With a public key as PEM, how can this be converted to DER format using openssl? Please note that this is not a x509 certificate. Also this question is about EC (ECDSA) public keys not RSA and using openssl not C, C++ or some other programming language
-----BEGIN PUBLIC KEY-----
xxx
-----END PUBLIC KEY-----
Try:
openssl pkey -pubin -in ec_pub.pem -outform DER -out ec_pub.der
man openssl-pkey. Did you have any issue?
man openssl-ec indicates similar options will work for elliptic curve keys (openssl ec instead of openssl x509).
The PEM format consists of -----BEGIN …----- line, a Base64-encoded body and an -----END …----- line. If you just want to convert to DER (binary), you just need to extract the body and convert it from Base64 to binary.
(This is for plaintext, i.e. non-encrypted files. Encrypted PEM files have additional information that describes the encryption method. You typically can't usefully just extract the DER, you have to decrypt it, because the Base64-encoded part doesn't have any metadata about the encryption method.)
You can do this generically with the openssl enc -base64 command, which can be abbreviated to openssl base64.
openssl base64 -d -in myfile.pem -out myfile.der
Note that if you wanted to use a straight Base64 decoder, such as base64, you would need to strip of the begin/end lines.
<myfile.pem grep '^[^-]' | base64 -d >myfile.der
Alternatively, with openssl, you can use the management command that's specific to the particular kind of data you're dealing with. (Many kinds of data can be handled by more than one openssl command, for various reasons.) Manipulating a PUBLIC KEY is the job of openssl pkey. Pass -outform DER to indicate that you want DER output (-inform PEM is optional because that's the default). Pass -pubin to indicate that the input is a public key (by default, openssl pkey expects a private key).
openssl pkey -pubin -in myfile.pem -outform DER -out myfile.der
If you happen to know that the key is an EC key, openssl ec -pubin -in myfile.pem -outform DER also works, but there's no advantage in using ec unless you need the command to work with antique versions of OpenSSL that are no longer supported.
