Which type of certificate file format contains private and public keys and is protected by a password?

SSL Certificate Formats

An SSL Certificate is essentially an X.509 certificate. X.509 is a standard that defines the structure of the certificate. It defines the data fields that should be included in the SSL certificate. X.509 uses a formal language called Abstract Syntax Notation One (ASN.1) to express the certificate's data structure.

Inhaltsverzeichnis Show

SSL Certificate Formats
PKCS#7 Format
PKCS#12 Format
X.509 certificate encoding formats and extensions:
Base64 (ASCII)
What certificate format allows the transfer of private keys and is password protected?
Is SSL public or private key?
Is .CER a public key?
What type of file is a private key?

There are different formats of X.509 certificates such as PEM, DER, PKCS#7 and PKCS#12. PEM and PKCS#7 formats use Base64 ASCII encoding while DER and PKCS#12 use binary encoding. The certificate files have different extensions based on the format and encoding they use.

The following figure illustrates the X.509 Certificate's encoding formats and file extensions.

SSL Certificate Format

PEM Format

Most CAs (Certificate Authority) provide certificates in PEM format in Base64 ASCII encoded files. The certificate file types can be .pem, .crt, .cer, or .key. The .pem file can include the server certificate, the intermediate certificate and the private key in a single file. The server certificate and intermediate certificate can also be in a separate .crt or .cer file. The private key can be in a .key file.

PEM files use ASCII encoding, so you can open them in any text editor such as notepad, MS word etc. Each certificate in the PEM file is contained between the ---- BEGIN CERTIFICATE---- and ----END CERTIFICATE---- statements. The private key is contained between the ---- BEGIN RSA PRIVATE KEY----- and -----END RSA PRIVATE KEY----- statements. The CSR is contained between the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- statements.

PKCS#7 Format

The PKCS#7 format is a Cryptographic Message Syntax Standard. The PKCS#7 certificate uses Base64 ASCII encoding with file extension .p7b or .p7c. Only certificates can be stored in this format, not private keys. The P7B certificates are contained between the "-----BEGIN PKCS7-----" and "-----END PKCS7-----" statements.

DER Format

The DER certificates are in binary form, contained in .der or .cer files. These certificates are mainly used in Java-based web servers.

PKCS#12 Format

The PKCS#12 certificates are in binary form, contained in .pfx or .p12 files.

The PKCS#12 can store the server certificate, the intermediate certificate and the private key in a single .pfx file with password protection. These certificates are mainly used on the Windows platform.

CAs provide certificates in any of the above formats. Learn how to install a certificate on different web servers in the next chapter.

There is a multitude of server and device types out there. Ones that allow an SSL to be installed and configured require the digital certificate file to be encoded and formatted in a certain way. All you need to know is that there are several file extension types and encoding formats. Plus, in order to successfully install an SSL on your server, you need to know which type exactly your server or device requires. In some cases, the server can accept different certificate formats, and they can be interchangeable. In other cases, however, a particular file type and encoding are required. This article is more of a hands-on guide on how to handle the certificate files received in an SSLs.com order. For an in-depth approach to this topic, feel free to check the X.509 article on Wikipedia and the comprehensive definition of X.509 certificate and CRL in a Request for Comments (RFC) publication by Internet Engineering Task Force (IETF).

Once you’ve got your certificate files, checking the certificate file extension will allow you to know what’s in the file, and which file fits best your needs.

X.509 certificate encoding formats and extensions:

Base64 (ASCII)

PEM

.pem
.crt
.ca-bundle

PKCS#7

.p7b
.p7s

Binary

DER

.der
.cer

PKCS#12

.pfx
.p12

*.pem, *.crt, *.ca-bundle, *.cer, *.p7b, *.p7s files contain one or more X.509 digital certificate files that use base64 (ASCII) encoding. You get one of those in a zip file downloaded from your user account or receive such file from the Certificate Authority.

You may also encounter *.pfx files. This is an archive file format for storing several cryptographic objects in a single file. In the scope of SSL certificates for SSL/TLS client and SSL/TLS web server authentication (the ones we offer), a .pfx file must contain the end-entity certificate (issued for your domain), a matching private key, and may optionally include an intermediate certification authority (a.k.a. CA Bundle). All this is wrapped up in a single file which is then protected with a pfx password. We can’t possibly provide you with a ready .pfx file, since it has a private key as the second essential element. Private key must be kept secret and is something that you generate alongside with the certificate signing request (CSR) by using available server tools, asking your web host to generate it for you, or using an online CSR + private key generation tool.

When ordering a certificate on SSLs.com, there are two ways you can get your certificate files.

Option #1: Take the cert files from the email sent by the Certificate Authority. Such email is sent to the administrative email address once the validation requirements are met and the certificate is issued. The file type and encoding format of the certificate files depend on the web server type chosen by the user in the course of SSL activation.

If I’m installing on a Windows server or Java Tomcat server was chosen, you should receive a file with .cer, .p7s or .p7b file extension. Those should be equally accepted by a server designed to use such certificate files. The file extension may vary between different certificate issuer companies.

Those have PKCS #7 file type, and are mostly used in Windows or Java-based server environments (e.g. Internet Information Server (IIS), MS Exchange server, Java Tomcat, etc). PKCS #7 certificate file includes the end-entity certificate (the one issued to your domain name), plus one or more trusted intermediate certification authority files.

(file with —–BEGIN PKCS7—- line on top means that it’s a PKCS7 security certificate file)

If Any other server (ex. Apache) was selected during SSL activation, the Certificate Authority’s email should contain files with .crt and .ca-bundle file extensions.

Those are PEM encoded, x509 certificates.

(—–BEGIN CERTIFICATE—- header starts a PEM encoded certificate)

Option #2 to get your certificate files is to download the cert files zip archive right to your SSLs.com account.

For that, you will need to click on the ID of the certificate when it’s showing Active (meaning the cert is issued).

Then you need to hit Download in the top right corner.

This way you will have a zip archive with all the necessary certificate files in it.

The range of cert file types available in the zip is most likely to be enough. However, if your server requires .DER (binary) encoded certificate file or something else, you can use our online SSL certificate converter or consult your hosting provider.

Once you have defined the type of cert files the server was designed to accept, and you managed to get them, you can proceed with installing these files on your server and making further configurations.

What certificate format allows the transfer of private keys and is password protected?

To copy a certificate to a different key database format or to a different system with its private key, the certificate must be exported to a PKCS #12 formatted file. PKCS #12 files are password-protected to allow encryption of the private key information.

Is SSL public or private key?

When performing authentication, SSL uses a technique called public-key cryptography. Public-key cryptography is based on the concept of a key pair, which consists of a public key and a private key. Data that has been encrypted with a public key can be decrypted only with the corresponding private key.

Is .CER a public key?

cer is a public key certificate that can contain only public key but not private key.

What type of file is a private key?

PKCS #8. This format can contain private keys and encrypted private key information. It stores the data in base64 encoded data, usually using a DER or PEM structure which is then encrypted. The standard extension is .