Split a PEM file into a certificate and private key

A PEM file can contain a certificate, a private key, a certificate chain, or a combination of these. You can extract a .crt and .key only if the input actually contains both. OpenSSL cannot derive a missing private key from a certificate.

Identify the blocks

A combined file may have this structure:

-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
... leaf certificate ...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... intermediate certificate ...
-----END CERTIFICATE-----

Inspect the BEGIN labels without copying private material into tickets or logs. Keys may also use labels such as ENCRYPTED PRIVATE KEY, RSA PRIVATE KEY, or EC PRIVATE KEY.

Extract the key and certificate

umask 077

# The default output key is unencrypted.
openssl pkey -in combined.pem -out private.key

# Read the first certificate block.
openssl x509 -in combined.pem -out certificate.crt

# Export all certificate blocks, including the leaf.
openssl crl2pkcs7 -nocrl -certfile combined.pem \
  | openssl pkcs7 -print_certs -out all-certs.pem

Use -aes-256-cbc with openssl pkey if you need an encrypted output key and your service supports the corresponding passphrase workflow. The first certificate is only the leaf if the input was ordered that way; inspect its identity before deploying it.

The last command exports all certificates, not just intermediates. Use the CA's documented chain and the certificate Subject/Issuer relationships to select intermediates when a separate chain file is required.

Verify the extracted files

Run each command successfully before comparing the final digests:

openssl x509 -in certificate.crt -text -noout
openssl pkey -in private.key -check -noout
openssl x509 -in certificate.crt -pubkey -noout -out cert-public.pem
openssl pkey -in private.key -pubout -out key-public.pem
openssl pkey -pubin -in cert-public.pem -outform DER -out cert-public.der
openssl pkey -pubin -in key-public.pem -outform DER -out key-public.der
openssl dgst -sha256 cert-public.der key-public.der

Matching public-key digests confirm the pair matches. This works for common RSA and EC keys and avoids an RSA-only modulus comparison. It does not verify the chain, hostname, or expiration. A failed command must not be mistaken for a matching empty-input digest.

Can I split the file in an editor?

Yes. Copy each complete block, including its matching BEGIN and END lines, into the appropriate file. Keep the Base64 data intact and ensure boundary lines remain separate. OpenSSL reduces the risk of selecting the wrong block or corrupting its formatting.

Common questions

What do .pem, .crt, .cer, and .key mean?

They are filename conventions. PEM denotes a text encoding; .crt and .cer usually hold certificates, and .key usually holds a private key. A .crt can also contain binary DER data. Check the content and the target application's format requirements rather than relying on the suffix.

Why does OpenSSL say it cannot load the key?

The file may contain only certificates, or the key may be encrypted or malformed. Check the block labels and the error message. If no private key exists in the bundle, locate the original key or key-management provider. A lost key requires a new key pair and reissued certificate.

Which permissions should I use?

Treat private.key as a secret: typically mode 600, owned by the administrator or controlled service identity that must read it. A public certificate can usually be 644. If a private key is exposed, replace it and follow the CA's revocation process.

See OpenSSL's pkey and x509 documentation.