Can extensions .pem and .crt be used interchangeably? - certificate

Question

I have an authority certificate generated in PEM encoding. Does it mean I can call it both ca.pem and ca.crt? Can .crt and .pem mean the same thing? Or are they actually different formats?

Answer 1

To a file, file names and extensions don't matter.
Windows does maintain an association of extensions to semantic types (and semantic types to what-to-do-with-this), which is the ftype/assoc system.
C:\>assoc .cer
.cer=CERFile
C:\>ftype CERFile
CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
We can also ask "What are all of the associations?", and filter that:
C:\>assoc | findstr CERFile
.cer=CERFile
.crt=CERFile
.der=CERFile
So Windows will treat any of .cer, .crt, and .der the same.
PEM, on the other hand, is not a default association:
C:\>assoc .pem
File association not found for extension .pem
In general, a ".pem" would suggest that it is some data in the Privacy Enhanced Mail (PEM) format, which is
(Beginning of file or a newline)
5 hyphens
BEGIN
a space
One or more characters ending in not-a-space
5 hyphens
A newline
Base64 data, formatted 64 characters to a line
A newline
5 hyphens
END
a space
The same string as in BEGIN
5 hyphens
Newline or end-of-file
The word(s) identify the data format, which is then used by the reader. For a certificate, for example, that's "BEGIN CERTIFICATE".
Certificates really are defined in a binary syntax called DER (Distinguished Encoding Rules (for ASN.1 data)). Certificate processors ultimately need the binary data (which is what got base64-encoded), but they can differ on whether they expect DER or PEM data. To many Windows APIs the certificate can be presented in either form and the underlying system content sniffs to figure out which format the data is in.
There's no real standard or heuristic for if .cer, .crt, or .der is PEM or DER data; though one would sort of expect .der to be DER :). (But lots of things are DER-encoded; not just certificates)
Does it mean I can call it both ca.pem and ca.crt?
If you're loading things by filename, it probably doesn't matter. If you're using OpenSSL commandline tools it definitely doesn't matter (but they want the data to be PEM encoded by default).
If you're on Windows and you want double-clicking to work, you want .cer or .crt.