CRT vs CER: What's the Difference?

This surprises people: .crt and .cer are the same thing — both are X.509 public certificate files. The extension is just naming convention (.crt is common on Linux/Apache, .cer on Windows). What actually differs is the encoding:

  • PEM — Base64 text that starts with -----BEGIN CERTIFICATE-----. Human-readable.
  • DER — binary. Not human-readable.

A .crt or .cer file can be either PEM or DER. So "converting CRT to CER" usually means one of two things: simply renaming the file, or changing the encoding between PEM and DER. Neither format contains a private key — for that you need a .PFX file.

Convert CRT to CER Using the Windows Certificate Export Wizard

If you're on Windows and don't have OpenSSL, the built-in Certificate Export Wizard is the easiest route.

  1. Double-click the .crt certificate file.

    Crt to Cer Certificate

  2. Go to the Details tab and click Copy to File...

    Cer Certificate Copy to File

  3. The Certificate Export Wizard starts. Click Next.

    Certificate Export Wizard

  4. On the Export File Format screen, choose Base-64 encoded X.509 (.CER) for PEM encoding, or DER encoded binary X.509 (.CER) for binary.

    Convert to Cer file

  5. Click Browse, set the file name and path, and finish the wizard.

    Certificate File to Export

Convert CRT to CER Using OpenSSL

OpenSSL gives you precise control over the encoding and works on any OS.

Convert a PEM certificate to DER-encoded .cer:

openssl x509 -in certificate.crt -outform DER -out certificate.cer

Keep it PEM but change the extension to .cer:

openssl x509 -in certificate.crt -outform PEM -out certificate.cer

Convert CER to CRT (the Reverse)

Because the formats are interchangeable, going from .cer back to .crt is the same operation in reverse.

DER .cer to PEM .crt:

openssl x509 -inform DER -in certificate.cer -outform PEM -out certificate.crt

If the .cer is already PEM, you can simply rename it to .crt — the content is identical.

Related Certificate Conversions

Frequently Asked Questions

Is a .CRT file the same as a .CER file?

Essentially yes. Both hold an X.509 public certificate. The difference is only the file extension convention and the encoding inside — PEM (Base64 text) or DER (binary). A .crt and a .cer can each be either encoding.

How do I know if my certificate is PEM or DER?

Open it in a text editor. If you see -----BEGIN CERTIFICATE----- and Base64 text, it's PEM. If it's unreadable binary, it's DER. PEM files can be safely renamed between .crt, .cer, and .pem.

Does converting CRT to CER include the private key?

No. Neither .crt nor .cer contains a private key — they hold only the public certificate. To package the certificate together with its private key, convert to PFX.

Can I convert CRT to CER without OpenSSL?

Yes. On Windows, double-click the .crt, go to Details → Copy to File, and use the Certificate Export Wizard to save it as a Base-64 or DER-encoded .cer.