A website protected with an SSL certificate gives visitors a secure and encrypted connection. But while protecting the respective website, many technical complexities arise. Among that, one such complexity is of the.PEM file.

But what exactly is a .pem file, and how can it be used for SSL certificates? This blog is here to demystify the process for you. You'll learn how to effortlessly convert and create a .pem file for your SSL certifications.

What is a Pem file?

A few years back, security communities and Google Chrome pushed the compulsion of having SSL certificates installed. However, not every small website owner is a tech giant who knows the ins and outs of SSL certificates. And if you are also unfamiliar with the complexities of PEM files, then you are in the right place. So, let’s begin by understanding what PEM is.

Privacy Enhanced Mail or PEM file is a commonly used container format that involves cryptographic information in relation to cryptography and computer security. It contains the public certificate or the SSL chain with public and private keys, intermediate and root certificates, and end-user certificates. Also, it is a type of Public Key Infrastructure file used for certificates and keys.

PEM file starts with -

 and ends with -

Everything in the middle is base64 encoded(lowercase and uppercase digits,/and +), which helps in forming a block of data that is usable in other programs. A single PEM file can easily hold multiple blocks.

Although it represents all types of data, it is mainly used to encode RSA keys for SSH and certificates for SSL encryption.

Initially, PEM was to make email secure, but now it is an Internet security standard. It is a text file that carries Base64 encoding of a plain text header and footer, and certificate text. These files have extensions like  .crt, .cer, .pem, or .key.

Using separate blocks, each certificate file gets listed in a PEM file. Here’s how-

-----BEGIN CERTIFICATE-----

//end-user

-----END CERTIFICATE---

-----BEGIN CERTIFICATE-----

//intermediate

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

//root

-----END CERTIFICATE-----

How to Use a .pem File for SSL Certificates?

The PEM file helps store SSL certificates and their associated private key. To use a PEM file for SSL certificates, configure your web server with the apt certificate and key files.

• Firstly, generate a .pem file, which involves the certificates issued by the SSL provider, and put them in a specific server location. It’s the file used in servers like Apache and Nginx to encrypt HTTPS.

• For Apache, you must define the SSLCertificateKeyFile and SSLCertificateFile directives in the virtual host configuration. In Nginx, you have to define the path to the .pem file in the server configuration.

The use of a .pem text file ensures that the web server has essential SSL certificates to enable safe HTTPS encryption for your domain.

How to Open a .pem File?

With Notepad on Windows and Text Edit on macOS, you can easily open a .pem file with a text editor.

Other than that, you can open a .pem file with Certificate Viewer. In case a PEM file contains  X.509 certificates, you can use a management tool and certificate viewer to open and view the certificate.

• For Windows, use the built-in Certificate Manager and access it by pressing Win + R, typing- msc, and hitting Enter. Lastly, import the file and view the certificate.

• For macOS, use the Keychain Access app to import certificates.

• For Linux, OpenSSL displays certificates from the command line. Use the following command to view a certificate in a PEM file-

             openssl x509 -in your_cert.pem -text -noout

Pro Tip: Use the ssh-keygen tool if the file contains SSH keys.

How to create a .pem file for SSL Certificate Installations

You can create a .pem file manually or via OpenSSL. If you bought the certificate from CA and opened the required SSL files and with the PEM file extension, copy and paste the content into another file. Ensure the certificate order is apt as per the provider’s guidelines.

How to Generate a .pem File With OpenSSL?

Follow these steps to generate a .pem file with OpenSSL-

1. Install OpenSSL
2. Open a command prompt or terminal.
3. To generate the .pem file, navigate to the directory.
4. Run the command - openssl req -newkey rsa:2048 -nodes -keyout private.key -out csr.csr to generate a private key and CSR.
5. Now, run the following command: “openssl x509 -req -in csr.csr -signkey private.key -out certificate.pem” to generate the .pem file.

How to Generate a .pem File From a Private Key?

To generate this, we will use OpenSSL -

1. Open a command prompt or terminal.
2. Navigate to the directory using the associated private key.
3. Run the command: openssl rsa -in private.key -outform PEM -out private.pem

With this, the command converts the private key to PEM format.

How to Get the Private Key From a .pem File?

To get the private key from OpenSSL-

1. Open a command prompt or terminal.
2. With the .pem file, navigate to the directory.
3. Run the command: openssl rsa -in yourfile.pem -out privatekey.pem
4. Change ‘yourfile.pem’ to your .pem file name.
5. When prompted, enter the passphrase.

How to Convert a .pem File?

With OpenSSL or an external file converter tool, you can easily convert a .pem file.

How to Create a .pem File from .crt?

With a conversion process, create a .pem certificate file from a .crt file. As the .crt file is already a certificate in the PEM format, there is no requirement for additional steps to convert it. You can rename the file extension if you wish to create a .pem file from a .crt file. Just right-click the file on Windows and select “Rename.”

How to Convert a .crt File to .pem with OpenSSL

To convert .crt File to .pem with OpenSSL, follow these steps

1. Open a command prompt or terminal.
2. To convert the .crt file to a .pem file, use the command: openssl x509 -in your_certificate.crt -out your_certificate.pem -outform PEM.
3. Replace your_certificate.pem with the desired name for the .pem file and your_certificate.crt with the actual name of your .crt file.

Frequently Asked Questions (FAQs)

1.    Can Windows Use .pem?

The answer is Yes. However, specific Windows applications that are related to Microsoft might require keys and certificates in another format, like .cer or .pfx. Using OpenSSL, you can convert the .pem file to these formats.

2.    Is a .pem File a Private Key?

Although it can, it does not every time. As a container format, it includes the entire certificate and public certificate chain.