A PEM / DER / PKCS decoder identifies which container a certificate or key file uses and lists what it holds: certificates, chains, private keys or CRLs.
Example
Open a PKCS#7 bundle (.p7b) and every certificate in it is listed and decoded:
PKCS#7 / CMS signedData with 2 certificate(s).
# certificate 1
Subject: CN=example.com
Key: RSA 2048-bit
…A .pfx / .p12 file is identified as PKCS#12, but its private key and certificates are encrypted with the file's password, so their contents can't be read without it.
The formats
| Format | Looks like | Holds | Extensions |
|---|---|---|---|
| DER | Binary, starts with byte 30 | One certificate, key or CSR | .der, .cer |
| PEM | Text between -----BEGIN …----- lines | Base64 DER. A file may contain several blocks | .pem, .crt, .key |
| PKCS#7 | PEM BEGIN PKCS7, or binary | Certificates and chains, no private keys | .p7b, .p7c |
| PKCS#12 | Binary, password-protected | Private key plus certificate chain | .pfx, .p12 |
The PEM label tells you what's inside: CERTIFICATE, CERTIFICATE REQUEST, PRIVATE KEY (PKCS#8), RSA PRIVATE KEY (PKCS#1), EC PRIVATE KEY, ENCRYPTED PRIVATE KEY or PUBLIC KEY.
How to use the decoder
- Paste PEM text, or open a
.der,.p7bor.pfxfile. - PEM input is listed block by block; PKCS#7 bundles have their certificates decoded; PKCS#12 files are identified (their contents are password-encrypted).
- Each certificate found is shown with its subject, issuer, validity and fingerprint.
You can also inspect and convert these files with openssl:
# DER to PEM, and back
openssl x509 -inform der -in cert.der -out cert.pem
openssl x509 -in cert.pem -outform der -out cert.der
# List the certificates in a PKCS#7 bundle
openssl pkcs7 -in chain.p7b -print_certs -noout
# Inspect a PKCS#12 file (asks for the password)
openssl pkcs12 -in bundle.pfx -info -noout
# Split a PKCS#12 into key and certificates
openssl pkcs12 -in bundle.pfx -nocerts -nodes -out key.pem
openssl pkcs12 -in bundle.pfx -nokeys -out certs.pemAt a glance
| PEM | RFC 7468 (textual encodings) |
| PKCS#7 / CMS | RFC 2315 / RFC 5652 |
| PKCS#12 | RFC 7292 |
| Private keys in | PEM PRIVATE KEY blocks and PKCS#12 only |
Frequently asked questions
Which format does my web server want?
Nginx and Apache want PEM: the certificate followed by intermediates in one file, and the key in another. IIS and Windows import PKCS#12 (.pfx). Java keystores can import PKCS#12 directly.
Why does my PEM file contain several certificates?
It's a chain: your certificate first, then one or more intermediates. Servers send the whole chain so clients can link your certificate to a trusted root.
What's the difference between "BEGIN PRIVATE KEY" and "BEGIN RSA PRIVATE KEY"?
PRIVATE KEY is PKCS#8, a generic wrapper for any key type. RSA PRIVATE KEY is the older RSA-only PKCS#1 format. openssl pkey converts between them.
Last reviewed · found a mistake? contact@decoder.tools · view as markdown