What Are The SSL Containers?

SSL has been around for a long time, and you'd think in this time it would have arrived at some unified container stantards. Well... there are. Too many standards as it happens. Here's the most common ones.

  • .csr - This is a Certificate Signing Request. Some applications can generate these for submission to certificate-authorities. The actual format is PKCS10 which is defined in RFC 2986. It includes some/all of the key details of the requested certificate such as subject, organization, state, whatnot, as well as the public key of the certificate to get signed. These get signed by the CA and a certificate is returned. The returned certificate is the public certificate (which includes the public key but not the private key), which itself can be in a couple of formats.
  • .pem - Defined in RFCs 1421 through 1424, this is a container format that may include just the public certificate (such as with Apache installs, and CA certificate files /etc/ssl/certs), or may include an entire certificate chain including public key, private key, and root certificates. Confusingly, it may also encode a CSR (e.g. as used here) as the PKCS10 format can be translated into PEM. The name is from Privacy Enhanced Mail (PEM), a failed method for secure email but the container format it used lives on, and is a base64 translation of the x509 ASN.1 keys.
  • .key - This is a PEM formatted file containing just the private-key of a specific certificate and is merely a conventional name and not a standardized one. In Apache installs, this frequently resides in /etc/ssl/private. The rights on these files are very important, and some programs will refuse to load these certificates if they are set wrong.
  • .pkcs12 .pfx .p12 - Originally defined by RSA in the Public-Key Cryptography Standards (abbreviated PKCS), the "12" variant was originally enhanced by Microsoft, and later submitted as RFC 7292. This is a passworded container format that contains both public and private certificate pairs. Unlike .pem files, this container is fully encrypted. Openssl can turn this into a .pem file with both public and private keys: openssl pkcs12 -in file-to-convert.p12 -out converted-file.pem -nodes

A few other formats that show up from time to time:

  • .der - A way to encode ASN.1 syntax in binary, a .pem file is just a Base64 encoded .der file. OpenSSL can convert these to .pem (openssl x509 -inform der -in to-convert.der -out converted.pem). Windows sees these as Certificate files. By default, Windows will export certificates as .DER formatted files with a different extension. Like...
  • .cert .cer .crt - A .pem (or rarely .der) formatted file with a different extension, one that is recognized by Windows Explorer as a certificate, which .pem is not.
  • .p7b .keystore - Defined in RFC 2315 as PKCS number 7, this is a format used by Windows for certificate interchange. Java understands these natively, and often uses .keystore as an extension instead. Unlike .pem style certificates, this format has a defined way to include certification-path certificates.
  • .crl - A certificate revocation list. Certificate Authorities produce these as a way to de-authorize certificates before expiration. You can sometimes download them from CA websites.

In summary, there are four different ways to present certificates and their components:

  • PEM - Governed by RFCs, its used preferentially by open-source software. It can have a variety of extensions (.pem, .key, .cer, .cert, more)
  • PKCS7 - An open standard used by Java and supported by Windows. Does not contain private key material.
  • PKCS12 - A Microsoft private standard that was later defined in an RFC that provides enhanced security versus the plain-text PEM format. This can contain private key material. Its used preferentially by Windows systems, and can be freely converted to PEM format through use of openssl.
  • DER - The parent format of PEM. It's useful to think of it as a binary version of the base64-encoded PEM file. Not routinely used very much outside of Windows.

I hope this helps.

If you have any comments, feel free to post them below or find us on Twitter and Facebook!

- Until next time!

December 07 2019

Add or review comments

Please leave your comment

Existing comments

Comments 54


Lbgsesse
viagra las vegas nv <a href="http://genqpviag.com/#">canadian pharmacy viagra quick delivery</a> viagra shipped overnight [url=http://genqpviag.com/]military viagra[/url] ’
Jdbxsesse
150 mg viagra <a href="http://llviabest.com/#">paypal viagra</a> discount viagra [url=http://llviabest.com/]generic viagra online pharmacy[/url] ’
JbnbUript
canadianpharmacyusa24h <a href="http://online21rxon.com/ ">best 10 online canadian pharmacies</a> hormones
NncsExole
viagra sale <a href="http://lightvigra.com/ ">buy viagra in uk online</a> viagra townofthurston
Kbcxhifs
northwest pharmacy canada <a href="http://xuypharmacyonline.com/">london drugs canada</a> canadian drugs
Lbsxsesse
meds online without doctor prescription <a href="https://ssviagriia.com/ ">chinese viagra pills</a> online pharmacies of canada
Ahkdsesse
buy generic viagra online <a href="http://storerxpharmcanada.com/ ">canadian pharmacy without prescription</a> canadian drugs pharmacy
FvfcExole
cheap drugs online <a href="http://hopeviagrin.com/ ">viagra for sal</a> viagra 50 mg
JbnvUript
get cash loans without a job <a href="http://samcash21.com/ ">petty cash advance request form</a> payday loans appleton
Jbbnsesse
cialis 20mg user review <a href="http://ljcialishe.com/ ">quante volte si puГІ prendere il cialis</a> come riconoscere cialis originale
Ahbzsesse
direct money personal loans <a href="http://daymoneygo.com/ ">where is magnum cash advance located</a> fast cash loans up to 2500
FbsgExole
cialis without perscriptions <a href="https://llecialisjaw.com/ ">free samples viagra cialis </a> cialis over the counter in mexico
Fqbbsesse
do payday loans work <a href="http://ascashapply.com/ ">usa payday loan locations</a> payday loans poway
Kndnhifs
what does a viagra pill look like <a href="http://viagratx.com/ ">for hims viagra</a> fildena vs viagra
NbmoExole
cialis without prescripe <a href="http://buycialisxz.com/ ">original cialis </a> voucher cialis index
FjjuExole
taking viagra <a href="https://viagraonlinejc.com/ ">canada pharmacy viagra </a> too much viagra
Brfghifs
[url=https://ljcialishe.com/]is there a generic cialis available in the us[/url] [url=https://cialisvja.com/]cialis commercial 2016[/url] [url=https://viagraonlinejc.com/]how can i get viagra[/url] [url=https://viagratx.com/]drugs like viagra[/url] [url=https://buycialisxz.com/]order cialis online[/url]
Abgcsesse
[url=https://thesiswritingtob.com/]help with thesis[/url] writing a thesis <a href="http://thesiswritingtob.com/ ">thesis phd</a> writing thesis proposal
Fbsfsesse
women's health https://uspharmus.com/ the canadian pharmacy
Lrbssesse
levitra com http://uslevitraanna.com/ walgreens levitra price
RfvbExole
cialis egypt http://cileve.com/ cheap original cialis
LhdvExole
cialis pills http://asciled.com/ walmart pharmacy cialis prices
Abdgsesse
Cialis Professional [url=http://canadianeve21.com/ ]Premarin[/url] cialis generic pharmacy online
Jbsdsesse
Frumil https://onlinecanda21.com/ Tofranil
GvdbUript
tadalafil cost walmart https://boxtadafil.com/ what is cialis tadalafil 20 mg used for
Bbdfhifs
when is viagra going generic https://gensitecil.com/ does viagra increase blood pressure
Fbsfsesse
Meclizine http://uspharmus.com/ canadian pharmacies without prescriptions
RfvbExole
cialis without prescription http://cileve.com/ buy cialis online in new zealand
Lrbssesse
levitra how long http://uslevitraanna.com/ levitra shelf life
Fmrfsesse
cialis cheap [url=https://cialisee.com/ ]cialis with dapoxetine sale[/url] cialis buy online
LbsoExole
cialis pro http://ucialisdas.com/ generic cialis uk
GtnbUript
cheap viagra online https://jokviagra.com/ benefits of viagra for men
Bbshhifs
how long is viagra good for http://loxviagra.com/ too much viagra
Jebgsesse
Toradol https://pharmacylo.com/ legit online pharmacy
Fmrfsesse
cialis free trial phone # https://cialisee.com/ puchsae cialis
RebfExole
cialis generic [url=https://rcialisgl.com/ ]buy cialis using paypal[/url] kupi online cialis
Lebnsesse
canadian drugs without prescription http://xlnpharmacy.com/ web pharmacy
LbsoExole
cialis 20mg price https://ucialisdas.com/ generic cialis bestelle
Anoosesse
metro viagra http://llviagra.com/ viagra side effects glaucoma
GtnbUript
what works like viagra http://jokviagra.com/ viagra bottle
Lebnsesse
most reliable canadian pharmacies http://xlnpharmacy.com/ prescription drugs online without doctor
RebfExole
overnight delivery generic cialis [url=http://rcialisgl.com/ ]generic cialis black 800 mg[/url] cialis nz
LbsoExole
cialis canada and paypal http://ucialisdas.com/ cialis 60
GtnbUript
viagra ad http://jokviagra.com/ over the counter viagra substitute cvs
Bbshhifs
viagra tablets https://loxviagra.com/ how long for viagra to take effect
Lebnsesse
erection pills https://xlnpharmacy.com/ canadian pharmacy without prescription
RebfExole
cialis paypal accepted [url=https://rcialisgl.com/ ]generic cialis in usa[/url] cialis on line overnight
sesseDev
canadian pharmacy com viagra [url=https://cjepharmacy.com/ ]general health[/url] legit canadian online pharmacies
Exoleloh
tadacip vs cialis [url=https://rcialisgl.com/ ]viagra cialis and levitra[/url] how long do the effects of cialis last
UriptAsd
cialis overnight [url=https://cialisjla.com/ ]cialis prices at walmart[/url] cialis 5mg no perscription
hifsSwa
36 hour cialis [url=https://ckacialis.com/ ]free cialis samples[/url] viagra cialis samples
sesseGtv
online pharmacy valium [url=https://pharmacyhrn.com/ ]online class for pharmacy technician[/url] rx plus pharmacy glendale ny
sesseHtf
cialis grapefruit interaction [url=https://cialishav.com/ ]cialis black uk[/url] cheap cialis canada pharmacy
sesseHtf
cialis generic 2018 [url=https://cialishav.com/ ]cialis daily review[/url] can you buy cialis without a prescription