PEM vs DER: SSL Certificate File Formats Explained

PEM and DER are the two main certificate file formats. Learn the difference, when to use each, and how to convert between them.

When working with SSL certificates, you'll encounter two primary encoding formats: PEM and DER. They represent the same X.509 data — just encoded differently.

DER: The Base Format

DER (Distinguished Encoding Rules) is a binary encoding of the ASN.1 data structure that defines an X.509 certificate. It's compact and machine-readable but not human-friendly — open a DER file in a text editor and you'll see garbage characters.

DER files typically use the .cer or .der extension. They're common in Java environments and Windows systems.

PEM: Base64-Wrapped DER

PEM (Privacy Enhanced Mail) is simply DER encoded in Base64 with a header and footer:

-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIJAJC1HiIAZAiIMA0GCSqGSIb3DQEBCwUAMEUxCzAJ...
-----END CERTIFICATE-----

PEM is text-based, which makes it easy to copy-paste, email, and store in configuration files. It's the dominant format on Linux/Unix systems and is what the SSL Certificate Decoder accepts as input.

Other Related Formats

  • PKCS#7 / P7B — can contain a certificate chain but no private key. Used in Windows and Java.
  • PKCS#12 / PFX — bundles certificate, chain, and private key in one encrypted file. Common for exporting from Windows IIS.
  • CRT / CER — file extensions that might be either DER or PEM depending on context. Always check the content.

Converting Between Formats

OpenSSL makes conversion straightforward:

# DER to PEM
openssl x509 -in cert.der -inform DER -out cert.pem -outform PEM

# PEM to DER
openssl x509 -in cert.pem -out cert.der -outform DER

Which Format Does the Decoder Use?

Our SSL Certificate Decoder accepts PEM format — the text format with the -----BEGIN CERTIFICATE----- header. If you have a DER file, convert it to PEM first using the OpenSSL command above.

Decode any SSL certificate instantly

Paste any PEM certificate into the free decoder — see subject, issuer, SANs, fingerprints, validity dates, and all X.509 extensions explained in plain English.

Open the Decoder
All articles