--- product: Chilkat product_version: 11.7.0 language: pascal language_label: Lazarus Pascal class: Pem license: bundle deprecated: false reference_html: https://www.chilkatsoft.com/refdoc/pascal_PemRef.html --- # Chilkat Pem — Lazarus Pascal — v11.7.0 > Chilkat 11.7.0 · language=pascal · class=Pem > Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0//classes/Pem.md`. > Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/guide.md`. ## Purpose **Load, inspect, assemble, export, and convert PEM certificate and key material.** `Chilkat.Pem` is the Chilkat class for handling PEM-formatted certificate and key material. It can load PEM and PKCS#7 data, add certificates, private keys, public keys, CSRs, and certificate chains, retrieve individual items, remove content, control PKCS#1 vs. PKCS#8 private key output, export PEM with optional encryption and extended attributes, and convert PEM material to PFX or Java KeyStore objects. **Load PEM and PKCS#7** Load PEM-encoded certificates, keys, CSRs, and PKCS#7 certificate data from files, strings, or memory. **Collect certs and keys** Add certificates, private keys, public keys, CSRs, and certificate chains into a single PEM container. **Retrieve individual items** Extract selected certificates, keys, CSRs, or chains for use with `Cert`, `PrivateKey`, `PublicKey`, or related Chilkat classes. **Private-key format control** Choose PKCS#1 or PKCS#8 private-key output depending on the format required by the target system. **Encrypted PEM output** Export private-key material with password-based encryption when PEM data must be stored or transferred securely. **Convert to PFX or JKS** Convert PEM certificates and keys into PFX/P12 or Java KeyStore objects when another platform or API requires those container formats. **Common pattern:** Use `Pem` when certificate and key material is packaged as one or more PEM blocks. Load the PEM, inspect or retrieve the needed items, add or remove entries as needed, then export the result as PEM, PFX/P12, or Java KeyStore data. Use `Chilkat.Cert`, `PrivateKey`, and `PublicKey` when working directly with individual objects. For an extended overview, see [Pem Class Overview](https://www.chilkatsoft.com/pem_class_overview.asp). ## Object creation, unlocking and error handling **Create / Free** ```pascal uses Chilkat.Pem; var obj: TPem; begin obj := TPem.Create; try if not obj.IsValid then raise Exception.Create('Failed to create a TPem instance.'); // ... use obj ... finally obj.Free; end; end; ``` `constructor Create;` Allocates the underlying CkPem object and returns a new TPem instance. Simply adding **Chilkat.Pem** to the unit's `uses` clause is enough to locate and bind to the Chilkat shared library (DLL / .so / .dylib) at runtime — no separate load step is required. Check `obj.IsValid` after calling `Create`; it is `False` if the underlying library could not be found/loaded or the object could not be allocated (for example, when unlicensed). `destructor Destroy; override;` Every TPem created by calling `Create` should eventually be released by calling `.Free` (inherited from `TObject`). The destructor automatically disposes the underlying CkPem handle. A native (unmanaged) memory leak occurs if the object is never freed. Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Lazarus Pascal. ## Members common to every Chilkat class Documented once per language in `common-members.md`; listed here so this page is self-contained. | Property | Signature | Access | Meaning | |---|---|---|---| | `DebugLogFilePath` | `property DebugLogFilePath: string read GetDebugLogFilePath write SetDebugLogFilePath;` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. | | `LastErrorHtml` | `property LastErrorHtml: string read GetLastErrorHtml;` | read-only | Provides HTML-formatted information about the last called method or property. | | `LastErrorText` | `property LastErrorText: string read GetLastErrorText;` | read-only | Provides plain text information about the last called method or property. | | `LastErrorXml` | `property LastErrorXml: string read GetLastErrorXml;` | read-only | Provides XML-formatted information about the last called method or property. | | `LastMethodSuccess` | `property LastMethodSuccess: Boolean read GetLastMethodSuccess write SetLastMethodSuccess;` | read/write | Indicates the success or failure of the most recent method call: `True` means success, `False` means failure. | | `VerboseLogging` | `property VerboseLogging: Boolean read GetVerboseLogging write SetVerboseLogging;` | read/write | If set to `True`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. | | `Version` | `property Version: string read GetVersion;` | read-only | Version of the component/library, such as "10.1.0" | ## Member index | Member | Kind | Signature | |---|---|---| | `AppendMode` | property, read/write | `property AppendMode: Boolean read GetAppendMode write SetAppendMode;` | | `HeartbeatMs` | property, read/write | `property HeartbeatMs: Integer read GetHeartbeatMs write SetHeartbeatMs;` | | `NumCerts` | property, read-only | `property NumCerts: Integer read GetNumCerts;` | | `NumCrls` | property, read-only | `property NumCrls: Integer read GetNumCrls;` | | `NumCsrs` | property, read-only | `property NumCsrs: Integer read GetNumCsrs;` | | `NumPrivateKeys` | property, read-only | `property NumPrivateKeys: Integer read GetNumPrivateKeys;` | | `NumPublicKeys` | property, read-only | `property NumPublicKeys: Integer read GetNumPublicKeys;` | | `PrivateKeyFormat` | property, read/write | `property PrivateKeyFormat: string read GetPrivateKeyFormat write SetPrivateKeyFormat;` | | `PublicKeyFormat` | property, read/write | `property PublicKeyFormat: string read GetPublicKeyFormat write SetPublicKeyFormat;` | | `AddCert` | method | `// cert is a TCert object. function AddCert(cert: TChilkatBase;     includeChain: Boolean): Boolean;` | | `AddItem` | method | `function AddItem(const itemType: string;     const encoding: string;     const itemData: string): Boolean;` | | `AddP7b` | method | `// bd is a TBinData object. function AddP7b(bd: TChilkatBase): Boolean;` | | `AddPrivateKey` | method | `// privateKey is a TPrivateKey object. function AddPrivateKey(privateKey: TChilkatBase): Boolean;` | | `AddPrivateKey2` | method | `// privKey is a TPrivateKey object. // certChain is a TCertChain object. function AddPrivateKey2(privKey: TChilkatBase;     certChain: TChilkatBase): Boolean;` | | `AddPublicKey` | method | `// pubkey is a TPublicKey object. function AddPublicKey(pubkey: TChilkatBase): Boolean;` | | `CertAt` | method | `// cert is a TCert object. function CertAt(index: Integer;     cert: TChilkatBase): Boolean;` | | `Clear` | method | `function Clear: Boolean;` | | `GetEncodedItem` | method | `function GetEncodedItem(const itemType: string;     const itemSubType: string;     const encoding: string;     index: Integer): string;` | | `LoadP7bFile` | method | `function LoadP7bFile(const path: string): Boolean;` | | `LoadPem` | method | `function LoadPem(const pemContent: string;     const password: string): Boolean;` | | `LoadPemFile` | method | `function LoadPemFile(const path: string;     const password: string): Boolean;` | | `LoadTaskCaller` | method | `// task is a TTask object. function LoadTaskCaller(task: TChilkatBase): Boolean;` | | `PrivateKeyAt` | method | `// privKey is a TPrivateKey object. function PrivateKeyAt(index: Integer;     privKey: TChilkatBase): Boolean;` | | `PublicKeyAt` | method | `// pubKey is a TPublicKey object. function PublicKeyAt(index: Integer;     pubKey: TChilkatBase): Boolean;` | | `RemoveCert` | method | `function RemoveCert(index: Integer): Boolean;` | | `RemovePrivateKey` | method | `function RemovePrivateKey(index: Integer): Boolean;` | | `ToJksObj` | method | `// jksObj is a TJavaKeyStore object. function ToJksObj(const aliasName: string;     const password: string;     jksObj: TChilkatBase): Boolean;` | | `ToPem` | method | `function ToPem: string;` | | `ToPemEx` | method | `function ToPemEx(extendedAttrs: Boolean;     noKeys: Boolean;     noCerts: Boolean;     noCaCerts: Boolean;     const encryptAlg: string;     const password: string): string;` | | `ToPfxObj` | method | `// pfxObj is a TPfx object. function ToPfxObj(pfxObj: TChilkatBase): Boolean;` | ## Properties ### Pem.AppendMode `Chilkat 11.7.0 · pascal · Pem · AppendMode · property · read/write · since 9.5.0.49` ```pascal property AppendMode: Boolean read GetAppendMode write SetAppendMode; ``` When set to `True`, each of the Load\* methods appends to the current contents of this PEM object. When set to `False`, a Load\* method replaces the contents of this PEM object. The default is `False`. ### Pem.HeartbeatMs `Chilkat 11.7.0 · pascal · Pem · HeartbeatMs · property · read/write · since 9.5.0.49` ```pascal property HeartbeatMs: Integer read GetHeartbeatMs write SetHeartbeatMs; ``` **Full documentation for this property (same in every language):** [Event Callback Examples](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/event_callback_examples.md) The interval in milliseconds between each `AbortCheck` event callback, which enables an application to abort certain method calls before they complete. **By default, HeartbeatMs is set to** `0`**, meaning no AbortCheck event callbacks will trigger.** ### Pem.NumCerts `Chilkat 11.7.0 · pascal · Pem · NumCerts · property · read-only · since 9.5.0.49` ```pascal property NumCerts: Integer read GetNumCerts; ``` The number of certificates in the loaded PEM. To get the 1st certificate, call GetCert(0). ### Pem.NumCrls `Chilkat 11.7.0 · pascal · Pem · NumCrls · property · read-only · since 9.5.0.77` ```pascal property NumCrls: Integer read GetNumCrls; ``` The number of certificate revocation lists (CRLs) in the loaded PEM. ### Pem.NumCsrs `Chilkat 11.7.0 · pascal · Pem · NumCsrs · property · read-only · since 9.5.0.50` ```pascal property NumCsrs: Integer read GetNumCsrs; ``` The number of certificate signing requests (CSRs) in the loaded PEM. ### Pem.NumPrivateKeys `Chilkat 11.7.0 · pascal · Pem · NumPrivateKeys · property · read-only · since 9.5.0.49` ```pascal property NumPrivateKeys: Integer read GetNumPrivateKeys; ``` The number of private keys in the loaded PEM. To get the 1st private key, call GetPrivateKey(0). ### Pem.NumPublicKeys `Chilkat 11.7.0 · pascal · Pem · NumPublicKeys · property · read-only · since 9.5.0.49` ```pascal property NumPublicKeys: Integer read GetNumPublicKeys; ``` The number of public keys in the loaded PEM. To get the 1st public key, call GetPublicKey(0). ### Pem.PrivateKeyFormat `Chilkat 11.7.0 · pascal · Pem · PrivateKeyFormat · property · read/write · since 9.5.0.49` ```pascal property PrivateKeyFormat: string read GetPrivateKeyFormat write SetPrivateKeyFormat; ``` Controls the format to be used for **unencrypted** private keys when writing a PEM. Possible values are `pkcs1` and `pkcs8`. (OpenSSL typically uses the `pkcs8` format.) When writing encrypted private keys to PEM, the format is always PKCS8, and the PEM header is `BEGIN ENCRYPTED PRIVATE KEY`. The default is `pkcs8`. The PKCS1 format uses the PEM header: BEGIN RSA PRIVATE KEY. The PKCS8 format uses the PEM header: BEGIN PRIVATE KEY. ### Pem.PublicKeyFormat `Chilkat 11.7.0 · pascal · Pem · PublicKeyFormat · property · read/write · since 9.5.0.49` ```pascal property PublicKeyFormat: string read GetPublicKeyFormat write SetPublicKeyFormat; ``` Controls the format to be used for public keys when writing a PEM. Possible values are `pkcs1` and `pkcs8`. (OpenSSL typically uses the `pkcs8` format.) The default is `pkcs8`. The PKCS1 format uses the PEM header: BEGIN RSA PUBLIC KEY. The PKCS8 format uses the PEM header: BEGIN PUBLIC KEY. ## Methods ### Pem.AddCert `Chilkat 11.7.0 · pascal · Pem · AddCert · method · since 9.5.0.49` ```pascal // cert is a TCert object. function AddCert(cert: TChilkatBase;     includeChain: Boolean): Boolean; ``` Adds a certificate, and potentially the certs in its chain of authentication to the PEM. If `includeChain` is `True`, then certificates in the `cert`'s chain of authentication up to and including the root are automatically added. Returns True for success, False for failure. ### Pem.AddItem `Chilkat 11.7.0 · pascal · Pem · AddItem · method · since 9.5.0.59` ```pascal function AddItem(const itemType: string;     const encoding: string;     const itemData: string): Boolean; ``` Adds a certificate, private key, public key, or csr to the PEM. The possible values for `itemType` are `certificate` (or `cert`), `privateKey`, `publicKey`, or `csr`. The `encoding` can be `Base64`, `modBase64`, `Base32`, `QP` (for quoted-printable), `URL` (for url-encoding), `Hex`, `url_oauth`, `url_rfc1738`, `url_rfc2396`, and `url_rfc3986`. The `itemData` contains the ASN.1 data in string format according to the encoding specified in `encoding`. Returns True for success, False for failure. ### Pem.AddP7b `Chilkat 11.7.0 · pascal · Pem · AddP7b · method · since 11.0.0` ```pascal // bd is a TBinData object. function AddP7b(bd: TChilkatBase): Boolean; ``` Loads the PEM from the contents of an PKCS7 container (.p7b) contained in `bd`. A .p7b (or .p7c) file contains a PKCS#7 container, which may include: - One or more X.509 certificates (a certificate chain) - Optionally, CRLs (Certificate Revocation Lists) - No private key Common Use: Used to bundle intermediate and root certificates for things like SSL certificate chains. Returns True for success, False for failure. ### Pem.AddPrivateKey `Chilkat 11.7.0 · pascal · Pem · AddPrivateKey · method · since 9.5.0.49` ```pascal // privateKey is a TPrivateKey object. function AddPrivateKey(privateKey: TChilkatBase): Boolean; ``` Adds a private key to the PEM object. Returns True for success, False for failure. ### Pem.AddPrivateKey2 `Chilkat 11.7.0 · pascal · Pem · AddPrivateKey2 · method · since 9.5.0.49` ```pascal // privKey is a TPrivateKey object. // certChain is a TCertChain object. function AddPrivateKey2(privKey: TChilkatBase;     certChain: TChilkatBase): Boolean; ``` Adds a private key and it's associated certificate chain to the PEM object. Returns True for success, False for failure. ### Pem.AddPublicKey `Chilkat 11.7.0 · pascal · Pem · AddPublicKey · method · since 9.5.0.49` ```pascal // pubkey is a TPublicKey object. function AddPublicKey(pubkey: TChilkatBase): Boolean; ``` Adds a public key to the PEM object. Returns True for success, False for failure. ### Pem.CertAt `Chilkat 11.7.0 · pascal · Pem · CertAt · method · since 11.0.0` ```pascal // cert is a TCert object. function CertAt(index: Integer;     cert: TChilkatBase): Boolean; ``` Returns in `cert` the Nth certificate from the PEM. The first certificate is at index 0. Returns True for success, False for failure. ### Pem.Clear `Chilkat 11.7.0 · pascal · Pem · Clear · method · since 9.5.0.49` ```pascal function Clear: Boolean; ``` Removes all content from this PEM object. Returns True for success, False for failure. ### Pem.GetEncodedItem `Chilkat 11.7.0 · pascal · Pem · GetEncodedItem · method · since 9.5.0.50` ```pascal function GetEncodedItem(const itemType: string;     const itemSubType: string;     const encoding: string;     index: Integer): string; ``` Returns the encoded contents of the Nth item of a particular type (0-based `index`). The possible values for `itemType` are `certificate` (or `cert`), `privateKey`, `publicKey`, or `csr`. Input string args are case-insensitive. If the `itemType` is `privateKey`, the `itemSubType` may be `der` or `pkcs8`. If the `itemType` is `publicKey`, the `itemSubType` may be `der` or `pkcs1`. The `itemSubType` is ignored for other values of `itemType`. The valid `encoding` modes are `Base64`, `modBase64`, `Base32`, `Base58`, `QP` (for quoted-printable), `URL` (for url-encoding), `Hex`, `url_oauth`, `url_rfc1738`, `url_rfc2396`, and `url_rfc3986`. Returns True for success, False for failure. ### Pem.LoadP7bFile `Chilkat 11.7.0 · pascal · Pem · LoadP7bFile · method · since 9.5.0.49` ```pascal function LoadP7bFile(const path: string): Boolean; ``` Loads the contents of a PKCS7 container (.p7b file). Returns True for success, False for failure. ### Pem.LoadPem `Chilkat 11.7.0 · pascal · Pem · LoadPem · method · since 9.5.0.49` ```pascal function LoadPem(const pemContent: string;     const password: string): Boolean; ``` Loads the PEM from a PEM string. If encrypted, then the `password` is required for decryption. Otherwise, an empty string (or any string) may be passed for the `password`. Returns True for success, False for failure. ### Pem.LoadPemFile `Chilkat 11.7.0 · pascal · Pem · LoadPemFile · method · since 9.5.0.49` ```pascal function LoadPemFile(const path: string;     const password: string): Boolean; ``` Loads the PEM from a PEM file. If encrypted, then the `password` is required for decryption. Otherwise, an empty string (or any string) may be passed for the `password`. Returns True for success, False for failure. ### Pem.LoadTaskCaller `Chilkat 11.7.0 · pascal · Pem · LoadTaskCaller · method · since 9.5.0.80` ```pascal // task is a TTask object. function LoadTaskCaller(task: TChilkatBase): Boolean; ``` Loads the caller of the task's async method. Returns True for success, False for failure. ### Pem.PrivateKeyAt `Chilkat 11.7.0 · pascal · Pem · PrivateKeyAt · method · since 11.0.0` ```pascal // privKey is a TPrivateKey object. function PrivateKeyAt(index: Integer;     privKey: TChilkatBase): Boolean; ``` Returns in `privKey` the Nth private key from the PEM. The first private key is at index 0. Returns True for success, False for failure. ### Pem.PublicKeyAt `Chilkat 11.7.0 · pascal · Pem · PublicKeyAt · method · since 11.0.0` ```pascal // pubKey is a TPublicKey object. function PublicKeyAt(index: Integer;     pubKey: TChilkatBase): Boolean; ``` Returns in `pubKey` the Nth public key from the PEM. The first public key is at index 0. Returns True for success, False for failure. ### Pem.RemoveCert `Chilkat 11.7.0 · pascal · Pem · RemoveCert · method · since 9.5.0.49` ```pascal function RemoveCert(index: Integer): Boolean; ``` Removes the Nth certificate from the PEM. The first certificate is at index 0. Returns True for success, False for failure. ### Pem.RemovePrivateKey `Chilkat 11.7.0 · pascal · Pem · RemovePrivateKey · method · since 9.5.0.49` ```pascal function RemovePrivateKey(index: Integer): Boolean; ``` Removes the Nth private key from the PEM. The first private key is at index 0. Returns True for success, False for failure. ### Pem.ToJksObj `Chilkat 11.7.0 · pascal · Pem · ToJksObj · method · since 11.0.0` ```pascal // jksObj is a TJavaKeyStore object. function ToJksObj(const aliasName: string;     const password: string;     jksObj: TChilkatBase): Boolean; ``` This function converts this PEM to a Java KeyStore (JKS) object and stores it in `jksObj`. If `aliasName` is provided, it will be used as the alias for the first object in the PEM (either a private key or certificate), while subsequent objects will receive autogenerated aliases. The resulting JKS will be encrypted with `password`, unless the PEM contains only certificates, in which case `password` is not used. Returns True for success, False for failure. ### Pem.ToPem `Chilkat 11.7.0 · pascal · Pem · ToPem · method · since 9.5.0.47` ```pascal function ToPem: string; ``` Write the PFX to a PEM formatted string. The resultant PEM will contain the private key, as well as the certs in the chain of authentication (or whatever certs are available in the PFX). For example: ``` -----BEGIN RSA PRIVATE KEY----- ... ... the private key associated with the main certificate. ... -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- ... ... the main certificate ... -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- ... ... an intermediate CA certificate (if present) ... -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- ... ... the root CA certificate ... -----END CERTIFICATE----- ``` Returns True for success, False for failure. ### Pem.ToPemEx `Chilkat 11.7.0 · pascal · Pem · ToPemEx · method · since 9.5.0.49` ```pascal function ToPemEx(extendedAttrs: Boolean;     noKeys: Boolean;     noCerts: Boolean;     noCaCerts: Boolean;     const encryptAlg: string;     const password: string): string; ``` Write the PFX to a PEM formatted string. If `extendedAttrs` is `True`, then extended properties (Bag Attributes and Key Attributes) are output. If `noKeys` is `True`, then no private keys are output. If `noCerts` is `True`, then no certificates are output. If `noCaCerts` is `True`, then no CA certs or intermediate CA certs are output. If `encryptAlg` is not empty, it indicates the encryption algorithm to be used for encrypting the private keys (otherwise the private keys are output unencrypted). The possible choices for the `encryptAlg` are `des3`, `aes128`, `aes192`, and `aes256`. (All encryption algorithm choices use CBC mode.) If the private keys are to be encrypted, then `password` is the password to be used. Otherwise, `password` may be left empty. For example: ``` Bag Attributes Microsoft Local Key set: localKeyID: 01 00 00 00 friendlyName: le-2b09a3d2-9037-4a05-95cc-4d44518e8607 Microsoft CSP Name: Microsoft RSA SChannel Cryptographic Provider Key Attributes X509v3 Key Usage: 10 -----BEGIN RSA PRIVATE KEY----- ... ... the private key associated with the main certificate. ... -----END RSA PRIVATE KEY----- Bag Attributes localKeyID: 01 00 00 00 1.3.6.1.4.1.311.17.3.92: 00 08 00 00 1.3.6.1.4.1.311.17.3.20: C2 53 54 F3 ... 1.3.6.1.4.1.311.17.3.71: 49 00 43 00 ... 1.3.6.1.4.1.311.17.3.75: 31 00 42 00 ... subject=/OU=Domain Control Validated/OU=PositiveSSL/CN=something.com issuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA -----BEGIN CERTIFICATE----- ... ... the main certificate ... -----END CERTIFICATE----- ... -----BEGIN CERTIFICATE----- ... ... an intermediate CA certificate (if present) ... -----END CERTIFICATE----- ... -----BEGIN CERTIFICATE----- ... ... the root CA certificate ... -----END CERTIFICATE----- ``` Returns True for success, False for failure. ### Pem.ToPfxObj `Chilkat 11.7.0 · pascal · Pem · ToPfxObj · method · since 11.0.0` ```pascal // pfxObj is a TPfx object. function ToPfxObj(pfxObj: TChilkatBase): Boolean; ``` Converts this PEM object, which must contain at least one private key, to PKCS12 and returns the PFX in `pfxObj`. Typically, a PKCS12 file includes one private key, its associated certificate, and the certificate chain. Returns True for success, False for failure. ## Related classes [`BinData`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/BinData.md), [`Cert`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/Cert.md), [`CertChain`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/CertChain.md), [`JavaKeyStore`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/JavaKeyStore.md), [`Pfx`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/Pfx.md), [`PrivateKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/PrivateKey.md), [`PublicKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/PublicKey.md)