devkult_
tools30converters34
home/mime/.pem

.pem MIME type

PEM filecertificates & keys

application/x-pem-file

Base64-encoded certificates and keys between -----BEGIN and -----END lines. Unregistered; application/x-pem-file is the convention.

MIME typeapplication/x-pem-file
Extensions.pem
Content-Typeapplication/x-pem-file
Compress in transit?Yes — enable gzip or Brotli
File signature2D 2D 2D 2D 2D 42 45 47 49 4E (-----BEGIN)
some tools write text before the first BEGIN line

Good to know

  • The label after BEGIN says what's inside: CERTIFICATE, PRIVATE KEY, PUBLIC KEY, CERTIFICATE REQUEST. One file can hold several blocks, such as a certificate chain.
  • To publish a certificate for download, serve it as DER with application/pkix-cert — see .crt.
  • Private keys never belong in a web root. On disk they should be chmod 600 or chmod 400; ssh refuses keys that other users can read.

Serve .pem files with the right type

The response header to send:

Content-Type: application/x-pem-file

Most servers pick the type from the file extension. If yours sends the wrong one, map it explicitly:

nginx (inside the types block in mime.types)
application/x-pem-file pem;
Apache (.htaccess or server config)
AddType application/x-pem-file .pem
Express
res.set("Content-Type", "application/x-pem-file");
Python
import mimetypes

mimetypes.add_type("application/x-pem-file", ".pem")
HTML file input
<input type="file" accept=".pem,application/x-pem-file">

Check it

See what a server sends for a file, and what type a local file really is by its contents:

curl -sI https://example.com/file.pem | grep -i '^content-type:'
file --mime-type file.pem

Frequently asked questions

What is the MIME type for .pem files?

application/x-pem-file.

What Content-Type header should a .pem file be served with?

Content-Type: application/x-pem-file. It compresses well, so let the server apply gzip or Brotli.

How can I tell if a file is really a .pem?

Check its bytes rather than the extension: PEM files start with 2D 2D 2D 2D 2D 42 45 47 49 4E (-----BEGIN) — some tools write text before the first BEGIN line. On the command line, file --mime-type name.pem does this for you.

Related types

Headers that go with it: Content-Type · Content-Disposition · X-Content-Type-Options