Tag, length, value
DER encodes everything as an identifier byte, a length, and a value, nested as deep as the document needs. The identifier carries the class, whether the value is constructed, and the tag number. That is the entire grammar, which is why a single decoder handles certificates, keys, PKCS#7 bundles, OCSP responses, and SNMP packets alike.
Constructed values keep their name in the output. A certificate reads as nested SEQUENCE and SET entries with [0] for context-specific tags, matching the structure in RFC 5280 rather than flattening into anonymous arrays.
Wrapped structures
A BIT STRING or OCTET STRING often holds another DER document. A SubjectPublicKeyInfo ends in a bit string that is really a SEQUENCE of modulus and exponent, and a PKCS#8 private key wraps the whole key material in an octet string.
Both are expanded in place when their contents parse cleanly, so an RSA key decodes down to its modulus, public exponent, primes, and CRT coefficients without a second pass.
Certificate fields worth finding
The serial number is the first INTEGER inside the inner SEQUENCE. Validity is two time values, UTCTime before 2050 and GeneralizedTime after, both converted to ISO timestamps here. Subject and issuer are sequences of sets, each holding an OID and its string value, which is why a common name sits three levels deep.
Extensions live under [3], each one a sequence of an OID, an optional critical boolean, and an octet string holding the extension’s own DER.
Indefinite lengths
Strict DER always states a length, but BER allows an indefinite form terminated by two zero bytes. PKCS#7 signatures produced by some signing tools use it. Both forms decode here, so a bundle that other parsers reject on the first byte still opens.