--- product: Chilkat product_version: 11.7.0 language: swift language_label: Swift class: Pem class_name: CkoPem license: bundle deprecated: false reference_html: https://www.chilkatsoft.com/refdoc/swift_PemRef.html --- # Chilkat Pem — Swift — v11.7.0 > Chilkat 11.7.0 · language=swift · class=Pem (CkoPem) > Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0//classes/Pem.md`. > Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/swift/guide.md`. ## Purpose **Load, inspect, assemble, export, and convert PEM certificate and key material.** `Chilkat.Pem` is the Chilkat class for handling PEM-formatted certificate and key material. It can load PEM and PKCS#7 data, add certificates, private keys, public keys, CSRs, and certificate chains, retrieve individual items, remove content, control PKCS#1 vs. PKCS#8 private key output, export PEM with optional encryption and extended attributes, and convert PEM material to PFX or Java KeyStore objects. **Load PEM and PKCS#7** Load PEM-encoded certificates, keys, CSRs, and PKCS#7 certificate data from files, strings, or memory. **Collect certs and keys** Add certificates, private keys, public keys, CSRs, and certificate chains into a single PEM container. **Retrieve individual items** Extract selected certificates, keys, CSRs, or chains for use with `Cert`, `PrivateKey`, `PublicKey`, or related Chilkat classes. **Private-key format control** Choose PKCS#1 or PKCS#8 private-key output depending on the format required by the target system. **Encrypted PEM output** Export private-key material with password-based encryption when PEM data must be stored or transferred securely. **Convert to PFX or JKS** Convert PEM certificates and keys into PFX/P12 or Java KeyStore objects when another platform or API requires those container formats. **Common pattern:** Use `Pem` when certificate and key material is packaged as one or more PEM blocks. Load the PEM, inspect or retrieve the needed items, add or remove entries as needed, then export the result as PEM, PFX/P12, or Java KeyStore data. Use `Chilkat.Cert`, `PrivateKey`, and `PublicKey` when working directly with individual objects. For an extended overview, see [Pem Class Overview](https://www.chilkatsoft.com/pem_class_overview.asp). ## Object creation, unlocking and error handling **Object Creation** ```swift let obj = CkoPem()! ``` Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Swift. How failure is reported depends on the method's return type and is stated in the note under each method below. In every case the diagnostic text is in the `LastErrorText` property of the object whose method was called. ## Members common to every Chilkat class Documented once per language in `common-members.md`; listed here so this page is self-contained. | Property | Signature | Access | Meaning | |---|---|---|---| | `DebugLogFilePath` | `debugLogFilePath: String!` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. | | `LastErrorHtml` | `lastErrorHtml: String! (read-only)` | read-only | Provides HTML-formatted information about the last called method or property. | | `LastErrorText` | `lastErrorText: String! (read-only)` | read-only | Provides plain text information about the last called method or property. | | `LastErrorXml` | `lastErrorXml: String! (read-only)` | read-only | Provides XML-formatted information about the last called method or property. | | `LastMethodSuccess` | `lastMethodSuccess: Bool` | read/write | Indicates the success or failure of the most recent method call: `true` means success, `false` means failure. | | `VerboseLogging` | `verboseLogging: Bool` | read/write | If set to `true`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. | | `Version` | `version: String! (read-only)` | read-only | Version of the component/library, such as "10.1.0" | ## Member index | Member | Kind | Signature | |---|---|---| | `AppendMode` | property, read/write | `appendMode: Bool` | | `HeartbeatMs` | property, read/write | `heartbeatMs: Int` | | `NumCerts` | property, read-only | `numCerts: Int (read-only)` | | `NumCrls` | property, read-only | `numCrls: Int (read-only)` | | `NumCsrs` | property, read-only | `numCsrs: Int (read-only)` | | `NumPrivateKeys` | property, read-only | `numPrivateKeys: Int (read-only)` | | `NumPublicKeys` | property, read-only | `numPublicKeys: Int (read-only)` | | `PrivateKeyFormat` | property, read/write | `privateKeyFormat: String!` | | `PublicKeyFormat` | property, read/write | `publicKeyFormat: String!` | | `AddCert` | method | `addCert(cert: CkoCert, includeChain: Bool) -> Bool` | | `AddItem` | method | `addItem(itemType: String, encoding: String, itemData: String) -> Bool` | | `AddP7b` | method | `addP7b(bd: CkoBinData) -> Bool` | | `AddPrivateKey` | method | `addPrivateKey(privateKey: CkoPrivateKey) -> Bool` | | `AddPrivateKey2` | method | `addPrivateKey2(privKey: CkoPrivateKey, certChain: CkoCertChain) -> Bool` | | `AddPublicKey` | method | `addPublicKey(pubkey: CkoPublicKey) -> Bool` | | `CertAt` | method | `cert(at: Int, cert: CkoCert) -> Bool` | | `Clear` | method | `clear() -> Bool` | | `GetEncodedItem` | method | `getEncodedItem(itemType: String, itemSubType: String, encoding: String, index: Int) -> String` | | `LoadP7b` | method | `loadP7b(p7bData: NSData) -> Bool` | | `LoadP7bFile` | method | `loadP7bFile(path: String) -> Bool` | | `LoadPem` | method | `load(pemContent: String, password: String) -> Bool` | | `LoadPemFile` | method | `loadFile(path: String, password: String) -> Bool` | | `LoadTaskCaller` | method | `loadTaskCaller(task: CkoTask) -> Bool` | | `PrivateKeyAt` | method | `privateKey(at: Int, privKey: CkoPrivateKey) -> Bool` | | `PublicKeyAt` | method | `publicKey(at: Int, pubKey: CkoPublicKey) -> Bool` | | `RemoveCert` | method | `removeCert(index: Int) -> Bool` | | `RemovePrivateKey` | method | `removePrivateKey(index: Int) -> Bool` | | `ToJksObj` | method | `toJksObj(alias: String, password: String, jksObj: CkoJavaKeyStore) -> Bool` | | `ToPem` | method | `to() -> String` | | `ToPemEx` | method | `toEx(extendedAttrs: Bool, noKeys: Bool, noCerts: Bool, noCaCerts: Bool, encryptAlg: String, password: String) -> String` | | `ToPfxObj` | method | `toPfxObj(pfxObj: CkoPfx) -> Bool` | Deprecated members are listed at the end of this file with their replacements; do not use them in new code. ## Properties ### Pem.AppendMode `Chilkat 11.7.0 · swift · Pem · AppendMode · property · read/write · since 9.5.0.49` ```swift appendMode: Bool ``` When set to `true`, each of the Load\* methods appends to the current contents of this PEM object. When set to `false`, a Load\* method replaces the contents of this PEM object. The default is `false`. ### Pem.HeartbeatMs `Chilkat 11.7.0 · swift · Pem · HeartbeatMs · property · read/write · since 9.5.0.49` ```swift heartbeatMs: Int ``` **Full documentation for this property (same in every language):** [Event Callback Examples](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/event_callback_examples.md) The interval in milliseconds between each `AbortCheck` event callback, which enables an application to abort certain method calls before they complete. **By default, HeartbeatMs is set to** `0`**, meaning no AbortCheck event callbacks will trigger.** ### Pem.NumCerts `Chilkat 11.7.0 · swift · Pem · NumCerts · property · read-only · since 9.5.0.49` ```swift numCerts: Int (read-only) ``` The number of certificates in the loaded PEM. To get the 1st certificate, call GetCert(0). ### Pem.NumCrls `Chilkat 11.7.0 · swift · Pem · NumCrls · property · read-only · since 9.5.0.77` ```swift numCrls: Int (read-only) ``` The number of certificate revocation lists (CRLs) in the loaded PEM. ### Pem.NumCsrs `Chilkat 11.7.0 · swift · Pem · NumCsrs · property · read-only · since 9.5.0.50` ```swift numCsrs: Int (read-only) ``` The number of certificate signing requests (CSRs) in the loaded PEM. ### Pem.NumPrivateKeys `Chilkat 11.7.0 · swift · Pem · NumPrivateKeys · property · read-only · since 9.5.0.49` ```swift numPrivateKeys: Int (read-only) ``` The number of private keys in the loaded PEM. To get the 1st private key, call GetPrivateKey(0). ### Pem.NumPublicKeys `Chilkat 11.7.0 · swift · Pem · NumPublicKeys · property · read-only · since 9.5.0.49` ```swift numPublicKeys: Int (read-only) ``` The number of public keys in the loaded PEM. To get the 1st public key, call GetPublicKey(0). ### Pem.PrivateKeyFormat `Chilkat 11.7.0 · swift · Pem · PrivateKeyFormat · property · read/write · since 9.5.0.49` ```swift privateKeyFormat: String! ``` Controls the format to be used for **unencrypted** private keys when writing a PEM. Possible values are `pkcs1` and `pkcs8`. (OpenSSL typically uses the `pkcs8` format.) When writing encrypted private keys to PEM, the format is always PKCS8, and the PEM header is `BEGIN ENCRYPTED PRIVATE KEY`. The default is `pkcs8`. The PKCS1 format uses the PEM header: BEGIN RSA PRIVATE KEY. The PKCS8 format uses the PEM header: BEGIN PRIVATE KEY. ### Pem.PublicKeyFormat `Chilkat 11.7.0 · swift · Pem · PublicKeyFormat · property · read/write · since 9.5.0.49` ```swift publicKeyFormat: String! ``` Controls the format to be used for public keys when writing a PEM. Possible values are `pkcs1` and `pkcs8`. (OpenSSL typically uses the `pkcs8` format.) The default is `pkcs8`. The PKCS1 format uses the PEM header: BEGIN RSA PUBLIC KEY. The PKCS8 format uses the PEM header: BEGIN PUBLIC KEY. ## Methods ### Pem.AddCert `Chilkat 11.7.0 · swift · Pem · AddCert · method · since 9.5.0.49` ```swift addCert(cert: CkoCert, includeChain: Bool) -> Bool ``` Adds a certificate, and potentially the certs in its chain of authentication to the PEM. If `includeChain` is `true`, then certificates in the 's chain of authentication up to and including the root are automatically added. Returns true for success, false for failure. ### Pem.AddItem `Chilkat 11.7.0 · swift · Pem · AddItem · method · since 9.5.0.59` ```swift addItem(itemType: String, encoding: String, itemData: String) -> Bool ``` Adds a certificate, private key, public key, or csr to the PEM. The possible values for are `certificate` (or `cert`), `privateKey`, `publicKey`, or `csr`. The `encoding` can be `Base64`, `modBase64`, `Base32`, `QP` (for quoted-printable), `URL` (for url-encoding), `Hex`, `url_oauth`, `url_rfc1738`, `url_rfc2396`, and `url_rfc3986`. The `itemData` contains the ASN.1 data in string format according to the encoding specified in `encoding`. Returns true for success, false for failure. ### Pem.AddP7b `Chilkat 11.7.0 · swift · Pem · AddP7b · method · since 11.0.0` ```swift addP7b(bd: CkoBinData) -> Bool ``` Loads the PEM from the contents of an PKCS7 container (.p7b) contained in . A .p7b (or .p7c) file contains a PKCS#7 container, which may include: - One or more X.509 certificates (a certificate chain) - Optionally, CRLs (Certificate Revocation Lists) - No private key Common Use: Used to bundle intermediate and root certificates for things like SSL certificate chains. Returns true for success, false for failure. ### Pem.AddPrivateKey `Chilkat 11.7.0 · swift · Pem · AddPrivateKey · method · since 9.5.0.49` ```swift addPrivateKey(privateKey: CkoPrivateKey) -> Bool ``` Adds a private key to the PEM object. Returns true for success, false for failure. ### Pem.AddPrivateKey2 `Chilkat 11.7.0 · swift · Pem · AddPrivateKey2 · method · since 9.5.0.49` ```swift addPrivateKey2(privKey: CkoPrivateKey, certChain: CkoCertChain) -> Bool ``` Adds a private key and it's associated certificate chain to the PEM object. Returns true for success, false for failure. ### Pem.AddPublicKey `Chilkat 11.7.0 · swift · Pem · AddPublicKey · method · since 9.5.0.49` ```swift addPublicKey(pubkey: CkoPublicKey) -> Bool ``` Adds a public key to the PEM object. Returns true for success, false for failure. ### Pem.CertAt `Chilkat 11.7.0 · swift · Pem · CertAt · method · since 11.0.0` ```swift cert(at: Int, cert: CkoCert) -> Bool ``` Returns in `cert` the Nth certificate from the PEM. The first certificate is at index 0. Returns true for success, false for failure. ### Pem.Clear `Chilkat 11.7.0 · swift · Pem · Clear · method · since 9.5.0.49` ```swift clear() -> Bool ``` Removes all content from this PEM object. Returns true for success, false for failure. ### Pem.GetEncodedItem `Chilkat 11.7.0 · swift · Pem · GetEncodedItem · method · since 9.5.0.50` ```swift getEncodedItem(itemType: String, itemSubType: String, encoding: String, index: Int) -> String ``` Returns the encoded contents of the Nth item of a particular type (0-based `index`). The possible values for are `certificate` (or `cert`), `privateKey`, `publicKey`, or `csr`. Input string args are case-insensitive. If the is `privateKey`, the `itemSubType` may be `der` or `pkcs8`. If the is `publicKey`, the `itemSubType` may be `der` or `pkcs1`. The `itemSubType` is ignored for other values of . The valid `encoding` modes are `Base64`, `modBase64`, `Base32`, `Base58`, `QP` (for quoted-printable), `URL` (for url-encoding), `Hex`, `url_oauth`, `url_rfc1738`, `url_rfc2396`, and `url_rfc3986`. Returns `nil` on failure ### Pem.LoadP7b `Chilkat 11.7.0 · swift · Pem · LoadP7b · method · since 9.5.0.49` ```swift loadP7b(p7bData: NSData) -> Bool ``` Loads the PEM from the contents of an in-memory PKCS7 container (.p7b). Returns true for success, false for failure. ### Pem.LoadP7bFile `Chilkat 11.7.0 · swift · Pem · LoadP7bFile · method · since 9.5.0.49` ```swift loadP7bFile(path: String) -> Bool ``` Loads the contents of a PKCS7 container (.p7b file). Returns true for success, false for failure. ### Pem.LoadPem `Chilkat 11.7.0 · swift · Pem · LoadPem · method · since 9.5.0.49` ```swift load(pemContent: String, password: String) -> Bool ``` Loads the PEM from a PEM string. If encrypted, then the `password` is required for decryption. Otherwise, an empty string (or any string) may be passed for the `password`. Returns true for success, false for failure. ### Pem.LoadPemFile `Chilkat 11.7.0 · swift · Pem · LoadPemFile · method · since 9.5.0.49` ```swift loadFile(path: String, password: String) -> Bool ``` Loads the PEM from a PEM file. If encrypted, then the `password` is required for decryption. Otherwise, an empty string (or any string) may be passed for the `password`. Returns true for success, false for failure. ### Pem.LoadTaskCaller `Chilkat 11.7.0 · swift · Pem · LoadTaskCaller · method · since 9.5.0.80` ```swift loadTaskCaller(task: CkoTask) -> Bool ``` Loads the caller of the task's async method. Returns true for success, false for failure. ### Pem.PrivateKeyAt `Chilkat 11.7.0 · swift · Pem · PrivateKeyAt · method · since 11.0.0` ```swift privateKey(at: Int, privKey: CkoPrivateKey) -> Bool ``` Returns in `privKey` the Nth private key from the PEM. The first private key is at index 0. Returns true for success, false for failure. ### Pem.PublicKeyAt `Chilkat 11.7.0 · swift · Pem · PublicKeyAt · method · since 11.0.0` ```swift publicKey(at: Int, pubKey: CkoPublicKey) -> Bool ``` Returns in `pubKey` the Nth public key from the PEM. The first public key is at index 0. Returns true for success, false for failure. ### Pem.RemoveCert `Chilkat 11.7.0 · swift · Pem · RemoveCert · method · since 9.5.0.49` ```swift removeCert(index: Int) -> Bool ``` Removes the Nth certificate from the PEM. The first certificate is at index 0. Returns true for success, false for failure. ### Pem.RemovePrivateKey `Chilkat 11.7.0 · swift · Pem · RemovePrivateKey · method · since 9.5.0.49` ```swift removePrivateKey(index: Int) -> Bool ``` Removes the Nth private key from the PEM. The first private key is at index 0. Returns true for success, false for failure. ### Pem.ToJksObj `Chilkat 11.7.0 · swift · Pem · ToJksObj · method · since 11.0.0` ```swift toJksObj(alias: String, password: String, jksObj: CkoJavaKeyStore) -> Bool ``` This function converts this PEM to a Java KeyStore (JKS) object and stores it in `jksObj`. If is provided, it will be used as the alias for the first object in the PEM (either a private key or certificate), while subsequent objects will receive autogenerated aliases. The resulting JKS will be encrypted with `password`, unless the PEM contains only certificates, in which case `password` is not used. Returns true for success, false for failure. ### Pem.ToPem `Chilkat 11.7.0 · swift · Pem · ToPem · method · since 9.5.0.47` ```swift to() -> String ``` Write the PFX to a PEM formatted string. The resultant PEM will contain the private key, as well as the certs in the chain of authentication (or whatever certs are available in the PFX). For example: ``` -----BEGIN RSA PRIVATE KEY----- ... ... the private key associated with the main certificate. ... -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- ... ... the main certificate ... -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- ... ... an intermediate CA certificate (if present) ... -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- ... ... the root CA certificate ... -----END CERTIFICATE----- ``` Returns `nil` on failure ### Pem.ToPemEx `Chilkat 11.7.0 · swift · Pem · ToPemEx · method · since 9.5.0.49` ```swift toEx(extendedAttrs: Bool, noKeys: Bool, noCerts: Bool, noCaCerts: Bool, encryptAlg: String, password: String) -> String ``` Write the PFX to a PEM formatted string. If is `true`, then extended properties (Bag Attributes and Key Attributes) are output. If `noKeys` is `true`, then no private keys are output. If `noCerts` is `true`, then no certificates are output. If `noCaCerts` is `true`, then no CA certs or intermediate CA certs are output. If `encryptAlg` is not empty, it indicates the encryption algorithm to be used for encrypting the private keys (otherwise the private keys are output unencrypted). The possible choices for the `encryptAlg` are `des3`, `aes128`, `aes192`, and `aes256`. (All encryption algorithm choices use CBC mode.) If the private keys are to be encrypted, then `password` is the password to be used. Otherwise, `password` may be left empty. For example: ``` Bag Attributes Microsoft Local Key set: localKeyID: 01 00 00 00 friendlyName: le-2b09a3d2-9037-4a05-95cc-4d44518e8607 Microsoft CSP Name: Microsoft RSA SChannel Cryptographic Provider Key Attributes X509v3 Key Usage: 10 -----BEGIN RSA PRIVATE KEY----- ... ... the private key associated with the main certificate. ... -----END RSA PRIVATE KEY----- Bag Attributes localKeyID: 01 00 00 00 1.3.6.1.4.1.311.17.3.92: 00 08 00 00 1.3.6.1.4.1.311.17.3.20: C2 53 54 F3 ... 1.3.6.1.4.1.311.17.3.71: 49 00 43 00 ... 1.3.6.1.4.1.311.17.3.75: 31 00 42 00 ... subject=/OU=Domain Control Validated/OU=PositiveSSL/CN=something.com issuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA -----BEGIN CERTIFICATE----- ... ... the main certificate ... -----END CERTIFICATE----- ... -----BEGIN CERTIFICATE----- ... ... an intermediate CA certificate (if present) ... -----END CERTIFICATE----- ... -----BEGIN CERTIFICATE----- ... ... the root CA certificate ... -----END CERTIFICATE----- ``` Returns `nil` on failure ### Pem.ToPfxObj `Chilkat 11.7.0 · swift · Pem · ToPfxObj · method · since 11.0.0` ```swift toPfxObj(pfxObj: CkoPfx) -> Bool ``` Converts this PEM object, which must contain at least one private key, to PKCS12 and returns the PFX in . Typically, a PKCS12 file includes one private key, its associated certificate, and the certificate chain. Returns true for success, false for failure. ## Deprecated members — do not use in new code | Member | Kind | Deprecated in | Use instead | |---|---|---|---| | `GetCert` | method | before 11.6.1 | `CertAt` | | `GetPrivateKey` | method | before 11.6.1 | `PrivateKeyAt` | | `GetPublicKey` | method | before 11.6.1 | `PublicKeyAt` | | `ToJks` | method | before 11.6.1 | `ToJksObj` | | `ToPfx` | method | before 11.6.1 | `ToPfxObj` | ## Related classes [`BinData`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/swift/classes/BinData.md), [`Cert`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/swift/classes/Cert.md), [`CertChain`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/swift/classes/CertChain.md), [`JavaKeyStore`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/swift/classes/JavaKeyStore.md), [`Pfx`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/swift/classes/Pfx.md), [`PrivateKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/swift/classes/PrivateKey.md), [`PublicKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/swift/classes/PublicKey.md), [`Task`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/swift/classes/Task.md)