中文

Glossary

PKCS #7 (Cryptographic Message Syntax (.p7b / .p7c))

Last verified

Definition

PKCS #7 is a format for signed and encrypted data that, in .p7b or .p7c files, is commonly used to carry a bundle of certificates without any private key.

PKCS #7, published as RFC 2315 and continued by the IETF as the Cryptographic Message Syntax (CMS, RFC 5652), defines containers for signed, enveloped (encrypted) and other protected data. Its SignedData structure has a field for certificates, and a "certificates-only" SignedData with no content or signatures is a convenient way to ship a certificate chain. Such files usually have the .p7b or .p7c extension and may be PEM-wrapped (BEGIN PKCS7) or raw DER.

Why it matters

Some CAs and Windows tools deliver issued certificates and their intermediates as .p7b files, and Java's keytool accepts a PKCS #7 chain when importing a CA reply. The same structure underlies S/MIME messages and Authenticode code signatures. For web servers you normally convert a .p7b into a PEM chain, putting the leaf certificate first, because nginx and Apache read PEM rather than PKCS #7.

Example

openssl pkcs7 -in example.com.p7b -print_certs -out example.com-chain.pem
# if the file is binary, add: -inform DER
openssl crl2pkcs7 -nocrl -certfile fullchain.pem -out example.com.p7b

Common misconceptions

  • A .p7b file contains the private key. It holds certificates and optionally CRLs, never keys; use PKCS #12 when the key must travel too.
  • Certificates inside a .p7b are in chain order. The certificates field is an unordered set; reorder them, leaf first, when building a PEM chain.
  • PKCS #7 is only a certificate format. Its main purpose is signed and encrypted messages; certificate bundles are a side use.

See also