devkult_
tools30converters34
home/mime/.crt

.crt MIME type

X.509 certificatecertificates & keys

application/pkix-cert

X.509 certificates in binary DER form. RFC 2585 registered application/pkix-cert for them.

MIME typeapplication/pkix-cert
Extensions.crt, .cer, .der
Also seen asapplication/x-x509-ca-cert
Content-Typeapplication/pkix-cert
Compress in transit?No — already compressed
File signature30 82
an ASN.1 SEQUENCE, meaning DER encoding. A file that starts with -----BEGIN is PEM, whatever its extension

Good to know

  • .crt and .cer files can be DER or PEM — the extension doesn't tell you. openssl x509 -in cert.crt -noout -text reads PEM; add -inform der for DER.
  • Apache's stock config maps .crt and .der to application/x-x509-ca-cert, a type some clients, notably Android, treat as a CA certificate to install rather than a file to save.
  • Certificate URLs inside certificates (the Authority Information Access extension) should serve DER as application/pkix-cert.

Serve .crt files with the right type

The response header to send:

Content-Type: application/pkix-cert

Most servers pick the type from the file extension. If yours sends the wrong one, map it explicitly:

nginx (inside the types block in mime.types)
application/pkix-cert crt cer der;
Apache (.htaccess or server config)
AddType application/pkix-cert .crt .cer .der
Express
res.set("Content-Type", "application/pkix-cert");
Python
import mimetypes

mimetypes.add_type("application/pkix-cert", ".crt")
mimetypes.add_type("application/pkix-cert", ".cer")
mimetypes.add_type("application/pkix-cert", ".der")
HTML file input
<input type="file" accept=".crt,.cer,.der,application/pkix-cert">

Check it

See what a server sends for a file, and what type a local file really is by its contents:

curl -sI https://example.com/file.crt | grep -i '^content-type:'
file --mime-type file.crt

Frequently asked questions

What is the MIME type for .crt files?

application/pkix-cert. You may also see application/x-x509-ca-cert, but application/pkix-cert is the one to send. The same type covers .cer, .der.

What Content-Type header should a .crt file be served with?

Content-Type: application/pkix-cert. It's already compressed, so servers shouldn't gzip it.

How can I tell if a file is really a .crt?

Check its bytes rather than the extension: CRT files start with 30 82 — an ASN.1 SEQUENCE, meaning DER encoding. A file that starts with -----BEGIN is PEM, whatever its extension. On the command line, file --mime-type name.crt does this for you.

Related types

Headers that go with it: Content-Type · Content-Disposition · X-Content-Type-Options