When a client sends you a pkcs#7 file to communicate with you, Is this because the file has their public key(certificate) and their chain and to avoid the confusion on your side what needs to be there in your truststore?

Note: The certificate is a internally issued by the client.

In other cases other external clients just send their certificate(issued by well known CA) and ask us to import it.


A certificate is a thing that is supposed to be validated, a convoluted process by which the certificate is put at the end of a certificate chain, that start with a root CA, goes from CA to sub-CA, and ends with the certificate that you are interested in (often called "end-entity"). The signature on each certificate is to be verified with the public key of the preceding certificate in the chain.

The root CA you already have (that's the point of root CA: this is what you start with). For proper validation, you need to obtain all the other certificates, to build a chain. In some protocols, there is provision for sending non-root CA certificates along with the end-entity (e.g. a SSL/TLS server does not send only its certificate to the client, but a complete chain). If the protocol at hand does not provide for that feature, then the system that must validate the certificate will have to obtain the non-root CA in some other way. Sometimes these can be downloaded, following URL found in certificates themselves (Authority Information Access extension), but this requires that the certificates have indeed been placed on remotely accessible servers with all the proper URL in place.

But, in all generality, it is considered polite to send non-root CA whenever you transmit the certificate itself. This can only make operations smoother.

The PKCS#7 format (now called CMS) is a generic format for encrypted and/or signed files. It so happens that when it uses the "signed" option, it includes an optional header field to store "extra certificates" that may be useful to anybody trying to verify the signatures. Thus, it became traditional to (ab)use this format into a "bag of certificates": this is a CMS file, signed, with no content and zero signature, but with the "extra certificate" field containing the certificates (without order). This is often called a "PKCS#7 certificate" and Windows systems like to call it a ".P7B file".

What should be in your trust store is the root CA -- and nothing else, by definition. The non-root CA are conveyed to you so that your machine may find it easy to build the chain. A very nice feature of certificates is that they are signed: thus, how you obtain them is irrelevant for security; what matters is whether the signature matches.


What needs to be in your truststore is a certificate that you trust for this specific communication. You may want to use one or more CRL's or OCSP connections as well.

Basically you are trying to build a certificate chain to a trusted certificate, while validating all certificates in the chain. So those certificates should have correct dates, they should not be revoked and they should of course verify with the certificate of the issuer.

Validating with a well-known CA is great, but mind that you don't want to verify a message send by just any party that has a certificate by a well known CA. Anybody can obtain one of those.

So you may want to explicitly check the subject field, use certificate pinning or something otherwise unique when verifying the signature.

How many certificates are delivered within the PKCS#7 CMS can vary. They are just used to create a chain to a trusted certificate.

So in your case you may want to establish trust for the CA certificate that has been assigned the task to secure this particular message (which I presume is signed). This is an out of band action (i.e. you may need to pick up the phone to verify the certificate fingerprint). If there is no CA specific for this task, you could put the leaf certificate in the trust store.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.