# What Is DER (Distinguished Encoding Rules)?

> DER (Distinguished Encoding Rules) is the binary ASN.1 encoding that gives every value exactly one byte representation, used for X.509 certificates and keys.

Source: https://ssl.sh/glossary/der/
Last updated: 2026-11-10

DER is a set of rules from ITU-T X.690 for encoding ASN.1 data structures as bytes. It is a strict subset of BER (Basic Encoding Rules) that removes every encoding choice, so a given value always encodes to exactly the same bytes. That property matters for cryptography: an [X.509](https://ssl.sh/glossary/x509/) certificate is signed over its DER encoding, and any re-encoding would break the signature. Files with .der or .cer extensions often contain raw DER, and a [PEM](https://ssl.sh/glossary/pem/) file is simply DER that has been Base64-encoded and wrapped in text headers.

## Why it matters
DER appears wherever binary formats are preferred: Windows certificate exports, Java and Android tooling, smart cards, and inside protocols such as TLS itself, where certificates travel in DER form during the handshake. Certificate fingerprints are hashes of the DER bytes. If a tool rejects a certificate file that looks like binary noise in a text editor, it is probably DER and needs an explicit input format flag or a conversion.

## Example
```bash
openssl x509 -in example.com.der -inform DER -noout -subject
openssl x509 -in example.com.der -inform DER -out example.com.pem   # DER to PEM
openssl asn1parse -in example.com.der -inform DER | head -5
```

## Common misconceptions
- **DER and PEM certificates are different certificates.** They contain identical data in different encodings; converting does not change the fingerprint.
- **A DER file can hold a whole chain.** A DER file normally holds one object; use a PEM bundle or a [PKCS #7](https://ssl.sh/glossary/pkcs7/) file for chains.
- **BER and DER are interchangeable.** Some parsers accept BER, but certificate signatures are computed over DER, so only DER is safe for certificates.

## Related terms

- [PEM](https://ssl.sh/zh/glossary/pem/): PEM 是一种把 DER 二进制数据做 Base64 编码、再用 BEGIN 和 END 行包起来的文本格式，是存放证书和私钥最常见的方式。
- [X.509](https://ssl.sh/zh/glossary/x509/): X.509 是 ITU-T 制定的公钥证书标准格式，其互联网配置规范 RFC 5280 规定了 TLS 所用证书的结构和验证方法。
- [CRT 文件](https://ssl.sh/zh/glossary/crt-file/): CRT 文件是存放 X.509 证书的 .crt 或 .cer 文件，内容可能是 PEM 文本，也可能是二进制 DER，取决于生成它的平台。
- [PKCS#7](https://ssl.sh/zh/glossary/pkcs7/): PKCS#7 是一种用于签名和加密数据的格式，在 .p7b 或 .p7c 文件中常用来打包一组证书，不含私钥。
- [PKCS#12](https://ssl.sh/zh/glossary/pkcs12/): PKCS#12 是一种用口令保护的二进制容器格式，可以把私钥、证书和证书链打包进一个文件，扩展名通常是 .p12 或 .pfx。
- [KEY 文件](https://ssl.sh/zh/glossary/key-file/): KEY 文件是按惯例存放私钥的 .key 文件，通常为 PEM 编码，但扩展名本身并不说明里面的具体格式。
- [证书指纹](https://ssl.sh/zh/glossary/certificate-fingerprint/): 证书指纹是对证书 DER 编码计算出的哈希值（通常用 SHA-256），用来唯一标识一张证书，它本身并不存储在证书里。