Creating a .pem File for SSL Certificate Installations

Overview

Learn how to create a PEM (.pem) file for SSL certificate installations. This article explains three common PEM creation scenarios:

• Creating a PEM file with the complete trust chain
• Creating a PEM file with the server and intermediate certificates
• Creating a PEM file with the private key and complete certificate trust chain

What Is a PEM File?

A PEM (Privacy Enhanced Mail) file is a Base64-encoded container file used to store SSL/TLS certificates, certificate chains, and private keys. PEM files allow multiple certificate blocks to be stored in one file and are commonly used when applications require a complete certificate chain during installation.

Prerequisites

• Primary SSL certificate, such as your_domain_name.crt.
• Required intermediate certificate, such as SectigoRSA.crt.
• Root certificate, such as USERTrustRSACertificationAuthorityCARoot.crt, when required by the target application.
• Private key, such as your_domain_name.key, if the target application requires a combined key and certificate PEM file.
• A text editor such as Notepad, Notepad++, or WordPad.
• Access to your Sectigo certificate download location.

Scenario 1: Create a PEM File Containing the Entire SSL Certificate Trust Chain

Purpose

Use this format when the target application requires the full certificate chain in a single PEM file.

Steps

1. Download the primary certificate, intermediate certificate, and root certificate from your Sectigo Management Account or certificate download location.
2. Open a text editor.
3. Paste the certificates into one text file in this order: primary certificate, intermediate certificate, then root certificate.
4. Confirm each certificate block includes the BEGIN CERTIFICATE and END CERTIFICATE lines.
5. Save the combined file as your_domain_name.pem.

Example

-----BEGIN CERTIFICATE-----
(Primary Certificate: your_domain_name.crt)
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
(Intermediate Certificate: SectigoRSA.crt)
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
(Root Certificate: USERTrustRSACertificationAuthorityCARoot.crt)
-----END CERTIFICATE-----
    

Scenario 2: Create a PEM File Containing the Server and Intermediate Certificates

Purpose

Use this format when the target platform requires the server certificate and intermediate certificate chain, but does not require the root certificate in the same file.

Steps

1. Download the primary certificate and intermediate certificate from your Sectigo Management Account or certificate download location.
2. Open a text editor.
3. Paste the certificates into one text file in this order: primary certificate, then intermediate certificate.
4. Confirm each certificate block includes the BEGIN CERTIFICATE and END CERTIFICATE lines.
5. Save the combined file as your_domain_name.pem.

Example

-----BEGIN CERTIFICATE-----
(Primary Certificate: your_domain_name.crt)
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
(Intermediate Certificate: SectigoRSA.crt)
-----END CERTIFICATE-----
    

Scenario 3: Create a PEM File Containing the Private Key and Entire Trust Chain

Purpose

Use this format when the target application requires the private key and the complete certificate trust chain in a single PEM file.

Steps

1. Download or locate the private key, primary certificate, intermediate certificate, and root certificate.
2. Open a text editor.
3. Paste the entries into one text file in this order: private key, primary certificate, intermediate certificate, then root certificate.
4. Confirm the private key block includes BEGIN RSA PRIVATE KEY and END RSA PRIVATE KEY lines.
5. Confirm each certificate block includes the BEGIN CERTIFICATE and END CERTIFICATE lines.
6. Save the combined file as your_domain_name.pem.

Example

-----BEGIN RSA PRIVATE KEY-----
(Private Key: your_domain_name.key)
-----END RSA PRIVATE KEY-----

-----BEGIN CERTIFICATE-----
(Primary Certificate: your_domain_name.crt)
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
(Intermediate Certificate: SectigoRSA.crt)
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
(Root Certificate: USERTrustRSACertificationAuthorityCARoot.crt)
-----END CERTIFICATE-----
    

Important Note About Certificate Chains

How to Verify Success

• Open the PEM file in a text editor.
• Confirm that every certificate block includes both BEGIN CERTIFICATE and END CERTIFICATE tags.
• Confirm that the certificate order matches the selected scenario.
• Confirm that the private key appears first when creating a PEM file that includes the private key.
• Confirm there are no missing, truncated, or extra characters between certificate blocks.

Troubleshooting

Issue	Possible Cause	Resolution
PEM file is rejected during installation	The certificate order may be incorrect.	Rebuild the PEM file using the correct order for the target scenario.
Trust chain errors occur	The wrong intermediate or root certificate may have been used.	Download the correct root and intermediate certificates for the issued certificate.
SSL/TLS service fails to start	The target application may require the private key in the PEM file.	Create a PEM file that includes the private key and certificate chain if required by the application.
Invalid PEM file format	One or more BEGIN or END tags may be missing.	Verify every key and certificate block includes the required BEGIN and END lines.
Installation succeeds but trust warnings remain	The PEM file may include the wrong or incomplete chain.	Verify the chain requirements for the target application and rebuild the PEM file with the correct certificates.

Frequently Asked Questions

What is the correct certificate order in a PEM file?

The primary certificate should appear first, followed by the intermediate certificate, and then the root certificate when the root certificate is required by the target application.

Can I include a private key in a PEM file?

Yes. Use the private key and entire trust chain scenario when the application requires the private key, primary certificate, intermediate certificate, and root certificate in one PEM file.

Do all systems require the root certificate?

No. Requirements vary by application. Follow the installation guidance for the target application and use the root certificate only when required.

What happens if I use the wrong intermediate certificate?

The application may report trust errors or fail to validate the certificate chain. Download the correct intermediate and root certificates for the issued certificate.

Similar Questions

• How do I create a PEM file?
• What certificates should be included in a PEM file?
• What is the correct certificate order in a PEM file?
• How do I combine a private key and certificate into a PEM file?
• Do I need to include the root certificate in my PEM file?
• How do I create a PEM trust chain?