Knowledge Base · Category 19
Certificate formats
This chapter explains how certificates and keys are encoded and packed into files, which format each TLSPilot target takes, and what TLSPilot writes when you export a certificate or deploy it as a file. It is background for chapter Export options and for the deployment targets File Path (WinRM), UNC share and File Path (SSH) in chapter My first deployments.
Articles in this category
- 19.1
Encoding: DER and PEM
A certificate is a data structure according to X.509. It can be stored in two encodings:
- 19.2
Containers: PEM, CRT, CER, PFX and P7B
The file extension describes the container, not always the encoding. A file with the extension .crt or .cer can contain PEM text or DER bytes.
- 19.3
Parts of a certificate: leaf, intermediates, root and key
A server does not present a single certificate, but a chain:
- 19.4
Key types: RSA and ECDSA
Which sizes are available depends on the issuer: ACME providers list only the algorithms they support, for example Let’s Encrypt up to P-384 and ZeroSSL RSA 2048, RSA 4096 and P-256.
- 19.5
Which format each target takes
Most targets take a fixed format, which TLSPilot builds automatically. Only the three file targets let you choose the format and the chain options.
- 19.6
What TLSPilot exports
The dialog Export certificate (chapter Export options) and the deployment targets File Path (WinRM), UNC share and File Path (SSH) offer the same four formats and chain options.
- 19.7
Chain options
Three options control which certificates of the chain TLSPilot writes and in which order.
- 19.8
Standard order of the chain
TLS 1.3 (RFC 8446, section 4.4.2) specifies the order that every client expects: the leaf certificate first, then the intermediates, each certifying the one before it.
- 19.9
Typical errors
Messages, causes and solutions: chapter Deployment targets.