Certificate formats · 19.2
Containers: PEM, CRT, CER, PFX and P7B
The file extension describes the container, not always the encoding. A file with the extension .crt or .cer can contain PEM text or DER bytes. Open it in a text editor: if it starts with -----BEGIN, it is PEM.
| Container | Extensions | Content | TLSPilot |
|---|---|---|---|
| PEM | .pem | Certificate, chain and/or private key as PEM blocks. | Writes it |
| CRT / CER | .crt, .cer | Certificate, sometimes with the chain, never a key. .crt is usually PEM; .cer from Windows is often DER. | Writes .crt in PEM |
| KEY | .key | Private key, usually PEM. | Writes it in PEM |
| PFX / P12 (PKCS #12) | .pfx, .p12 | Certificate, private key and optionally the chain in one binary file, protected by a password. Windows imports a PFX into a certificate store; Java uses it as a keystore. | Writes .pfx |
| P7B (PKCS #7) | .p7b, .p7c | Certificates and chain only, never a private key. | Does not write it |
A PFX always contains the private key. The password protects the whole file, including the key. Whoever has the PFX and the password has the key, so treat both like a secret and send them on separate channels. With the format Encrypted PEM, the password protects the private key only; the certificate stays readable.