THE GARDEN

PEM & DER (ASN.1 Encoding)

Updated 13 Sep 2026

• •

  What it is

  • •

    ASN.1 is a schema language for describing structured data (like "an RSA key has a modulus and an exponent"); DER is a specific, canonical binary encoding rule for serializing ASN.1 values. PEM is just DER data, Base64-encoded and wrapped in a one-line -----BEGIN X----- / -----END X----- header and footer that tells a parser what's inside (an RSA key, a certificate, etc.).

• •

  When to apply

  • •

    You're handed a .pem (text, with BEGIN/END markers) or .der (raw binary) file containing a key or certificate. Use a library rather than hand-parsing — PyCryptodome's RSA.importKey() / RSA.import_key() understands both PEM and DER directly, and openssl can inspect or convert between them from the command line.

• •

  Worked example

  • •

    Stripping the PEM header/footer and Base64-decoding the body of a -----BEGIN RSA PUBLIC KEY----- block yields the exact same bytes as the equivalent .der file for that key.

• •

  Python

  • •

    from Crypto.PublicKey import RSA
    key = RSA.importKey(open("key.pem", "rb").read())   # also works directly on .der bytes
    print(key.n, key.d)   # modulus, private exponent (if present)
    

• •

  Bash

  • •

    openssl x509 -inform der -in cert.der -noout -modulus
    openssl rsa -in key.pem -text -noout
    

• •

  Related

  • •

    Base64

  • •

    X.509 Certificate

  • •

    SSH Public-Private Key Format

• •

  Cards

  • •

    What's the relationship between PEM and DER?

    • •

      PEM is Base64-encoded DER data wrapped with a BEGIN/END header and footer identifying its contents.

  • •

    What library call reads both PEM and DER RSA keys directly in Python?

    • •

      Crypto.PublicKey.RSA.importKey() / RSA.import_key().

◌ Explore connections in Graph view