Certificate File Formats
PEM and DER: Two Encodings
PEM vs CRT is less a real choice than a naming mix-up. PEM is an encoding for certificate data, while CRT is a file extension that can hold either PEM or DER data. Many PEM files are named with a .crt or .pem extension, which causes the confusion.
A PEM file is text. The certificate's binary data is written in Base64 characters between lines such as BEGIN CERTIFICATE and END CERTIFICATE, so you can open it in a text editor. DER is the same data in raw binary form. It is compact and unreadable as text, and tools must parse its structure to display it.
Containers: PFX, P12 and P7B
Some formats bundle several items into one file. PKCS #12 files, usually with the extensions .pfx or .p12, can hold a private key, a certificate and its intermediate certificates in one password-protected container. They are common on Windows systems and in software that imports keys and certificates together.
PKCS #7 files, often with a .p7b extension, carry certificates and chains but no private key. They are typically used to deliver a chain from an authority or to import trust, and they are rarely loaded directly by a web server.
Keys, Bundles and Chains
A private key is usually stored in its own PEM file, often with a .key extension. It must stay secret and is kept separate from the certificate. The role of the key is explained in public and private keys. Many web servers read the certificate and key as two files, while other platforms expect them combined in a container.
A bundle or chain file holds the server certificate followed by intermediate certificates. Browsers need this path to reach a trusted root, as explained in the certificate chain of trust. Files named fullchain or bundle usually contain this combined content.
Example: Repackaging a Certificate for Windows
A team receives a certificate from its provider as a .crt file and a separate .key file, but its Windows server expects a single PFX file. The certificate and key are correct; only the container differs. The team combines them into a password-protected PKCS #12 file for the import tool. The certificate has not changed, so nothing needs to be reissued.
Frequently asked questions
Is a .crt file always PEM?
No. The .crt extension is used for both PEM and DER certificates. Opening the file in a text editor shows which it is: text with BEGIN CERTIFICATE lines means PEM, while binary content means DER. The encoding matters more than the extension.
Which format does my server need?
It depends on the software and platform. Many Linux web servers expect PEM files, Windows systems often use PFX, and some applications require their own keystore. The documentation for the software you run settles the question, because the file extension alone rarely does.