# What Is KEY File (.key file)? Definition and Examples

> KEY files (.key) are files that by convention hold a private key, usually PEM-encoded, though the extension says nothing about the exact format inside.

Source: https://ssl.sh/glossary/key-file/
Last updated: 2026-11-10

A .key file is the conventional home of a TLS server's [private key](https://ssl.sh/glossary/private-key/). The extension is only a naming habit; what matters is the content, which is almost always [PEM](https://ssl.sh/glossary/pem/) text whose first line reveals the format:

- `-----BEGIN PRIVATE KEY-----`: unencrypted PKCS #8, the default output of OpenSSL 3.x.
- `-----BEGIN ENCRYPTED PRIVATE KEY-----`: PKCS #8 protected by a passphrase.
- `-----BEGIN RSA PRIVATE KEY-----`: the older PKCS #1 format for RSA keys.
- `-----BEGIN EC PRIVATE KEY-----`: the SEC 1 format for elliptic-curve keys.

## Why it matters
Servers such as nginx and Apache expect the key as a separate PEM file next to the certificate, so you need to know which form you have and whether it is encrypted. A passphrase-protected key makes nginx prompt at startup unless you supply `ssl_password_file`, which breaks unattended restarts. Mismatched key and certificate pairs are a frequent deployment error; compare the public key derived from the .key file with the one in the certificate before reloading.

## Example
```bash
head -1 example.com.key
openssl pkey -in example.com.key -out example.com.pkcs8.key                  # convert to PKCS #8
openssl rsa -in example.com.pkcs8.key -traditional -out example.com.rsa.key  # back to PKCS #1
openssl pkey -in encrypted.key -out decrypted.key                            # remove a passphrase
```

## Common misconceptions
- **All .key files are the same format.** They may be PKCS #1, SEC 1 or PKCS #8, encrypted or not, and occasionally binary [DER](https://ssl.sh/glossary/der/).
- **Renaming .key to .pem changes the format.** Extensions are labels; conversion requires OpenSSL or a similar tool.
- **The .key file can be shared with the CA or hosting support.** It should never leave the systems that terminate TLS.

## Related terms

- [私钥](https://ssl.sh/zh/glossary/private-key/): 私钥是非对称密钥对中保密的那一半，TLS 服务器用它证明自己拥有证书里的那把公钥。
- [PEM](https://ssl.sh/zh/glossary/pem/): PEM 是一种把 DER 二进制数据做 Base64 编码、再用 BEGIN 和 END 行包起来的文本格式，是存放证书和私钥最常见的方式。
- [CRT 文件](https://ssl.sh/zh/glossary/crt-file/): CRT 文件是存放 X.509 证书的 .crt 或 .cer 文件，内容可能是 PEM 文本，也可能是二进制 DER，取决于生成它的平台。
- [PKCS#12](https://ssl.sh/zh/glossary/pkcs12/): PKCS#12 是一种用口令保护的二进制容器格式，可以把私钥、证书和证书链打包进一个文件，扩展名通常是 .p12 或 .pfx。
- [CSR](https://ssl.sh/zh/glossary/csr/): CSR 是证书签名请求，包含申请者的公钥和希望写入证书的身份信息，用私钥签名后提交给 CA 以申请证书。
- [DER](https://ssl.sh/zh/glossary/der/): DER 是 ASN.1 的二进制编码规则，保证每个值只有唯一一种字节表示，X.509 证书和密钥都以它为基础。