PEM vs DER vs CRT vs PFX: Certificate File Formats Explained
Certificate file extensions cause endless confusion, because they describe two different things at once: the encoding of the data (PEM or DER) and the container it travels in (a single certificate, a chain, or an encrypted bundle with a private key). Once you separate those two questions, every format makes sense.
The two encodings
| Encoding | What it looks like | Notes |
|---|---|---|
| PEM | Text. Starts with -----BEGIN CERTIFICATE-----, base64 inside. | Most common on Linux, servers and devices. Can hold several certificates (a chain) in one file. Easy to inspect and paste. |
| DER | Binary — the same data as raw bytes, no base64, not readable in a text editor. | Common on Windows and in embedded devices. One certificate per file, normally. |
The common extensions
| Extension | Usually is | Contains a private key? |
|---|---|---|
| .crt / .cer | A single certificate — PEM on Linux, often DER on Windows. The extension alone does not tell you; check the file's first bytes. | No |
| .pem | PEM encoding; may hold a certificate, a chain, a key, or all of them, depending on the BEGIN line. | Sometimes |
| .key | The private key, usually PEM. | Yes — it is the key |
| .pfx / .p12 | A PKCS#12 bundle: certificate(s) plus private key, protected by a password. | Yes, inside the bundle |
| .p7b / .p7c | PKCS#7 container, typically a certificate chain without keys. | No |
Convert between formats with OpenSSL
# PEM -> DER
openssl x509 -in certificate.pem -outform DER -out certificate.der
# DER -> PEM
openssl x509 -in certificate.der -inform DER -out certificate.pem
# extract certificate and key from a PFX bundle
openssl pkcs12 -in bundle.pfx -clcerts -nokeys -out certificate.crt
openssl pkcs12 -in bundle.pfx -nocerts -nodes -out private.key
# build a PFX bundle from certificate + key + CA
openssl pkcs12 -export -out bundle.pfx -inkey private.key -in certificate.crt -certfile ca.crtWhich format does your device want?
- Many medical, industrial and embedded devices ask for a CA certificate plus a client certificate and key as three separate PEM files.
- Windows servers and IIS prefer a single .pfx.
- Nginx wants PEM (certificate + chain in one file, key separate); Apache the same.
- If a device rejects a file with a format error, first check whether it is actually PEM or DER — renaming the extension does not convert anything.
Not sure what you are holding? Drag the file into the CertView viewer: it detects PEM, DER and PFX automatically and shows the contents before you deploy anything.
PEM vs DER vs CRT vs PFX：证书文件格式详解
证书文件扩展名总是让人困惑，因为它们同时描述了两件不同的事：数据的编码（PEM 或 DER），以及它所在的容器（单张证书、一条链，还是带私钥的加密包）。把这两个问题分开看，每种格式就都说得通了。
两种编码
| 编码 | 它长什么样 | 说明 |
|---|---|---|
| PEM | 文本。以 -----BEGIN CERTIFICATE----- 开头，里面是 base64。 | 在 Linux、服务器和设备上最常见。一个文件里可以包含多张证书（一条链）。易于查看和粘贴。 |
| DER | 二进制——和 PEM 是同一份数据，只是原始字节，没有 base64，在文本编辑器里打不开。 | 在 Windows 和嵌入式设备上常见。通常一个文件一张证书。 |
常见扩展名
| 扩展名 | 通常是什么 | 包含私钥吗？ |
|---|---|---|
| .crt / .cer | 单张证书——在 Linux 上是 PEM，在 Windows 上通常是 DER。只看扩展名判断不了；要看文件的开头几个字节。 | 否 |
| .pem | PEM 编码；根据 BEGIN 行的不同，可以包含一张证书、一条链、一把私钥，或者全部。 | 有时会 |
| .key | 私钥，通常是 PEM 格式。 | 是——它就是私钥 |
| .pfx / .p12 | 一个 PKCS#12 证书包：证书加私钥，受密码保护。 | 是，在包内 |
| .p7b / .p7c | PKCS#7 容器，通常是一条证书链，不带私钥。 | 否 |
用 OpenSSL 在各种格式之间转换
# PEM -> DER
openssl x509 -in certificate.pem -outform DER -out certificate.der
# DER -> PEM
openssl x509 -in certificate.der -inform DER -out certificate.pem
# extract certificate and key from a PFX bundle
openssl pkcs12 -in bundle.pfx -clcerts -nokeys -out certificate.crt
openssl pkcs12 -in bundle.pfx -nocerts -nodes -out private.key
# build a PFX bundle from certificate + key + CA
openssl pkcs12 -export -out bundle.pfx -inkey private.key -in certificate.crt -certfile ca.crt你的设备想要哪种格式？
- 许多医疗、工业和嵌入式设备要求以三个独立的 PEM 文件提供 CA 证书、客户端证书和私钥。
- Windows 服务器和 IIS 更喜欢单个 .pfx。
- Nginx 要 PEM（证书加链在一个文件里，私钥单独一个文件）；Apache 也一样。
- 如果设备以格式错误为由拒绝一个文件，先确认它到底是 PEM 还是 DER——改扩展名并不能转换任何东西。
不确定你手里的是什么？把文件拖进 CertView 查看器：它会自动识别 PEM、DER 和 PFX，并在你部署任何东西之前把内容展示出来。
立即试用：打开 CertView 证书查看器，把证书文件拖进去，文中讲的每个字段都会立刻解码出来——全程在你的浏览器里完成，不上传任何东西。Try it now: open the CertView certificate viewer, drag your certificate file in, and every field in this guide is decoded instantly — in your browser, with nothing uploaded.