# .crt, .cer and .cert files

There is no technical difference between `.crt`, `.cer` and `.cert`. All three mean "this file is an X.509 certificate" and none of them says anything about the encoding, which may be PEM text or binary DER. `.crt` is the Unix convention and `.cer` is the Windows one, but both platforms read either. The only reliable way to know what you have is to look at the first byte — a `-` means PEM, `0x30` means DER.

Source: https://certguru.io/formats/crt-cer/
Last updated: 2026-08-19
Commands verified against OpenSSL 3.5.7.

---

## The short answer

| Extension | Means | Encoding | Convention |
| --- | --- | --- | --- |
| `.crt` | A certificate | PEM or DER | Unix / Linux |
| `.cer` | A certificate | PEM or DER | Windows |
| `.cert` | A certificate | PEM or DER | Occasional |
| `.pem` | Base64-wrapped anything | PEM by definition | Cross-platform |
| `.der` | Binary ASN.1 anything | DER by definition | Cross-platform |

The first three rows are interchangeable. The distinction that actually matters is not in that
column at all — it is the encoding, and none of the certificate extensions record it.

## Find out what you have

*One command answers it*

```bash
file certificate.crt
```

Expected output:

```
certificate.crt: PEM certificate
```

Without `file`:

```bash
head -n1 certificate.crt
```

A line of dashes means PEM. Unreadable bytes mean DER.

*Definitive check on the first byte*

```bash
head -c 1 certificate.crt | xxd -p
```

Expected output:

```
30
```

`30` is DER. `2d` is a `-` character, so PEM.

## Why Windows makes this worse

The Windows certificate export wizard offers three options and writes all of them as `.cer` unless
you intervene:

- **DER encoded binary X.509** — binary.
- **Base-64 encoded X.509** — PEM.
- **Cryptographic Message Syntax Standard – PKCS #7** — a [P7B bundle](/formats/pkcs7-p7b/),
  written as `.p7b`.

So a `.cer` from a Windows colleague is a coin flip, and the third option is not a bare certificate
at all. Always check before assuming.

## What to do with each

#### It is PEM

Nothing to convert. Rename it if a tool insists on a particular extension:

    ```bash
cp certificate.crt certificate.pem
```

    To normalise it — stripping any stray text, bag attributes or trust settings:

    ```bash
openssl x509 -in certificate.crt -out certificate.pem
```

#### It is DER

Convert to PEM before using it with anything that expects text:

    ```bash
openssl x509 -inform der -in binary.crt -out certificate.pem
```

    Full detail at [convert DER to PEM](/convert/der-to-pem/).

## Inspecting one either way

*Works regardless of extension, once you know the encoding*

```bash
openssl x509 -in certificate.crt -noout -subject -issuer -dates
```

> **A script that handles both**
>
> When you cannot control what you are given, try PEM and fall back to DER:
>
>   ```bash
>   openssl x509 -in "$f" -noout -text 2>/dev/null \
>     || openssl x509 -inform der -in "$f" -noout -text
>   ```

## Related extensions you may meet

| Extension | What it usually is |
| --- | --- |
| `.key` | A private key, usually PEM. See [key files](/formats/key/) |
| `.csr` | A [certificate signing request](/formats/csr/) |
| `.p7b`, `.p7c` | A [PKCS#7 bundle](/formats/pkcs7-p7b/) — certificates only |
| `.pfx`, `.p12` | A [PKCS#12 archive](/formats/pkcs12-pfx-p12/) — usually includes a key |
| `.jks` | A [Java keystore](/formats/jks-keystore/) |
| `.ca-bundle`, `.chain` | Concatenated PEM intermediates |


## Frequently asked questions

### Is .crt the same as .pem?

Often, but they answer different questions. `.pem` describes an encoding; `.crt` describes a role. A `.crt` file is usually PEM-encoded, in which case renaming it to `.pem` changes nothing — but it can equally be DER, in which case renaming produces a broken file.

### Which extension should I use for a new file?

`.crt` for a PEM certificate on Unix, `.pem` if you want the encoding to be obvious, and `.der` for binary. Avoid `.cer` for anything new, because it is used for both encodings and communicates nothing.

### Can a .crt file contain a private key?

It should not, and by convention it does not. If `grep "PRIVATE KEY"` finds a match in a file someone sent you as a certificate, treat that key as compromised and reissue.

### Does nginx or Apache care about the extension?

No. Both read whatever path is configured and detect the encoding from the file contents. Extensions exist for humans.


## References

- [RFC 5280: X.509 and CRL profile](https://www.rfc-editor.org/rfc/rfc5280) — the specification every field on a certificate comes from
- [RFC 7468: textual encodings of PKIX structures](https://www.rfc-editor.org/rfc/rfc7468) — defines the PEM armour and what may sit between the BEGIN and END lines

## Related pages

- https://certguru.io/formats/pem/
- https://certguru.io/formats/der/
- https://certguru.io/convert/crt-to-pem/
- https://certguru.io/convert/der-to-pem/
- https://certguru.io/openssl/view-certificate/

--
CertGuru — https://certguru.io