DER vs PEM Certificate Formats
Understand the differences between DER and PEM certificate encoding formats. Learn when to use each format, how to convert between them, and which platforms prefer which encoding.
Detailed Explanation
DER and PEM: Two Encodings, Same Data
SSL/TLS certificates are encoded using ASN.1 (Abstract Syntax Notation One) data structures. The two most common ways to serialize this data are DER (Distinguished Encoding Rules) and PEM (Privacy-Enhanced Mail).
DER Format
DER is a binary encoding format. A DER file contains the raw bytes of the ASN.1 structure with no text encoding or headers. DER files are not human-readable — opening one in a text editor shows binary gibberish.
# DER files are binary — cannot be displayed as text
# Common extensions: .der, .cer (on Windows)
Characteristics of DER:
- Binary format — smaller file size than PEM
- Single certificate — a DER file contains exactly one certificate
- No headers — no
BEGIN/END CERTIFICATEmarkers - Used by — Java keystores (
.jks), Windows certificate stores, some embedded systems
PEM Format
PEM is a text encoding that wraps the DER binary data in Base64 and adds header/footer lines:
-----BEGIN CERTIFICATE-----
MIIFjTCCA3WgAwIBAgIRANOxciY0IzLc9AUoUSrsnGo...
-----END CERTIFICATE-----
Characteristics of PEM:
- Text-based — can be copy/pasted, emailed, embedded in configs
- Multiple objects — a single PEM file can contain certificates, private keys, and chains
- Used by — Apache, Nginx, most Linux/Unix tools, OpenSSL, Let's Encrypt
Converting Between Formats
# PEM to DER
openssl x509 -in cert.pem -outform DER -out cert.der
# DER to PEM
openssl x509 -in cert.der -inform DER -outform PEM -out cert.pem
How to Identify the Format
Open the file in a text editor. If you see -----BEGIN CERTIFICATE-----, it is PEM. If you see binary content (non-printable characters), it is DER. You can also check programmatically:
file cert.pem # Output: PEM certificate
file cert.der # Output: data (binary)
Which Format Should You Use?
| Platform | Preferred Format |
|---|---|
| Apache / Nginx | PEM |
| IIS / Windows | DER or PFX/PKCS#12 |
| Java (keytool) | DER (imported into JKS) |
| AWS / GCP / Azure | PEM |
| Kubernetes | PEM |
Most modern tooling prefers PEM because it is text-safe and can bundle multiple certificates. DER is used in environments that need compact binary representation or where platform tooling requires it.
Use Case
Choose the right certificate format when configuring SSL on different platforms — PEM for Linux servers, Nginx, and cloud providers, or DER for Java applications and Windows environments.