PEM
Privacy Enhanced Mail (PEM) is a Base64-encoded format for storing cryptographic keys, certificates, and other security-related data. Despite its name, PEM is widely used beyond email applications for various cryptographic purposes. The encoding is defined by RFC 7468.
Structure Format
| Component | Description | Example |
|---|---|---|
| Begin Marker | Header identifying content type | -----BEGIN CERTIFICATE----- |
| Headers | Optional key-value metadata pairs | Proc-Type: 4,ENCRYPTED |
| Encoded Data | Base64-encoded binary content | MIIHzTCCBbWgAwIBAgIQaBYE3/M08XHYCnNVmcFBcjANBgkqhkiG9w0BAQsFADBy... |
| End Marker | Footer matching the begin marker | -----END CERTIFICATE----- |
Common PEM Types
RFC 7468 Standard Types
| Type | Begin/End Label | Description | Use Case |
|---|---|---|---|
| Certificate | CERTIFICATE | X.509 public key certificate | SSL/TLS, code signing |
| Certificate Revocation List | X509 CRL | X.509 certificate revocation list | Certificate validity checking |
| Certificate Request | CERTIFICATE REQUEST | PKCS#10 certificate signing request | Certificate authority requests |
| Private Key | PRIVATE KEY | PKCS#8 unencrypted private key | General-purpose private key storage |
| Encrypted Private Key | ENCRYPTED PRIVATE KEY | PKCS#8 encrypted private key | Password-protected private key storage |
| Public Key | PUBLIC KEY | X.509 SubjectPublicKeyInfo | Public key distribution |
| PKCS#7 Message | PKCS7 | Legacy cryptographic message syntax | Certificate chains, signed data (legacy) |
| CMS Message | CMS | Cryptographic Message Syntax | Certificate chains, signed data (modern) |
| Attribute Certificate | ATTRIBUTE CERTIFICATE | X.509 attribute certificate (RFC 5755) | Authorization attributes |
Algorithm-Specific Types (OpenSSL)
| Type | Begin/End Label | Description | Use Case |
|---|---|---|---|
| RSA Private Key | RSA PRIVATE KEY | PKCS#1 RSA private key | RSA-specific private keys |
| RSA Public Key | RSA PUBLIC KEY | PKCS#1 RSA public key | RSA-specific public keys |
| DSA Private Key | DSA PRIVATE KEY | DSA private key | DSA cryptography |
| EC Private Key | EC PRIVATE KEY | Elliptic Curve private key | EC cryptography |
| DH Parameters | DH PARAMETERS | Diffie-Hellman parameters | Key exchange configuration |
Encrypted PEM Format
The headers below predate RFC 7468 and are defined by RFC 1421. They appear on legacy OpenSSL-encrypted keys.
| Field | Description | Example |
|---|---|---|
| Proc-Type | Processing type and encryption flag | Proc-Type: 4,ENCRYPTED |
| DEK-Info | Encryption algorithm and IV | DEK-Info: AES-256-CBC,A1B2C3D4E5F6... |
| Encrypted Data | Base64-encoded encrypted content | Encrypted binary data... |
Types Used by DataStream
Of the types listed above, the following are the ones DataStream reads and writes.
| Label | Read | Written | Context |
|---|---|---|---|
CERTIFICATE | Y | Y | TLS certificates. The only label accepted when reading a certificate—other blocks in a bundle are skipped |
PRIVATE KEY | Y | Y | PKCS#8 keys. What -pfx2pem writes, and what a PKCS#8 encrypted key is re-emitted as once decrypted |
ENCRYPTED PRIVATE KEY | Y | N | PKCS#8 encrypted keys, decrypted with the configured passphrase |
RSA PRIVATE KEY | Y | Y | PKCS#1 keys, including legacy Proc-Type/DEK-Info encrypted ones. A legacy-encrypted key is re-emitted under its own original label, not converted to PRIVATE KEY |
EC PRIVATE KEY | Y | Y | Elliptic-curve keys. Written only for ephemeral self-signed TLS |
ECDSA PRIVATE KEY | Y | N | Accepted as a synonym of EC PRIVATE KEY |
PUBLIC KEY | Y | Y | PKIX public keys, used for signature verification |
The Director's -pfx2pem option converts a PFX bundle into exactly two files: key.pem, holding a PRIVATE KEY block, and cert.pem, holding the leaf CERTIFICATE. Both are written to the current directory. Intermediate and root certificates in the bundle are not written.
The conversion checks the leaf certificate first and refuses to write anything when it has expired or is not yet valid. An unknown signing authority is not a reason to refuse — a self-signed bundle converts normally.
Example Structure
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-256-CBC,A1B2C3D4E5F67890A1B2C3D4E5F67890
MIIEpAIBAAKCAQEA2Z3QX0KZVE9I+sLlmEUKkYgJiEQSvfNF6JUVNBQdHPvs
kNkRFWGLQQEjLXPOCjGhvQZZLvbPjVZGKlnTJ1yJQvzjhvnP0zJhExFmKWz8
...
-----END RSA PRIVATE KEY-----
PEM files are text-based, human-readable, and can contain multiple objects separated by blank lines. They're commonly used in web servers, email systems, and various security applications.