The PEM Format

PEM (Privacy Enhanced Mail) is a format used for transmitting cryptographic keys, certificates and other data.  

PEM structure consists of a text file in Base64 encoded data format (a binary-to-text encoding consisting of 64 printable characters - the idea is you can push binary data into a communication channel that only supports text). Base64 is famous for its use in attachments, since SMTP in its original form was designed to support 7-bit ASCII characters only.

An alternative to PEM in Java contexts is DER (Distinguished Encoding Rules) used for X.509 certificates and private keys.

Busting Certificate Issues in Ubuntu

Suppose you are running a data pipeline on Linux/Ubuntu that consumes data from the web. You get a RuntimeError: "SSL certificate verification failed".  What do you investigate?

Verifying the ca-certificates package and updating /etc/ssl/certs

 sudo apt-get install -y ca-certificates

installs the ca-certificates package (the -y means "say yes to all prompts").

This software processes certificates in PEM format.

With this installed, new certificates can be added to /usr/local/share/ca-certificates.  

The trust store can then be updated with:

sudo update-ca-certificates

You can then check if the certificate has been added.

ls /etc/ssl/certs | grep local-ca