---
description: Quick reference to the various file extension types.
---

# File Extensions



<table data-header-hidden><thead><tr><th width="296"></th><th></th></tr></thead><tbody><tr><td><mark style="color:red;"><code>.csr</code></mark><br><mark style="color:red;"><code>.req</code></mark><br><mark style="color:red;"><code>.p10</code></mark></td><td><p><br><br>Certificate Signing Request.<br><br>Applications can generate these for submission to certificate-authorities (CA). The actual format is PKCS10 which is defined in <a href="https://www.rfc-editor.org/rfc/rfc2986">RFC 2986</a>. It includes some/all of the key details of the requested certificate such as subject, organization, state, etc, as well as the <em>public key</em> of the certificate to get signed. </p><p></p><p>These get signed by the CA and a certificate is returned. The returned certificate is the public <em>certificate</em> (which includes the public key but not the private key), which itself can be in a couple of formats.<br></p><p>Contains information such as the public key and common name required by a Certificate Authority to create and sign a certificate for the requester, the encoding could be PEM or DER (which is a binary encoding of an ASN.1 specified structure).<br><br></p></td></tr><tr><td><mark style="color:red;"><strong><code>.pem</code></strong></mark></td><td><p><br><br><a href="https://www.rfc-editor.org/rfc/rfc7468">PEM, Privacy Enhanced Mail</a> <br>Defined in RFC <a href="https://www.rfc-editor.org/rfc/rfc1422">1422</a> (part of a series from <a href="https://www.rfc-editor.org/rfc/rfc1421">1421</a> through <a href="https://www.rfc-editor.org/rfc/rfc1424">1424</a>) <br><br>Usually the public key</p><p></p><p>Is a container format that may include just the public certificate (such as with Apache installs, and CA certificate files <code>/etc/ssl/certs</code>), or may include an entire certificate chain including public key, private key, and root certificates. </p><p></p><p>Confusingly, it may also encode a CSR (e.g. as used <a href="https://jamielinux.com/docs/openssl-certificate-authority/create-the-intermediate-pair.html">here</a>) as the PKCS10 format can be translated into PEM. </p><p></p><p>The name is from <a href="https://en.wikipedia.org/wiki/Privacy-enhanced_Electronic_Mail">Privacy Enhanced Mail (PEM)</a>, a failed method for secure email but the container format it used lives on, and is a base64 translation of the x509 ASN.1 keys.<br><br>It simply indicates a base64 encoding with header and footer lines. Mail traditionally only handles text, not binary which most cryptographic data is, so some kind of encoding is required to make the contents part of a mail message itself (rather than an encoded attachment). <br><br>The contents of the PEM are detailed in the header and footer line - <code>.pem</code> itself doesn't specify a data type - just like <code>.xml</code> and <code>.html</code> do not specify the contents of a file, they just specify a specific <em>encoding.</em><br><br></p></td></tr><tr><td><mark style="color:red;"><strong><code>.key</code></strong></mark></td><td><br><br>Usually the private key<br><br>This is a (usually) PEM formatted file containing just the private-key of a specific certificate and is merely a conventional name and not a standardized one. Can be any kind of key, but usually it is the private key - OpenSSL can wrap private keys for all algorithms (RSA, DSA, EC) in a generic and standard PKCS#8 structure, but it also supports a separate 'legacy' structure for each algorithm, and both are still widely used even though the documentation has marked PKCS#8 as superior for almost 20 years; both can be stored as DER (binary) or PEM encoded, and both PEM and PKCS#8 DER can protect the key with password-based encryption or be left unencrypted.<br><br></td></tr><tr><td><mark style="color:red;"><code>.crt</code></mark><br><mark style="color:red;"><code>.cer</code></mark></td><td><br><br>Stands simply for certificate, usually an <a href="https://www.rfc-editor.org/rfc/rfc5280">X509v3</a> certificate. The encoding could be PEM or DER; a certificate <em>contains</em> the public key, but it contains much more information (most importantly the signature by the Certificate Authority over the data and public key, of course).<br><br></td></tr><tr><td><mark style="color:red;"><strong><code>.pkcs12</code></strong></mark><br><mark style="color:red;"><strong><code>.pfx</code></strong></mark><br><mark style="color:red;"><strong><code>.p12</code></strong></mark></td><td><br><br>Originally defined by RSA in the <a href="https://en.wikipedia.org/wiki/PKCS">Public-Key Cryptography Standards</a> (abbreviated PKCS), the "12" variant was originally enhanced by Microsoft, and later submitted as <a href="https://www.rfc-editor.org/rfc/rfc7292">RFC 7292</a>. This is a password-protected container format that contains both public and private certificate pairs. Unlike .pem files, this container is fully encrypted. Openssl can turn this into a .pem file with both public and private keys: <code>openssl pkcs12 -in file-to-convert.p12 -out converted-file.pem -nodes</code><br><br></td></tr></tbody></table>

