PEM (Privacy-Enhanced Mail encoding)
Definition
PEM is a text encoding that wraps Base64-encoded DER data between BEGIN and END lines, the most common way to store certificates and keys.
PEM is the textual encoding used for most certificates, keys and CSRs on Unix-like systems. It takes the binary DER encoding of an object, Base64-encodes it in lines of 64 characters, and wraps it between a header and footer naming the object type, such as BEGIN CERTIFICATE, BEGIN PRIVATE KEY or BEGIN CERTIFICATE REQUEST. The name comes from the Privacy-Enhanced Mail standards of the early 1990s; that email system never caught on, but its encoding survived, and RFC 7468 now documents it for PKIX, PKCS and CMS structures.
Why it matters
PEM is what nginx, Apache, HAProxy, Postfix, curl and most Linux tools expect. Because it is plain text, one file can hold several objects in sequence, which is how a fullchain file or a CA bundle works, and it survives copy and paste into control panels and configuration management. Knowing that PEM is only a wrapper around DER makes format conversion straightforward.
Example
-----BEGIN CERTIFICATE-----
MIIDdzCCAl+gAwIBAgIUJ3...(Base64, 64 characters per line)...
-----END CERTIFICATE-----
openssl x509 -in example.com.pem -outform DER -out example.com.der
Common misconceptions
- PEM is a type of certificate. It is an encoding; the same certificate can be stored as PEM or DER.
- A .pem file always contains a certificate. It may hold a key, a CSR, a chain, or several of these together.
- Small edits do not matter. Missing dashes, a truncated BEGIN line or deleted characters in the Base64 body make the file unreadable.