Fix "PEM Certificate Is Invalid" Error: Common Causes and Solutions
"PEM certificate is invalid" is one of the most common TLS deployment errors, and it's almost never a security problem — it's a file format problem. The certificate data is fine; the way it's stored or pasted is broken. Here's how to fix it in a few minutes.
The symptom
Your web server, load balancer, or openssl command refuses to load a certificate file, usually with "unable to load certificate" or "PEM routines:CRYPTO_internal:bad decrypt".
Common causes
- Wrong format: you saved a DER file as .pem. PEM is base64 text with BEGIN/END lines; DER is raw binary.
- Missing or mangled header/footer. PEM must start with
-----BEGIN CERTIFICATE-----and end with-----END CERTIFICATE-----. - Broken chain: cert files pasted out of order. A full chain is root + intermediate + leaf, with the leaf first.
- Extra whitespace or hidden characters. A stray space or newline mid-base64 breaks the decoder.
- Password-protected private key. Without the passphrase, loading fails.
Fix it, one step at a time
1. Identify the format
Run file certificate.pem and head -c 100 certificate.pem. If you see binary, it's DER. If you see base64 with header lines, it's PEM.
2. Convert DER to PEM
openssl x509 -inform der -in cert.der -out cert.pem3. Rebuild a clean PEM file
# Leaf first, then intermediates, then root
cat leaf.pem intermediate.pem root.pem > fullchain.pem
openssl verify -untrusted intermediate.pem -CAfile root.pem fullchain.pem4. Strip stray whitespace
openssl x509 -in cert.pem -out clean.pemOpenSSL re-emits a canonical PEM, dropping stray spaces.
5. Handle a password-protected key
# Remove passphrase (make a secure copy first)
openssl rsa -in encrypted.key -out decrypted.key6. Verify before deploying
openssl x509 -in cert.pem -noout -text | head -20
openssl x509 -in cert.pem -noout -checkend 0
If the file still fails, paste it into the SSL Certificate Decoder — it will show you exactly which field or line is malformed.
Is this error dangerous?
It just means the file isn't loadable as a certificate. Usually it's a format problem, not a security issue — but do fix it before deployment.
What's the difference between PEM and DER?
DER is binary; PEM is the base64 text version with header/footer lines. Same certificate, different packaging.
Why would my key be password-protected?
If the private key was created with a passphrase, OpenSSL won't load it without the password.
Does this affect my whole site?
Only if the broken file is what your server loads. Fix the format, then reload the service.
