# What is the correct format for a CRLF in a SSL certificate's pem

Currently I am working with SSL certificates inside a Ruby on Rails application.

I am storing the certificates in a database along with the corresponding dhparam, and chain. At some point I want to render these fields into real files and publish them to a server.

Although the published certificates work in the client's browser we got in massive trouble with a couple of other apps (including golang services, amazon cloudfront, ...) telling us that the certificate is not correct (e.g. x509: certificate signed by unknown authority).

So I had a look at the certificates that were rendered. The only difference I was able to find is that Ruby's OpenSSL library returns the certificate with a different carriage return than I was used to:

-----BEGIN CERTIFICATE-----\n MIIDhDCCBWygAwIBAgIQDyh/z7hUIji7pFcz+75NWTANBgkqhkiG9w0BAQsFADCB\n kDER ... 

but the original, raw string looks like this:

-----BEGIN CERTIFICATE-----\r\n MIIDhDCCBWygAwIBAgIQDyh/z7hUIji7pFcz+75NWTANBgkqhkiG9w0BAQsFADCB\r\n kDER ... 

And here's how I rendered the certificate:

certificate = OpenSSL::X509::Certificate.new '<raw certificate>' certificate.to_pem # => This returns the \n formatted certificate 

Could the different format of the CRLF be the root of the problem? Are both formats valid?

As for the carriage return: openssl returns only a line-feed character - as most unix utilities probably will. But any implementation that doesn't accept CRLF or even just CR (for Apple) will be in serious trouble, so I don't think you'll find many libraries / applications that won't accept any kind of line ending (and certainly not Amazon etc.).