====== Certificates - Key File Types ======


In summary, there are four different ways to present certificates and their components:

  * **PEM** - Governed by RFCs, its used preferentially by open-source software.  It can have a variety of extensions (.pem, .key, .cer, .cert, more).
  * **PKCS7** - An open standard used by Java and supported by Windows.  Does not contain private key material.
  * **PKCS12** - A Microsoft private standard that was later defined in an RFC that provides enhanced security versus the plain-text PEM format.  This can contain private key material.  Its used preferentially by Windows systems, and can be freely converted to PEM format through use of openssl.
  * **DER** - The parent format of PEM.  It's useful to think of it as a binary version of the base64-encoded PEM file.  Not routinely used very much outside of Windows.


<WRAP info>
**NOTE:**  A general rule of thumb is:

  * If looks like base64 encoding, it's probably **PEM**-encoded.
  * If it looks like a binary file, it's probably **DER**-encoded.
</WRAP>


----

===== .csr =====

Certificate Signing Request.

Some applications can generate these for submission to certificate-authorities.

The actual format is PKCS10 which is defined in [[https://tools.ietf.org/html/rfc2986|RFC 2986]].

It includes some/all of the key details of the requested certificate such as subject, organization, state, whatnot, as well as the public key of the certificate to get signed.

These get signed by the CA and a certificate is returned.

The returned certificate is the public certificate (which includes the public key but not the private key), which itself can be in a couple of formats.

----


===== .pem =====

The name is from [[https://en.wikipedia.org/wiki/Privacy-enhanced_Electronic_Mail|Privacy Enhanced Mail (PEM)]], a failed method for secure email but the container format it used lives on, and is a base64 translation of the x509 ASN.1 keys.

Defined in [[https://tools.ietf.org/html/rfc1421|RFCs 1421]] through [[https://tools.ietf.org/html/rfc1424|1424]].

This is a container format that may include just the public certificate (such as with Apache installs, and CA certificate files ///etc/ssl/certs//), or may include an entire certificate chain including public key, private key, and root certificates.

Confusingly, it may also encode a CSR (e.g. as used [[https://jamielinux.com/docs/openssl-certificate-authority/create-the-intermediate-pair.html|here]]) as the PKCS10 format can be translated into PEM.

<WRAP info>
**NOTE:**  PEM files can actually include multiple certificates (up to or maybe more than 4 certificates).

This can actually be required for OpenSSL to verify the full chain of authority.

Example:

<file>
 -----BEGIN CERTIFICATE-----
(Your Primary SSL certificate: your_domain_name.crt)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Your Intermediate certificate: CertCA.crt)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Your Root certificate: TrustedRoot.crt)
-----END CERTIFICATE----- 
</file>
</WRAP>


----

===== .key =====

This is a PEM formatted file containing just the private-key of a specific certificate and is merely a conventional name and not a standardized one.

In Apache installs, this frequently resides in ///etc/ssl/private//.

The rights on these files are very important, and some programs will refuse to load these certificates if they are set wrong.

----


===== .pkcs12 .pfx .p12 =====

Originally defined by RSA in the [[https://en.wikipedia.org/wiki/PKCS|Public-Key Cryptography Standards]] (abbreviated PKCS), the "12" variant was originally enhanced by Microsoft, and later submitted as [[https://tools.ietf.org/html/rfc7292|RFC 7292]].

This is a passworded container format that contains both public and private certificate pairs.

Unlike **.pem** files, this container is fully encrypted.

To convert a PKCS#12 file (.pfx .p12) containing a private key and public key (certificates) to PEM: 

<code bash>
openssl pkcs12 -in keyStore.pfx -out keyStore.pem -nodes
</code>

or

<code bash>
openssl pkcs12 -in file-to-convert.p12 -out converted-file.pem -nodes
</code>

To convert a PEM certificate file and a private key to PKCS#12 (.pfx .p12):

<code bash>
openssl pkcs12 -export -out cert.pfx -inkey privateKey.key -in cert.crt -certfile CACert.crt
</code>

----

===== .der =====

A way to encode ASN.1 syntax in binary, a **.pem** file is just a Base64 encoded **.der** file.

Windows sees these as Certificate files.

By default, Windows will export certificates as .DER formatted files with a different extension. Like...

To convert a DER file (.crt .cer .der) to PEM:

<code bash>
openssl x509 -inform der -in cert.cer -out cert.pem
</code>

To convert a PEM file to DER:

<code bash>
openssl x509 -outform der -in cert.pem -out cert.der
</code>

----

===== .cert .cer .crt =====

A **.pem** (or rarely **.der**) formatted file with a different extension, one that is recognized by Windows Explorer as a certificate, which **.pem** is not.


<WRAP important>

**WARNING:**  Sometimes a **.crt** file is already a **.pem**.

Your keys may already be in PEM format, but just named with **.crt** or **.key**.

If the file's content begins with **-----BEGIN** and you can read it in a text editor:

  * The file uses base64, which is readable in ASCII, not binary format.
  * The certificate is already in PEM format.
  * Just change the extension to **.pem**.
</WRAP>


----

===== .p7b .keystore =====

Defined in [[https://tools.ietf.org/html/rfc2315|RFC 2315]] as PKCS number 7, this is a format used by Windows for certificate interchange.

Java understands these natively, and often uses **.keystore** as an extension instead.

Unlike **.pem** style certificates, this format has a defined way to include certification-path certificates.

----

===== .crl =====

A certificate revocation list.

Certificate Authorities produce these as a way to de-authorize certificates before expiration.

You can sometimes download them from CA websites.

----