Combine a certificate and private key into a PEM file

If the certificate and private key are already PEM-encoded, concatenate them into a combined PEM file. Add any required intermediates after the leaf certificate. Check the target application's requirements before combining files; Nginx and Apache commonly configure the certificate and key separately.

Combine the files

umask 077
cat server.crt server.key > server.pem

# With an intermediate certificate:
cat server.crt intermediate.crt server.key > server.pem

Choose the appropriate command; the second overwrites the result of the first. Each input must end with a newline so that the next BEGIN marker starts on its own line. umask restricts newly created files, but does not tighten permissions on a file that already exists; check those permissions too.

For byte-preserving concatenation from PowerShell:

cmd /c "copy /b server.crt+server.key server.pem"

Apply restrictive Windows ACLs to the combined file. You can also use an editor, provided each complete PEM block and its line boundaries remain intact.

Follow the consumer's format requirements

HAProxy can load a PEM containing a leaf certificate, intermediate chain, and private key. Keep the leaf before its intermediates; consult the version's certificate-loading documentation for other requirements.

Nginx normally uses ssl_certificate and ssl_certificate_key, and Apache uses SSLCertificateFile and SSLCertificateKeyFile. Neither requires you to merge separate files for these ordinary configurations. A filename ending in .crt or .key does not establish its encoding: binary DER must be converted rather than concatenated as if it were PEM.

Validate the bundle

openssl x509 -in server.pem -text -noout
openssl pkey -in server.pem -check -noout
openssl x509 -in server.pem -pubkey -noout -out cert-public.pem
openssl pkey -in server.pem -pubout -out key-public.pem
openssl pkey -pubin -in cert-public.pem -outform DER -out cert-public.der
openssl pkey -pubin -in key-public.pem -outform DER -out key-public.der
openssl dgst -sha256 cert-public.der key-public.der

Only compare the final hashes if every preceding command succeeds. Matching public keys establish pairing for common RSA and EC keys, but do not validate trust, hostname coverage, or expiration. See OpenSSL's pkey and x509 references.

A simple bundle has this shape:

-----BEGIN CERTIFICATE-----
... leaf certificate ...
-----END CERTIFICATE-----
-----BEGIN PRIVATE KEY-----
... private key ...
-----END PRIVATE KEY-----

Intermediate certificate blocks go after the leaf when included. Key labels may instead identify an encrypted, RSA, or EC private key.

Common questions

When is a combined PEM useful?

Some load balancers, HAProxy configurations, and certificate-upload interfaces expect one file containing both the certificate and key. Use that format when the consuming service requires it.

Is the combined file safe to share?

No. It contains the private key and must be handled as a secret. On Unix-like systems, use restrictive ownership and permissions, commonly chmod 600 server.pem. Keep it out of source control and container images.

Why does the service report a PEM parsing error?

Check the input encodings, complete BEGIN/END markers, and newline boundaries. A certificate ending without a newline can produce END CERTIFICATE-----BEGIN PRIVATE KEY on one line after cat, which is invalid. Validate the files individually before blaming their combined order.