How can I create a PEM file from an SSL certificate?
These are the files that I have available:
.crtserver.csrserver.key
12 Answers
Your keys may already be in PEM format, but just named with .crt or .key.
If the file's content begins with -----BEGIN and you can read it in a text editor:
The file uses base64, which is readable in ASCII, not binary format. The certificate is already in PEM format. Just change the extension to .pem.
If the file is in binary:
For the server.crt, you would use
openssl x509 -inform DER -outform PEM -in server.crt -out server.crt.pem
For server.key, use openssl rsa in place of openssl x509.
The server.key is likely your private key, and the .crt file is the returned, signed, x509 certificate.
If this is for a Web server and you cannot specify loading a separate private and public key:
You may need to concatenate the two files. For this use:
cat server.crt server.key > server.includesprivatekey.pem
I would recommend naming files with "includesprivatekey" to help you manage the permissions you keep with this file.
A pem file contains the certificate and the private key. It depends on the format your certificate/key are in, but probably it's as simple as this:
cat server.crt server.key > server.pem
All of the files (*.crt, server.csr, server.key) may already be in PEM format, what to do next with these files depends on how you want to use them, or what tool is using them and in which format it requires.
I'll go a bit further here to explain what are the different formats used to store cryptography materials and how to recognise them as well as convert one to/from another.
Standards
| Standards | Content format | File encoding | Possible content |
|---|---|---|---|
| X509 | X | Certificates | |
| PKCS#1 | X | RSA keys (public/private) | |
| PKCS#7 | X | Certificates, CRLs | |
| PKCS#8 | X | Private keys, encrypted private keys | |
| PKCS#12 | X | Certificates, CRLs, private keys | |
| JKS | X | Certificates, private keys | |
| PEM | X | ||
| DER | X |
Common combinations
| Content \ Encoding | PEM (*) | DER (**) | Binary |
|---|---|---|---|
| X509 | X | X | |
| PKCS#1 | X | X | |
| PKCS#7 (***) | X | X | |
| PKCS#8 | X | X | |
| PKCS#12 (***) | X | ||
| JKS (***) | X |
This is a gist explains the same thing + commands for conversion/verification/inspection.
In conclusion, typical steps to work with cryptography/PKI materials:
- Understand which format they are in (use verification/inspection commands)
- Understand which format they are required (read doc)
- Use conversion commands to convert the files
- Optional: use verification/inspection commands to verify converted files
On Windows, you can use the certutil tool:
certutil -encode server.crt cert.pem
certutil -encode server.key key.pem
You can combine both files to one in PowerShell like this:
Get-Content cert.pem, key.pem | Set-Content cert-and-key.pem
And in CMD like this:
copy cert.pem+key.pem cert-and-key.pem /b
Related