PEM is one of the most common formats for storing cryptographic objects, including certificates, keys, and certificate signing requests. Let’s look at how it is structured and how to read its contents.
What is the PEM format?
PEM (Privacy Enhanced Mail) is a text format based on Base64 encoding of binary data. A PEM file contains one or more blocks. Each block begins with the line BEGIN ТИП and ends with END ТИП, each enclosed by five hyphens.
A typical PEM file consists of a header, several lines of Base64, and a closing header. The format was created in 1993 for secure email, but became widely used because of its simplicity: it is a plain text file that can be read in any editor.
Types of PEM files
X.509 certificate
Block header: BEGIN CERTIFICATE
A public certificate containing the domain name, validity period, public key, certificate authority information, and the CA’s digital signature. File extensions: .pem, .crt, .cer.
Private key
Block formats:
BEGIN PRIVATE KEY— PKCS#8, unencryptedBEGIN ENCRYPTED PRIVATE KEY— PKCS#8, encryptedBEGIN RSA PRIVATE KEY— traditional PKCS#1 formatBEGIN EC PRIVATE KEY— ECDSA key
A private key is the most sensitive file. Store it in a secure location and never share it with third parties.
Public key
Block header: BEGIN PUBLIC KEY
The public part of a key pair. Safe to share and publish.
CSR (Certificate Signing Request)
Block header: BEGIN CERTIFICATE REQUEST
A request to issue a certificate. It contains a public key and organization information. It is sent to a certificate authority (CA) to obtain a signed certificate.
PEM vs. DER
| Characteristic | PEM | DER |
|---|---|---|
| Format | Text (Base64) | Binary |
| Extensions | .pem, .crt, .cer, .key | .der, .cer |
| Editable | Opens in a text editor | Requires binary utilities |
| Size | ~33% larger | More compact |
| Use | Web servers (nginx, Apache) | Java, Windows |
SSL/TLS trust chain
An SSL/TLS certificate works through a trust hierarchy:
- Root CA — root certificate authority (Sectigo, DigiCert, Let's Encrypt)
- Intermediate CA — an intermediate CA signed by the Root CA
- End-entity certificate — your website’s certificate, signed by the Intermediate CA
A browser trusts a website if it can build a chain from the website’s certificate to a trusted Root CA. A PEM file often contains the entire chain, with several blocks in sequence.
Useful openssl commands
# Просмотр содержимого сертификата
openssl x509 -in cert.pem -text -noout
# Проверить срок действия
openssl x509 -in cert.pem -noout -dates
# Показать субъект и издателя
openssl x509 -in cert.pem -noout -subject -issuer
# Просмотр CSR
openssl req -in request.csr -text -noout
# Проверить соответствие ключа и сертификата
openssl x509 -noout -modulus -in cert.pem | md5sum
openssl rsa -noout -modulus -in key.pem | md5sum
# Просмотр цепочки сертификатов сайта
openssl s_client -connect example.com:443 -showcertsTo check the SSL certificate of a live domain, use SSL Checker. To work with JWT tokens, use the JWT decoder.
Tool on reChecker
The PEM file viewer on reChecker parses content right in your browser: paste a PEM block to get readable information about a certificate, key, or CSR — without sending data to a server.