--- product: Chilkat product_version: 11.7.0 language: wcpp language_label: Unicode C++ class: Pem class_name: CkPemW license: bundle deprecated: false reference_html: https://www.chilkatsoft.com/refdoc/wcppCkPemWRef.html --- # Chilkat Pem — Unicode C++ — v11.7.0 > Chilkat 11.7.0 · language=wcpp · class=Pem (CkPemW) > Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0//classes/Pem.md`. > Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/wcpp/guide.md`. ## Purpose **Load, inspect, assemble, export, and convert PEM certificate and key material.** `Chilkat.Pem` is the Chilkat class for handling PEM-formatted certificate and key material. It can load PEM and PKCS#7 data, add certificates, private keys, public keys, CSRs, and certificate chains, retrieve individual items, remove content, control PKCS#1 vs. PKCS#8 private key output, export PEM with optional encryption and extended attributes, and convert PEM material to PFX or Java KeyStore objects. **Load PEM and PKCS#7** Load PEM-encoded certificates, keys, CSRs, and PKCS#7 certificate data from files, strings, or memory. **Collect certs and keys** Add certificates, private keys, public keys, CSRs, and certificate chains into a single PEM container. **Retrieve individual items** Extract selected certificates, keys, CSRs, or chains for use with `Cert`, `PrivateKey`, `PublicKey`, or related Chilkat classes. **Private-key format control** Choose PKCS#1 or PKCS#8 private-key output depending on the format required by the target system. **Encrypted PEM output** Export private-key material with password-based encryption when PEM data must be stored or transferred securely. **Convert to PFX or JKS** Convert PEM certificates and keys into PFX/P12 or Java KeyStore objects when another platform or API requires those container formats. **Common pattern:** Use `Pem` when certificate and key material is packaged as one or more PEM blocks. Load the PEM, inspect or retrieve the needed items, add or remove entries as needed, then export the result as PEM, PFX/P12, or Java KeyStore data. Use `Chilkat.Cert`, `PrivateKey`, and `PublicKey` when working directly with individual objects. For an extended overview, see [Pem Class Overview](https://www.chilkatsoft.com/pem_class_overview.asp). ## Object creation, unlocking and error handling **Object Creation** ```cpp // Local variable on the stack CkPemW obj; // Dynamically allocate/delete CkPemW *pObj = new CkPemW(); // ... delete pObj; ``` Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Unicode C++. How failure is reported depends on the method's return type and is stated in the note under each method below. In every case the diagnostic text is in the `LastErrorText` property of the object whose method was called. ## Members common to every Chilkat class Documented once per language in `common-members.md`; listed here so this page is self-contained. | Property | Signature | Access | Meaning | |---|---|---|---| | `DebugLogFilePath` | `void get_DebugLogFilePath(CkString &str); const wchar_t *debugLogFilePath(void); void put_DebugLogFilePath(const wchar_t *str);` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. | | `LastErrorHtml` | `void get_LastErrorHtml(CkString &str); const wchar_t *lastErrorHtml(void);` | read-only | Provides HTML-formatted information about the last called method or property. | | `LastErrorText` | `void get_LastErrorText(CkString &str); const wchar_t *lastErrorText(void);` | read-only | Provides plain text information about the last called method or property. | | `LastErrorXml` | `void get_LastErrorXml(CkString &str); const wchar_t *lastErrorXml(void);` | read-only | Provides XML-formatted information about the last called method or property. | | `LastMethodSuccess` | `bool get_LastMethodSuccess(void); void put_LastMethodSuccess(bool newVal);` | read/write | Indicates the success or failure of the most recent method call: `true` means success, `false` means failure. | | `VerboseLogging` | `bool get_VerboseLogging(void); void put_VerboseLogging(bool newVal);` | read/write | If set to `true`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. | | `Version` | `void get_Version(CkString &str); const wchar_t *version(void);` | read-only | Version of the component/library, such as "10.1.0" | ## Member index | Member | Kind | Signature | |---|---|---| | `AppendMode` | property, read/write | `bool get_AppendMode(void); void put_AppendMode(bool newVal);` | | `HeartbeatMs` | property, read/write | `int get_HeartbeatMs(void); void put_HeartbeatMs(int newVal);` | | `NumCerts` | property, read-only | `int get_NumCerts(void);` | | `NumCrls` | property, read-only | `int get_NumCrls(void);` | | `NumCsrs` | property, read-only | `int get_NumCsrs(void);` | | `NumPrivateKeys` | property, read-only | `int get_NumPrivateKeys(void);` | | `NumPublicKeys` | property, read-only | `int get_NumPublicKeys(void);` | | `PrivateKeyFormat` | property, read/write | `void get_PrivateKeyFormat(CkString &str); const wchar_t *privateKeyFormat(void); void put_PrivateKeyFormat(const wchar_t *str);` | | `PublicKeyFormat` | property, read/write | `void get_PublicKeyFormat(CkString &str); const wchar_t *publicKeyFormat(void); void put_PublicKeyFormat(const wchar_t *str);` | | `AddCert` | method | `bool AddCert(CkCertW &cert, bool includeChain);` | | `AddItem` | method | `bool AddItem(const wchar_t *itemType, const wchar_t *encoding, const wchar_t *itemData);` | | `AddP7b` | method | `bool AddP7b(CkBinDataW &bd);` | | `AddPrivateKey` | method | `bool AddPrivateKey(CkPrivateKeyW &privateKey);` | | `AddPrivateKey2` | method | `bool AddPrivateKey2(CkPrivateKeyW &privKey, CkCertChainW &certChain);` | | `AddPublicKey` | method | `bool AddPublicKey(CkPublicKeyW &pubkey);` | | `CertAt` | method | `bool CertAt(int index, CkCertW &cert);` | | `Clear` | method | `bool Clear(void);` | | `GetEncodedItem` | method | `bool GetEncodedItem(const wchar_t *itemType, const wchar_t *itemSubType, const wchar_t *encoding, int index, CkString &outStr); const wchar_t *getEncodedItem(const wchar_t *itemType, const wchar_t *itemSubType, const wchar_t *encoding, int index);` | | `LoadP7bFile` | method | `bool LoadP7bFile(const wchar_t *path);` | | `LoadPem` | method | `bool LoadPem(const wchar_t *pemContent, const wchar_t *password);` | | `LoadPemFile` | method | `bool LoadPemFile(const wchar_t *path, const wchar_t *password);` | | `LoadTaskCaller` | method | `bool LoadTaskCaller(CkTaskW &task);` | | `PrivateKeyAt` | method | `bool PrivateKeyAt(int index, CkPrivateKeyW &privKey);` | | `PublicKeyAt` | method | `bool PublicKeyAt(int index, CkPublicKeyW &pubKey);` | | `RemoveCert` | method | `bool RemoveCert(int index);` | | `RemovePrivateKey` | method | `bool RemovePrivateKey(int index);` | | `ToJksObj` | method | `bool ToJksObj(const wchar_t *aliasName, const wchar_t *password, CkJavaKeyStoreW &jksObj);` | | `ToPem` | method | `bool ToPem(CkString &outStr); const wchar_t *toPem(void);` | | `ToPemEx` | method | `bool ToPemEx(bool extendedAttrs, bool noKeys, bool noCerts, bool noCaCerts, const wchar_t *encryptAlg, const wchar_t *password, CkString &outStr); const wchar_t *toPemEx(bool extendedAttrs, bool noKeys, bool noCerts, bool noCaCerts, const wchar_t *encryptAlg, const wchar_t *password);` | | `ToPfxObj` | method | `bool ToPfxObj(CkPfxW &pfxObj);` | Deprecated members are listed at the end of this file with their replacements; do not use them in new code. ## Properties ### Pem.AppendMode `Chilkat 11.7.0 · wcpp · Pem · AppendMode · property · read/write · since 9.5.0.49` ```cpp bool get_AppendMode(void); void put_AppendMode(bool newVal); ``` When set to `true`, each of the Load\* methods appends to the current contents of this PEM object. When set to `false`, a Load\* method replaces the contents of this PEM object. The default is `false`. ### Pem.HeartbeatMs `Chilkat 11.7.0 · wcpp · Pem · HeartbeatMs · property · read/write · since 9.5.0.49` ```cpp int get_HeartbeatMs(void); void put_HeartbeatMs(int newVal); ``` **Full documentation for this property (same in every language):** [Event Callback Examples](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/event_callback_examples.md) The interval in milliseconds between each `AbortCheck` event callback, which enables an application to abort certain method calls before they complete. **By default, HeartbeatMs is set to** `0`**, meaning no AbortCheck event callbacks will trigger.** ### Pem.NumCerts `Chilkat 11.7.0 · wcpp · Pem · NumCerts · property · read-only · since 9.5.0.49` ```cpp int get_NumCerts(void); ``` The number of certificates in the loaded PEM. To get the 1st certificate, call GetCert(0). ### Pem.NumCrls `Chilkat 11.7.0 · wcpp · Pem · NumCrls · property · read-only · since 9.5.0.77` ```cpp int get_NumCrls(void); ``` The number of certificate revocation lists (CRLs) in the loaded PEM. ### Pem.NumCsrs `Chilkat 11.7.0 · wcpp · Pem · NumCsrs · property · read-only · since 9.5.0.50` ```cpp int get_NumCsrs(void); ``` The number of certificate signing requests (CSRs) in the loaded PEM. ### Pem.NumPrivateKeys `Chilkat 11.7.0 · wcpp · Pem · NumPrivateKeys · property · read-only · since 9.5.0.49` ```cpp int get_NumPrivateKeys(void); ``` The number of private keys in the loaded PEM. To get the 1st private key, call GetPrivateKey(0). ### Pem.NumPublicKeys `Chilkat 11.7.0 · wcpp · Pem · NumPublicKeys · property · read-only · since 9.5.0.49` ```cpp int get_NumPublicKeys(void); ``` The number of public keys in the loaded PEM. To get the 1st public key, call GetPublicKey(0). ### Pem.PrivateKeyFormat `Chilkat 11.7.0 · wcpp · Pem · PrivateKeyFormat · property · read/write · since 9.5.0.49` ```cpp void get_PrivateKeyFormat(CkString &str); const wchar_t *privateKeyFormat(void); void put_PrivateKeyFormat(const wchar_t *str); ``` Controls the format to be used for **unencrypted** private keys when writing a PEM. Possible values are `pkcs1` and `pkcs8`. (OpenSSL typically uses the `pkcs8` format.) When writing encrypted private keys to PEM, the format is always PKCS8, and the PEM header is `BEGIN ENCRYPTED PRIVATE KEY`. The default is `pkcs8`. The PKCS1 format uses the PEM header: BEGIN RSA PRIVATE KEY. The PKCS8 format uses the PEM header: BEGIN PRIVATE KEY. ### Pem.PublicKeyFormat `Chilkat 11.7.0 · wcpp · Pem · PublicKeyFormat · property · read/write · since 9.5.0.49` ```cpp void get_PublicKeyFormat(CkString &str); const wchar_t *publicKeyFormat(void); void put_PublicKeyFormat(const wchar_t *str); ``` Controls the format to be used for public keys when writing a PEM. Possible values are `pkcs1` and `pkcs8`. (OpenSSL typically uses the `pkcs8` format.) The default is `pkcs8`. The PKCS1 format uses the PEM header: BEGIN RSA PUBLIC KEY. The PKCS8 format uses the PEM header: BEGIN PUBLIC KEY. ## Methods ### Pem.AddCert `Chilkat 11.7.0 · wcpp · Pem · AddCert · method · since 9.5.0.49` ```cpp bool AddCert(CkCertW &cert, bool includeChain); ``` Adds a certificate, and potentially the certs in its chain of authentication to the PEM. If `includeChain` is `true`, then certificates in the `cert`'s chain of authentication up to and including the root are automatically added. Returns true for success, false for failure. ### Pem.AddItem `Chilkat 11.7.0 · wcpp · Pem · AddItem · method · since 9.5.0.59` ```cpp bool AddItem(const wchar_t *itemType, const wchar_t *encoding, const wchar_t *itemData); ``` Adds a certificate, private key, public key, or csr to the PEM. The possible values for `itemType` are `certificate` (or `cert`), `privateKey`, `publicKey`, or `csr`. The `encoding` can be `Base64`, `modBase64`, `Base32`, `QP` (for quoted-printable), `URL` (for url-encoding), `Hex`, `url_oauth`, `url_rfc1738`, `url_rfc2396`, and `url_rfc3986`. The `itemData` contains the ASN.1 data in string format according to the encoding specified in `encoding`. Returns true for success, false for failure. ### Pem.AddP7b `Chilkat 11.7.0 · wcpp · Pem · AddP7b · method · since 11.0.0` ```cpp bool AddP7b(CkBinDataW &bd); ``` Loads the PEM from the contents of an PKCS7 container (.p7b) contained in `bd`. A .p7b (or .p7c) file contains a PKCS#7 container, which may include: - One or more X.509 certificates (a certificate chain) - Optionally, CRLs (Certificate Revocation Lists) - No private key Common Use: Used to bundle intermediate and root certificates for things like SSL certificate chains. Returns true for success, false for failure. ### Pem.AddPrivateKey `Chilkat 11.7.0 · wcpp · Pem · AddPrivateKey · method · since 9.5.0.49` ```cpp bool AddPrivateKey(CkPrivateKeyW &privateKey); ``` Adds a private key to the PEM object. Returns true for success, false for failure. ### Pem.AddPrivateKey2 `Chilkat 11.7.0 · wcpp · Pem · AddPrivateKey2 · method · since 9.5.0.49` ```cpp bool AddPrivateKey2(CkPrivateKeyW &privKey, CkCertChainW &certChain); ``` Adds a private key and it's associated certificate chain to the PEM object. Returns true for success, false for failure. ### Pem.AddPublicKey `Chilkat 11.7.0 · wcpp · Pem · AddPublicKey · method · since 9.5.0.49` ```cpp bool AddPublicKey(CkPublicKeyW &pubkey); ``` Adds a public key to the PEM object. Returns true for success, false for failure. ### Pem.CertAt `Chilkat 11.7.0 · wcpp · Pem · CertAt · method · since 11.0.0` ```cpp bool CertAt(int index, CkCertW &cert); ``` Returns in `cert` the Nth certificate from the PEM. The first certificate is at index 0. Returns true for success, false for failure. ### Pem.Clear `Chilkat 11.7.0 · wcpp · Pem · Clear · method · since 9.5.0.49` ```cpp bool Clear(void); ``` Removes all content from this PEM object. Returns true for success, false for failure. ### Pem.GetEncodedItem `Chilkat 11.7.0 · wcpp · Pem · GetEncodedItem · method · since 9.5.0.50` ```cpp bool GetEncodedItem(const wchar_t *itemType, const wchar_t *itemSubType, const wchar_t *encoding, int index, CkString &outStr); const wchar_t *getEncodedItem(const wchar_t *itemType, const wchar_t *itemSubType, const wchar_t *encoding, int index); ``` Returns the encoded contents of the Nth item of a particular type (0-based `index`). The possible values for `itemType` are `certificate` (or `cert`), `privateKey`, `publicKey`, or `csr`. Input string args are case-insensitive. If the `itemType` is `privateKey`, the `itemSubType` may be `der` or `pkcs8`. If the `itemType` is `publicKey`, the `itemSubType` may be `der` or `pkcs1`. The `itemSubType` is ignored for other values of `itemType`. The valid `encoding` modes are `Base64`, `modBase64`, `Base32`, `Base58`, `QP` (for quoted-printable), `URL` (for url-encoding), `Hex`, `url_oauth`, `url_rfc1738`, `url_rfc2396`, and `url_rfc3986`. Returns true for success, false for failure. ### Pem.LoadP7bFile `Chilkat 11.7.0 · wcpp · Pem · LoadP7bFile · method · since 9.5.0.49` ```cpp bool LoadP7bFile(const wchar_t *path); ``` Loads the contents of a PKCS7 container (.p7b file). Returns true for success, false for failure. ### Pem.LoadPem `Chilkat 11.7.0 · wcpp · Pem · LoadPem · method · since 9.5.0.49` ```cpp bool LoadPem(const wchar_t *pemContent, const wchar_t *password); ``` Loads the PEM from a PEM string. If encrypted, then the `password` is required for decryption. Otherwise, an empty string (or any string) may be passed for the `password`. Returns true for success, false for failure. ### Pem.LoadPemFile `Chilkat 11.7.0 · wcpp · Pem · LoadPemFile · method · since 9.5.0.49` ```cpp bool LoadPemFile(const wchar_t *path, const wchar_t *password); ``` Loads the PEM from a PEM file. If encrypted, then the `password` is required for decryption. Otherwise, an empty string (or any string) may be passed for the `password`. Returns true for success, false for failure. ### Pem.LoadTaskCaller `Chilkat 11.7.0 · wcpp · Pem · LoadTaskCaller · method · since 9.5.0.80` ```cpp bool LoadTaskCaller(CkTaskW &task); ``` Loads the caller of the task's async method. Returns true for success, false for failure. ### Pem.PrivateKeyAt `Chilkat 11.7.0 · wcpp · Pem · PrivateKeyAt · method · since 11.0.0` ```cpp bool PrivateKeyAt(int index, CkPrivateKeyW &privKey); ``` Returns in `privKey` the Nth private key from the PEM. The first private key is at index 0. Returns true for success, false for failure. ### Pem.PublicKeyAt `Chilkat 11.7.0 · wcpp · Pem · PublicKeyAt · method · since 11.0.0` ```cpp bool PublicKeyAt(int index, CkPublicKeyW &pubKey); ``` Returns in `pubKey` the Nth public key from the PEM. The first public key is at index 0. Returns true for success, false for failure. ### Pem.RemoveCert `Chilkat 11.7.0 · wcpp · Pem · RemoveCert · method · since 9.5.0.49` ```cpp bool RemoveCert(int index); ``` Removes the Nth certificate from the PEM. The first certificate is at index 0. Returns true for success, false for failure. ### Pem.RemovePrivateKey `Chilkat 11.7.0 · wcpp · Pem · RemovePrivateKey · method · since 9.5.0.49` ```cpp bool RemovePrivateKey(int index); ``` Removes the Nth private key from the PEM. The first private key is at index 0. Returns true for success, false for failure. ### Pem.ToJksObj `Chilkat 11.7.0 · wcpp · Pem · ToJksObj · method · since 11.0.0` ```cpp bool ToJksObj(const wchar_t *aliasName, const wchar_t *password, CkJavaKeyStoreW &jksObj); ``` This function converts this PEM to a Java KeyStore (JKS) object and stores it in `jksObj`. If `aliasName` is provided, it will be used as the alias for the first object in the PEM (either a private key or certificate), while subsequent objects will receive autogenerated aliases. The resulting JKS will be encrypted with `password`, unless the PEM contains only certificates, in which case `password` is not used. Returns true for success, false for failure. ### Pem.ToPem `Chilkat 11.7.0 · wcpp · Pem · ToPem · method · since 9.5.0.47` ```cpp bool ToPem(CkString &outStr); const wchar_t *toPem(void); ``` Write the PFX to a PEM formatted string. The resultant PEM will contain the private key, as well as the certs in the chain of authentication (or whatever certs are available in the PFX). For example: ``` -----BEGIN RSA PRIVATE KEY----- ... ... the private key associated with the main certificate. ... -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- ... ... the main certificate ... -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- ... ... an intermediate CA certificate (if present) ... -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- ... ... the root CA certificate ... -----END CERTIFICATE----- ``` Returns true for success, false for failure. ### Pem.ToPemEx `Chilkat 11.7.0 · wcpp · Pem · ToPemEx · method · since 9.5.0.49` ```cpp bool ToPemEx(bool extendedAttrs, bool noKeys, bool noCerts, bool noCaCerts, const wchar_t *encryptAlg, const wchar_t *password, CkString &outStr); const wchar_t *toPemEx(bool extendedAttrs, bool noKeys, bool noCerts, bool noCaCerts, const wchar_t *encryptAlg, const wchar_t *password); ``` Write the PFX to a PEM formatted string. If `extendedAttrs` is `true`, then extended properties (Bag Attributes and Key Attributes) are output. If `noKeys` is `true`, then no private keys are output. If `noCerts` is `true`, then no certificates are output. If `noCaCerts` is `true`, then no CA certs or intermediate CA certs are output. If `encryptAlg` is not empty, it indicates the encryption algorithm to be used for encrypting the private keys (otherwise the private keys are output unencrypted). The possible choices for the `encryptAlg` are `des3`, `aes128`, `aes192`, and `aes256`. (All encryption algorithm choices use CBC mode.) If the private keys are to be encrypted, then `password` is the password to be used. Otherwise, `password` may be left empty. For example: ``` Bag Attributes Microsoft Local Key set: localKeyID: 01 00 00 00 friendlyName: le-2b09a3d2-9037-4a05-95cc-4d44518e8607 Microsoft CSP Name: Microsoft RSA SChannel Cryptographic Provider Key Attributes X509v3 Key Usage: 10 -----BEGIN RSA PRIVATE KEY----- ... ... the private key associated with the main certificate. ... -----END RSA PRIVATE KEY----- Bag Attributes localKeyID: 01 00 00 00 1.3.6.1.4.1.311.17.3.92: 00 08 00 00 1.3.6.1.4.1.311.17.3.20: C2 53 54 F3 ... 1.3.6.1.4.1.311.17.3.71: 49 00 43 00 ... 1.3.6.1.4.1.311.17.3.75: 31 00 42 00 ... subject=/OU=Domain Control Validated/OU=PositiveSSL/CN=something.com issuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA -----BEGIN CERTIFICATE----- ... ... the main certificate ... -----END CERTIFICATE----- ... -----BEGIN CERTIFICATE----- ... ... an intermediate CA certificate (if present) ... -----END CERTIFICATE----- ... -----BEGIN CERTIFICATE----- ... ... the root CA certificate ... -----END CERTIFICATE----- ``` Returns true for success, false for failure. ### Pem.ToPfxObj `Chilkat 11.7.0 · wcpp · Pem · ToPfxObj · method · since 11.0.0` ```cpp bool ToPfxObj(CkPfxW &pfxObj); ``` Converts this PEM object, which must contain at least one private key, to PKCS12 and returns the PFX in `pfxObj`. Typically, a PKCS12 file includes one private key, its associated certificate, and the certificate chain. Returns true for success, false for failure. ## Deprecated members — do not use in new code | Member | Kind | Deprecated in | Use instead | |---|---|---|---| | `GetCert` | method | before 11.6.1 | `CertAt` | | `GetPrivateKey` | method | before 11.6.1 | `PrivateKeyAt` | | `GetPublicKey` | method | before 11.6.1 | `PublicKeyAt` | | `LoadP7b` | method | before 11.6.1 | — | | `ToJks` | method | before 11.6.1 | `ToJksObj` | | `ToPfx` | method | before 11.6.1 | `ToPfxObj` | ## Related classes [`BinData`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/wcpp/classes/BinData.md), [`Cert`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/wcpp/classes/Cert.md), [`CertChain`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/wcpp/classes/CertChain.md), [`JavaKeyStore`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/wcpp/classes/JavaKeyStore.md), [`Pfx`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/wcpp/classes/Pfx.md), [`PrivateKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/wcpp/classes/PrivateKey.md), [`PublicKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/wcpp/classes/PublicKey.md), [`Task`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/wcpp/classes/Task.md)