Certificates & Site Ops

PKCS#1 vs PKCS#8 vs SPKI Key Labels

Understand common PEM labels and the structures they represent so you can stop renaming files and start importing the right thing.

Encrypt Online Editorial TeamPublished April 24, 20263 min read

Encrypt Online guide cover on a sand background with the headline "PKCS#1, PKCS#8, SPKI". The PEM name sits within a broad inspection lens.

PEM labels are clues, not decoration. They tell you what structure is inside the file, whether it is private or public, and which parsers are likely to accept it.

A lot of key-import pain comes from treating every PEM block as interchangeable because it starts with BEGIN and ends with END.

In brief

What it is: PKCS#1 commonly describes RSA-specific key structures, PKCS#8 describes a private-key container that can wrap multiple algorithm families, and SPKI is the common public-key structure used in certificates and many PEM public-key files.

Why it matters: Import errors often come from feeding a parser the wrong structure, not the wrong algorithm.

Worth knowing: A structure-aware converter changes the ASN.1 container; file names and PEM labels describe the wrapper.

Container type and algorithm are separate questions

A parser may care both about the algorithm family and about the key container. PKCS#8 can hold an RSA or EC private key. SPKI can describe an RSA or EC public key. That is why “it is an RSA key” is sometimes not enough to satisfy the import path.

Determine whether the key is public or private, then identify its container structure.

Read the label, then verify the structure

Labels such as BEGIN PRIVATE KEY, BEGIN RSA PRIVATE KEY, and BEGIN PUBLIC KEY are useful hints. They are not infallible if someone copied content badly, but they usually tell you whether you are looking at PKCS#8, RSA-specific PKCS#1, or a public-key container. A key inspector is valuable because it confirms the inside, not just the text wrapper.

This matters in JOSE, OpenSSL, and certificate tooling alike. The wrong wrapper can look close enough to mislead you until import fails.

BEGIN RSA PRIVATE KEY often points to PKCS#1.
BEGIN PRIVATE KEY commonly points to PKCS#8.
BEGIN PUBLIC KEY commonly points to SPKI.

Why this belongs in a focused toolset

Use a key inspector to identify the key blob. When a key must match a certificate or CSR, use the Certificate, Key & CSR Matcher to compare canonical SPKI public-key bytes. Filenames and PEM labels are insufficient evidence.

See it in a small example

Notice: The labels are only the first clue. The point is to match structure to parser expectations.

BEGIN RSA PRIVATE KEY   -> RSA-specific private-key structure
BEGIN PRIVATE KEY       -> PKCS#8 private-key structure
BEGIN PUBLIC KEY        -> SPKI public-key structure

What to verify

Separate public/private questions from structure questions.
Read the PEM label, then confirm the inside with a structure-aware tool.
Use a structure-aware converter when the underlying key container needs to change; a new file name or label only changes the wrapper text.