DER and CER Certificates

What is the difference between DER and CER encoded certificates?  CompTIA added these into the SY0-501 version of the Security+ exam, so if you plan to take it, you should have a good understanding of these encoding types. The primary differences are:

• Canonical Encoding Rules (CER) files are stored as ASCII files
• Distinguished Encoding Rules (DER) files are stored as binary files

However, it is important to understand that the extension doesn’t necessarily tell you what encoding rules were implemented to create the certificate file. In other words, an extension of .cer doesn’t necessarily indicate that the file is using Canonical Encoding Rules (CER).

What is Base-64 Encoding?

CER certificate files are stored using a base-64 encoded X.509 certificate format. However, instead of referring to them as CER files, they are often just referred to as a base-64 encoded X.509 files.

Base-64 encoding uses the base64 formatting rules to convert the binary data into readable ASCII characters.

DER and CER Certificate Labs

If you have a Windows system, try these labs.

Export a DER Certificate

1) Click the Windows Start button.

2) Type “certmgr” without the quotes.

3) Select Manage Computer Certificates.

4) Open Trusted Root Certification Authorities and select Certificates.

5) Right click over one of the certificates and select All Tasks -> Export as shown in the following graphic.

6) Click Next.

7) Select the option of creating a DER encoded binary X.509 (.CER) file and click Next.

8) Click Browse… and browse to a location where you can find the file later. Name the file something like SampleDER and click Save.
Note that Windows automatically saves this as a .cer file.

9) Click Next.

10) Click Finish to finish the export. Click OK.

11. Leave certmgr open.

CompTIA Security+ Study Guide

The 601 Version of the Study Guide

The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study Guide is an update to the top-selling SY0-201, SY0-301, SY0-401, and SY0-501 study guides, which have helped thousands of readers pass the exam the first time they took it.  It includes the same elements readers raved about in the previous four versions.

Each of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.

You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.

---

---

Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:

• A 75 question pre-test
• A 75 question post-test
• Practice test questions at the end of every chapter.

 

Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.

If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.

Kindle edition also available.

Export a CER Certificate

) Right click over the certificate you did in the “Export a DER Certificate lab and select All Tasks -> Export as shown in the following graphic.

6) Click Next.

7) Select the option of creating a Base-64 encoded binary X.509 (.CER) file and click Next.

8) Click Browse… and browse to the same location where you created the SampleDER file. Name the file something like SampleCER and click Save.

Note that Windows automatically saves this as a .cer file.

9) Click Next.

10) Click Finish to finish the export. Click OK.

Open the Files with Notepad

1) Browse to the location where you saved the files using File Explorer. Note that they look the same in File Explorer.

The following graphic shows them with File name extensions enabled. If your system doesn’t have this enabled, you won’t see the .cer extension.

If you open the files with Notepad, you can see that they have completely different formats.

2) Right-click over SampleCER.cer file and select Open With and select Notepad (if it is available). If Notepad is not available, select Choose another app, select More apps, and then scroll down to select Notepad. You’ll see something like the following graphic.

Note that CER files are ASCII files and have readable ASCII characters. They typically start with —–BEGIN CERTIFICATE—–, end with —–END CERTIFICATE—–, and have readable ASCII characters in the middle. Admittedly the ASCII characters aren’t readable words and paragraphs, but they are readable.

3) Right-click over SampleDER.cer file and select Open With and select Notepad. You’ll see something like the following graphic.

Note that DER files are binary files and have few (if any) ASCII characters.

Why Do We Have Both Formats?

In some scenarios, you’re unable to copy binary data and retain integrity of the data. However, you can reliably copy and paste ASCII data.

Additionally, utilities such as certutil allow you to convert a binary DER file to an ASCII CER file using the encode switch. Alternately, you can convert an ASCII CER file to a binary DER file using the decode switch.

Memory Trick

If you’re having trouble remembering which one is ASCII and which one is binary, you’re not alone. I ultimately came up with a simple memory trick to help me.

Each of these starts with the unique letters of A, B, C, and D. A is ASCII, B is binary, C is CER, and D is DER.

• A matches with C. ASCII matches with CER.
• B matches with D. Binary matches with DER.

Once I finally got these straight in my head, this memory trick helped me keep it straight.