PEM, DER, PFX, CER, CRT, and CSR for connecting to servers

Hey All Following my recent obsession with the the certificates and private key used to communicate between server and a client I am writing this post about my understanding of what the file extension we use as a backend engineer trying to connect to various server like kafka. CER and CRT The CER file is used to store information about the owner certificate and the specific public key. These files can hold only one certificate(x509) at max and it does not have the capacity to hold the private key. The specifically secured certificate authorities are those which belong to HTTPS, a trusted and secured protocol for browsing.The CER is a certificate of your server. It is usually received by the certificate authority for the domain. CER is mostly considered the same as CRT, although both are the same format of SSL certificate but are different filename extensions. The file can be generated by the above mentioned CA or we can generate it on our own which is also called an Self Signed Certificate. The self signed certificates are only intended for local development and testing. Incase we need to use it in production out in the real world we need to have it signed by a certificate authority. Difference between CER and CRT File Extensions: The most noticeable difference is the file extensions themselves: CER and CRT. This might seem insignificant, but it can cause compatibility issues with certain software or systems. Usage and Convention: While both file types contain the same information, the CER extension is often used for security files installed in various operating systems. CRT is frequently associated with certificates that are specifically part of SSL/TLS implementations. Operating System Compatibility: Some operating systems have preferences for one format over the other. For instance, Windows systems might prefer CER files, while UNIX/Linux systems prefer CRT files. ### Converting CRT to CER and Vice Versa #### CRT to CER openssl x509 -in inputFile.crt -out outputFile.cer CER to CRT openssl x509 -inform der -in certificate.cer -out certificate.crt CSR A Certificate Signing Request(CSR) is the precursor of the certificate. It is usually generated on the same server you are planning to install your certificate on. The CSR contains information about the Common name, Organization, Country etc. which is used by the Certificate Authority to create your certificate. One a Self signed certificate we would be creating our own Certificate(CER or CRT) from the CSR. We generally used the Private Key to generate the CSR Data stored in the CSR Information about your website you’re trying to equip with SSL Common Name : The fully qualified domain name (FQDN) of your server. Organization : The legal name of your organization. Do not abbreviate and include any suffixes, such as Inc., Corp., or LLC. Organizational Unit : The division of your organization handling the certificate. City/Locality : The city where your organization is located. This shouldn’t be abbreviated. State/County/Region :The state/region where your organization is located. This shouldn't be abbreviated. Country : Two-letter country code where organization is located. Email Address : Email address used to contact your organization. The public key that will be included in the certificate. Since the SSL use Assymetric keys to encrpyt the data transmitted suring the SSL session the public key is included in the CSR The Public key is used to encrypt the message and the private key is used to decrypt it. Information about the key type and length Used to carry information about the key wether its RSA 2048 or ECC. PFX PFX is a password protected file certificate commonly used for code signing you app. It derives from the PKCS 12 Archive File format certificate. The PFX files generally holds the below contents x509 public key certificates x509 private keys Intermediate Certificate (Optional) Establish a chain of trust from the certificate to a trusted root certificate. Convert CER to PFX openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.cer -certfile CACert.cer Convert PEM to PFX openssl pkcs12 -export -out Cert.p12 -in cert.pem -inkey key.pem -passin pass:root -passout pass:root I'll be covering what an PKCS is in a separate post. PEM PEM - Privacy Enhanced Email. It is the most common forat for x509 certificates. It contains one or more formats in a Base64 ASCII encoding each with a plain text header and footer (-----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----). A single PEM file could contain an end-entity certificate, a private key, or multiple certificates forming a complete chain of trust. Most certificate files downloaded from SSL.com will be in PEM format. Convert DER to PEM openssl x509 -inform der -in certificate.cer -out certif

Apr 5, 2025 - 14:11

PEM, DER, PFX, CER, CRT, and CSR for connecting to servers

Hey All
Following my recent obsession with the the certificates and private key used to communicate between server and a client I am writing this post about my understanding of what the file extension we use as a backend engineer trying to connect to various server like kafka.

CER and CRT

The CER file is used to store information about the owner certificate and the specific public key. These files can hold only one certificate(x509) at max and it does not have the capacity to hold the private key. The specifically secured certificate authorities are those which belong to HTTPS, a trusted and secured protocol for browsing.The CER is a certificate of your server. It is usually received by the certificate authority for the domain. CER is mostly considered the same as CRT, although both are the same format of SSL certificate but are different filename extensions. The file can be generated by the above mentioned CA or we can generate it on our own which is also called an Self Signed Certificate. The self signed certificates are only intended for local development and testing. Incase we need to use it in production out in the real world we need to have it signed by a certificate authority.

Difference between CER and CRT

File Extensions: The most noticeable difference is the file extensions themselves: CER and CRT. This might seem insignificant, but it can cause compatibility issues with certain software or systems.
Usage and Convention: While both file types contain the same information, the CER extension is often used for security files installed in various operating systems. CRT is frequently associated with certificates that are specifically part of SSL/TLS implementations.
Operating System Compatibility: Some operating systems have preferences for one format over the other. For instance, Windows systems might prefer CER files, while UNIX/Linux systems prefer CRT files. ### Converting CRT to CER and Vice Versa #### CRT to CER

openssl x509 -in inputFile.crt -out outputFile.cer

CER to CRT

openssl x509 -inform der -in certificate.cer -out certificate.crt

CSR

A Certificate Signing Request(CSR) is the precursor of the certificate. It is usually generated on the same server you are planning to install your certificate on. The CSR contains information about the Common name, Organization, Country etc. which is used by the Certificate Authority to create your certificate. One a Self signed certificate we would be creating our own Certificate(CER or CRT) from the CSR. We generally used the Private Key to generate the CSR

Data stored in the CSR

Information about your website you’re trying to equip with SSL
1. Common Name : The fully qualified domain name (FQDN) of your server.
2. Organization : The legal name of your organization. Do not abbreviate and include any suffixes, such as Inc., Corp., or LLC.
3. Organizational Unit : The division of your organization handling the certificate.
4. City/Locality : The city where your organization is located. This shouldn’t be abbreviated.
5. State/County/Region :The state/region where your organization is located. This shouldn't be abbreviated.
6. Country : Two-letter country code where organization is located.
7. Email Address : Email address used to contact your organization.
The public key that will be included in the certificate.
1. Since the SSL use Assymetric keys to encrpyt the data transmitted suring the SSL session the public key is included in the CSR
2. The Public key is used to encrypt the message and the private key is used to decrypt it.
Information about the key type and length
1. Used to carry information about the key wether its RSA 2048 or ECC.

PFX

PFX is a password protected file certificate commonly used for code signing you app. It derives from the PKCS 12 Archive File format certificate. The PFX files generally holds the below contents

x509 public key certificates
x509 private keys
Intermediate Certificate (Optional) Establish a chain of trust from the certificate to a trusted root certificate.

Convert CER to PFX

openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.cer -certfile CACert.cer

Convert PEM to PFX

openssl pkcs12 -export -out Cert.p12 -in cert.pem -inkey key.pem -passin pass:root -passout pass:root

I'll be covering what an PKCS is in a separate post.

PEM

PEM - Privacy Enhanced Email. It is the most common forat for x509 certificates. It contains one or more formats in a Base64 ASCII encoding each with a plain text header and footer (-----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----). A single PEM file could contain an end-entity certificate, a private key, or multiple certificates forming a complete chain of trust. Most certificate files downloaded from SSL.com will be in PEM format.

Convert DER to PEM

openssl x509 -inform der -in certificate.cer -out certificate.pem

DER

DER (Distinguished Encoding Rules) is a binary encoding for x509 certificates and private keys. Unlike PEM, DER-encoded files do not contain plain text statements such as -----BEGIN CERTIFICATE-----. DER files are most commonly seen in Java contexts.

Convert PEM to DER and Certificates

Convert PEM to DER

openssl rsa -in  -out  -outform DER
openssl rsa -in  -inform PEM -out  -outform DER

Convert PEM to Certificate

openssl x509 -in  -out  -outform DER
openssl x509 -in  -inform PEM -out  -outform DER

PEM is a base64 encoded file with where as the DER is the binary form. Since we do not use the headers in the DER file we can distinguish between different objects and hence DER can only store one object where as a PEM has simple headers and footers which allows us to distinguish and store multiple objects