PEM

Generated by scripts/gen-format-pages.py from docs/data/format-metadata/, FILE_FORMATS.csv and docs/formats-master.csv. Do not edit by hand: change the source, then run the script.

PEM Crypto Preview.

At a glance

How much Poka reads

B2 Broad. The common content of the current and the common older versions is decoded. Some named features or versions are not, and are listed.

Confidence: medium (the reviewer read the code). Basis: Reviewed 2026-10-26: read parsers/poka-pem/src/main.rs (556 lines) and plugin.json. The three unit tests cover a bare DER certificate, telling PEM text from DER bytes and refusing text that is neither; the corpus has six .pem, .crt and .pub samples, read by no test. Covers .pem, .crt and .pub. The tree lists every block; certificates are decoded with x509-parser (subject, issuer, serial, version, validity, signature and key algorithms, SANs, key usage, basic constraints) and other blocks (keys, requests, parameters) show their type and size. A bare DER certificate is read too. Judgement: B2: certificates, the usual content, are decoded; other block types are only named.

What Poka does not read

• Keys, certificate requests and parameters are named and sized, not decoded
• Certificate extensions beyond SAN, key usage and basic constraints are not shown
• Chains are not verified
• SSH public keys (.pub in OpenSSH format) are not PEM and are refused (judgement from the code)

Libraries

Libraries Poka uses or has assessed for this format, with the status, licence and language the registry records.

• x509-parser (used; MIT OR Apache-2.0; Rust)
• pem (pem-rs) (candidate; MIT; Rust; https://github.com/jcreekmore/pem-rs) — Rust library for parsing and encoding PEM-encoded data; returns tag plus decoded bytes.
• rustls-pemfile (candidate; Apache-2.0 OR MIT OR ISC; Rust; https://github.com/rustls/pemfile) — PEM section reader returning DER; repo archived Aug 2025, functionality moved to rustls-pki-types.

Sources

• parsers/poka-pem/src/main.rs
• parsers/poka-pem/plugin.json