PKCS7 certificate - Revision history

Jsummers: /* Software */

2016-02-02T22:15:46Z

‎Software

Jsummers: /* Identification */

2013-10-30T23:09:49Z

‎Identification

Jsummers: /* Identification */

2013-10-27T15:04:27Z

‎Identification

Jsummers at 14:49, 27 October 2013

2013-10-27T14:49:32Z

Jsummers at 22:02, 18 October 2013

2013-10-18T22:02:19Z

Jsummers: Created page with "{{FormatInfo |formattype=electronic |subcat=Security |extensions={{ext|p7b}}, {{ext|p7c}}, {{ext|spc}}, {{ext|pem}} }} '''PKCS7 certificate''' (or '''PKCS #7 certificate''') i..."

2013-10-18T21:48:24Z

Created page with "{{FormatInfo |formattype=electronic |subcat=Security |extensions={{ext|p7b}}, {{ext|p7c}}, {{ext|spc}}, {{ext|pem}} }} '''PKCS7 certificate''' (or '''PKCS #7 certificate''') i..."

New page

{{FormatInfo
|formattype=electronic
|subcat=Security
|extensions={{ext|p7b}}, {{ext|p7c}}, {{ext|spc}}, {{ext|pem}}
}}
'''PKCS7 certificate''' (or '''PKCS #7 certificate''') is a file format based on the [[PKCS7|PKCS #7]] cryptographic message standard defined in RFC 2315. It stores [[X.509 certificate|X.509 certificates]], or possibly a certificate revocation list.

== Format ==
A PKCS7 certificate is serialized using either [[PEM]] or [[DER]] format.

The format is distinct from [[PEM encoded certificate]] and [[DER encoded certificate]] formats, even though those names are accurate descriptions of it.

'''.spc''' files sometimes use a different format, in which the DER data is [[base64]]-encoded (raw base64, not PEM), and then the base64 text is written to the file encoded in either ASCII or [[UTF-16]].

== Identification ==
PEM-formatted files have a line that reads "<code>-----BEGIN PKCS7-----</code>" or "<code>-----BEGIN PKCS #7 SIGNED DATA-----</code>".

Reportedly, the line "<code>-----BEGIN CERTIFICATE-----</code>" has sometimes been used instead, but this collides with [[PEM encoded certificate]] format, and should be considered incorrect.

== Examples ==
To view the contents of a PEM-formatted PKS7 certificate, using OpenSSL:
openssl pkcs7 -noout -text -print_certs -in example.p7b

To view the contents of a DER-formatted PKS7 certificate:
openssl pkcs7 -inform der -noout -text -print_certs -in example.p7b

== Software ==
* [http://www.openssl.org/ OpenSSL]

== Links ==
* RFC 2315: PKCS #7: Cryptographic Message Syntax
* [[Wikipedia:PKCS|Wikipedia: PKCS]]

== Editors' notes ==
The PKCS #7 RFC defines six content types, but none of them are for certificate storage, so this is a slightly mysterious format. It's probably a degenerate form of the "signed data" type, with certificates but no data.

@@ Line 14: / Line 14: @@
 == Identification ==
-PEM-formatted files have a line that reads "<code>-----BEGIN PKCS7-----</code>" or "<code>-----BEGIN PKCS #7 SIGNED DATA-----</code>".
+PEM-formatted files have a line that reads "<code>-----BEGIN PKCS7-----</code>" or "<code>-----BEGIN PKCS #7 SIGNED DATA-----</code>". However, this does not distinguish them from other PKCS7 data types.
 Reportedly, the line "<code>-----BEGIN CERTIFICATE-----</code>" has sometimes been used instead, though this could cause it to be confused with [[PEM encoded certificate]] format.

@@ Line 26: / Line 26: @@
 == Software ==
-* [http://www.openssl.org/ OpenSSL]
+* [[OpenSSL]]
 == Links ==
 * RFC 2315: PKCS #7: Cryptographic Message Syntax
 * [[Wikipedia:PKCS|Wikipedia: PKCS]]

@@ Line 16: / Line 16: @@
 PEM-formatted files have a line that reads "<code>-----BEGIN PKCS7-----</code>" or "<code>-----BEGIN PKCS #7 SIGNED DATA-----</code>".
-Reportedly, the line "<code>-----BEGIN CERTIFICATE-----</code>" has sometimes been used instead, but this collides with [[PEM encoded certificate]] format, and should be considered incorrect.
+Reportedly, the line "<code>-----BEGIN CERTIFICATE-----</code>" has sometimes been used instead, though this could cause it to be confused with [[PEM encoded certificate]] format.
 == Examples ==

@@ Line 4: / Line 4: @@
 |extensions={{ext|p7b}}, {{ext|p7c}}, {{ext|spc}}, {{ext|pem}}
 }}
-'''PKCS7 certificate''' (or '''PKCS #7 certificate''') is a file format based on the [[PKCS7|PKCS #7]] cryptographic message standard defined in RFC 2315. It stores [[X.509 certificate|X.509 certificates]], or possibly a certificate revocation list.
+'''PKCS7 certificate''' (or '''PKCS #7 certificate''') is a degenerate form of the [[PKCS7|PKCS #7]] cryptographic message standard defined in RFC 2315. It stores only [[X.509 certificate|X.509 certificates]] (or possibly a certificate revocation list), with no encrypted data.
 == Format ==
@@ Line 31: / Line 31: @@
 * RFC 2315: PKCS #7: Cryptographic Message Syntax
 * [[Wikipedia:PKCS|Wikipedia: PKCS]]

@@ Line 19: / Line 19: @@
 == Examples ==
-To view the contents of a PEM-formatted PKS7 certificate, using OpenSSL:
+To view the contents of a PEM-formatted PKCS7 certificate, using OpenSSL:
    openssl pkcs7 -noout -text -print_certs -in example.p7b
-To view the contents of a DER-formatted PKS7 certificate:
+To view the contents of a DER-formatted PKCS7 certificate:
    openssl pkcs7 -inform der -noout -text -print_certs -in example.p7b