PEM vs DER Certificate Format

PEM vs DER Certificate Format: Which One Do You Have?

PEM and DER are the two encoding formats for X.509 certificates, and the wrong format in the wrong context causes parsing errors that are easy to misdiagnose. DER (Distinguished Encoding Rules) is the binary encoding defined by ASN.1 standards for X.509 structures¹. PEM (Privacy Enhanced Mail) is a Base64-encoded representation of DER data wrapped in header and footer lines, making binary certificate data safe to embed in text files, copy-paste into terminals, and transmit over text-based protocols. The CapyToolkit Certificate Inspector accepts both formats: paste PEM text directly into the textarea, or drop a .der file onto the dropzone for automatic binary parsing. Knowing which format your tools and servers expect prevents time lost diagnosing encoding errors that appear as cryptic parsing failures.

DER: the canonical binary encoding

DER is the definitive encoding for X.509 certificates. Every certificate, regardless of how it is stored or transmitted, ultimately represents a DER-encoded ASN.1 structure defined in RFC 5280. DER files use the extension .der or sometimes .cer on Windows systems. The binary format is compact but not human-readable and cannot be pasted directly into a terminal or text configuration file. OpenSSL, Java keystores, and Windows certificate tools all consume DER natively, which is why DER remains the canonical encoding even though PEM is more convenient for manual editing.

When DER is the required format

Tools that consume DER directly expect a binary stream; passing a PEM file to them produces an immediate parsing error. Java keystores, Windows certificate import dialogs, and some hardware security module APIs work natively with DER. Using OpenSSL's -inform DER flag switches its parser to binary mode: openssl x509 -in certificate.der -inform DER -text -noout prints the certificate fields from a binary DER file¹. The CapyToolkit Certificate Inspector detects DER files automatically by inspecting the first bytes for ASN.1 structure markers, so you can drop a .der file onto the dropzone without manually selecting the format. When you are unsure whether a file is DER or PEM, inspecting the first byte tells you everything: DER files start with the ASN.1 SEQUENCE tag byte 0x30, while PEM files start with the hyphen character from the header line.

PEM: the text-safe encoding for configuration files

PEM encodes DER binary data as Base64 and wraps it in header and footer lines that identify the content type. A certificate PEM block begins with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----². The Base64 data between these lines is the DER-encoded certificate. PEM's text-safe encoding makes it the standard format for nginx, Apache, Let's Encrypt, and most Unix-based TLS tooling. Because PEM is safe to paste into a configuration value, it is the format most documentation and deployment tools assume you are working with.

Why PEM dominates configuration files and pipelines

Furthermore, PEM files can contain multiple blocks: a full certificate chain is typically stored as a single PEM file containing the leaf certificate block followed by each intermediate certificate block in order. Pasting this multi-block PEM into the Certificate Inspector parses each block separately and displays the full chain ordered leaf-first. The header text is how the inspector identifies the format; no headers means DER or raw Base64, which the inspector also handles automatically.

A useful pattern is to keep one canonical PEM file per endpoint that contains the full chain in leaf-first order. That single file works for nginx, Apache, and most ACME tooling, and you can split or convert it only when a downstream system demands DER. The CapyToolkit Certificate Inspector parses multi-block PEM directly, so pasting that file shows the entire chain without you having to separate the blocks yourself.

Converting between PEM and DER with OpenSSL

Converting between PEM and DER is a one-command operation with OpenSSL, and knowing these two commands eliminates the guesswork when a tool rejects a certificate for the wrong format. To convert from PEM to DER: openssl x509 -in certificate.pem -outform DER -out certificate.der. To convert from DER to PEM: openssl x509 -in certificate.der -inform DER -outform PEM -out certificate.pem³.

When automatic conversion saves a troubleshooting session

The Certificate Inspector handles both directions automatically, so you can open a DER certificate without converting it: drop a .der file and the inspector decodes the binary, converts it internally to a parsed structure, and displays all fields. This is particularly useful when you receive a certificate in DER format from a system that cannot export PEM, or when you need to inspect a certificate extracted in binary form from a Java keystore or Windows certificate store. Conversely, some systems accept only PEM, and you can copy the PEM output from the conversion command directly into a configuration file.

When to use this

Use this guide when you receive a certificate file and are unsure of its format, when a configuration tool reports a parsing error on your certificate file, or when you need to convert between formats for a specific system that requires one encoding over the other. It also applies when you extract a certificate from a Windows system or Java keystore, since both commonly export DER binary files with .cer or .der extensions that Unix-based tools expect in PEM format. Furthermore, use this guide when integrating certificates into automated deployment scripts: scripts that pass certificates to multiple tools in sequence often require PEM for the text-aware steps and DER for the binary-aware steps, and a clear understanding of which tool expects which format prevents cryptic parsing failures. Refer back to this guide any time you see PEM_read_bio_X509, invalid DER format, or unable to load certificate error messages in your server or application startup logs, since those errors almost always indicate a format mismatch rather than a certificate validity problem.

Examples