DER (Distinguished Encoding Rules)
Definition
DER (Distinguished Encoding Rules) is the binary ASN.1 encoding that gives every value exactly one byte representation, used for X.509 certificates and keys.
DER is a set of rules from ITU-T X.690 for encoding ASN.1 data structures as bytes. It is a strict subset of BER (Basic Encoding Rules) that removes every encoding choice, so a given value always encodes to exactly the same bytes. That property matters for cryptography: an X.509 certificate is signed over its DER encoding, and any re-encoding would break the signature. Files with .der or .cer extensions often contain raw DER, and a PEM file is simply DER that has been Base64-encoded and wrapped in text headers.
Why it matters
DER appears wherever binary formats are preferred: Windows certificate exports, Java and Android tooling, smart cards, and inside protocols such as TLS itself, where certificates travel in DER form during the handshake. Certificate fingerprints are hashes of the DER bytes. If a tool rejects a certificate file that looks like binary noise in a text editor, it is probably DER and needs an explicit input format flag or a conversion.
Example
openssl x509 -in example.com.der -inform DER -noout -subject
openssl x509 -in example.com.der -inform DER -out example.com.pem # DER to PEM
openssl asn1parse -in example.com.der -inform DER | head -5
Common misconceptions
- DER and PEM certificates are different certificates. They contain identical data in different encodings; converting does not change the fingerprint.
- A DER file can hold a whole chain. A DER file normally holds one object; use a PEM bundle or a PKCS #7 file for chains.
- BER and DER are interchangeable. Some parsers accept BER, but certificate signatures are computed over DER, so only DER is safe for certificates.