> For the complete documentation index, see [llms.txt](https://yubico.gitbook.io/yubikey5/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yubico.gitbook.io/yubikey5/cheatsheets/pem-types.md).

# PEM Types

If you are unsure what PEM type is used on a key or certificate, you can open the <mark style="color:red;">**`.PEM`**</mark> file and review the header text. Each PEM header has different text which can be matched with the list below in order to identify what was used to create that PEM file.

{% tabs %}
{% tab title="Certificate" %}
Matched with the list below, this certificate is <mark style="color:red;">**`PEM_STRING_X509`**</mark>

```
-----BEGIN CERTIFICATE-----
GRHFtDDCB2ygAwIBAgIUIiJFcijmTzMoQwlZVH4AcFrcUuwwDQYJKoZIhvcNAQEL
```

{% endtab %}

{% tab title="Key" %}
Matched with the list below, this certificate is <mark style="color:red;">**`PEM_STRING_PKCS8`**</mark>

```
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIFLTBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQIYtPtoLIdOWwCAggA
```

{% endtab %}
{% endtabs %}

|                                                               |                           |
| ------------------------------------------------------------- | ------------------------- |
| <mark style="color:red;">**`PEM_STRING_X509_OLD`**</mark>     | "X509 CERTIFICATE"        |
| <mark style="color:red;">**`PEM_STRING_X509`**</mark>         | "CERTIFICATE"             |
| <mark style="color:red;">**`PEM_STRING_X509_PAIR`**</mark>    | "CERTIFICATE PAIR"        |
| <mark style="color:red;">**`PEM_STRING_X509_TRUSTED`**</mark> | "TRUSTED CERTIFICATE"     |
| <mark style="color:red;">**`PEM_STRING_X509_REQ_OLD`**</mark> | "NEW CERTIFICATE REQUEST" |
| <mark style="color:red;">**`PEM_STRING_X509_REQ`**</mark>     | "CERTIFICATE REQUEST"     |
| <mark style="color:red;">**`PEM_STRING_X509_CRL`**</mark>     | "X509 CRL"                |
| <mark style="color:red;">**`PEM_STRING_EVP_PKEY`**</mark>     | "ANY PRIVATE KEY"         |
| <mark style="color:red;">**`PEM_STRING_PUBLIC`**</mark>       | "PUBLIC KEY"              |
| <mark style="color:red;">**`PEM_STRING_RSA`**</mark>          | "RSA PRIVATE KEY"         |
| <mark style="color:red;">**`PEM_STRING_RSA_PUBLIC`**</mark>   | "RSA PUBLIC KEY"          |
| <mark style="color:red;">**`PEM_STRING_DSA`**</mark>          | "DSA PRIVATE KEY"         |
| <mark style="color:red;">**`PEM_STRING_DSA_PUBLIC`**</mark>   | "DSA PUBLIC KEY"          |
| <mark style="color:red;">**`PEM_STRING_PKCS7`**</mark>        | "PKCS7"                   |
| <mark style="color:red;">**`PEM_STRING_PKCS7_SIGNED`**</mark> | "PKCS #7 SIGNED DATA"     |
| <mark style="color:red;">**`PEM_STRING_PKCS8`**</mark>        | "ENCRYPTED PRIVATE KEY"   |
| <mark style="color:red;">**`PEM_STRING_PKCS8INF`**</mark>     | "PRIVATE KEY"             |
| <mark style="color:red;">**`PEM_STRING_DHPARAMS`**</mark>     | "DH PARAMETERS"           |
| <mark style="color:red;">**`PEM_STRING_DHXPARAMS`**</mark>    | "X9.42 DH PARAMETERS"     |
| <mark style="color:red;">**`PEM_STRING_SSL_SESSION`**</mark>  | "SSL SESSION PARAMETERS"  |
| <mark style="color:red;">**`PEM_STRING_DSAPARAMS`**</mark>    | "DSA PARAMETERS"          |
| <mark style="color:red;">**`PEM_STRING_ECDSA_PUBLIC`**</mark> | "ECDSA PUBLIC KEY"        |
| <mark style="color:red;">**`PEM_STRING_ECPARAMETERS`**</mark> | "EC PARAMETERS"           |
| <mark style="color:red;">**`PEM_STRING_ECPRIVATEKEY`**</mark> | "EC PRIVATE KEY"          |
| <mark style="color:red;">**`PEM_STRING_PARAMETERS`**</mark>   | "PARAMETERS"              |
| <mark style="color:red;">**`PEM_STRING_CMS`**</mark>          | "CMS"                     |

## <mark style="color:red;">❊ Notes</mark>

<mark style="color:red;">**`PKCS#8`**</mark> only used for **PRIVATE KEYS**