I'm entirely confused on PEM vs DER, but I believe we do support that format. The code I'm using here based on what X509KeyPair uses to parse the keys, which is why the variable uses "der". I believe we are talking about a PEM file where multiple ``----BEGIN-----`` blocks encapsulate a "DER encoded ASN.1 structure". It seems to work with the regular certificate and private key files I am using for nginx and others.