📖 What is a CRT File?
A CRT file is a security certificate. It uses the .crt extension, and it holds a digital certificate that lets a website prove who it is and set up an encrypted connection with your browser.
When you visit a site and see the padlock in the address bar, a certificate like this is doing the work behind it. The file follows the X.509 standard, the shared rulebook for this kind of certificate, and it contains the site's public details along with the signature of the authority that vouched for it.
The important thing to hold onto is what a .crt does and does not carry. It holds the public certificate, the part meant to be shared openly, and nothing secret. That single fact shapes almost everything else about the file, from how safely you can send it to how it differs from the bundles used on some servers.
Key Characteristics
- A digital certificate, following the X.509 standard
- Holds the public part, safe to share
- Identifies a website, to a visiting browser
- Signed by an authority, that vouches for it
Good to Know
- Carries no secret key, unlike a .pfx bundle
- Content can be text or binary, two encodings
- Central to HTTPS, the secure web
- Often paired, with a separate key file
⚡ Quick Facts
| File Extension | .crt |
| Purpose | Security certificate |
| Standard | X.509 |
| Holds | A public certificate, no private key |
| Encodings | PEM text or DER binary |
| Used For | HTTPS and secure connections |
| Issued By | A certificate authority |
| Related Extensions | .cer, .pem, .pfx |
🔍 What It Holds
A certificate is really a small record of identity, signed so it can be trusted. Reading one, you find a handful of clear parts.
The Subject
Who the certificate is for, such as the website name it belongs to.
The Issuer
The authority that checked the details and signed the certificate.
The Public Key
The shareable key others use to encrypt data meant for the holder.
The Validity
The dates between which the certificate counts as current and trusted.
Notice what is absent from that list. The matching private key, the secret half that must never be shared, lives outside the .crt in its own protected file. A certificate proves identity and hands out a public key, and it does that job precisely because the secret stays elsewhere.
🔡 PEM vs DER
Here is the point that trips people up most. The .crt extension tells you the file is a certificate, but not how that certificate is written down. There are two ways, and a .crt can use either.
A PEM certificate, opened in a text editor
# readable text between clear markers -----BEGIN CERTIFICATE----- MIIDdzCCAl+gAwIBAgIEbGFt... ...encoded certificate data... -----END CERTIFICATE-----
The first way is PEM, which stores the certificate as text. Open a PEM file and you see readable lines wrapped between a BEGIN and END marker, with the certificate itself as a block of Base64 letters and numbers. The second way is DER, which stores exactly the same certificate as compact binary instead, so a text editor would display only unreadable symbols. Both hold identical information, just written differently.
⚖️ CRT vs PFX
The clearest way to understand a .crt is to compare it with a .pfx, because the two are often confused yet play opposite roles around the same secret.
| Point | CRT | PFX |
|---|---|---|
| Holds the certificate | ✓ | ✓ |
| Holds the private key | ✗ never | ✓ yes |
| Safe to share openly | ✓ | ✗ keep secret |
| Password protected | ✗ not needed | ✓ usually |
A .pfx bundles the certificate together with its private key in one password-protected file, which is why it must be guarded carefully and never sent around freely. A .crt is the public certificate on its own, with no key inside, so it can be handed out without worry. Put simply, a .crt is the part you show the world, while a .pfx holds the secret that proves you own it.
🔀 CRT vs CER
You will also meet the very similar .cer extension, and the difference between the two is smaller than it looks.
Both .crt and .cer name a certificate file, and both can hold either PEM or DER content. The split is mostly a matter of habit across systems, since the .crt name grew up in the Unix and Linux world, while .cer is more common on Windows. In day-to-day use they are close to interchangeable, and if a tool insists on one, renaming the file from .cer to .crt or back usually satisfies it, since the contents are the same either way.
🔗 The Certificate Chain
A certificate rarely stands alone. A browser trusts one because it links back, step by step, to an authority the browser already trusts. That sequence is the chain of trust, and understanding it explains most real certificate trouble.
The chain has three parts. Your website's own certificate is the leaf, the one at the end. It was signed by an intermediate certificate, which was in turn signed by a root certificate belonging to a trusted authority. A browser follows this path from your leaf up to a root it recognises, and only then shows the connection as secure. The root is already built into browsers and devices, so it does not travel with your site, but the intermediate does have to be sent.
Combining a leaf and intermediate into one file
# leaf certificate first, then the intermediate $ cat your_domain.crt intermediate.crt > fullchain.crt
This is why servers often want a combined file. A tool like Nginx expects your leaf and the intermediate joined into a single certificate file, with your own certificate first and the intermediate below it. Apache instead keeps the leaf and the chain in separate settings. Get the order right and the chain holds, so every visitor sees a trusted connection.
📂 How to Open a CRT File
Opening a certificate is easy, and how you do it depends on whether you want to read its details or check its raw contents.
Double-click it
On Windows a double-click opens the certificate viewer, showing the issuer, dates and fingerprint.
A text editor
If the file is PEM, any text editor reveals its readable BEGIN and END markers.
The OpenSSL tool
OpenSSL prints a certificate's details in full, whichever encoding it uses.
Reading a certificate with OpenSSL
# show the certificate details as readable text $ openssl x509 -in cert.crt -text -noout
🔄 Converting a Certificate
Different servers expect certificates in different shapes, so converting a .crt from one encoding to another is a routine part of setting one up.
The most common need is turning a .crt into PEM, because many servers, including Apache and Nginx, expect that text form. If your .crt is already PEM, this is barely a conversion at all, since the content is the same and only the label changes. If it is DER, a single OpenSSL command rewrites it as PEM. The same tool moves a certificate the other way, or bundles a .crt together with its private key into a .pfx for platforms like Windows IIS that want the pair in one file.
Converting a DER certificate to PEM
# rewrite a binary certificate as text $ openssl x509 -inform DER -in cert.crt -out cert.pem
🌐 How Certificates Are Used
Seeing where a .crt fits in day-to-day use makes the file far easier to understand. Its main home is the secure web.
When a browser connects to a secure site, the server presents its certificate to prove it is genuine. The browser checks that a trusted authority signed it and that it has not expired, then uses the public key inside to help set up an encrypted channel. On the server, the certificate usually sits beside a separate private key file, and the two work as a pair, so the certificate is shown to everyone, while the key stays hidden. Certificates also secure email, sign software and protect other kinds of connection, but the padlocked website is where most people meet one.
One more distinction is worth knowing. A certificate signed by a recognised authority is trusted automatically, while a self-signed certificate, one an owner signs themselves, is not, so a browser warns about it. Self-signed certificates are fine for testing or internal tools, but a public site needs one from a trusted authority to avoid that warning.
🛠️ Common Issues
Most certificate trouble comes down to the wrong encoding, a missing companion file, or a lapse in dates. The usual cases are quick to spot.
| Server rejects it | The certificate is in the wrong encoding. Many servers want PEM, so a DER .crt needs converting first. |
| Looks like gibberish | You opened a DER certificate in a text editor. That is normal for binary, so use a viewer or OpenSSL instead. |
| Not trusted warning | A needed intermediate certificate is missing, or the issuer is not trusted. The full chain has to be present. |
| Expired certificate | The validity dates have passed. An expired certificate must be renewed and replaced, not simply reopened. |
🔀 Related Formats
A .crt sits among a family of certificate and key formats that often appear together.
.cer | A close cousin, another name for a certificate file, more common on Windows. |
.pem | The text encoding itself, a container that can hold a certificate, a key, or both. |
.der | The binary encoding, the same certificate stored in a compact non-readable form. |
.key | The separate private key file, the secret partner a certificate is paired with. |
.pfx | A password-protected bundle of a certificate and its private key in one file. |
❓ Frequently Asked Questions
How you open a .crt depends on what you want to see. On Windows, a double-click opens the built-in certificate viewer, which shows who the certificate is for, who issued it and when it expires. If the file is in the text PEM encoding, any text editor shows its contents between the BEGIN and END markers. And the OpenSSL tool prints a certificate's full details on any system, whichever encoding the file uses. You do not need special software just to inspect one.
A CRT file is a security certificate, using the .crt extension, that helps a website prove its identity and set up an encrypted connection with your browser. It follows the X.509 standard and holds the public certificate, made up of the subject it belongs to, the issuer that signed it, a public key and the validity dates. Importantly it holds no private key, only the public part meant to be shared. A certificate like this is what sits behind the padlock you see on a secure site.
No, and this is the most important thing to know about it. A .crt holds only the public certificate, the part designed to be shared openly. The matching private key, the secret half, is kept in a separate file and must never be shared. This is exactly what separates a .crt from a .pfx bundle, which does contain the private key alongside the certificate. Because a .crt carries no secret, it is generally safe to send or publish.
They describe different things, which is why the pairing confuses people. CRT is a file extension that says the file is a certificate. PEM is an encoding, a way of writing that certificate as readable text between BEGIN and END markers. A .crt file is often stored in PEM encoding, but it can also be stored in the binary DER encoding instead. So a certificate can be both a .crt and PEM at once, because the two words are answering different questions about the same file.
Again, these are two different kinds of thing. CRT is the file extension, while DER is one of the two encodings a certificate can use, the compact binary one. A .crt file might contain DER-encoded data, or it might contain the text PEM encoding instead. If you open a .crt in a text editor and see scrambled characters rather than readable BEGIN and END lines, you are looking at DER. Converting it to PEM with a tool like OpenSSL makes it text.
If your .crt is already in the text PEM encoding, there is almost nothing to do, since the content is identical and only the label differs, so copying it to a .pem name is enough. If the .crt is in the binary DER encoding, a single OpenSSL command rewrites it as PEM. The reason this comes up so often is that many servers, including Apache and Nginx, expect certificates in the PEM text form, so a DER certificate has to be converted before it will install.
Very little, in practice. Both name a certificate file, and both can hold either PEM text or DER binary content. The difference is mostly a naming habit across systems, with .crt more common on Unix and Linux, while .cer turns up more on Windows. They are close to interchangeable, so if a tool wants one and you have the other, renaming the file between .crt and .cer usually works, because the contents inside are the same.
Generally yes, because a .crt holds only the public certificate, which is meant to be shared. A website hands its certificate to every visitor as a normal part of connecting, so the public part is not a secret. What must stay private is the separate key file that pairs with the certificate. As long as you are sharing only the .crt and not that key, or a .pfx bundle that contains the key, sending a certificate around is not a risk.
Because you have opened a DER certificate, which is stored as binary rather than text. Unlike a PEM certificate, which shows readable lines between BEGIN and END markers, a DER file looks like scrambled characters in a text editor, and that is completely normal. To read its details, open it in a certificate viewer by double-clicking, or run it through OpenSSL, both of which understand the binary form. You can also convert it to PEM if you need the text version.
The usual reason is that the certificate is in the wrong encoding for that server. Many servers expect the text PEM form, so a certificate saved as binary DER is refused until it is converted. Another common cause is a missing intermediate certificate, which leaves the chain of trust incomplete and produces a not-trusted warning. Checking that the .crt is PEM encoded and that any intermediate certificates are included usually clears the problem.
Several built-in and free tools handle a .crt. On Windows the certificate viewer opens with a double-click and shows the certificate's details. On macOS the Keychain Access app imports and displays certificates. A plain text editor reads any PEM-encoded certificate, and the cross-platform OpenSSL tool prints the details of a certificate in either encoding. Web browsers also let you view the certificate of a site you are visiting through the padlock in the address bar.
A certificate chain is the sequence that links your certificate back to an authority a browser trusts. It runs from your own certificate, the leaf, up through one or more intermediate certificates, to a root certificate held by a trusted authority. A browser follows this path upward, and only trusts your site if it reaches a root it recognises. The root is already built into browsers, so it does not travel with your site, but the intermediate does need to be sent alongside your leaf certificate.
Some servers want your leaf certificate and the intermediate joined into one file. You place your own certificate first, then the intermediate below it, saving the result as a single certificate file, which for Nginx is often called a fullchain file. The order matters, with your certificate at the top. Apache takes a different approach, keeping the leaf in one setting and pointing to the chain in a separate one. Either way, the aim is the same, giving the browser a complete path up to a trusted root.
A CA-issued certificate is signed by a recognised certificate authority, so browsers trust it automatically and show the padlock without complaint. A self-signed certificate is one the owner signs themselves, with no outside authority vouching for it, so a browser cannot trace it to a trusted root and warns the visitor. Self-signed certificates are perfectly useful for testing or for internal tools where you control the machines, but a public website needs a CA-issued certificate to avoid the warning.
📝 Summary
A CRT file is a security certificate, using the .crt extension, that lets a website prove its identity and set up an encrypted connection with a browser. It follows the X.509 standard and holds the public certificate, made up of the subject, the issuer that signed it, a public key and the validity dates. The single most important point is that a .crt holds no private key, only the public part meant to be shared, which is why it is generally safe to send and what sets it apart from a .pfx bundle that packs the certificate together with its secret key. The extension names the file as a certificate but not how it is written, since a .crt can be stored in the readable PEM text encoding or the compact binary DER encoding, and opening it in a text editor tells you which. Its close cousin .cer is nearly the same file under a different naming habit. You open a .crt by double-clicking to view its details, in a text editor when it is PEM, or with OpenSSL for any encoding, and you convert between encodings, most often DER to PEM for servers like Apache and Nginx, using OpenSSL. Throughout, the certificate is public while the separate key file stays private.