Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Would anyone happen to have an example of an XER encoded X.509 certificate so I can play around with it?


share|improve this question

closed as not a real question by Terry Chia, Iszi, AviD Nov 26 '12 at 8:24

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

This isn't really a question, is it? I'm sure you could just create such a certificate with whatever library you choose... Besides, it's not really a security question, it's either a crypto question or a Server Fault question. – AviD Nov 26 '12 at 8:24

X.509 states that certificates use DER encoding:

For signature calculation, the data that is to be signed is encoded using the ASN.1 distinguished encoding rules (DER)

Nominally, you could imagine that you encode the certificate data in XER, and that the DER encoding of the to-be-signed structure (TBSCertificate) is performed dynamically for purposes of computing or verifying the signature, but nobody does that because:

  1. It would be very hard to do, because although DER is suposedly deterministic, there are an awful lot of details which can get wrong (do you use UTCTime or GeneralizedTime for the validity dates ? How do you handle milliseconds in the date representation ? For DN components, do you use PrintableString, BMPString, UTF8String ? Which kind of Unicode decomposition do you use for diacritics ? And so on). It would not be reliable.

  2. XML encoding is awfully inefficient, both in space (it uses a lot of bytes, even when compared with Base64-encoded DER) and in CPU (that can be a tough issue with reduced platforms like smart cards).

  3. Certificates are all about interoperability, and nobody supports XER-encoded certificates, so there is no added value in supporting them right now. There is no incentive either: what XML can bring (compared to DER) is automatic support of generic data transforms (XPath, XSLT... you name it), but that's the kind of thing that we do not want to do with certificates, because a certificate is signed and you cannot change a single bit of it without invalidating the signature.

If you want to play with signatures on XML data, lookup XML-DSig. It is noteworthy that when an XML-DSig object embeds a certificate (as an X509Certificate element), it uses Base64 encoding of the binary certificate (i.e., DER-encoded certificate)(see section 4.4.4).

Summary: there is no such thing as a "standard" XER-encoded certificate and I predict that it will take some time before such a thing appears (and I pray all the gods I know that it will not happen before I retire).

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.