Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am required to store a certificate as ".arm" file only for a public key that is intended for use in RSA Encryption. I am currently able to generate the public key as ".key" file.

P.S I am new to encryption so, this may be a basic question.

share|improve this question

migrated from Aug 21 '12 at 4:15

This question came from our site for professional and enthusiast programmers.

up vote 1 down vote accepted

Neither .arm nor .key are standard extensions. You should be more specific on who/what generated .key files and who/what is going to use .arm files.

I can only guess .arm refers to "ASCII armor" which is an old PGP jargon for Base64, a format where only 7-bit ASCII characters are used.

The PEM format is exactly that. Assuming .key files are DER encoded (binary), try to use openssl to covert your certificate to PEM format:

openssl x509 -inform der -in certificate.key -out certificate.arm
share|improve this answer
I generate public-private key pair. I need to share my public key/certificate to my client, so that he can send me encrypted data using my key. And my clients system only accept .arm file. I am new to this. Can you please what is this .arm. Above you have mentioned some info. Can you please share more? – Ashish Agarwal Aug 21 '12 at 6:32
@ashish-agarwal Which software did you use to create the key pair, and which software will clients use to read the .arm file? – SquareRootOfTwentyThree Aug 21 '12 at 7:04
I created the key pair using Java code. And my client is also going to do same. – Ashish Agarwal Aug 21 '12 at 7:54
@ashish-agarwal Could you post the code (small snippet) for creating the key, and the code that will use it. Besides that, does the command I provided succeed at converting the key? Can the result be used by the client software? – SquareRootOfTwentyThree Aug 21 '12 at 11:01

Have no fears on being new - you've hit on a weird one.

I swear I've seen *.arm used as an extension - but not often. Typically certificates (which include the public key as part of the data) are stored in either a binary (commonly called DER) or as ASCII (commonly called PEM). Most likely an *.arm certificate is one of those, hopefully without extra formatting.

Here's a quick rundown of the really common types of storage along with some command line instructions for one of the most common open source tools for certificate manipulation - OpenSSL.

It's probably worthwhile to ask what the consumer of this data will be, get access to the software or a test kit and run tests. You try a basic PEM or DER encoding and change the file type to *.arm just to see if it works. Given that this is non-standard, you may have to check back with the stakeholders who need this requirement to see if they can give you the format of this... sadly, you may end up developing it yourself - unless they can also give you an API for generating it...

share|improve this answer

Following code solved my problem.






    import java.math.BigInteger;
    import java.nio.charset.Charset;
    import java.util.Date;
         * Create a self-signed X.509 Certificate
         * @param dn the X.509 Distinguished Name, eg "CN=Test, L=London, C=GB"
         * @param pair the KeyPair
         * @param days how many days from now the Certificate is valid for
         * @param algorithm the signing algorithm, eg "SHA1withRSA"
        static X509Certificate generateCertificate(String dn, KeyPair pair, int days, String algorithm)
          throws GeneralSecurityException, IOException
          PrivateKey privkey = pair.getPrivate();
          X509CertInfo info = new X509CertInfo();
          Date from = new Date();
          Date to = new Date(from.getTime() + days * 86400000l);
          CertificateValidity interval = new CertificateValidity(from, to);
          BigInteger sn = new BigInteger(64, new SecureRandom());
          X500Name owner = new X500Name(dn);

          info.set(X509CertInfo.VALIDITY, interval);
          info.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(sn));
          info.set(X509CertInfo.SUBJECT, new CertificateSubjectName(owner));
          info.set(X509CertInfo.ISSUER, new CertificateIssuerName(owner));
          info.set(X509CertInfo.KEY, new CertificateX509Key(pair.getPublic()));
          info.set(X509CertInfo.VERSION, new CertificateVersion(CertificateVersion.V3));

          AlgorithmId algo = new AlgorithmId(AlgorithmId.sha1WithRSAEncryption_oid);
          info.set(X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId(algo));

          // Sign the cert to identify the algorithm that's used.
          X509CertImpl cert = new X509CertImpl(info);
          cert.sign(privkey, algorithm);

          // Update the algorith, and resign.
          algo = (AlgorithmId)cert.get(X509CertImpl.SIG_ALG);
          info.set(CertificateAlgorithmId.NAME + "." + CertificateAlgorithmId.ALGORITHM, algo);
          cert = new X509CertImpl(info);
          cert.sign(privkey, algorithm);
          return cert;

        // This method writes a certificate to a file. If binary is false, the
        // certificate is base64 encoded.
        public static void export( cert, File file, boolean binary) throws IOException {

          System.out.println("Your file has been written");  
            try {
                // Get the encoded form which is suitable for exporting
                byte[] buf = cert.getEncoded();

                FileOutputStream os = new FileOutputStream(file);
                if (binary) {
                    // Write in binary form
                } else {
                    // Write in text form
                    Writer wr = new OutputStreamWriter(os, Charset.forName("UTF-8"));
                    wr.write("-----BEGIN CERTIFICATE-----\n");
                    wr.write(new sun.misc.BASE64Encoder().encode(buf));
                    wr.write("\n-----END CERTIFICATE-----\n");
            } catch (CertificateEncodingException e) {
            } catch (IOException e) {

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.