Security files are the ones that keep the internet's locks working. Certificates prove you are who you say you are. Keys encrypt and decrypt. Keystores hold collections of both. Most people never interact with these files directly — until they're setting up HTTPS, configuring SSH, or debugging why their API suddenly returns 'certificate expired.' Handle private keys like passwords: if someone else has them, the security is gone.
The ecosystem is built on asymmetric cryptography: a public key (safe to share) and a private key (never share). Certificates bind a public key to an identity and are signed by a Certificate Authority that browsers trust. PEM is the most common encoding — Base64 text between header markers. DER is the binary equivalent. P12/PFX bundles everything with a password.
The naming conventions are a mess. .pem, .crt, .cer, and .der can all contain the same certificate data in different encodings with different extension conventions. OpenSSL is the universal tool for inspecting, converting, and managing all of these formats. Learn `openssl x509`, `openssl rsa`, and `openssl pkcs12` and you can handle anything the certificate world throws at you.
Same caution as .gpg — verify the source. Public key .asc files are safe to share.
GPG files may contain any type of encrypted content. The encryption itself is safe, but verify the source before decrypting unknown files.
Contains certificates and potentially private keys. Password-protected. Handle with the same care as P12/PFX files.
Contains private keys. Password-protected but handle with extreme care — anyone with the file and password has your certificate's private key.
PEM files containing private keys should be kept secret. Certificate-only PEM files are safe to share.
Contains private keys. Password-protected but handle with extreme care.