Verified by SSL Insights Editorial Team - Last reviewed: July 2026 | Based on 10+ years across SSL/TLS and web security.
Quick Answer
.CER and .CRT are file extensions for the same thing: an X.509 digital certificate. The difference is encoding, not content - CER defaults to binary DER, CRT defaults to Base64 PEM. Installing the wrong encoding on a server is the most common reason a certificate "won't load" even though the file itself is valid.
CER and CRT files store identical certificate data - the distinction is encoding and platform habit, not format superiority. CER files typically use binary DER encoding and are the Windows default. CRT files typically use Base64 PEM (readable ASCII text) and are the default on Linux/Unix servers like Apache and Nginx. Converting between them is routine when a certificate crosses from one ecosystem to another, and OpenSSL handles it in one command.
What Is the Difference Between .CER and .CRT Files?
Both a .CER file and a .CRT file store an X.509 digital certificate - the structure defined in RFC 5280, the IETF standard for public key infrastructure. The extension doesn't determine the encoding; it only signals which platform generated it.
CER files default to binary DER (Distinguished Encoding Rules) - compact, and unreadable in a text editor. Windows tools, including IIS and Microsoft Certificate Manager, produce and expect .CER by default.
CRT files default to Base64 PEM (Privacy Enhanced Mail) - ASCII text wrapped between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----. Apache, Nginx, and most Linux/Unix stacks expect .CRT.
Is a CER file binary or text?
It depends on how it was exported - CER is usually DER (binary) but can be PEM (text) if the issuing tool encoded it that way. The only reliable check is opening the file, not trusting the extension.
| Feature | .CER File | .CRT File |
| Default Encoding | Binary DER | Base64 PEM (ASCII text) |
| Readable in Text Editor | No (binary) | Yes |
| Native Platform | Windows / IIS | Linux / Unix (Apache, Nginx) |
| Portability | Lower (binary format) | Higher (plain text) |
| Java Compatibility | Yes (DER) | Yes (PEM) |
| PEM header visible? | Only if PEM-encoded | Yes, by convention |
Hidden Difference A .CER file that opens as readable text starting with -----BEGIN CERTIFICATE----- is functionally a .CRT file wearing a different label - the extension never guarantees the encoding.
For the full X.509 certificate structure these files carry, the underlying ASN.1 fields are identical regardless of which encoding wraps them.
Why Do You Need to Convert Between CER and CRT?
Conversion becomes necessary whenever a certificate crosses environments:
- A Windows server exports .CER, but the target is Apache or Nginx expecting .CRT (PEM).
- A Linux box generates .CRT, but it needs importing into Windows Certificate Manager or IIS.
- A Java application or email system requires DER binary, but the CA delivered PEM.
- Someone needs to inspect certificate contents in a text editor - only possible in PEM.
Renaming a .CER to .CRT does not convert it. The extension is a label; the encoding is a separate, actual re-encoding of the certificate data. OpenSSL and Windows certutil do this correctly - a file manager rename does not.
For broader format conversions, see converting CRT to PEM, DER to PEM, and CER to PFX, and for Apache-specific guidance, do I need to convert .CER to .CRT for Apache SSL certificates?
How Do You Convert CER to CRT Using OpenSSL?
OpenSSL is the standard cross-platform tool - pre-installed on most Linux distributions and macOS, and usable on Windows via WSL.
Convert DER-encoded .CER to PEM-encoded .CRT:
openssl x509 -inform DER -in certificate.cer -out certificate.crt
If your .CER file is already Base64 PEM-encoded (you can confirm by opening it in a text editor and looking for -----BEGIN CERTIFICATE-----), omit the -inform DER flag:
openssl x509 -in certificate.cer -out certificate.crt
Convert PEM-encoded .CRT to DER-encoded .CER:
openssl x509 -in certificate.crt -outform DER -out certificate.cer
How do you verify a certificate after conversion?
openssl x509 -in certificate.crt -text -noout
If it prints readable Subject, Issuer, and Validity fields, the conversion succeeded.
In practice, most conversion "failures" reported to SSLInsights turn out to be a missed -inform flag rather than a corrupted certificate - running the file through the verify command first saves a support ticket.
How Do You Convert CRT to CER on Windows?
Windows ships two built-in paths.
Using certutil (Command Prompt, run as Administrator)
What certutil command converts CRT to CER?
certutil -encode input.crt output.cer
And the reverse - CER to CRT:
certutil -decode input.cer output.crt
Using Certificate Manager (GUI)
- Open the certificate file by double-clicking it.
- Go to Details → Copy to File.
- The Export Wizard will open - select your target format: DER encoded binary (.CER) or Base64 encoded (.CRT).
- Save the exported file.
The GUI method is useful when you need to export certificates stored in the Windows certificate store, not just standalone files.
How Do You Convert CER and CRT Files on Linux?
On Linux, OpenSSL handles all conversions. The commands follow the same pattern - specify the input format with -inform and the output format with -outform.
CRT to CER (PEM to DER):
openssl x509 -inform PEM -in input.crt -outform DER -out output.cer
CER to CRT (DER to PEM):
openssl x509 -inform DER -in input.cer -outform PEM -out output.crt
If you are unsure of the input encoding, test it first:
openssl x509 -in yourfile.cer -text -noout
Readable output means PEM. A parsing error means add -inform DER and retry - this single check prevents most installation failures before they happen.
For a wider command reference, see common OpenSSL commands, and for generating the underlying private key and CSR these certificates pair with, see the cPanel guide.
When Should You Use .CER vs .CRT?
Does Windows accept CRT files? Platform context decides:
- Use .CER when working with Windows environments - IIS, Active Directory Certificate Services, or any Microsoft product. Windows tooling generates and expects .CER by default, usually in DER binary format.
- Use .CRT when configuring Linux or Unix servers - Apache, Nginx, Lighttpd, or any server that reads PEM-encoded certificates. The .CRT extension with Base64 PEM encoding is the default expectation for these environments.
- Use either when the encoding matches what the application requires and you verify it before installation. Apache, for instance, will accept a .CER file if it is actually PEM-encoded - the extension is secondary to the actual encoding format.
Can Apache accept a CER file?
Yes - if it's actually PEM-encoded. Apache reads the content, not the extension. Check the file contents before installing: PEM shows -----BEGIN CERTIFICATE----- in a text editor; DER appears as binary characters.
Decision Tip: When a CA delivers a certificate with an unfamiliar extension, don't guess from the filename - run the OpenSSL verify command once and let the output tell you the real encoding.
What Are Common CER/CRT Conversion Errors and How Do You Fix Them?
- Wrong input encoding specified: Running openssl x509 -in file.cer on a DER binary file will fail. Always inspect first with openssl x509 -in file -text -noout and add -inform DER if that fails.
- File extension mismatch after conversion: Some systems reject certificates where the extension does not match the encoding. After converting, rename the file extension to match the new format (.cer for DER, .crt for PEM).
- Permission errors on Linux: Certificate directories (e.g., /etc/ssl/) require root privileges. Run conversion commands with sudo or switch to root.
- Corrupted or truncated file: If a certificate was copied via email or a text editor that auto-wrapped lines, the Base64 encoding may be corrupted. Re-download or re-export the certificate from the CA before retrying.
- Expired certificate: OpenSSL will convert an expired certificate without error, but the server will reject it at installation. Verify validity with openssl x509 -in certificate.crt -noout -dates before proceeding.
- Invalid certificate: If the original file is damaged or from an untrusted source, conversion will not produce a usable result. Always start with a valid certificate from your CA.
Best Fit Scenario: Mixed-environment deployments - a Windows CA issuing certificates for a Linux-hosted app, or vice versa - are where CER/CRT mismatches show up most often. Building the conversion step into the deployment checklist avoids last-minute format scrambles.
For related PFX certificate packaging, or a full list of other SSL file extensions you may encounter, SSLInsights maintains dedicated guides.
Frequently Asked Questions (FAQs) About CER and CRT Files
Are .CER and .CRT files the same?
They contain identical certificate data - both store X.509 certificates. The difference is encoding and platform convention. CER files default to binary DER encoding on Windows; CRT files default to Base64 PEM encoding on Linux. The extensions are labels, not format guarantees.
Can you just rename a .CRT file to .CER?
No. Renaming only changes the file extension label - it does not re-encode the data. A Windows system expecting DER binary format will reject a file that is Base64 PEM regardless of its extension. Use OpenSSL or certutil to actually convert the encoding.
What is DER encoding in a certificate file?
DER (Distinguished Encoding Rules) is a binary encoding format for ASN.1 data structures. Certificate files in DER format are more compact than PEM but cannot be read in a text editor. They are common on Windows and Java platforms.
What is the difference between PEM and CER?
PEM is an encoding format (Base64 ASCII with header/footer lines). CER is a file extension. A CER file can be either DER-encoded (binary) or PEM-encoded (Base64). The quickest way to tell: open the file in a text editor. If it shows -----BEGIN CERTIFICATE-----, it is PEM-encoded despite the .CER extension.
How do you convert CER to CRT without OpenSSL?
On Windows, use certutil -decode input.cer output.crt from an elevated Command Prompt. Alternatively, use the Windows Certificate Manager GUI and export via the Export Wizard selecting Base64 encoding. Online converters exist but are not recommended for production certificates due to security risks.
Which format should you use for Apache SSL installation?
Apache expects PEM-encoded certificates, typically with the .CRT extension. If you receive a .CER file from your CA, verify its encoding first. If it is DER binary, convert it with openssl x509 -inform DER -in certificate.cer -out certificate.crt before installation.
Final Thoughts
CER and CRT aren't competing formats - they're two labels for the same X.509 certificate, wearing different encodings by platform habit. The fix for a mismatch is never renaming the file; it's re-encoding it with OpenSSL or certutil, and confirming the result with a verify command before it goes anywhere near a production server.
Priya Mervana
Verified Web Security Experts
Priya Mervana is working at SSLInsights.com as a web security expert with over 10 years of experience writing about encryption, SSL certificates, and online privacy. She aims to make complex security topics easily understandable for everyday internet users.
