or public key may need to be placed in a PDF for an audit record, support case, approval package, printing, or long-term documentation. The PDF is a readable snapshot only; servers, browsers, and cryptographic tools still require the original PEM, DER, PKCS#12, or other supported certificate format.

What PEM contains

PEM, originally “Privacy-Enhanced Mail,” is a text encoding and container convention for cryptographic data. It stores Base64-encoded blocks between labels such as -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.

Certificate authorities, OpenSSL, web servers, reverse proxies, VPNs, cloud services, and SSH-related tools use PEM files for X.509 certificates, certificate chains, certificate-signing requests (CSRs), public keys, and private keys. Filename extensions are not reliable identifiers: .pem, .crt, and .cer can contain PEM text, while .cer may also contain binary DER data.

Inspect the block label before sharing or converting a file. Files containing BEGIN PRIVATE KEY, BEGIN ENCRYPTED PRIVATE KEY, BEGIN RSA PRIVATE KEY, or BEGIN EC PRIVATE KEY contain private-key material and must not be uploaded to online converters, emailed, or included in routine documentation.

What PDF provides

PDF is a fixed-layout document format for viewing, printing, and document exchange. A text-based PDF preserves selectable PEM text and decoded certificate fields, which makes serial numbers, SHA-256 fingerprints, subjects, issuers, and validity dates easier to review and copy than a screenshot or scanned page.

A PDF cannot be used as an ssl_certificate file, imported as a normal certificate or key, or passed to OpenSSL as a PEM input. Converting a PEM file to PDF does not validate it, change its cryptographic properties, or make it suitable for TLS configuration.

Create a PDF record from a certificate

For an X.509 certificate, decode its fields locally with OpenSSL:

openssl x509 -in certificate.pem -text -noout > certificate-details.txt

Check the certificate identity and validity before export:

openssl x509 -in certificate.pem -noout -subject -issuer -dates -fingerprint -sha256

To retain both the original public certificate block and its decoded fields, create one text record:

{
  echo "Original PEM"
  cat certificate.pem
  echo
  echo "Decoded certificate details"
  openssl x509 -in certificate.pem -text -noout
} > certificate-record.txt

Open certificate-record.txt in LibreOffice Writer, Microsoft Word, or another editor that exports text cleanly. Use a monospaced font such as Consolas, Courier New, or Liberation Mono, then export with LibreOffice File → Export As → Export as PDF or Word File → Save As → PDF.

LibreOffice can perform a basic command-line conversion:

libreoffice --headless --convert-to pdf certificate-record.txt

On Windows, File → Print → Microsoft Print to PDF also works. On macOS, use File → Print → Save as PDF. Verify the resulting PDF visually because line wrapping can split long Base64 lines or fingerprints.

Other PEM block types

For a CSR, use:

openssl req -in request.pem -text -noout > request-details.txt

For a PEM public key, use:

openssl pkey -pubin -in public-key.pem -text -noout > public-key-details.txt

Do not generate a PDF record from a private key unless a controlled security procedure explicitly requires it. If such documentation is unavoidable, redact the key block itself and record only non-secret information, such as the key algorithm, size, public-key fingerprint, and handling reference.

Online conversion and compatibility limits

CloudConvert and Zamzar can convert a prepared .txt file to PDF, but they render text; they do not reliably decode, validate, or understand PEM objects. Use them only for non-sensitive public material after reviewing the file contents. Keep certificate chains, client-certificate identity data, internal hostnames, and all private keys on local systems where possible.

A PEM chain contains multiple BEGIN CERTIFICATE blocks. Preserve their order in the PDF, because TLS deployments normally require the leaf certificate followed by intermediate certificates; do not include the root certificate unless the receiving procedure specifically requests it.

Export selectable text instead of a scanned or rasterized PDF. A raster image can make a fingerprint or PEM block difficult to copy, search, compare, and independently verify.

Digitally signing an existing PDF with a PEM certificate is a separate operation, not a file conversion. It requires the corresponding private key, the signing certificate and often its chain, plus PDF-signing software that supports PEM credentials; never disclose the private key merely to create or sign a PDF.