Skip to content

Certificate formats · 19.1

Encoding: DER and PEM

A certificate is a data structure according to X.509. It can be stored in two encodings:

  • DER (Distinguished Encoding Rules): the binary form of the certificate. A DER file cannot be read in a text editor and always contains exactly one object, for example one certificate.
  • PEM (Privacy-Enhanced Mail): the DER bytes in Base64, between a header line and a footer line. A PEM file is plain text and can hold several blocks one after the other, for example a certificate with its chain, or a certificate followed by its private key.
-----BEGIN CERTIFICATE-----
MIIFBjCCA+6gAwIBAgISBN3e…
…
-----END CERTIFICATE-----

The header line names the content. TLSPilot writes certificates and keys in PEM, or packed into a PFX file. It does not write DER files. The PEM blocks you meet in TLSPilot:

PEM blocks and the matching TLSPilot formats
Header lineContentIn TLSPilot
BEGIN CERTIFICATEOne certificate. Several blocks one after the other form a chain.All PEM formats
BEGIN PRIVATE KEYPrivate key according to PKCS #8, unencrypted. Works for RSA and ECDSA keys.PKCS #8 (PEM)
BEGIN RSA PRIVATE KEYPrivate key according to PKCS #1, unencrypted. RSA keys only.PKCS #1 (PEM RSA)
BEGIN ENCRYPTED PRIVATE KEYPrivate key according to PKCS #8, encrypted with a password (AES-256-CBC, key derivation with SHA-256 and 100,000 iterations).Encrypted PEM