# What Is PKCS #7? Definition and Examples

> PKCS #7 is a format for signed and encrypted data that, in .p7b or .p7c files, is commonly used to carry a bundle of certificates without any private key.

Source: https://ssl.sh/glossary/pkcs7/
Last updated: 2026-11-10

PKCS #7, published as RFC 2315 and continued by the IETF as the Cryptographic Message Syntax (CMS, RFC 5652), defines containers for signed, enveloped (encrypted) and other protected data. Its SignedData structure has a field for certificates, and a "certificates-only" SignedData with no content or signatures is a convenient way to ship a [certificate chain](https://ssl.sh/glossary/certificate-chain/). Such files usually have the .p7b or .p7c extension and may be [PEM](https://ssl.sh/glossary/pem/)-wrapped (`BEGIN PKCS7`) or raw DER.

## Why it matters
Some CAs and Windows tools deliver issued certificates and their intermediates as .p7b files, and Java's keytool accepts a PKCS #7 chain when importing a CA reply. The same structure underlies [S/MIME](https://ssl.sh/glossary/smime/) messages and Authenticode code signatures. For web servers you normally convert a .p7b into a PEM chain, putting the leaf certificate first, because nginx and Apache read PEM rather than PKCS #7.

## Example
```bash
openssl pkcs7 -in example.com.p7b -print_certs -out example.com-chain.pem
# if the file is binary, add: -inform DER
openssl crl2pkcs7 -nocrl -certfile fullchain.pem -out example.com.p7b
```

## Common misconceptions
- **A .p7b file contains the private key.** It holds certificates and optionally CRLs, never keys; use PKCS #12 when the key must travel too.
- **Certificates inside a .p7b are in chain order.** The certificates field is an unordered set; reorder them, leaf first, when building a PEM chain.
- **PKCS #7 is only a certificate format.** Its main purpose is signed and encrypted messages; certificate bundles are a side use.

## Related terms

- [PEM](https://ssl.sh/zh/glossary/pem/): PEM 是一种把 DER 二进制数据做 Base64 编码、再用 BEGIN 和 END 行包起来的文本格式，是存放证书和私钥最常见的方式。
- [DER](https://ssl.sh/zh/glossary/der/): DER 是 ASN.1 的二进制编码规则，保证每个值只有唯一一种字节表示，X.509 证书和密钥都以它为基础。
- [证书链](https://ssl.sh/zh/glossary/certificate-chain/): 证书链是从网站终端证书经中间证书一直到受信任根证书的有序证书序列，每一张都由下一张签名。
- [S/MIME](https://ssl.sh/zh/glossary/smime/): S/MIME 是一种使用 X.509 证书和 CMS 格式对电子邮件进行端到端签名和加密的标准。
- [代码签名证书](https://ssl.sh/zh/glossary/code-signing-certificate/): 代码签名证书是带有 codeSigning 扩展密钥用途、用来给软件做数字签名，让用户能核实发布者身份和文件完整性的 X.509 证书。
- [CRT 文件](https://ssl.sh/zh/glossary/crt-file/): CRT 文件是存放 X.509 证书的 .crt 或 .cer 文件，内容可能是 PEM 文本，也可能是二进制 DER，取决于生成它的平台。
- [中间证书](https://ssl.sh/zh/glossary/intermediate-certificate/): 中间证书是由根证书（或上级中间证书）签发、用来签发网站证书的 CA 证书，服务器必须把它和网站证书一起发送给客户端。