PEM (Privacy-Enhanced Mail)

What a PEM file looks like

-----BEGIN CERTIFICATE-----
MIIC...several lines of Base64...
-----END CERTIFICATE-----

Between the markers is the binary DER encoding of the object, converted to standard Base64 and wrapped into lines of 64 characters. The marker names what is inside. PEM was originally designed for encrypted email, and the name stuck long after that use faded.

Common labels

Label	Contents
CERTIFICATE	An X.509 certificate
CERTIFICATE REQUEST	A certificate signing request (CSR)
PUBLIC KEY	A public key
PRIVATE KEY	An unencrypted private key (PKCS#8)
ENCRYPTED PRIVATE KEY	A password-protected PKCS#8 private key
RSA PRIVATE KEY	An older RSA-specific private key format (PKCS#1)
EC PRIVATE KEY	An older elliptic-curve private key format

A file can hold several blocks back to back. A “chain” or “bundle” file is simply a leaf certificate followed by its intermediates, and sometimes a private key too.

PEM versus DER

DER is the raw binary form and PEM is its text wrapper. The two are interchangeable, and OpenSSL converts between them:

openssl x509 -in cert.der -inform DER -out cert.pem
openssl x509 -in cert.pem -outform DER -out cert.der

File extensions such as .pem, .crt, .cer and .key are conventions only. What matters is what is between the markers, and whether the file is text (PEM) or binary (DER).

Common pitfalls

• A private key hiding in a bundle. Files named fullchain.pem or bundle.pem sometimes include the key. Check for PRIVATE KEY before sharing or pasting one anywhere.
• Mangled line endings or wrapping. Windows line endings and hard-wrapped email text can break strict parsers, and a missing final newline causes trouble with some tools.
• Confusing the key labels. BEGIN PRIVATE KEY and BEGIN RSA PRIVATE KEY are different structures, and some software accepts only one.
• Stray text around the block. Most parsers ignore text before the BEGIN line, which is why output from openssl x509 -text still contains a usable certificate.