Signing Certificate File Formats: Containers and Encodings

The distinction between certificate content, private-key containers and the textual or binary encoding used to store them.

Sarah Mitchell

Published on

2026-11-06

Last updated on

PFX/P12 commonly package PKCS #12 data and may include private keys.
PEM and DER describe encodings; the extension alone does not determine contents.
Changing a file format does not establish certificate trust or qualification.

What are signing certificate file formats?

Signing certificate file formats describe how certificates and related material are packaged or encoded. The file extension is not enough to determine whether a file contains only public information or also includes a private key.

PFX, P12 and PKCS #12

PFX and P12 commonly identify a PKCS #12 container. RFC 7292 describes a transfer syntax capable of holding certificates, private keys and other information under different protection modes.

Such a container may hold a signing key and certificate chain, but it need not contain a private key in every case. Do not infer its contents or protection merely from the extension. This differs from an ordinary public-key certificate, which does not itself contain the private signing key.

PEM and DER

DER is a binary encoding used for ASN.1 structures. PEM-style textual encoding represents relevant data in base64 with labeled boundaries, such as CERTIFICATE or PRIVATE KEY. RFC 7468 specifies textual encodings for these different objects.

A PEM file is therefore not automatically certificate-only. Labels and actual contents matter, and extensions such as CER or CRT can be used for certificates with different encodings.

Does the format establish trust?

No. Packaging, encoding and trust answer different questions. Converting an encoding does not make an untrusted certificate trusted or create QES status. Evaluate the issuer chain, status and intended use separately.

Handle a container according to what it contains, especially any private signing key. File-format knowledge is not evidence that a particular signing application supports importing it; check supported workflows rather than assume every certificate or key file should be uploaded.

A Common Case: Identifying a credential package

A Pennsylvania legal-services firm might receive a credential package labeled P12 while preparing a signing workflow. Staff would identify whether it contains private-key material and what the intended application supports, rather than treat it as an ordinary public certificate suitable for unrestricted sharing.