Certificate file formats
Last reviewed 2026-07-18 by the Just Software engineering team · print-friendly
| Format |
Extensions |
Encoding |
Certificate(s) |
Chain |
Private key |
Typical use |
| PEM |
.pem, .crt, .cer, .key |
Base64 text with -----BEGIN/END----- markers |
Yes (one or many) |
Optional (concatenated) |
Optional (separate block or file) |
OpenSSL, web servers, appliances, Linux |
| DER |
.der, .cer, .crt |
Binary |
Yes (exactly one) |
No |
No |
Windows, Java, binary exchange |
| PKCS#12 (PFX) |
.pfx, .p12 |
Binary, password-protected |
Yes |
Usually |
Yes |
Moving an identity (key + cert) between systems |
| PKCS#7 (P7B) |
.p7b, .p7c |
Binary or Base64 |
Yes (one or many) |
Yes — its main job |
No |
Distributing a cert plus its chain |
| CSR (PKCS#10) |
.csr, .req, .txt |
Usually PEM (BEGIN CERTIFICATE REQUEST) |
No — a request, public key only |
No |
No |
Submitted to a CA for issuance |
Quick identification: opens in Notepad with -----BEGIN lines → PEM. Binary garbage → DER, PFX or binary P7B. Anything with a private key is a secret — only PFX/P12 and PEM key files carry keys.
Inspect before you convert
| Task |
Command |
| Dump a PEM certificate |
openssl x509 -in cert.pem -text -noout |
| Dump a DER certificate |
openssl x509 -in cert.der -inform der -text -noout |
| Dump a CSR |
openssl req -in request.csr -text -noout |
| List certs in a P7B |
openssl pkcs7 -print_certs -in bundle.p7b -noout |
| List PFX contents |
openssl pkcs12 -info -in cert.pfx -nokeys |
| Windows: dump any cert/CSR/P7B |
certutil -dump file.cer |
Conversion matrix — openssl
| From → To |
Command |
| PEM → DER |
openssl x509 -in cert.pem -outform der -out cert.der |
| DER → PEM |
openssl x509 -in cert.der -inform der -out cert.pem |
| PEM (+key +chain) → PFX |
openssl pkcs12 -export -out cert.pfx -inkey key.pem -in cert.pem -certfile chain.pem |
| PFX → PEM (everything) |
openssl pkcs12 -in cert.pfx -out all.pem -nodes |
| PFX → cert only |
openssl pkcs12 -in cert.pfx -clcerts -nokeys -out cert.pem |
| PFX → key only |
openssl pkcs12 -in cert.pfx -nocerts -nodes -out key.pem |
| P7B → PEM certs |
openssl pkcs7 -print_certs -in bundle.p7b -out certs.pem |
| P7B (binary/DER) → PEM certs |
openssl pkcs7 -print_certs -in bundle.p7b -inform der -out certs.pem |
| PEM cert(s) → P7B |
openssl crl2pkcs7 -nocrl -certfile certs.pem -out bundle.p7b |
Notes: -nodes writes the private key unencrypted — protect the output file. To build a PFX from separate certs, concatenate leaf + intermediates into one PEM first, or pass intermediates via -certfile.
Conversion matrix — certutil (Windows)
| Task |
Command |
| DER → PEM (Base64) |
certutil -encode cert.der cert.pem |
| PEM → DER |
certutil -decode cert.pem cert.der |
| Import a PFX to the machine store |
certutil -importpfx cert.pfx |
| Repair store link between cert and key |
certutil -repairstore my <thumbprint> |
certutil -encode/-decode convert between binary and Base64 for any file type (certs, P7B, CSRs). Note that certutil -encode wraps output in BEGIN/END CERTIFICATE markers regardless of content type, so rename markers manually if the payload is not a certificate.
Gotchas
.cer and .crt tell you nothing — either can be PEM or DER. Check the content.- A PEM file can hold a whole chain: leaf first, then intermediates, root last (root usually optional).
- P7B never contains a private key. If someone sends you "the certificate" as P7B after you generated the CSR elsewhere, that is fine — the key stays where the CSR was made.
- Losing the private key means re-issuing: a certificate alone (PEM/DER/P7B) cannot be turned back into a PFX without the key file.