I am new to digital certification and I am trying to understand it as well as get my domain certified.

I know this question may be broad, but can someone give me a general idea of the usage of the following files and how they are related?

  • xxx.cer
  • xxx.csr
  • xxx.JKS
  • xxx.p12


to add on, i am reading https://support.ssl.com/Knowledgebase/Article/View/19/0/der-vs-crt-vs-cer-vs-pem-certificates-and-how-to-convert-them

what is per,der and pem format ? and how are they link to .cer ?


The answer of @SmokeDispenser is quite concrete and accurate. I will try to provide a bit of additional background in case you need it.

A private key is the most critical piece of data of your list. If someone gets access to it or manages to use it, the certification is pointless. As a result, private keys are often stored in files known as keystores. The content is usually password protected (technically it can support other protection modes, but I've only seen the case of passwords). This is important and often mishandled: do not send the password via email or other insecure mechanism, nor keep copies of them around. The extensions .p12 and .jks belong to two formats of keystore. If you work with Windows, you might find also the extension .pfx, but it's practically the same as .p12.

Since you cannot distribute around your keystore and still don't have a certificate, you have to send a Certificate Signature Request (CSR) to the certificate authority. The .csr file contains public information about your key and your identity.

As a response, the CA replies to your request with a certificate (.cer or .crt). It contains all your information, including your public key, some data about the CA and it is signed by the CA. Note that a certificate is only valid if you have a certificate chain (i.e. the system that validates the certificate, probably the browser, has the certificates of the CA stored).

Finally, depending of the usage you intend for the certificate, you might also need to be aware of the Certificate Revokation List (.crl files). If a certificate is revoked (i.e. it is no longer valid for whatever reason), that action will be reflected on the CRL. When verifying a certificate, one should ensure that it is not in there. Nowadays, most reputable CAs offer also an online status check via the OCSP protocol.

  • thanks for the wonderful add-on, i have slightly amended my original question. please kindly take a look – Noob Mar 29 '16 at 15:38
  • @Noob They are just encodings and shouldn't bother you in high level terms. However, you can take a look to my answer here about them: crypto.stackexchange.com/questions/33636/… – Sergio Andrés Figueroa Santos Mar 29 '16 at 15:48
  • @sergios, thanks for the link, will try to digest it. just want to be sure, when we talk about encoding of the cert, we are just talking about the format/internal presentation of the cert, and that is before the cert get sign by a CA ? – Noob Mar 29 '16 at 15:58
  • Exactly. Most robust tools can handle all the alternative encodings transparently. – Sergio Andrés Figueroa Santos Mar 29 '16 at 16:05
  • thanks! so this "encoding' of the format der,pem is nothing to do with the "digital signing/encryption" of the cert itself by the CA - yea ? just wanna be sure. – Noob Mar 29 '16 at 16:08

To put it as simple as possible:

  • a cer is a certificate. Think: a (your) public key, signed by a CA (certificate authority)
  • a csr is a certificate signing request. Think:

    Here, CA, this is my public key and a proof that I do in fact have the private key for that public key

  • p12 is a container format that holds various things. Often, and probably in your case a key pair (a private and corresponding public key), often encrypted itself.
  • JKS is the java keystore format. Like p12, it is a container, which can hold multiple keys and/or certificates. A keystore which holds only certificates is called a truststore.
  • DER and PEM are two different encodings used to represent a certificate.
  • hi smoke, thanks for the straight to the point and easy to understand answers. i have amended my original question , please kindly take a look – Noob Mar 29 '16 at 15:39
  • sorry, just changed it. – Noob Mar 29 '16 at 15:43
  • I edited my answer. For how to convert between DER and PEM, feel free to google yourself as I'm on the run;) – Tobi Nary Mar 29 '16 at 15:50
  • thanks, so the encoding of a cert has nothing to do with the encryption/digitally signing of the cert by the CA yea ? – Noob Mar 29 '16 at 16:02
  • Not per-se it's just two ways of expressing the same data, whereas one allows "easy" binary consumption and one easy textual transmission – Tobi Nary Mar 29 '16 at 16:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.