Skip to main content

What is a PEM file?

You'll often come across this file format across when working with SSL certificates.

A
Written by Admin account
Updated over a week ago

PEM (Privacy-Enhanced Mail) is a widely used text-based format for storing and transmitting cryptographic data such as SSL/TLS certificates, private keys, and certificate chains. The syntax and structure of certificates stored in PEM format follow the X.509 v3 standard, and their behavior and usage are defined in IETF RFC 5280.

Although PEM was originally designed for secure email, it has become the de facto standard format for SSL/TLS certificates used by web servers, load balancers, APIs, and many security tools.
​

PEM File Structure

A PEM file contains Base64-encoded (ASCII) data wrapped between human-readable header and footer lines. These delimiters identify the type of content stored in the file.

Common PEM encodings:

Certificate:

-----BEGIN CERTIFICATE-----
(base64-encoded certificate data)
-----END CERTIFICATE-----

Private Key (unencrypted)

-----BEGIN PRIVATE KEY-----
(base64-encoded key data)
-----END PRIVATE KEY-----

Private Key (RSA-specific)

-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----

Encrypted Private Key

-----BEGIN ENCRYPTED PRIVATE KEY-----
...
-----END ENCRYPTED PRIVATE KEY-----

Certificate Signing Request (CSR)

-----BEGIN CERTIFICATE REQUEST-----
...
-----END CERTIFICATE REQUEST-----

A single PEM file may contain multiple blocks, such as:

  • A server certificate

  • One or more intermediate certificates (certificate chain)

  • A private key (not recommended to combine with certs in production unless required)

PEM Files and SSL/TLS Certificates

In the context of SSL/TLS:

  • Server Certificate: Identifies a website or service and is issued by a Certificate Authority (CA).

  • Intermediate Certificates: Link the server certificate to a trusted root CA.

  • Root Certificate: Trusted by operating systems and browsers (usually not included in server configs).

Other certificate formats (such as .p12, .pfx, or .der) are often converted into PEM for compatibility.

Common PEM File Extensions

PEM files can use various extensions, including:

  • .pem – Generic PEM container

  • .crt or .cer – Certificate files (often PEM-encoded)

  • .key – Private key files

  • .ca-bundle – Certificate chain or bundle of intermediate certificates

The file extension does not strictly define the content—the BEGIN/END markers do.

Validating PEM Files

Validating a PEM file ensures that it is well-formed, readable, and cryptographically correct. Validation can be performed both offline and online.

Offline Validation (Using OpenSSL)

1. Validate Certificate Structure

openssl x509 -in certificate.pem -text -noout

If valid, this command displays certificate details such as:

  • Subject and issuer

  • Validity period

  • Public key information

  • Extensions (SAN, Key Usage, etc.)

2. Validate Private Key

Verify that a private key is valid:

openssl pkey -in privatekey.pem -check

For RSA keys:

openssl rsa -in privatekey.pem -check

3. Match Certificate and Private Key

openssl x509 -noout -modulus -in certificate.pem | openssl md5
openssl pkey -noout -modulus -in privatekey.pem | openssl md5

Matching hashes indicate a valid pair.


Online Validation

If the PEM certificate is installed, you can use online tools, such as SSL Labs SSL Server Test to check:

  • Chain completeness

  • Trust level

  • Expiration dates

  • Cipher compatibility

  • Security weaknesses

Did this answer your question?