diff --git a/ChangeLog.d/cert-write-der-windows.txt b/ChangeLog.d/cert-write-der-windows.txt
new file mode 100644
index 0000000000..002092b943
--- /dev/null
+++ b/ChangeLog.d/cert-write-der-windows.txt
@@ -0,0 +1,3 @@
+Bugfix
+   * Fix corruption of DER certificates generated by the `cert_write`
+     sample program on Windows. #10152
diff --git a/programs/x509/cert_write.c b/programs/x509/cert_write.c
index 5d9a306ee7..947d73f54a 100644
--- a/programs/x509/cert_write.c
+++ b/programs/x509/cert_write.c
@@ -238,7 +238,11 @@ static int write_certificate(mbedtls_x509write_cert *crt, const char *output_fil
         output_start = output_buf;
     }
 
-    if ((f = fopen(output_file, "w")) == NULL) {
+    /*
+     * DER output is binary data. Use binary mode on Windows to prevent
+     * text-mode newline translation.
+     */
+    if ((f = fopen(output_file, opt.format == FORMAT_DER ? "wb" : "w")) == NULL) {
         return -1;
     }