Skip to content
ecdsa.com

PEM

The text wrapping of DER data as base64 between -----BEGIN label----- and -----END label----- lines, standardized for PKIX objects in RFC 7468 and used by most tools to store certificates and keys.
Also written asPEM filePEM formatBEGIN CERTIFICATERFC 7468

The body is standard base64 (not base64url) of the DER bytes, conventionally in 64-character lines. RFC 7468 labels include CERTIFICATE, X509 CRL, CERTIFICATE REQUEST, PKCS7, CMS, PRIVATE KEY (PKCS #8), ENCRYPTED PRIVATE KEY and PUBLIC KEY (SPKI). OpenSSL's traditional formats add RSA PRIVATE KEY, EC PRIVATE KEY and RSA PUBLIC KEY, and old encrypted keys carry Proc-Type: 4,ENCRYPTED and DEK-Info headers inherited from 1993 Privacy-Enhanced Mail.

A PEM file can hold several objects: a certificate chain (leaf first) or a key followed by its certificate. Text before or between blocks is allowed, which is how openssl x509 -text output can sit next to the base64.

Common errors come from the label, not the base64: no start line (wrong label or a DER file passed as PEM), expecting: ANY PRIVATE KEY (a public key where a private key was expected), CRLF or whitespace damage, and a missing final newline in strict parsers. Converting is lossless: openssl x509 -outform DER and back.

Standards and references

All terms