4

I have question regarding DER chain (root and intermediate) certificate. I've generated root and intermediate certificates with openSSL according to https://jamielinux.com/docs/openssl-certificate-authority/create-the-intermediate-pair.html. As a result i've got:

root certificate (ca4096.cert.pem)
and intermediate certificate (intermediate4096.cert.pem) that is signed through root authority.

I used cat command to combine them into certificate chain ca-chain4k4k.cert.pem.

Then with openssl command:

openssl x509 -outform der -in certificate.pem -out certificate.der

i converted intermediate4096.cert.pem and ca-chain4k4k.cert.pem into corresponding .der certificates. Both resulting files are binary equal.

Is it right so?
If yes could you explain me, why root certificate information is not needed?
If no, what mistake do i make? How can i attach root certificate information in the .der chain certificate.

I use OpenSSL 1.0.1t

Improve this question
0

1 Answer 1

Reset to default
2

I used cat command to combine them into certificate chain ca-chain4k4k.cert.pem ... 

openssl x509 -outform der -in certificate.pem -out certificate.der

i converted intermediate4096.cert.pem and ca-chain4k4k.cert.pem into corresponding .der certificates. Both resulting files are binary equal.

The command you used essentially converted the first certificate in intermediate4096.cert.pem and the first certificate in chain4k4k.cert.pem into the DER format. Since the first certificate in chain4k4k.cert.pem is the same as the first (and only) certificate in intermediate4096.cert.pem the result is the same.

How can i attach root certificate information in the .der chain certificate.

You cannot simply concatenate multiple certificates in DER format. While with PEM simply concatenating all the certificates is possible with DER you would need a container like PKCS12. See Generating a PKCS#12 file with openSSL for examples on how to create PKCS#12 files with OpenSSL.

Improve this answer
3
  • You can put multiple certs (often but not necessarily a chain) in a PKCS7 SignedData, including a 'degenerate' one with no data and no signature conventionally labelled p7b or p7c, and this can be put in a DER file as long as the programs or people using it know (or guess) to parse it as PKCS7 not X.509; although creating this in openssl commandline requires the silly-looking combination crl2pkcs7 -nocrl
    – dave_thompson_085
    Apr 29, 2017 at 4:06
  • @dave_thompson_085: I've updated the answer to include PKCS#12 as the container format which can be used instead of concatenating certificates in PEM format.
    – Steffen Ullrich
    Apr 29, 2017 at 4:33
  • Danke schön Steffen ☺️.
    – biechu
    Apr 29, 2017 at 22:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .