Certificate File Formats

What PEM, DER, CRT, CER, KEY, CSR, P7B, PKCS#8, PFX and JKS files actually contain, and how to tell them apart.

• PEM

  PEM is Base64-encoded DER wrapped in BEGIN and END lines. It can hold certificates, keys, CSRs or several at once, which is why the extension tells you so little.

• DER

  DER is the raw binary encoding of an X.509 object. It holds exactly one thing, has no delimiters, and is what PEM Base64-encodes.

• .crt, .cer and .cert files

  None of these extensions tells you the encoding. All three mean "a certificate", and any of them may be PEM text or binary DER. Here is how to check.

• .key private key files

  A .key file holds a private key, but the extension does not say which of the four PEM key formats it uses. The header line does.

• PKCS#12 — .pfx and .p12

  A password-protected binary archive holding a certificate, its private key and the chain in one file. Also the format most likely to break between OpenSSL versions.

• CSR — certificate signing request

  A CSR carries your public key and the identity you are claiming, signed with your private key to prove you hold it. The CA is free to ignore most of what it says.

• PKCS#7 — .p7b and .p7c

  A certificate-only bundle format. It can carry a whole chain in one file but never a private key, and it records no order between the certificates it holds.

• PKCS#8 private key format

  The modern private key format. It records which algorithm the key belongs to, so one parser handles RSA, EC and Ed25519 — which is why Java and Go accept nothing else.

• JKS — Java KeyStore

  Java's proprietary keystore format, deprecated in favour of PKCS#12 since Java 9. Read only by keytool, never directly by OpenSSL.