Compare
CRT vs PFX
CRT/CER commonly identifies an X.509 certificate; PFX/P12 is a container that can bundle certificates and private keys.
Which format should you choose?
Use CRT when a service requests a certificate file; use PFX/P12 when it requires a PKCS#12 bundle.
Good fit for CRT
Transfer or deploy X.509 certificates
- Servers and clients requesting certificate files
Good fit for PFX
Certificate migration
- Importing a certificate identity into a trusted system that requires PKCS#12
Basic information
| Field | CRT | PFX |
|---|---|---|
| Extension | .crt, .cer | .pfx, .p12 |
| MIME type | application/pkix-cert | application/pkcs12 |
| Common uses | Transfer or deploy X.509 certificates | Certificate migration |
| How to open | Use a certificate viewer to inspect subject names, issuer, validity dates, and chain. | Open only in a trusted certificate manager and verify its contents. |
| Export or convert | Before converting, determine encoding, whether the file includes a chain, and whether a private key is stored separately. | When exporting to PEM, check whether a private key is included and protect every output file. |
Choose by use case
Servers and clients requesting certificate files
Transfer or deploy X.509 certificates
CRTImporting a certificate identity into a trusted system that requires PKCS#12
Certificate migration
PFXKey point 1
CRT/CER does not by itself imply that a private key is included.
More on the differencesKey point 2
PFX/P12 can package certificates, private keys, and identity data.
More on the differencesMore on the differences
Check encoding, certificate chain, and target requirements. Protect any private key and its password.
- CRT/CER may be PEM or DER encoded.
- PFX/P12 uses a container structure and can include sensitive key material.
Frequently asked questions
Does a CRT file contain the private key?
Usually the extension identifies a certificate file, not a private key. Verify the contents and never assume the extension proves what is inside.