diff --git a/lib/hx509/test_ca.in b/lib/hx509/test_ca.in
index c4b6ca020..d9897c267 100644
--- a/lib/hx509/test_ca.in
+++ b/lib/hx509/test_ca.in
@@ -52,11 +52,11 @@ ${hxtool} issue-certificate \
 	  --ca-certificate=FILE:$srcdir/data/ca.crt,$srcdir/data/ca.key \
 	  --subject="cn=foo" \
 	  --req="pkcs10-request.der" \
-	  --certificate="FILE:cert-ee.der" || exit 1
+	  --certificate="FILE:cert-ee.pem" || exit 1
 
 echo "verify certificate"
 ${hxtool} verify --missing-revoke \
-	cert:FILE:cert-ee.der \
+	cert:FILE:cert-ee.pem \
 	anchor:FILE:$srcdir/data/ca.crt > /dev/null || exit 1
 
 echo "issue certificate (10years 1 month)"
@@ -65,7 +65,7 @@ ${hxtool} issue-certificate \
 	  --subject="cn=foo" \
           --lifetime="10years 1 month" \
 	  --req="pkcs10-request.der" \
-	  --certificate="FILE:cert-ee.der" || exit 1
+	  --certificate="FILE:cert-ee.pem" || exit 1
 
 echo "issue certificate (with https ekus)"
 ${hxtool} issue-certificate \
@@ -74,7 +74,7 @@ ${hxtool} issue-certificate \
 	  --type="https-server" \
 	  --type="https-client" \
 	  --req="pkcs10-request.der" \
-	  --certificate="FILE:cert-ee.der" || exit 1
+	  --certificate="FILE:cert-ee.pem" || exit 1
 
 echo "issue certificate (pkinit KDC)"
 ${hxtool} issue-certificate \
@@ -83,7 +83,7 @@ ${hxtool} issue-certificate \
 	  --type="pkinit-kdc" \
           --pk-init-principal="krbtgt/TEST.H5L.SE@TEST.H5L.SE" \
 	  --req="pkcs10-request.der" \
-	  --certificate="FILE:cert-ee.der" || exit 1
+	  --certificate="FILE:cert-ee.pem" || exit 1
 
 echo "issue certificate (pkinit client)"
 ${hxtool} issue-certificate \
@@ -92,7 +92,7 @@ ${hxtool} issue-certificate \
 	  --type="pkinit-client" \
           --pk-init-principal="lha@TEST.H5L.SE" \
 	  --req="pkcs10-request.der" \
-	  --certificate="FILE:cert-ee.der" || exit 1
+	  --certificate="FILE:cert-ee.pem" || exit 1
 
 echo "issue certificate (hostnames)"
 ${hxtool} issue-certificate \
@@ -102,7 +102,7 @@ ${hxtool} issue-certificate \
           --hostname="www.test.h5l.se" \
           --hostname="ftp.test.h5l.se" \
 	  --req="pkcs10-request.der" \
-	  --certificate="FILE:cert-ee.der" || exit 1
+	  --certificate="FILE:cert-ee.pem" || exit 1
 
 echo "issue certificate (email)"
 ${hxtool} issue-certificate \
@@ -111,14 +111,14 @@ ${hxtool} issue-certificate \
           --email="lha@test.h5l.se" \
           --email="test@test.h5l.se" \
 	  --req="pkcs10-request.der" \
-	  --certificate="FILE:cert-ee.der" || exit 1
+	  --certificate="FILE:cert-ee.pem" || exit 1
 
 echo "issue self-signed cert"
 ${hxtool} issue-certificate \
 	  --self-signed \
 	  --ca-private-key=FILE:$srcdir/data/key.der \
 	  --subject="cn=test" \
-	  --certificate="FILE:cert-ee.der" || exit 1
+	  --certificate="FILE:cert-ee.pem" || exit 1
 
 echo "issue ca cert"
 ${hxtool} issue-certificate \
@@ -157,30 +157,30 @@ ${hxtool} issue-certificate \
  	  --serial-number="deadbeaf" \
 	  --generate-key=rsa \
 	  --subject="cn=ca2-cert" \
-	  --certificate="FILE:cert-ca.der" || exit 1
+	  --certificate="FILE:cert-ca.pem" || exit 1
 
 echo "issue ee cert (generate rsa key)"
 ${hxtool} issue-certificate \
-	  --ca-certificate=FILE:cert-ca.der \
+	  --ca-certificate=FILE:cert-ca.pem \
 	  --generate-key=rsa \
 	  --subject="cn=cert-ee2" \
-	  --certificate="FILE:cert-ee.der" || exit 1
+	  --certificate="FILE:cert-ee.pem" || exit 1
 
 echo "verify certificate"
 ${hxtool} verify --missing-revoke \
-	cert:FILE:cert-ee.der \
-	anchor:FILE:cert-ca.der > /dev/null || exit 1
+	cert:FILE:cert-ee.pem \
+	anchor:FILE:cert-ca.pem > /dev/null || exit 1
 
 echo "sign CMS signature (generate key)"
 ${hxtool} cms-create-sd \
-	--certificate=FILE:cert-ee.der,ee2-key.der \
+	--certificate=FILE:cert-ee.pem \
 	"$srcdir/test_name.c" \
 	sd.data > /dev/null || exit 1
 
 echo "verify CMS signature (generate key)"
 ${hxtool} cms-verify-sd \
 	--missing-revoke \
-	--anchors=FILE:cert-ca.der \
+	--anchors=FILE:cert-ca.pem \
 	sd.data sd.data.out > /dev/null || exit 1
 cmp "$srcdir/test_name.c" sd.data.out || exit 1
 
@@ -190,15 +190,13 @@ ${hxtool} issue-certificate \
 	  --issue-ca \
           --lifetime="2years" \
  	  --serial-number="deadbeaf" \
-	  --ca-private-key=FILE:cert-ca.der \
+	  --ca-private-key=FILE:cert-ca.pem \
 	  --subject="cn=ca2-cert" \
-	  --certificate="FILE:cert-ca.der" || exit 1
+	  --certificate="FILE:cert-ca.pem" || exit 1
 
 echo "verify certificate generated by previous ca"
 ${hxtool} verify --missing-revoke \
-	cert:FILE:cert-ee.der \
-	anchor:FILE:cert-ca.der > /dev/null || exit 1
-
-
+	cert:FILE:cert-ee.pem \
+	anchor:FILE:cert-ca.pem > /dev/null || exit 1
 
 exit 0