CRT File (.crt / .cer certificate file)

A .crt or .cer file contains a public X.509 certificate and no private key. Both extensions are naming conventions rather than formats: on Linux and in most web server documentation, .crt usually means PEM text beginning with -----BEGIN CERTIFICATE-----, while Windows commonly uses .cer and lets you export either binary DER or Base64 (PEM-style) encoding. Windows opens both extensions in its certificate viewer on double-click.

Why it matters

Tools fail with unhelpful errors when they receive the wrong encoding, for example OpenSSL reporting that it could not load the certificate because the file is actually DER. A .crt file may also contain only the leaf certificate, which is why servers such as nginx need a fullchain file that appends the intermediates. Checking the first bytes of the file settles the encoding question quickly, and counting the BEGIN lines tells you how many certificates are inside.

Example

head -c 30 example.com.cer; echo        # PEM starts with -----BEGIN CERTIFICATE-----
openssl x509 -in example.com.cer -inform DER -noout -subject -enddate
openssl x509 -in example.com.cer -inform DER -out example.com.crt   # DER to PEM
grep -c "BEGIN CERTIFICATE" example.com.crt                         # number of certificates inside

Common misconceptions

• .crt and .cer are different certificate formats. Either can be PEM or DER; only the content decides.
• A .crt file includes the private key. Certificates are public; the key lives in a separate .key file or a PKCS #12 container.
• One .crt file is always one certificate. PEM files can hold several certificates in sequence, such as a CA bundle or a full chain.