CertConvert

Certificate Toolbox — convert, chain, inspect and generate X.509 certificates without installing OpenSSL.

CertConvert is a single self-contained desktop app (and command-line tool) that runs entirely offline. It exists for the times you need to turn a .pem into a .cer, assemble a root → intermediate → device chain, or bundle a key and certificate into a .pfx, but you're on a machine where installing OpenSSL and running shell commands isn't an option.

What it does

• Inspect any certificate, key, CSR or bundle — subject, issuer, validity, SANs, key usage, fingerprints and more. Signing requests decode in full, every certificate gets a health check and you can ask whether a certificate covers a given host name.
• Convert between PEM, DER (.cer/.der), PKCS #7 (.p7b) and PKCS #12 (.pfx/.p12), in both directions.
• Chain certificates: drop root, intermediate and device certs in any order, have them ordered automatically, validate the chain offline, then export it as a PEM bundle, P7B or PFX.
• Keys: convert private-key formats (PKCS #8, PKCS #1, SEC 1, encrypted or not), and check whether a key matches a certificate.
• Generate keys, CSRs and self-signed certificates (RSA or ECDSA), with SANs and CA options — the openssl req workflows.

Formats are detected from file content, not extensions, so misnamed files — the .cer that's secretly PEM — just work.

Security posture

For a tool that handles private keys, the dependency surface is the whole story:

• All cryptography is the .NET platform's own libraries (System.Security.Cryptography). There is no third-party crypto code. The only third-party dependencies are the UI framework (Avalonia) and the MVVM helper (CommunityToolkit.Mvvm) — neither touches key material.
• It never uses the network on its own. No telemetry, no outbound connection of any kind. The single exception is checking GitHub for a newer version — which is off by default, and otherwise happens only when you click Check For Updates (or run certconvert update). Your certificates and keys are never uploaded anywhere, ever.
• Private keys stay in memory. Keys loaded from PKCS #12 files are handled in process and are never imported into the operating-system key store.
• It only writes the files you ask it to (plus one small preferences file — see below).

Where things live

Almost nowhere — by design. CertConvert keeps no cache, no logs and no history. The only files it ever creates are the ones you explicitly save, plus a single small preferences file holding one setting (whether to check for updates on launch — nothing sensitive):

Platform	Preferences file
macOS	~/Library/Application Support/CertConvert/settings.json
Windows	%APPDATA%\CertConvert\settings.json

Delete it any time; the app recreates it with defaults.

Install & run

CertConvert is available on both app stores — signed, with automatic updates:

Platform	Store
macOS	Mac App Store
Windows	Microsoft Store

Prefer to build it yourself? See From source below.

From source

Needs the .NET 10 SDK.

git clone https://github.com/jermainewalkes/certconvert.git
cd certconvert
dotnet run --project src/CertConvert    # launches the GUI

Command line

A copy built from source is a CLI when given arguments and a GUI when not. Run it with --help for the full list; a few examples:

The Mac App Store and Microsoft Store editions are sandboxed — a sandboxed process cannot open files named on the command line, so those editions are the graphical app only. Build from source for the CLI.

certconvert inspect device.pem
certconvert inspect device.pem --hostname www.example.com   # does it cover this host?
certconvert check chain.pem                             # health check; non-zero exit on any critical finding
certconvert convert device.pem -o device.cer            # PEM → DER
certconvert convert bundle.p7b -o bundle.pem            # PKCS#7 → PEM
certconvert chain build device.pem ca.pem root.pem -o chain.pfx \
            --key device.key --out-password secret
certconvert chain verify chain.p7b
certconvert key convert device.key -o device_pkcs8.key --to pkcs8
certconvert key match --cert device.pem --key device.key
certconvert gen selfsigned --new-key p256 --key-out dev.key \
            --cn device.local --dns device.local -o dev.pem
certconvert update                                      # check GitHub for a newer version
certconvert update --install                            # download, verify and apply it

Exit codes: 0 success, 1 usage error, 2 failure (including an invalid chain or a key that does not match).

Troubleshooting

• macOS: "CertConvert can't be opened" — only applies to a self-compiled build (it is unsigned): right-click the app → Open (one-time), or allow it under System Settings → Privacy & Security. The Mac App Store edition is signed and opens normally.
• Windows: "Windows protected your PC" — only applies to self-compiled builds (SmartScreen on an unsigned binary; More info → Run anyway, one-time). The Microsoft Store edition is signed and shows no warning.
• "…is password-protected" — the file is an encrypted PFX or key; type the password in the password field and use Unlock (GUI) or --password (CLI). Errors always name the file that needs it.
• Windows CLI output interleaves with the prompt — the exe is a GUI program attaching to your console; press Enter to get the prompt back.
• Which build am I running? — certconvert --version prints the version plus the exact git commit it was built from.
• Updates — the Mac App Store and Microsoft Store editions update themselves. A self-compiled build has no auto-update; rebuild from source to update. (The legacy in-app self-updater, present in older GitHub builds, kept a recovery copy — CertConvert.app.bak / CertConvert.exe.old — beside the app until the next launch.)
• "Check For Updates" can't reach GitHub — that check needs internet; on an offline machine it simply reports the failure and changes nothing. Everything else works offline.

Development

src/CertConvert.Core/   all certificate/key logic — no UI dependencies
src/CertConvert/        Avalonia GUI + CLI (Cli/) in one executable
tests/                  Core unit tests (incl. OpenSSL interop fixtures)
                        and headless Avalonia UI tests
build/                  publish scripts, icon generation, dev-run helper

dotnet test                   # full suite
./build-in-docker.sh          # same suites + Release build in Docker — no host SDK needed
build/publish.sh              # self-contained builds: osx-x64, osx-arm64, win-x64
build/run-dev-app.sh          # macOS: run the Debug build as a bundled .app

The release process is documented in build/RELEASING.md.

Accessibility

Accessibility is a launch requirement, not an afterthought. Every control is reachable by keyboard, icon-only and ambiguous controls carry screen-reader labels, and operation results are announced through live regions. If anything is awkward with assistive technology, please raise an issue — accessibility problems are treated as bugs.

Support

CertConvert is free and open source under the MIT licence. If it saves you time, you can buy me a coffee on Ko-fi ☕

Roadmap

Signed and notarised macOS builds, a Windows installer, automated release builds, signing CSRs with your own CA, and a universal macOS binary.