Master SSL Certificate Formats and OpenSSL Commands: A Hands‑On Guide

There are two main types of certificate files: a Base64 (ASCII) text format, commonly known as PEM (extensions .pem, .crt, .key), and a binary format, commonly known as DER (extensions .der, .cer). Linux typically uses .crt files while Windows uses .cer files.

X.509 – a universal certificate format containing the holder’s public key and algorithm information.

PKCS#1 ~ PKCS#12 – standards for public‑key cryptography; files are usually stored with extensions like .p12, which bundles certificates and keys.

*.der – binary storage format for certificates (rarely used).

*.pem – Base64‑encoded text storage for certificates or keys; can store a certificate, a key, or both.

*.key – PEM‑formatted private key, typically saved with the .key extension.

*.cer / *.crt – both refer to certificates; Linux calls them .crt, Windows calls them .cer; the underlying storage can be PEM or DER.

*.csr – Certificate Signing Request, containing information such as country, email, domain, etc.

*.pfx – Microsoft IIS implementation.

*.jks – Java keytool implementation. openssl genrsa -out ca.key 2048 Generate a CA private key (extension can be .pem or .key). openssl req -new -key ca.key -out ca.csr Generate a CA certificate signing request; you will be prompted for basic information.

openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt

After these three steps you will have three files in the directory:

ca.key<br/>ca.csr<br/>ca.crt

Common Certificate Operations

# View certificate serial number
openssl x509 -in ca.crt -noout -serial
# Print subject name in RFC2253 format
openssl x509 -in ca.crt -noout -subject
# Print MD5 fingerprint
openssl x509 -in ca.crt -noout -fingerprint
# Print SHA1 fingerprint
openssl x509 -sha1 -in ca.crt -noout -fingerprint

Format Conversion

Certificate format conversion is essentially a conversion of encoding, such as between DER and PEM.

PEM to DER:

openssl x509 -inform pem -in certificate.pem -outform der -out certificate.der

DER to PEM:

openssl x509 -inform der -in certificate.der -outform pem -out certificate.pem

Generate a server certificate signing request:

openssl req -new -key server.key -out server.csr

Sign the server certificate using the previously created CA:

openssl x509 -req -days 3000 -sha1 -extensions v3_req -CA ca.crt -CAkey ca.key -CAserial ca.srl -CAcreateserial -in server.csr -out server.crt

-CA: path to the CA certificate

-CAkey: path to the CA private key

-CAserial: path to the certificate serial number file

-CAcreateserial: create a serial number file (default name ends with .srl)

Verify the issued certificate:

openssl verify -CAfile ca.crt server.crt
# server.crt: OK