.PEM

Introduction

PEM is the usual text form of keys and certificates. It takes binary data in DER encoding, writes it as base64 and wraps it between a -----BEGIN …----- line and an -----END …----- line that say what it is. The name comes from Privacy Enhanced Mail, an early standard for secure email; the mail standard faded but its text encoding became universal. RFC 7468 describes it as it is used today.

The same encoding is saved under several extensions: .pem for anything, .crt and .cer for certificates, .key for private keys and .csr for certificate signing requests. A .crt or .cer file can also hold the raw binary DER form instead, which starts with the byte 30 rather than with text.

Software

• OpenSSL (Windows, macOS, Linux)
• GnuTLS certtool (Linux, macOS, Windows)
• KeyStore Explorer (Windows, macOS, Linux)
• XCA, a certificate and key manager (Windows, macOS, Linux)
• Keychain Access, built into macOS
• The Windows certificate viewer, which opens .crt and .cer files

Structure

A PEM file is plain text holding one or more blocks. Each block is a BEGIN line with a label, the base64 encoding of the DER data in lines of 64 characters, and an END line with the same label. Text outside the blocks is ignored, so files often carry a description above each block. A certificate chain is several CERTIFICATE blocks one after another.

The label tells software what the data is. Common labels are CERTIFICATE, PRIVATE KEY for a PKCS #8 private key, ENCRYPTED PRIVATE KEY, RSA PRIVATE KEY and EC PRIVATE KEY for older key formats, PUBLIC KEY, CERTIFICATE REQUEST and X509 CRL.

-----BEGIN CERTIFICATE-----
MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJ
…
-----END CERTIFICATE-----