THE FILE FIELD GUIDE

.crt

Certificate File

Certificates & Keys

CRT commonly denotes an X.509 certificate encoded as PEM or DER. Review issuer, names, validity and usage; parsing is not proof of trust. One certificate does not necessarily include its private key or all server configuration.

What it is used for: Certificate of a public key and issuer-related information
What the file contains: Producer-dependent

All sections, questions and sources

Content reviewed：2026-10-13 · Editor：Kai

Opening steps

Choose your environment or purpose to see its steps.

Inspect the certificate

Separate inspection from trust-store import.

Identify source and encoding.
Inspect details on a copy.
Inspect names, issuer and validity.

Check service requirements

Inspect usage and chain.

Compare service DNS names with SAN.
Inspect key usage, signature algorithm and chain.
Identify the matching private key in its authorized storage.

Compare the supplied certificate

Do not import an unknown root merely to inspect it.

Obtain the expected fingerprint through a trusted channel.
Compare SHA-256 fingerprint and names.
Use the destination’s documented placement workflow.

Menu labels and support vary by app, OS and version. Preserve the original before making changes.

Troubleshooting by symptom

Parser fails: check encoding and whether it is a certificate.
Trust error: inspect issuer/chain, names and validity.
Missing server key: public certificates and private keys have different roles.
Fingerprint differs: inspect renewal version and digest algorithm.
Old certificate served: inspect configuration, proxy and endpoint.
Usage rejected: inspect key usage/service requirements.

CRT certificate → PEM / DER

Inspect and use a certificate encoder for the required format.
Compare names, issuer, public key and validity.
Compare names, validity and SHA-256 fingerprint after encoding conversion.

Re-encoding neither renews a certificate nor fixes trust; PFX bundling needs the required key/components.

Validity dates versus trust

Validate service requirements independently of certificate dates.

Example: compare SAN with the hostname and inspect the certificate actually served.

Source for these steps：OpenSSL Project · openssl-x509 / IETF / RFC Editor · RFC 7468 — Textual Encodings

Review renewal as a set

Inspect matching key, chain and configuration and verify at the service after renewal.

Source for these steps：OpenSSL Project · openssl-x509 / IETF / RFC Editor · RFC 7468 — Textual Encodings

Related-format differences

Related-format differences
Format / method	Role	What to verify
CRT	Certificate suffix	Actual encoding
Private key	Private credential	Separate storage
Intermediate certificate	Chain component	Chain relationship

Handling and security

Do not silence warnings by trusting unknown roots; verify legitimate issuer and purpose.

Questions and answers

Does a certificate contain its private key?

Ordinary certificates contain public keys, not the corresponding private key.

Does successful display imply trust?

Parsing and trust validation differ.

Can editing extend validity?

Use legitimate certificate renewal.

Does a hostname in the filename prove a match?

Inspect the certificate’s names; its filename is not proof.

Does a matching fingerprint prove usability?

Identity comparison differs from validating dates, names, usage and trust.

Format facts: name, steward and MIME type

Formal name: X.509 certificate (common CRT use)
Steward / specification: Issuing certificate authority / IETF standards
MIME type: Depends on the producer or server; an extension alone does not establish a MIME type.

Primary and official sources

Project documentationopenssl-x509
Reference for certificate inspection and PEM/DER conversion.
OpenSSL Project · Link checked：2026-10-13
StandardRFC 7468 — Textual Encodings
Defines textual encodings for certificates, keys and requests.
IETF / RFC Editor · Link checked：2026-10-13