Certificates & Site Ops · Field note
Certificate File Types Explained: CRT, PEM, DER, KEY, and More
Understand the file extensions and encodings that appear in certificate and key workflows.
Before you start
Inspect the current certificate, key, token, or endpoint output before changing deployment config; stale artifacts make fixes misleading.
In brief
What it is: Certificate file types describe how certificates, keys, and bundles are encoded and packaged, not whether they are all interchangeable.
Why it matters: Teams lose time when they confuse PEM, DER, CRT, CER, KEY, and bundle files during deployment or conversion.
Watch for: Assuming a file extension tells you everything you need to know about the actual contents.
Certificate workflows are confusing because several different things get mixed together: certificate contents, private keys, chains, container formats, and file extensions that vary by platform. The result is that people see a file named .crt, .cer, .pem, or .der and assume the extension alone tells the whole story.
The safer approach is to separate three questions: what the file contains, how it is encoded, and what your server or library expects.
The distinctions that matter
- A file extension is only a hint. The actual contents and encoding determine how the file should be used.
- PEM is a textual encoding commonly used for certificates and keys, while DER is binary.
- Private keys, certificates, and chains each have different roles even if they share similar-looking filenames.
| Term | What it usually means |
|---|---|
| PEM | Base64 text with header and footer lines |
| DER | Binary encoding often used in stricter interchange contexts |
| CRT / CER | Certificate file extension that may wrap PEM or DER depending on environment |
| KEY | Private key file, often PEM-encoded in practice |
Checks people skip
- Sending a private key because the filename looked similar to the certificate file.
- Assuming
.crtalways means PEM or.ceralways means DER. - Converting file encodings without tracking whether you changed the certificate, key, or chain.
What still needs an answer
Is PEM more secure than DER?
No. They are different encodings, not security levels.
Can the same certificate exist as both PEM and DER?
Yes. The same certificate material can be represented in different encodings.
Do this locally (CLI)
openssl x509 -in cert.pem -text -noout
openssl pkey -in private-key.pem -text -noout
- Inspect the contents before you trust the file extension.
- Never run the private-key command on a shared system unless the workflow is approved.