Step-by-step guide

How to export your DSC
as .cer, .pem, .pfx, .der

Need to check your DSC expiry but don't have the certificate file? This guide walks you through exporting your Digital Signature Certificate from a USB token, Windows, browser, or converting between formats using OpenSSL.

On this page
  1. Export from DSC USB Token
  2. Export from Windows Certificate Manager
  3. Export from Chrome / Firefox
  4. Convert formats with OpenSSL
  5. Format differences explained
  6. Frequently asked questions
1

Export from DSC USB Token

Works with eMudhra ePass, Sify SafeScrypt, NIC, NSDL tokens
ℹ
This exports only the public certificate — not the private key. The private key stays protected inside the token hardware and cannot be extracted. This is all you need to check validity on dscchecker.com.

Most DSC USB tokens come with their own software. The steps below cover the most common ones.

eMudhra ePass 2003 / 3003

  1. Insert your token and open SafeNet Authentication Client or the eMudhra utility
  2. Click on View Certificates or Certificate Details
  3. Select your certificate (usually your name or organisation name)
  4. Click Export → choose DER encoded binary X.509 (.cer)
  5. Save the file — you can now upload it to dscchecker.com

Sify SafeScrypt / ProcertUM token

  1. Open ProcertUM CSP Manager from the system tray
  2. Go to Certificates tab
  3. Right-click your certificate → Export certificate
  4. Choose .cer (DER format) and save

NIC / NICCA token

  1. Open NICCA eSign Client or SafeNet client installed with the token
  2. Navigate to Certificate Details
  3. Click Export and save as .cer
⚠
If the token software is not installed, insert the token and check Windows Certificate Manager instead — the certificate is often registered there automatically.
2

Export from Windows Certificate Manager

Works on Windows 7, 8, 10, 11 — no extra software needed

Windows registers your DSC automatically when you insert the token. You can export it directly from the built-in Certificate Manager.

  1. Press Win + R, type certmgr.msc and press Enter
  2. In the left panel, expand Personal → click Certificates
  3. Find your DSC certificate (look for your name or organisation)
  4. Right-click the certificate → All Tasks → Export…
  5. Click Next in the Export Wizard
  6. Select "No, do not export the private key" → click Next
  7. Choose format:
    • DER encoded binary X.509 (.CER) — most compatible, recommended
    • Base-64 encoded X.509 (.CER) — same certificate, text format (PEM)
  8. Choose a save location and click Finish
✔
The exported .cer file is ready to upload to dscchecker.com to check validity, issuer, key usage and expiry date.

Export as .pfx (with private key)

If you need a .pfx file (e.g. to use the DSC on another computer), follow the same steps but select "Yes, export the private key". You will be asked to set a password to protect the file. dscchecker.com supports password-protected PFX files.

3

Export from Chrome or Firefox

Useful if your DSC was installed directly in the browser

Google Chrome

  1. Go to chrome://settings/security in the address bar
  2. Scroll down and click Manage certificates
  3. Under the Personal tab, find your DSC certificate
  4. Click Export… and follow the wizard (same as Windows Certificate Manager above)

Mozilla Firefox

  1. Go to Settings (☰ menu) → Privacy & Security
  2. Scroll to the Certificates section → click View Certificates…
  3. Under the Your Certificates tab, select your DSC
  4. Click Export… and save as .p12 (PKCS#12 format)
  5. You can then convert the .p12 to .pem or .cer using OpenSSL (see Method 4)
⚠
If you do not see your DSC under Personal certificates, it means the certificate is stored on the USB token hardware and not in the browser. Connect your token and check Method 1 or Method 2 instead.
4

Convert formats with OpenSSL

Command-line conversions for all certificate formats

OpenSSL is a free tool available on Windows, macOS, and Linux. It can convert between any certificate format. Download OpenSSL for Windows. On macOS it is pre-installed.

PFX / P12 → PEM (certificate only)

Terminal / Command Prompt
openssl pkcs12 -in certificate.pfx -clcerts -nokeys -out certificate.pem

PFX / P12 → PEM (certificate + private key)

Terminal / Command Prompt
openssl pkcs12 -in certificate.pfx -out certificate.pem -nodes

DER (.cer) → PEM

Terminal / Command Prompt
openssl x509 -inform DER -in certificate.cer -out certificate.pem

PEM → DER (.cer)

Terminal / Command Prompt
openssl x509 -outform DER -in certificate.pem -out certificate.cer

PEM → PFX (with private key)

Terminal / Command Prompt
openssl pkcs12 -export -out certificate.pfx -inkey privatekey.pem -in certificate.pem

View certificate details from command line

Terminal / Command Prompt
# For PEM files
openssl x509 -in certificate.pem -text -noout

# For DER files
openssl x509 -inform DER -in certificate.cer -text -noout
💡
You will be prompted to enter the PFX password for commands that involve .pfx or .p12 files. If your PFX has no password, just press Enter when prompted.
5

Certificate format differences explained

What each extension means and when to use it
ExtensionFormatContainsUse when
.cerDER or PEMCertificate only (no private key)Uploading to portals, sharing your public cert
.crtDER or PEMCertificate onlySame as .cer — just a different extension
.pemBase64 textCert, key, or chain (starts with -----BEGIN…)Linux servers, OpenSSL, web servers
.derBinaryCertificate onlyJava applications, older Windows tools
.pfxPKCS#12 binaryCertificate + private key (password protected)Moving DSC to another device, IIS, Windows
.p12PKCS#12 binaryCertificate + private key (password protected)Same as .pfx — used on macOS, Firefox
.p7bPKCS#7Certificate chain only (no private key)Intermediate CA chains, email encryption
ℹ
dscchecker.com accepts all of these formats: .cer .crt .pem .der .pfx .p12 .p7b. No conversion needed before uploading.

Ready to check your certificate?

Upload any format — we'll show you the expiry date, issuer, key usage and more in seconds.

Check my DSC now →

Frequently asked questions

They contain the same data — a .cer file is usually DER (binary) format, while a .pem file is Base64-encoded text that starts with -----BEGIN CERTIFICATE-----. You can convert between them freely using OpenSSL. dscchecker.com accepts both.
Use Windows Certificate Manager (certmgr.msc). Open it, find your certificate under Personal → Certificates, right-click → All Tasks → Export. The wizard lets you choose DER (.cer) or Base64 (.cer/pem) format without any extra tools. Alternatively, download Win32 OpenSSL — it is free and takes 2 minutes to install.
No. By design, the private key in a Class 2 or Class 3 DSC token is generated and stored inside the token hardware and cannot be exported. This is a security feature — it ensures only you can use your DSC. You can only export the public certificate (.cer). To use your DSC on another computer, you need to physically plug in the token.
First make sure the token driver software is installed. For eMudhra tokens, install SafeNet Authentication Client. For Sify tokens, install ProcertUM CSP. After installation, remove and re-insert the token. Open certmgr.msc and check Personal → Certificates again. If still not visible, try a different USB port or restart your computer.
Any format works — .cer, .crt, .pem, .der, .pfx, .p12, or .p7b. No conversion is needed. If you have a .pfx or .p12, just upload it and enter the password when prompted. Everything is processed in your browser — nothing is uploaded to a server.