PEM vs DER and How to Read an X.509 Certificate

Certificates fail loudly in browsers and quietly in mutual-TLS services. The file on disk might be PEM, DER, or "a .crt that is secretly one or the other," and the error message is usually unable to l