Docs Security

Certificate Conversion

Convert certificates between PEM, DER, PFX, and other formats.

POST /v1/certificate-conversion certconvert.run

Converts an uploaded or pasted certificate between common formats (PEM, DER, PFX/PKCS12, and more), optionally including the private key or chain.

Authentication

This endpoint requires a valid API key sent as a Bearer token, and the key must carry the scope listed above. See Authentication and Scopes for details.

Headers

Header	Required	Description
Authorization	Required	Bearer token — `Bearer pk_live_...`
Content-Type	Required	`application/json`

Request Example

curl -X POST "https://api.paqet.net/v1/certificate-conversion" \
  -H "Authorization: Bearer pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
  "inputMode": "text",
  "inputText": "-----BEGIN CERTIFICATE-----...",
  "fromFormat": "PEM",
  "toFormat": "DER"
}'

using var client = new HttpClient();
client.DefaultRequestHeaders.Authorization = new("Bearer", "pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx");

var body = new StringContent("""
{
  "inputMode": "text",
  "inputText": "-----BEGIN CERTIFICATE-----...",
  "fromFormat": "PEM",
  "toFormat": "DER"
}
""", System.Text.Encoding.UTF8, "application/json");
var response = await client.PostAsync("https://api.paqet.net/v1/certificate-conversion", body);
var json = await response.Content.ReadAsStringAsync();
Console.WriteLine(json);

const response = await fetch("https://api.paqet.net/v1/certificate-conversion", {
  method: "POST",
  headers: {
    "Authorization": "Bearer pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
  "inputMode": "text",
  "inputText": "-----BEGIN CERTIFICATE-----...",
  "fromFormat": "PEM",
  "toFormat": "DER"
})
});

const data = await response.json();
console.log(data);

interface ApiResponse<T> {
  success: boolean;
  data?: T;
  code?: string;
  message?: string;
}

const response = await fetch("https://api.paqet.net/v1/certificate-conversion", {
  method: "POST",
  headers: {
    "Authorization": "Bearer pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
  "inputMode": "text",
  "inputText": "-----BEGIN CERTIFICATE-----...",
  "fromFormat": "PEM",
  "toFormat": "DER"
})
});

const data: ApiResponse<unknown> = await response.json();
console.log(data);

import requests

headers = {"Authorization": "Bearer pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"}

response = requests.post(
    "https://api.paqet.net/v1/certificate-conversion",
    headers=headers,
    json={
  "inputMode": "text",
  "inputText": "-----BEGIN CERTIFICATE-----...",
  "fromFormat": "PEM",
  "toFormat": "DER"
}
)

print(response.json())

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	body := strings.NewReader(`{
  "inputMode": "text",
  "inputText": "-----BEGIN CERTIFICATE-----...",
  "fromFormat": "PEM",
  "toFormat": "DER"
}`)
	req, _ := http.NewRequest("POST", "https://api.paqet.net/v1/certificate-conversion", body)
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Bearer pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	data, _ := io.ReadAll(resp.Body)
	fmt.Println(string(data))
}

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => "https://api.paqet.net/v1/certificate-conversion",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_POSTFIELDS => '{
  "inputMode": "text",
  "inputText": "-----BEGIN CERTIFICATE-----...",
  "fromFormat": "PEM",
  "toFormat": "DER"
}',
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
        "Content-Type: application/json"
    ]
]);

$response = curl_exec($curl);
curl_close($curl);

echo $response;

Response Example

200 OK

{
  "success": true,
  "data": {
    "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "summary": "Converted PEM to DER",
    "durationMs": 12,
    "results": [
      { "outputFormat": "DER", "outputBase64": "MIIDazCCAlOgAwIBAgIU..." }
    ]
  }
}

Error Responses

Status	Code	Meaning
401	API_KEY_INVALID	The API key is missing, malformed, or doesn't match any active key.
401	API_KEY_REVOKED	The API key was manually revoked and can never be reactivated.
401	API_KEY_EXPIRED	The API key's expiration date has passed.
403	PLAN_EXPIRED	Your Enterprise subscription is no longer active.
403	ENTERPRISE_REQUIRED	The Public API is only available on the Enterprise plan.
403	SCOPE_REQUIRED	The API key doesn't have the scope required for this endpoint.
429	RATE_LIMIT_EXCEEDED	The API key has exceeded its request limit for the current window.
422	VALIDATION_ERROR	One or more request parameters failed validation.
500	INTERNAL_ERROR	An unexpected error occurred on Paqet's side.

Rate Limits

This endpoint counts against your API key's standard request limit. See Rate Limits for current limits, response headers, and retry guidance.

Notes

Never send a private key or passphrase you don't control — treat this endpoint like any other secret-handling code path.

Certificate Chain

/v1/cert-chain

Try this endpoint

Run it live from the Playground using your own API key.

Open Playground