Certificate File Formats
We’ve covered details of what’s in a certificate, and how it’s used. However, there is one topic that is somewhat hidden but very often causes trouble if the implementer doesn’t understand about it, and that’s what kind of file formats are used to transfer and manage certificates on devices. Different runtimes and operating systems use different formats, and, like XKCD 927 implies, there are multiple “standards” related to those formats. This document talks about some of the most common formats a certificate-consuming developer or administrator is likely to encounter.
Encodings
Before getting into specific file formats, some notes about encodings would be good, to avoid repetition later.
An encoding defines the file format for how the certificate data is stored in the certifcate file. In other words, it defines how the certificate data is translated into bytes that will be stored in the file.
There are three encodings generally seen in the field — DER encoding, Base64 encoding, and PFX/PKCS#12 encoding. Two of these are cross-format, while the last, PFX/PKCS#12, is only used in that specific file type, and thus is described later for that extension specifically.
DER encoding
DER (Distinguished Encoding Rules) encoding is a relatively complex file format that is derived from the ASN.1 standard. The details of the formatting are outside of the scope of this documentation; the key point to understand is that this is a binary format, which means it can be more complicated to manage in some cases.
Base64 encoding
Base64 encoding is a general encoding format that converts binary into ASCII format. Although there have been some variants of this, the standard way to do this is defined in RFC 4648.
The important takeaway for Base64 is that because it’s an ASCII format, it’s very easy to transfer, including if appropriate in source code text strings or files stored side-by-side as source files in source code control. (Note that you should never store private keys in source code control!)
PFX/P12 files
A PFX (or PKCS#12 — the formal name for the format) is a binary format that supports holding both a private and a public key, with an optional password protecting the private key.
It also supports holding an entire certificate chain, up to an including a root CA public key, which means that a server using or importing a PFX file can present the entire chain for validation by a client. As described in the X.509 content, a full chain to a trusted root is required to perform proper validation.
Technically, PFX is not exactly the same as PKCS#12, but in common practice, it’s not unusual to see the terms used interchangably, although “PFX” is much more commonly used as the format name.
This file format is the typical file format used in Microsoft Windows and in Azure.
A PVK file is a Microsoft-proprietary format for binary storage of a private key exclusively. In practice, this is often a temporary format that is then used after a CA issues a certificate tied to the public half of the key pair; the public and private key are then combined into a PFX for future management and distribution. There’s documentation on this at Microsoft Learn in a few different pages.
These commmonly are seen for code-signing in Microsoft environments.
An SPC file (Software Publisher Certificate) is a DER-encoded file that stores one or more certificates and keys; often this is seen as the public-key companion to a PVK file, where the combination of a PVK and an SPC act as one or more certificates. Some CAs issue certificates for use cases such as code-signing through a pairing of SPC and PVK , although that’s not as commonnly seen nowadays.
PEM (CRT, CER)
A PEM file is a Base64-encoded that acts as a container for one or more base64-encoded certificates and keys. This format is very common; for example, it’s used by nginx, Because the format is essentially just a text file format that stores one or more base64-encoded objects, it’s very flexible; it can store just a public leaf key, or a certificate chain, or just a private key, or some combination of the above.
These are sometimes seen with the CRT extension (e.g. OpenSSL commonly uses that extension) or the CER extension (e.g. on Windows; note that Windows CER files may also be in the DER format).
One other common use case for PEM files is SSH — SSH tools generally store their public and private keys in seperate PEM files. For example, the
/.ssh/id_rsa file is a PEM file that represents an SSH private key, while the
/.ssh/id_rsa.pub represents an SSH public key.
P7B (PKCS#7)
P7B files (or PKCS#7 files) are Base64-encoded files that store only public key chains, without private keys. They are seen in both Microsoft Windows and Java environments.
Converting between formats
There are multiple tools that can convert between different file formats, but the one most commonly seen is the open source openssl tool. Examples of hwo to do this are available online at multiple sources, including:
Нужно ли мне конвертировать .CER в .CRT для сертификатов SSL Apache? Если да, то как?
У меня есть файл * .key, но вся документация, которую я нашел в Интернете, указаны файлы * .crt, а мой центр сертификации предоставил мне только файл * .cer.
Файлы * .cer — это то же самое, что * .crt? Если нет, как я могу преобразовать CER в формат CRT?
Расширения файлов для криптографических сертификатов на самом деле не так стандартизированы, как можно было бы ожидать. Windows по умолчанию обрабатывает двойной щелчок по .crt файлу как запрос на импорт сертификата в хранилище корневых сертификатов Windows, но обрабатывает .cer файл как запрос только на просмотр сертификата. Итак, они разные в том смысле, что Windows имеет различное значение для того, что происходит, когда вы дважды щелкаете каждый тип файла.
Но то, как Windows обрабатывает их, когда вы дважды щелкаете по ним, — это почти единственная разница между ними. Оба расширения просто представляют, что они содержат публичный сертификат. Вы можете переименовать файл сертификата, чтобы использовать одно расширение вместо другого в любой системе или файле конфигурации, который я видел. А на платформах, отличных от Windows (и даже в Windows), люди не особо заботятся о том, какое расширение они используют, и рассматривают их как взаимозаменяемые, поскольку между ними нет разницы, если содержимое файла правильное.
Еще больше сбивает с толку то, что существует два стандартных способа хранения данных сертификата в файле: один — «двоичная» кодировка X.509, а другой — «текстовая» кодировка base64, которая обычно начинается с « ——BEGIN CERTIFICATE—— ». Они кодируют одни и те же данные, но по-разному. Большинство систем принимают оба формата, но при необходимости вы можете преобразовать один в другой с помощью openssl или других инструментов. Кодировка в файле сертификата действительно не зависит от того, какое расширение кто-то дал файлу.
CER vs CRT: The Technical Difference & How to Convert Them
Feeling confused about the differences between CER and CRT files? We can help
CER, CRT, DER, PEM, P7B, P7S, PFX, and P12. Do you feel like pulling your hair when you see so many SSL/TLS certificate formats and extensions? Well, you’re not the only one. In our experience, a person dealing with SSL certificates passes through this stage at least once in their life. So, don’t worry as many have been there (and many are yet to arrive). In the meantime, we want to help by making this phase as short as possible for you.
And that’s why we’ve come up with this article — to help you clear up any confusion regarding CER vs CRT files.
CER vs CRT: What Is the Difference?
Fundamentally, there is no difference between CER and CRT… and yet there is a difference between the two. No, we’re not trying to refer to Schrödinger’s cat here, so relax. What we mean is that both are the same SSL certificate format — that is Base64 (ASCII) format — they both are different filename extensions. This is important because a server might require your certificate filename extension to be in either of the two extensions.
Feeling even more confused? Yeah, we thought so. Essentially, these extensions are used for certificates, and they’re encoded in binary DER or as ASCII PEM formats. CER & CRT extensions are most commonly used by the Unix family of operating systems.
X.509 Certificate Filename Extensions
Technically, all SSL certificates are regarded as types of X.509 certificates. These digital certificates have different filename extensions and formats. Here’s a brief overview of several common filename extensions:
- .pem — This is a (Privacy-enhanced Electronic Mail) Base64 encoded DER certificate, enclosed between “—–BEGIN CERTIFICATE—–” and “—–END CERTIFICATE—–“
- .cer, .crt, and .der — Although usually in binary DER form, Base64-encoded certificates are also common (see .pem above).
- .p7b and .p7c — PKCS#7 SignedData structure without data, just certificate(s) or CRL(s).
- .p12 — PKCS#12 files may contain certificate(s) (public) and private keys (password protected).
- .pfx — PFX is the predecessor of PKCS#12. This type of file usually contains data in PKCS#12 format (e.g., with PFX files generated in IIS).
Different Servers Require Different Formats & Extensions
As you likely know, there are tons of servers out there. And the (bad) thing about them is that they accept certificate files that are encoded and formatted in a certain manner. So, if you want to install an SSL certificate on your server, you must be aware of the format and extension requirements of your specific server. The good news? Some servers accept multiple certificate file formats.
If they don’t, though, you may find yourself needing to convert a certificate to a different file type. Lucky for you, we know how to do that.
How to Convert Files from CRT to CER
Because CER and CRT files are basically synonymous, they can be used interchangeably by simply changing the extension. So, in case your server requires you to use the .CER file extension, you can convert to .CRT extension easily by implementing the following steps:
- Double-click on the yourwebsite.crt file to open it into the certificate display.
- Click on the Details tab, and then select the Copy to file button.
- Click Next in the certificate wizard.
- Choose Base-64 encoded X.509 (.CER), and then click on Next.
- Now, browse to store your file and type in the filename that you want to keep
- Finally, save the file.
Congratulations! You’ve successfully converted your certificate from CRT to CER.
Save Up to 75% On
Comodo SSL Certificates
Tip : You can typically save a significant amount by buying your SSL certificate direct instead of through your web hosting company. We sell all Comodo SSL certificates at up to 75% off.
What is the difference between .CER and .CRT? [closed]
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 3 years ago .
Is there a difference between .cer and .crt. I know they both are same SSL certificate format, but don’t know what is the difference between them.
If there no difference, why 2 different extensions?
2 Answers 2
Extensions are useless, as are filenames. They DO NOT count. Only the content counts. The software does not care how you call your filenames, holding certificates and private keys, it could be foobar.42 and would work as well (as long as the content is correct).
The names are only to aid the humans to more easily know what it is about. It is customary for example to use the site name as filename to clearly identify it, and then use «some» extension, on one side for a certificate ( .cert or .crt or .cer ) and a private key ( .key ). You also have certificate signing requests (something you generate before getting the certificate), which are often .csr .
You may find .pem sometimes also, which is ambiguous: PEM is a format to encode a content, you can encode a certificate or a key, so just by .pem you do not know what it is about where .crt vs .key at least make the difference clear.
Now, .cert would probably be the most obvious choice. but since we inherit from some past arbitrary limits of some past OS, we often prefer 3 letters for extensions, at most, so pick your poison between shortening .cert either to .cer or .crt (the latter seems to me more often found). Also for the same silly past arbitrary decisions, some OS attaches specific actions on specific files based on their name. Your OS may treat the same file differently if it ends in .crt vs ending in .cer . But this is all configuration and local preferences, again only the content really matters.
In a good world, where everyone can be trusted, we might not need encryption, identification, certificates and such. But such world does not exist unfortunately, bad guys are everywhere, and thus came along the need for encryption, and symmetric keys were born. 1 key that is the same for both the client and the server to encrypt & decrypt the data is all that is needed. The process is fast, as the key is usually 256 bits in length only. All good.
One concern though is, how do we distribute the key securely?
Born was the public key infrastructure system, PKI or PKIX(X for X.509), where the public key is distributed to encrypt, and the private key,(not distributed, therefore secure), to decrypt. These are called asymmetric keys, which are usually at least 2048 bits, more robust, but you guess well, slower.
Then we needed a standard to construct those keys, X.500 came along, and evolved into X.509 v3 which is encoded in either .DER(binary) or .PEM(which is just a base-64 encoding of the DER, enclosed between "——BEGIN CERTIFICATE——" and "——END CERTIFICATE——). So, sometimes, you might see .DER, sometimes .PEM certificates.
Together with .DER and .PEM, we also have other related certificates formats such as .CER and .CRT.
The difference, a good explanation taken from here:
.CRT = The CRT extension is used for certificates. The certificates may be encoded as binary DER or as ASCII PEM. The CER and CRT extensions are nearly synonymous. Most common among *nix systems
CER = alternate form of .crt (Microsoft Convention) You can use MS to convert .crt to .cer (.both DER encoded .cer, or base64[PEM] encoded .cer) The .cer file extension is also recognized by IE as a command to run a MS cryptoAPI command
Hopefully, the above has given you a background and some idea of the oh-so-many certificate extensions lying around and which can be quite confusing at times, especially for the new comer.