Format and conversion of common PKI certificates

PKCS stands for public-key cryptography standards. It is a series of standards developed by the RSA lab and other security system developers to Promote the Development of public key cryptography. PKCS has published 15 standards. Commonly used:
PKCS #7 cryptographic message syntax Standard
PKCS #10 certification request Standard
PKCS #12 Personal Information Exchange syntax Standard

X.509 is a common certificate format. All certificates comply with ITU-T X509 International Standards for Public Key Infrastructure (PKI.

PKCS #7 common suffixes:. p7b. p7c. SPC
PKCS #12 common suffixes include. p12. pfx
The suffix of X.509 DER encoding (ASCII) is. Der. Cer. CRT.
The suffix of X.509 Pam encoding (base64) is. pem. Cer. CRT.
. Cer/. CRT is used to store certificates. It is in binary format and does not contain private keys.
The difference between. PEM and CRT/CER is that it is represented in ASCII.
Pfx/P12 is used to store the Personal Certificate/private key. It usually includes a password, which is in the binary mode.
P10 is a certificate request
P7r is the CA's reply to the certificate request and is only used for Import
P7b displays the certificate chain in a tree. It also supports a single certificate without the private key.

Use OpenSSL to create the RSA key for the CA certificate (in PEM format ):
OpenSSL genrsa-des3-out ca. Key 1024

Use openssl to create a CA certificate (in PEM format, if the validity period is one year ):
Openssl req-new-x509-days 365-key ca. key-out ca. crt-config openssl. cnf
Openssl can generate a CA certificate in DER format. It is best to use IE to convert a CA certificate in PEM format to a CA certificate in DER format.

Trix509 to pfx
Pkcs12-export-in keys/client1.crt-inkey keys/client1.key-out keys/client1.pfx

The ca. key in the PEM format is converted to the pvk format that Microsoft can recognize.
Pvk-in ca. key-out ca. pvk-nocrypt-topvk
Conversion from PKCS #12 to PEM
Openssl pkcs12-nocerts-nodes-in cert. p12-out private. pem
Verify openssl pkcs12-clcerts-nokeys-in cert. p12-out cert. pem
6. Extract the private key format file (. key) from the PFX Format File)
Openssl pkcs12-in mycert. pfx-nocerts-nodes-out mycert. key
Convert pem to spc
Openssl crl2pkcs7-nocrl-certfile venus. pem-outform DER-out venus. spc
Use-outform-inform to specify the DER or PAM format. For example:
Openssl x509-in Cert. pem-inform PEM-out cert. der-outform DER
Convert eight PEM to PKCS #12,
Openssl pkcs12-export-in Cert. pem-out Cert. p12-inkey key. pem

 

 

Keystore File Format [Keystore]

Format: JKS
Extension:. jks/. ks
Description: Java implementation version of The Keystore. The provider is SUN.
Features: different passwords are used to protect the keystore and private key.
 
Format: JCEKS
Extension:. jce
Description: JCE implementation version of the [JCE Keystore] Keystore. The provider is sun jce.
Features: a higher security level than JKS, TripleDES is used to protect the Keystore private key.
 
Format: PKCS12
Extension:. p12/. pfx
Description: [PKCS #12] syntax standard for personal information exchange
Features: 1. Private Key, public key, and certificate
2. Use the same password to protect the keystore and Private Key
 
Format: BKS
Extension:. bks
Description: Bouncycastle Keystore: BC implementation version of The Keystore. The provider is BC.
Features: JCE-based implementation
 
Format: UBER
Extension:. ubr
Description: [Bouncycastle UBER Keystore] the bc of the Keystore is more secure. The provider is BC.

 

Certificate file format [Certificate]
Format: DER
Extension:. cer/. crt/. rsa

Description: [ASN. 1 DER] is used to store certificates.
Features: private key and binary are not included

 

Format: PKCS7
Extension:. p7b/. p7r
Description: [PKCS #7] encryption information syntax Standard

Features: 1. p7b displays the certificate chain in a tree, excluding the Private Key
2. p7r is the CA's reply to the certificate request signature and can only be used for Import

 

Format: CMS
Extension:. p7c/. p7m/. p7s
Description: [Cryptographic Message Syntax]
Features: 1. p7c only saves certificates
2. p7m: signature with enveloped data
3. p7s: Timestamp signature file
 
Format: PEM
Extension:. pem
Description: Printable Encoded Message]
Features: 1. This encoding format is defined in RFC1421. In fact, PEM is short for [Privacy-Enhanced Mail], but it is also widely used in key management.
2. ASCII files
3. base 64 Encoding

 

Format: PKCS10
Extension:. p10/. csr
Description: [PKCS #10] public key encryption standard [Certificate Signing Request]
Features: 1. Certificate Signature request file
2. ASCII files
3. the CA signs the signature and replies to the p7r file.

 

Format: SPC
Extension:. pvk/. spc
Description: [Software Publishing Certificate]
Features: Microsoft's unique dual-Certificate file format is often used for code signatures.
1. pvk is used to save the Private Key
2. spc is used to save the Public Key