DER
acronymcryptographysecurity
Stands for: Distinguished Encoding Rules
A strict binary encoding for X.509 certificates and keys.
Distinguished Encoding Rules (ITU-T X.690) is a canonical binary form of ASN.1 structures. Certificate signatures are computed over the DER bytes, and PEM is just DER wrapped in Base64 with header lines.
DER is the binary encoding certificates and keys are actually defined in, and PEM is that binary wrapped in base64 with header lines so it survives being copied and pasted. Understanding that relationship resolves most confusion about certificate file formats: they are frequently the same content in two dresses.
The distinguished part of the name matters more than it sounds. DER is a canonical encoding, meaning any given structure has exactly one valid byte representation, and that property is what makes signatures verifiable at all. If the same certificate could be encoded two different ways, the hash would differ and the signature would not check out, so canonicality is a requirement rather than an elegance.
The practical consequence is file extensions lie. A .crt, .cer or .key file may hold either encoding, and tools accept different ones, which is why the first useful troubleshooting step is inspecting what a file actually contains rather than trusting its name. Conversion between the two is lossless and takes one command, so a rejected file is far more often the wrong encoding than a wrong certificate.
Also known as: der