So apps linked against openssl uses PEM, and Windows generally uses PKCS12, but I haven't seem much .DER in the wild - what server software uses DER?

  • PKCS12 is actually DER (or possibly BER) always, but of a different ASN.1 type than the things where the choice is labelled DER because PEM is also used (mostly X.509 cert, sometimes CRL, sometimes PKCS#7-dummy cert/CRL clump aka 'p7b' or 'p7c', sometimes PKCS#7-real signed or enveloped data etc.) Java crypto if coded directly (CertificateFactory, KeyFactory/PKCS8EncodedKeySpec) use DER, but most Java programs just use a keystore, either JKS or PKCS#12. – dave_thompson_085 Dec 18 '15 at 14:35

Can't think of any.

I don't remember any software that expects DER and rejects PEM. They usually accepted both.

Windows treats DER with a little preference. The "Export Certificate" wizard defaults to DER.

Other than that, little distinction is made by Windows. DER and single-pubkey-PEM both share the file name extensions .CER and .CRT.

Windows treats multi-component PEM-bundles files very ungracefully. It only displays the first object in a PEM-bundle and give no indication whatsoever that there is more inside. Very misleading. (So if you want to bundle these crypto objects, you really do have to use PKCS#12/.PFX, like you said.)

Update 2015-12-18Fr
Here's a little snippet regarding file name extensions. This is from my Win10 PC:

C:\>assoc .der

C:\>ftype CERFile
CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1

C:\>assoc | findstr /I cerfile

I think this means that Windows doesn't really care what file name extension you use here. I think you can freely mix and match from those three, regardless of actual contents. (It doesn't notify you if a .DER file actually has PEM contents. I just checked.)

Sidenote: More Windows crypto file name extensions
This cryptex.dll also opens other crypto files:

C:\>ftype | findstr /I cryptext
CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1

And these filetypes correspond to this list of extensions:

C:\>assoc | sort | findstr /I "catfile cerfile certificatestorefile crlfile p7rfile p7sfile pfxfile spcfile"
  • 1
    If you want only to clump certs together you can use PKCS7-dummy, usually designated with extension p7b or p7c, which can be in PEM but is I think more common DER. If you want privatekey and cert(s), or as Microsoft prefers to view it, cert(s) with privatekey, you need PKCS12 – dave_thompson_085 Dec 18 '15 at 14:42

By default, OpenSSL files are created in Privacy Enhanced Mail (PEM) format. SSL files that are created in Windows operating environments are created in Distinguished Encoding Rules (DER) format. Under Windows, you can import a file that is created in either PEM or DER format. However, a digital certificate that is created in DER format must be converted to PEM format before it can be included in a trust list under UNIX.

Here is an example of converting a server digital certificate from PEM input format to DER output format:

OpenSSL> x509 -inform PEM -outform DER -in server.pem -out server.der

Here is an example of converting a server digital certificate from DER input format to PEM output format :

OpenSSL> x509 -inform DER -outform PEM -in server.der -out server.pem

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.