.DER

Introduction

DER, the Distinguished Encoding Rules, is the binary form of certificates, keys and other security objects. X.509 certificates, PKCS #8 private keys, certificate signing requests and revocation lists are all defined in ASN.1, a notation for data structures, and DER turns them into bytes in exactly one way, so that a signature over those bytes can be checked.

A DER file is the same data as a PEM file without the base64 text wrapping. Windows and Java often use the binary form, saved as .cer, .crt or .der. The extensions do not say which form a file is in: a DER file starts with the byte 30, a PEM file with -----BEGIN.

Structure

DER data is a tree of tag, length, value fields. The tag byte says what the value is: 30 for a SEQUENCE, 02 for an INTEGER, 06 for an object identifier, 03 for a BIT STRING, 04 for an OCTET STRING, and so on. A length below 128 is one byte; a longer length is a byte 80 plus the number of length bytes that follow, so a certificate of a kilobyte or more begins 30 82 and a 2-byte length.

A certificate is a SEQUENCE of three parts: the to-be-signed certificate, with the version, serial number, issuer, validity dates, subject, public key and extensions; the signature algorithm; and the signature itself as a BIT STRING.

Also used for

• PEM certificate .crt
• PEM certificate .cer

Links