Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is the difference between the PEM and PFX certificate formats?
Short answer
PEM and PFX are two common file formats in which certificates are stored. PEM is Base64 text enclosed by headers such as -----BEGIN CERTIFICATE-----; the certificate, the private key and the chain are in separate blocks and can be copied as text. PFX (PKCS #12), on the other hand, carries the certificate, the private key and the chain in a single password-protected binary file; it is common in Windows and IIS environments. TR7 accepts both: in the Manual type, the certificate is pasted as PEM content (DER and PKCS #7/P7B content is also accepted), and in the PFX type, the file is uploaded with its password; certificates are exported by downloading them as PFX.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Certificates & PKI → SSL/TLS Certificates → Add → Manual | Certificate Content (PEM, PKCS #7/P7B or DER), Key Content (PEM), Password | Uploading the certificate and the key separately; the password is for an encrypted key |
| SSL/TLS Certificates → Add → PFX | PFX File (.pfx), Password | Taking the certificate, the key and the chain from a single file |
| SSL/TLS Certificates list → download icon | New PFX Password | Downloading the certificate as a PFX file with the chain and the key; only on records on which Allow Download is on |
| Certificates & PKI → Private Key Library | Private Key (PEM) | Importing the key as PEM |
| Certificates & PKI → Certificate Authorities (CA) | CA Certificate (PEM) | Adding the CA certificate as PEM |
Comparison
| PEM | PFX (PKCS #12) | |
|---|---|---|
| Format | Base64 text (RFC 7468) | Binary file (RFC 7292) |
| Content | Separate blocks (certificate, key, chain) | Certificate, key and chain in a single file |
| Protection | Key block optionally password-protected | The file is protected with a password |
| Typical extension | .pem, .crt, .cer, .key | .pfx, .p12 |
| In TR7 | Manual type; Private Key Library and CA records | PFX type (.pfx); export |
Common Misconceptions
- "PFX carries only the certificate." PFX also carries the private key and the chain; for this reason, the password of the file is kept secure.
- "A DER or P7B file cannot be uploaded to TR7." The Certificate Content field of the Manual type also accepts DER and PKCS #7/P7B content; the key, however, must be in PEM format.
- "The extension determines the format." A file with a
.crtor.cerextension can be either PEM or DER; what determines the format is the content.
How it is done in the documentation
