What is the CER file format?
A .cer file stores an X.509 public-key certificate used to authenticate websites, servers, and organizations on the internet. Such certificates assure that a website is genuine and can be trusted. They also enable encrypted connections using HTTPS and TLS/SSL protocols for secure browsing.
The .cer extension is a Windows naming convention. The file may hold the certificate in one of two encodings: binary DER or text-based PEM. To tell them apart, open the file in any text editor - a PEM-encoded .cer begins with the header -----BEGIN CERTIFICATE-----, while a DER-encoded file is binary and not human-readable. The same certificate data may also use the .crt, .pem or .der extension, depending on the system or tool that created it.
The process of obtaining a certificate
In order to apply for a certificate, the user or organization must contact a Certificate Authority (CA) - the entity that issues and signs certificates. The certificate issuing process comprises the following steps:
- Certificate registration - formal certificate request
- Payment - payment for the certificate (typically charged on an annual basis); free certificates are also available from authorities such as Let's Encrypt
- Choosing a domain - the user must choose the domain for which the certificate is to be issued
- Verification - formal verification to confirm the identity of the person or organization requesting a certificate
- Issuing of the certificate - the certificate is generated and delivered to the requester
- Certificate installation
Security & safety
RISK: LOWA .cer normally contains only a PUBLIC certificate - it's safe to view and share, and can't execute. The real caution is about TRUST, not malware: installing a certificate into your trust store tells your system to trust whoever it identifies, so only install a root/CA certificate from a source you trust (an unexpected 'install this certificate' request can be an attempt to intercept your encrypted traffic). Also don't confuse a .cer (public) with a .pfx/.p12 or a .key/.pem private key, which ARE secret and must never be shared or uploaded to online converters. Check a certificate's issuer and expiry before relying on it. Inspect/convert locally with OpenSSL rather than online certificate tools.
Format details
in a nutshellFULL NAMESecurity certificate (X.509 .cer)
DEVELOPERITU-T / IETF (X.509 PKI standard); the .cer convention is common on Windowssince X.509 first published 1988; .cer is a long-standing Windows certificate extension
CATEGORYSecurity / Certificate Files
MIME TYPEapplication/x-x509-ca-cert
TYPEX.509 public-key certificate - binary DER or Base64 PEM encoding
STANDARDOpen · royalty-free
This extension is also used by…
- Lahey Fortran compilation error log (legacy) - An obsolete plain-text compiler-error file from old Lahey Fortran tools - the (incorrect) name in this database; essentially never seen today.
- Internet Security Certificate / OS certificate export - Windows and browsers export trusted certificates as .cer - the same X.509 type this KB describes.
MAGIC BYTES · FILE SIGNATURE
OFFSET
0001
HEX
3082
ASCII
0·
A .cer holds an X.509 certificate in one of two encodings, and the extension does NOT tell you which: DER (binary) begins with the ASN.1 SEQUENCE tag 0x30 0x82; PEM (text) begins with the ASCII line '-----BEGIN CERTIFICATE-----' followed by Base64. Open it as text to tell them apart - PEM is readable, DER is binary. The same certificate may carry .cer, .crt, .der or .pem extensions.
Programs that open CER files
Windows3 apps
OpenSSL
Open-source Inspect: 'openssl x509 -in cert.cer -inform der -text -noout' (or -inform pem). Convert DER<->PEM and bundle into .pfx. The universal certificate tool.
Windows Crypto Shell / certmgr (built-in)
Built-in Double-click the .cer to open the certificate viewer (issuer, validity, purpose). Click 'Install Certificate' to add it to the store, or manage via certmgr.msc.
Notepad / any text editor
Open-source Open the .cer as text: if you see '-----BEGIN CERTIFICATE-----' it's PEM (readable Base64); if it's binary gibberish it's DER. Helps decide how to convert it. 
macOS2 apps
Keychain Access (built-in)
Built-in Double-click the .cer to view it and import/trust it in the keychain. macOS shows issuer, validity and trust settings.
OpenSSL / LibreSSL
Open-source In Terminal: 'openssl x509 -in cert.cer -text -noout' to inspect, or convert formats. Pre-installed on macOS (LibreSSL). 
Linux2 apps
OpenSSL
Open-source Pre-installed: 'openssl x509 -in cert.cer -inform der -text -noout' to read a binary .cer, or convert DER<->PEM for use in Apache/Nginx. The standard way to handle certificates.
GNOME/KDE certificate viewers
Built-in Double-click a .cer in the file manager to open the desktop certificate viewer, or import it into the system trust store. Technical details
deep spec| File encoding | Binary DER (ASN.1) or Base64-encoded PEM; the .cer extension alone does not indicate which encoding is used |
| DER magic bytes | 0x30 0x82 at offset 0 (ASN.1 SEQUENCE tag followed by a 2-byte length field) |
| PEM header | Begins with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----; body is Base64 |
| Contents | Public key and certificate metadata only; no private key is stored in a .cer file |
| MIME type | application/x-x509-ca-cert |
| Standard | X.509 v3 (ITU-T X.509 / IETF RFC 5280) |
| Platform convention | Windows-preferred extension for X.509 certificates; .crt is more common on Linux and macOS |
| Certificate types supported | Domain-validated (DV), organization-validated (OV), extended-validation (EV), CA root, and CA intermediate certificates |
| Key certificate fields | Subject DN, Issuer DN, Validity period (Not Before / Not After), Subject Public Key Info, Subject Alternative Names (SAN) |
| Common signature algorithms | RSA-SHA256 (2048 or 4096-bit keys), ECDSA-SHA256 (P-256 / P-384), Ed25519 |
| Inspect with OpenSSL | openssl x509 -in cert.cer -text -noout |
| Convert DER to PEM | openssl x509 -inform DER -in cert.cer -out cert.pem |
| Windows handling | Double-clicking opens the Certificate dialog; certmgr.msc manages the Windows certificate store |
| Related extensions | .crt, .pem, .der and .cert hold the same certificate data; .pfx and .p12 additionally bundle the private key |
| Typical use cases | TLS/HTTPS server authentication, code signing, S/MIME email encryption, client certificate authentication |
| Released | X.509 first published 1988; .cer is a long-standing Windows certificate extension |
| Open standard | Yes · royalty-free |
| Specification | datatracker.ietf.org |
CER conversions
Possible
.CER .PEMGUIDE
Yes, CER converts to PEM - the fastest method is one OpenSSL command: openssl x509 -inform der -in cert.cer…
How to convert
.CER .CRTGUIDE
Yes - in most cases renaming cert.cer to cert.crt is all you need; if the encoding must change, use OpenSSL.
How to convert
.CER .PFXGUIDE
Yes, you can convert CER to PFX using OpenSSL - but only if you have the matching private key file alongside…
How to convert
.CER .DERGUIDE
Yes, converting CER to DER is straightforward with OpenSSL - one command takes under a second.
How to convert
.CER .P7BGUIDE
Yes - one OpenSSL command converts a CER file to P7B in seconds.
How to convert
Community Q&A
asked by usersNo questions yet - be the first to ask about CER files.
Frequently asked questions
What is a .cer file?
A digital security certificate in the X.509 standard. It binds an identity (a website, server, person or software publisher) to a public key and is signed by a Certificate Authority, so software can verify it's genuine. It's the kind of certificate behind the HTTPS padlock.
How do I open a .cer file on Windows?
Double-click it to open the Windows certificate viewer, which shows the issuer, validity dates and intended use. From there you can choose 'Install Certificate' to add it to the certificate store.
Is a .cer file safe to open or share?
Yes, viewing it is safe and a .cer normally holds only the public certificate, which is meant to be shared. Be careful only about installing/trusting a certificate from an untrusted source, and never confuse it with a private-key file (.pfx/.p12/.key), which is secret.
How do I convert a .cer to .pem (for a Linux server)?
If it's binary DER: 'openssl x509 -inform der -in cert.cer -out cert.pem -outform pem'. If it's already Base64 text (starts with -----BEGIN CERTIFICATE-----), it's effectively PEM already - just rename it.
What's the difference between .cer, .crt, .pem and .der?
.cer and .crt both mean 'a certificate'; .der and .pem describe the encoding (DER = binary, PEM = Base64 text). The same certificate can carry any of these extensions - the extension doesn't fix the encoding, so check the file contents.
How do I turn a .cer into a .pfx?
You combine the certificate with its private key: 'openssl pkcs12 -export -in cert.cer -inkey private.key -out out.pfx'. A .cer by itself has no private key, so you need the matching .key file to make a usable .pfx.
References
1RFC 5280 - X.509 Public Key Infrastructure Certificatedatatracker.ietf.org
2Microsoft - Manage certificates (certmgr)learn.microsoft.com
