So apps linked against openssl uses PEM, and Windows generally uses PKCS12, but I haven't seem much .DER in the wild - what server software uses DER?
Can't think of any.
I don't remember any software that expects DER and rejects PEM. They usually accepted both.
Windows treats DER with a little preference. The "Export Certificate" wizard defaults to DER.
Other than that, little distinction is made by Windows. DER and single-pubkey-PEM both share the file name extensions
Windows treats multi-component PEM-bundles files very ungracefully. It only displays the first object in a PEM-bundle and give no indication whatsoever that there is more inside. Very misleading. (So if you want to bundle these crypto objects, you really do have to use PKCS#12/
.PFX, like you said.)
Here's a little snippet regarding file name extensions. This is from my Win10 PC:
C:\>assoc .der .der=CERFile C:\>ftype CERFile CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1 C:\>assoc | findstr /I cerfile .cer=CERFile .crt=CERFile .der=CERFile
I think this means that Windows doesn't really care what file name extension you use here. I think you can freely mix and match from those three, regardless of actual contents. (It doesn't notify you if a
.DER file actually has PEM contents. I just checked.)
Sidenote: More Windows crypto file name extensions
cryptex.dll also opens other crypto files:
C:\>ftype | findstr /I cryptext CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1 CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1 CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1 CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1 P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1 P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1 PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1 SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
And these filetypes correspond to this list of extensions:
C:\>assoc | sort | findstr /I "catfile cerfile certificatestorefile crlfile p7rfile p7sfile pfxfile spcfile" .cat=CATFile .cer=CERFile .crl=CRLFile .crt=CERFile .der=CERFile .p12=PFXFile .p7b=SPCFile .p7r=P7RFile .p7s=P7SFile .pfx=PFXFile .spc=SPCFile .sst=CertificateStoreFile .wbcat=wbcatfile
By default, OpenSSL files are created in Privacy Enhanced Mail (PEM) format. SSL files that are created in Windows operating environments are created in Distinguished Encoding Rules (DER) format. Under Windows, you can import a file that is created in either PEM or DER format. However, a digital certificate that is created in DER format must be converted to PEM format before it can be included in a trust list under UNIX.
Here is an example of converting a server digital certificate from PEM input format to DER output format:
OpenSSL> x509 -inform PEM -outform DER -in server.pem -out server.der
Here is an example of converting a server digital certificate from DER input format to PEM output format :
OpenSSL> x509 -inform DER -outform PEM -in server.der -out server.pem