Everything runs on your machine — your input is processed right here in your browser and never uploaded to any server.
Open the .p7b/.p7c file — both binary (DER) and Base64 (PEM) encodings work.
Check the subject chips to see which certificates the bundle contained.
Copy the PEM output or download certificates.pem.
Your CA delivered the certificate as a .p7b bundle, but Nginx, Apache or your load balancer wants plain PEM. This tool opens the PKCS#7 bundle — binary or Base64, .p7b or .p7c — and hands back every certificate inside as standard PEM, ready to deploy.
The subjects of all contained certificates are listed so you can see exactly what the bundle held — typically your domain certificate plus one or two intermediates — and everything downloads as one concatenated PEM file, which is the bundle format most servers expect.
100% private“The bundle is decoded entirely in your browser and never uploaded. P7B files contain only public certificates — there is no private key in them, or on this page.”
Not in the .p7b — the format never carries one. Your key stayed wherever the certificate request was generated (your server, or wherever you ran openssl/certreq). Pair the extracted certificates with that existing key file.
The one whose subject is your domain. The others are the CA’s intermediates; most servers want them all in one file (yours first), which is exactly how the download is ordered.