Compare
PEM vs DER
PEM and DER can represent the same certificate or key data in different encodings. PEM wraps Base64 text in labeled boundaries; DER is a binary ASN.1 encoding. The extension alone does not identify the contained object.
Which format should you choose?
Use the encoding required by the receiving software. PEM is convenient to inspect and exchange as text; DER is used when a binary encoding is required.
Good fit for PEM
Represent certificates and keys as text
- Systems requesting PEM-encoded material
Good fit for DER
Certificate deployment
- Supplying an ASN.1 certificate to software that requires binary input
Basic information
| Field | PEM | DER |
|---|---|---|
| Extension | .pem | .der |
| MIME type | application/x-pem-file | application/pkix-cert |
| Common uses | Represent certificates and keys as text | Certificate deployment |
| How to open | Inspect the labels as text without pasting the contents into public chats or shared locations. | Inspect with a certificate tool and confirm the object type. |
| Export or convert | Before converting to DER or PKCS#12, identify the contained objects and whether a private key must be handled. | When converting to PEM, verify the content and destination requirements. |
Choose by use case
Systems requesting PEM-encoded material
Represent certificates and keys as text
PEMSupplying an ASN.1 certificate to software that requires binary input
Certificate deployment
DERKey point 1
PEM uses Base64 text with BEGIN and END labels.
More on the differencesKey point 2
DER stores the encoded data in binary form.
More on the differencesMore on the differences
Check the application’s documented requirements and identify the object type before conversion. Validate the result with the intended tool, protect private keys, and never treat a filename change as an encoding conversion.
- PEM boundaries make the object recognizable in text, but do not by themselves prove its type or validity.
- DER is compact binary data and is not meant to be read directly as text.
- Certificate chains, private keys, and signing requests are distinct objects regardless of encoding.
Frequently asked questions
Can I convert PEM to DER by changing the extension?
No. Re-encode the object with a trusted tool and verify that the receiving application can parse it.