PEM ↔ Hex
Convert a PEM block to the raw hex of its DER payload, or wrap hex bytes back into PEM armor. On your device.
Runs on your device. The file is never uploaded.
PEM to hex prints the DER payload of every PEM block in a file as lowercase hex, each under its own label and split by a blank line. Switch mode to hex-to-pem and bytes are wrapped back into armor under label, which starts at CERTIFICATE. Structure is never checked, so any even count of hex digits is wrapped without complaint.
Questions
What does pem-to-hex give me?
The raw DER payload of each PEM block as lowercase hex, with the block label above it. Every block in the file is converted, not only the first, so a chain file gives you one labelled hex section per certificate, separated by a blank line.
How do I go the other way?
Switch mode to hex-to-pem and set label to the PEM name you want, which defaults to CERTIFICATE. Common alternatives are PUBLIC KEY and PRIVATE KEY. The hex is decoded to bytes and wrapped in the matching BEGIN and END armor.
Why did I get an error about hex digits?
Because the input was not clean hex. The tool strips whitespace and then requires hex characters only, in an even count, refusing with "expected a hex string with an even number of digits" otherwise. An odd digit count means at least one byte is incomplete, so it stops rather than guessing.
Does it check that my hex is valid DER?
No. hex-to-pem base64 wraps whatever bytes you give it, valid structure or not, and the only check it makes is that the input is hex with an even digit count. To find out whether the result parses as a certificate, run it through x509-parse afterwards and see what it says.
Why would I want the hex at all?
To look at the DER bytes directly, to paste them into a decoder or a debugger, or to hand raw bytes to something that will not take base64. It is a format change only; no field is interpreted and nothing is validated.