.PEM

Introduction

PEM is the usual text form of keys and certificates. It takes binary data in DER encoding, writes it as base64 and wraps it between a -----BEGIN …----- line and an -----END …----- line that say what it is. The name comes from Privacy Enhanced Mail, an early standard for secure email; the mail standard faded but its text encoding became universal. RFC 7468 describes it as it is used today.

The same encoding is saved under several extensions: .pem for anything, .crt and .cer for certificates, .key for private keys and .csr for certificate signing requests. A .crt or .cer file can also hold the raw binary DER form instead, which starts with the byte 30 rather than with text.

Structure

A PEM file is plain text holding one or more blocks. Each block is a BEGIN line with a label, the base64 encoding of the DER data in lines of 64 characters, and an END line with the same label. Text outside the blocks is ignored, so files often carry a description above each block. A certificate chain is several CERTIFICATE blocks one after another.

The label tells software what the data is. Common labels are CERTIFICATE, PRIVATE KEY for a PKCS #8 private key, ENCRYPTED PRIVATE KEY, RSA PRIVATE KEY and EC PRIVATE KEY for older key formats, PUBLIC KEY, CERTIFICATE REQUEST and X509 CRL.

-----BEGIN CERTIFICATE-----
MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJ
…
-----END CERTIFICATE-----

Also used for

• Apple Keynote presentation .key
• DER certificate .cer
• DER certificate .crt

Links