application/pkix-cert

A single X.509 certificate in raw DER, the type defined for fetching certificates over HTTP in a PKI. One certificate per body is the rule — chains do not belong here (that is application/pkix-pkipath or a PKCS #7 bundle). In the wild it competes with the older unregistered application/x-x509-ca-cert, which many servers still send for .cer and .crt files, so tolerant parsers accept both. PEM text with BEGIN CERTIFICATE armor is a different encoding, not just a different extension.

.cer and .crt are interchangeable in practice, and either may hold DER or PEM — the extension does not tell you which.

Defined by RFC 2585 · IANA registration. Registry facts from the IANA media-types registry via mime-db.