PEM
acronymcryptographysecurity
Stands for: Privacy-Enhanced Mail
A Base64 text wrapper for certificates and keys, with BEGIN/END lines.
Privacy-Enhanced Mail (RFC 7468) is the familiar `-----BEGIN CERTIFICATE-----` text format. Despite the mail-era name, it is now the standard way to store and paste DER-encoded certificates and keys as ASCII.
PEM is the format certificates and keys usually arrive in: base64 wrapped between BEGIN and END lines that name what the block contains. The armour exists because binary DER survives copying and pasting badly, and PEM is what made it possible to email a certificate without corrupting it.
The label on the header is the part worth reading carefully. CERTIFICATE, PRIVATE KEY, RSA PRIVATE KEY and PUBLIC KEY are different things, and the classic incident is a private key pasted where a certificate belonged, or a chain assembled in the wrong order. Order matters: the server certificate comes first, then intermediates toward the root, and a chain assembled backwards produces validation failures that look like expiry problems.
The failure modes are pedestrian and frequent. Windows line endings inside a PEM file break some parsers, a missing trailing newline breaks others, and an invisible character introduced by a word processor breaks everything. When a certificate that is definitely correct is definitely rejected, decoding the file to inspect what it actually contains resolves it faster than re-issuing.
Also known as: pem