Privacy Enhanced Mail (Privacy-enhanced Electronic-Mail) is a proposed IETF standard for securing electronic mail using public-key cryptography.  The .pem file extension is used to signify a certificate file that is base64 encoded.  This means that the files are encoded in ASCII and are readable in a text editor.  This is in contrast to the .crt file extension; this is used to signify binary certificate files.  PEM files wrap base64 encoded certificate in BEGIN/END markers that specify the type of certificate encoded between the makers.

PEM BEGIN/END Markers

BEGIN/END markers in PEM files start with the string “—–“ followed by “BEGIN” or “END” and then a marker name representing the type of certificate between the markers.  These markers are not standardized, but OpenSSL v1.68 defined the following markers in crypto/pem/pem.h:

"X509 CERTIFICATE", "CERTIFICATE", "CERTIFICATE PAIR", 
"TRUSTED CERTIFICATE","NEW CERTIFICATE REQUEST", "CERTIFICATE REQUEST", 
"X509 CRL", "ANY PRIVATE KEY", "PUBLIC KEY", "RSA PRIVATE KEY", 
"RSA PUBLIC KEY", "DSA PRIVATE KEY", "DSA PUBLIC KEY", "PKCS7", 
"PKCS #7 SIGNED DATA", "ENCRYPTED PRIVATE KEY", "PRIVATE KEY", 
"DH PARAMETERS", "SSL SESSION PARAMETERS", "DSA PARAMETERS", 
"ECDSA PUBLIC KEY", "EC PARAMETERS", "EC PRIVATE KEY”, "CMS"

PEM Certificate

A PEM Certificate is a base64 encoded certificate, in the format described by its marker tags.  The cryptographic definition of a public key certificate is an electronic document that uses a digital signature to bind a public key with an identity.  This identity could contain the name of a person or organization, an address, etc.  Certificates are used to verify that a public key belongs to a specific individual or organization.

X.509 Certificate

X.509 is an ITU Telecommunication Standardization Sector (ITU-T) standard for a public key infrastructure (PKI) and Privilege Management Infrastructure (PMI).  X.509’s specifications include, but are not limited to, standard formats for public key certificates, certificate revocation lists, attribute certificates, and a certification path validation algorithm.  The Internet Engineering Task Force (IETF) has a working group Public Key Infrastructure (X.509), more commonly known as PKIX, and the terminology X.509 Certificate usually refers to and IETF PKIX certificate, as well as the CRL Profile of the X.509 v3 certificate standard.  This standard is specified in RFC 5280.

5.509 Certificate Syntax

The X.509 v3 digital certificate contains the following fields, described using Abstract Syntax Notation One (ASN.1):

• Certificate
  • Version
  • Serial Number
  • Algorithm ID
  • Issuer
  • Validity
    • Not Before
    • Not After
  • Subject
  • Subject Public Key Info
    • Public Key Algorithm
    • Subject Public Key
  • Issuer Unique Identifier (optional)
  • Subject Unique Identifier (optional)
  • Extensions (optional)
• Certificate Signature Algorithm
• Certificate Signature

Common X509 Filename Extensions

• .pem – Privacy Enhanced Mail:  This is a base64 encoded DER certificate
• .cer, .crt, .der– These are usually in binary DER form, but are sometimes also base64 encoded.
• .p7b, .p7c – These are a SignedData structure with no data except one or more certificates or one or more certificate revocation lists.  These are signed with PKCS#7.
• .p12 – This is a password protected certificate and exchanged public and private objects in a single file using PKCS#12.
• .pfx – PFX is a predecessor of PKCS#12.  It usually is generated by IIS and contains data in the PKCS#12 format.

Relevant Algorithms

• PKCS#7 – Cryptographic Message Syntax Standard: This is based on the PEM standard.  The Cryptographic Message Standard (CMS) is usually used to sign or encrypt messages under a PKI.    This is also used for certificate dissemination, and also commonly used for single sign-on operations.
• PKCS#12 – Personal Information Exchange Syntax Standard:  PKCS#12 is an algorithm published by RSA Laboratories.  It is used to store X.509 private keys with accompanying public key certificates.  It protects the contents of the file with a password-based symmetric key.  As of now, it is the only standard way to store private keys and certificates in a single encrypted file.