中文

Glossary

KEY File (.key file)

Last verified

Definition

KEY files (.key) are files that by convention hold a private key, usually PEM-encoded, though the extension says nothing about the exact format inside.

A .key file is the conventional home of a TLS server's private key. The extension is only a naming habit; what matters is the content, which is almost always PEM text whose first line reveals the format:

  • -----BEGIN PRIVATE KEY-----: unencrypted PKCS #8, the default output of OpenSSL 3.x.
  • -----BEGIN ENCRYPTED PRIVATE KEY-----: PKCS #8 protected by a passphrase.
  • -----BEGIN RSA PRIVATE KEY-----: the older PKCS #1 format for RSA keys.
  • -----BEGIN EC PRIVATE KEY-----: the SEC 1 format for elliptic-curve keys.

Why it matters

Servers such as nginx and Apache expect the key as a separate PEM file next to the certificate, so you need to know which form you have and whether it is encrypted. A passphrase-protected key makes nginx prompt at startup unless you supply ssl_password_file, which breaks unattended restarts. Mismatched key and certificate pairs are a frequent deployment error; compare the public key derived from the .key file with the one in the certificate before reloading.

Example

head -1 example.com.key
openssl pkey -in example.com.key -out example.com.pkcs8.key                  # convert to PKCS #8
openssl rsa -in example.com.pkcs8.key -traditional -out example.com.rsa.key  # back to PKCS #1
openssl pkey -in encrypted.key -out decrypted.key                            # remove a passphrase

Common misconceptions

  • All .key files are the same format. They may be PKCS #1, SEC 1 or PKCS #8, encrypted or not, and occasionally binary DER.
  • Renaming .key to .pem changes the format. Extensions are labels; conversion requires OpenSSL or a similar tool.
  • The .key file can be shared with the CA or hosting support. It should never leave the systems that terminate TLS.

See also