PKCS 7

Standard

The latest version, 1.5, is available as RFC 2315.

An update to PKCS #7 is described in RFC 2630, which was replaced in turn by RFC 3369, RFC 3852 and then by RFC 5652.

PKCS #7 files may be stored both as raw DER format or as PEM format. PEM format is the same as DER format but wrapped inside Base64 encoding and sandwiched in between ‑‑‑‑‑BEGIN PKCS7‑‑‑‑‑ and ‑‑‑‑‑END PKCS7‑‑‑‑‑. Windows uses the .p7b file name extension for both these encodings.

A typical use of a PKCS #7 file would be to store certificates and/or certificate revocation lists (CRL).

Here's an example of how to first download a certificate, then wrap it inside a PKCS #7 archive and then read from that archive:

<span id="mwKQ"></span><span class="gp" id="mwKg">$ </span><span class="nb" id="mwKw">echo</span><span class="w" id="mwLA"> </span><span class="s1" id="mwLQ">''</span><span class="w" id="mwLg"> </span><span class="p" id="mwLw">|</span><span class="w" id="mwMA"> </span>openssl<span class="w" id="mwMQ"> </span>s_client<span class="w" id="mwMg"> </span>-connect<span class="w" id="mwMw"> </span>example.org:443<span class="w" id="mwNA"> </span>-host<span class="w" id="mwNQ"> </span>example.org<span class="w" id="mwNg"> </span><span class="m" id="mwNw">2</span>>/dev/null<span class="w" id="mwOA"> </span><span class="p" id="mwOQ">|</span><span class="w" id="mwOg"> </span>openssl<span class="w" id="mwOw"> </span>x509<span class="w" id="mwPA"> </span>><span class="w" id="mwPQ"> </span>example.org.cer<span class="w" id="mwPg"> </span><span class="m" id="mwPw">2</span>>/dev/null <span class="gp" id="mwQA">$ </span>openssl<span class="w" id="mwQQ"> </span>crl2pkcs7<span class="w" id="mwQg"> </span>-nocrl<span class="w" id="mwQw"> </span>-certfile<span class="w" id="mwRA"> </span>example.org.cer<span class="w" id="mwRQ"> </span>-out<span class="w" id="mwRg"> </span>example.org.cer.pem.p7b <span class="gp" id="mwRw">$ </span>openssl<span class="w" id="mwSA"> </span>pkcs7<span class="w" id="mwSQ"> </span>-in<span class="w" id="mwSg"> </span>example.org.cer.pem.p7b<span class="w" id="mwSw"> </span>-noout<span class="w" id="mwTA"> </span>-print_certs <span class="go" id="mwTQ">subject=C = US, ST = California, L = Los Angeles, O = Internet Corporation for Assigned Names and Numbers, OU = Technology, CN = www.example.org issuer=C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA</span>