diff --git a/changelogs/fragments/mtv-provider-x509-certificate-convert.yml b/changelogs/fragments/mtv-provider-x509-certificate-convert.yml
new file mode 100644
index 0000000..58dd984
--- /dev/null
+++ b/changelogs/fragments/mtv-provider-x509-certificate-convert.yml
@@ -0,0 +1,5 @@
+---
+minor_changes:
+  - Replace the ``openssl x509`` command invocation with the ``community.crypto.x509_certificate_convert`` module when converting the VMCA CA certificate from DER to PEM in the ``mtv_provider`` role, and read the converted certificate from the resulting file instead of parsing command output.
+bugfixes:
+  - Remove temporary VMCA certificate files (DER and PEM) after validation in the ``mtv_provider`` role so they no longer linger on disk when validation fails.
diff --git a/roles/mtv_provider/README.md b/roles/mtv_provider/README.md
index 823bd6a..58082d7 100644
--- a/roles/mtv_provider/README.md
+++ b/roles/mtv_provider/README.md
@@ -270,7 +270,7 @@ Description: Ensure host OpenShift provider and source provider CRs exist on tar
 | validate ¦ Retrieve leaf certificate from source | `community.crypto.get_certificate` | False |
 | validate ¦ Fetch CA certificate from VMCA endpoint | `block` | True |
 | validate ¦ Download VMCA CA certificate (DER format) | `ansible.builtin.uri` | False |
-| validate ¦ Convert VMCA CA certificate from DER to PEM | `ansible.builtin.command` | False |
+| validate ¦ Convert VMCA CA certificate from DER to PEM | `community.crypto.x509_certificate_convert` | False |
 | validate ¦ Store VMCA root CA certificate | `ansible.builtin.set_fact` | False |
 | validate ¦ Store leaf certificate (non-VMware or VMCA fallback) | `ansible.builtin.set_fact` | True |
 | validate ¦ Resolve effective certificate | `ansible.builtin.set_fact` | False |
diff --git a/roles/mtv_provider/tasks/validate.yml b/roles/mtv_provider/tasks/validate.yml
index 568d4f8..6756f14 100644
--- a/roles/mtv_provider/tasks/validate.yml
+++ b/roles/mtv_provider/tasks/validate.yml
@@ -136,6 +136,7 @@
       when: mtv_provider_source_type == 'vmware'
       vars:
         _mtv_provider_vmca_der_path: /tmp/.mtv_provider_vmca_ca.der
+        _mtv_provider_vmca_pem_path: /tmp/.mtv_provider_vmca_ca.pem
       block:
         - name: validate | Download VMCA CA certificate (DER format)
           ansible.builtin.uri:
@@ -149,18 +150,15 @@
           register: _mtv_provider_vmca_fetch
 
         - name: validate | Convert VMCA CA certificate from DER to PEM
-          ansible.builtin.command:
-            cmd: >-
-              openssl x509 -inform DER
-              -in {{ _mtv_provider_vmca_der_path }}
-              -outform PEM
-          register: _mtv_provider_vmca_pem
-          changed_when: false
+          community.crypto.x509_certificate_convert:
+            src_path: "{{ _mtv_provider_vmca_der_path }}"
+            dest_path: "{{ _mtv_provider_vmca_pem_path }}"
+            format: pem
 
         - name: validate | Store VMCA root CA certificate
           ansible.builtin.set_fact:
             _mtv_provider_source_certificate: >-
-              {{ _mtv_provider_vmca_pem.stdout ~ '\n' }}
+              {{ lookup('ansible.builtin.file', _mtv_provider_vmca_pem_path) }}
       rescue:
         - name: validate | VMCA endpoint unavailable, falling back to leaf cert
           ansible.builtin.debug:
@@ -168,6 +166,16 @@
               VMCA CA endpoint was not available on
               '{{ mtv_provider_source_host }}'. Falling back to the
               leaf certificate.
+      always:
+        - name: validate | Remove temporary certificate files
+          ansible.builtin.file:
+            path: "{{ __mtv_provider_tmp_cert_path }}"
+            state: absent
+          loop_control:
+            loop_var: __mtv_provider_tmp_cert_path
+          loop:
+            - "{{ _mtv_provider_vmca_der_path }}"
+            - "{{ _mtv_provider_vmca_pem_path }}"
 
     - name: validate | Store leaf certificate (non-VMware or VMCA fallback)
       ansible.builtin.set_fact: