# What Is CRT File (.crt / .cer certificate file)?

> CRT files (.crt, also .cer) hold an X.509 certificate, encoded either as PEM text or as binary DER depending on the platform that produced them.

Source: https://ssl.sh/glossary/crt-file/
Last updated: 2026-11-10

A .crt or .cer file contains a public X.509 certificate and no private key. Both extensions are naming conventions rather than formats: on Linux and in most web server documentation, .crt usually means [PEM](https://ssl.sh/glossary/pem/) text beginning with `-----BEGIN CERTIFICATE-----`, while Windows commonly uses .cer and lets you export either binary [DER](https://ssl.sh/glossary/der/) or Base64 (PEM-style) encoding. Windows opens both extensions in its certificate viewer on double-click.

## Why it matters
Tools fail with unhelpful errors when they receive the wrong encoding, for example OpenSSL reporting that it could not load the certificate because the file is actually DER. A .crt file may also contain only the leaf certificate, which is why servers such as nginx need a [fullchain](https://ssl.sh/glossary/fullchain/) file that appends the intermediates. Checking the first bytes of the file settles the encoding question quickly, and counting the BEGIN lines tells you how many certificates are inside.

## Example
```bash
head -c 30 example.com.cer; echo        # PEM starts with -----BEGIN CERTIFICATE-----
openssl x509 -in example.com.cer -inform DER -noout -subject -enddate
openssl x509 -in example.com.cer -inform DER -out example.com.crt   # DER to PEM
grep -c "BEGIN CERTIFICATE" example.com.crt                         # number of certificates inside
```

## Common misconceptions
- **.crt and .cer are different certificate formats.** Either can be PEM or DER; only the content decides.
- **A .crt file includes the private key.** Certificates are public; the key lives in a separate .key file or a PKCS #12 container.
- **One .crt file is always one certificate.** PEM files can hold several certificates in sequence, such as a CA bundle or a full chain.

## Related terms

- [PEM](https://ssl.sh/zh/glossary/pem/): PEM 是一种把 DER 二进制数据做 Base64 编码、再用 BEGIN 和 END 行包起来的文本格式，是存放证书和私钥最常见的方式。
- [DER](https://ssl.sh/zh/glossary/der/): DER 是 ASN.1 的二进制编码规则，保证每个值只有唯一一种字节表示，X.509 证书和密钥都以它为基础。
- [X.509](https://ssl.sh/zh/glossary/x509/): X.509 是 ITU-T 制定的公钥证书标准格式，其互联网配置规范 RFC 5280 规定了 TLS 所用证书的结构和验证方法。
- [KEY 文件](https://ssl.sh/zh/glossary/key-file/): KEY 文件是按惯例存放私钥的 .key 文件，通常为 PEM 编码，但扩展名本身并不说明里面的具体格式。
- [fullchain](https://ssl.sh/zh/glossary/fullchain/): fullchain 是依次包含站点证书和中间证书的 PEM 文件，让客户端能把站点证书连到受信任的根证书。
- [PKCS#7](https://ssl.sh/zh/glossary/pkcs7/): PKCS#7 是一种用于签名和加密数据的格式，在 .p7b 或 .p7c 文件中常用来打包一组证书，不含私钥。
- [SSL 证书](https://ssl.sh/zh/glossary/ssl-certificate/): SSL 证书是由 CA 签名的 X.509 证书，把公钥与一个或多个域名（或 IP 地址）绑定，供 TLS 客户端验证服务器身份。