1

I registered for SSL certs for a domain, and got 4 files in return:

  1. interCert.crt
  2. PKCS7Cert.crt
  3. rootCert.crt
  4. X509Cert.crt

I understand rootCert must be the root CA cert and interCert is an intermediate cert, but what are the other two? which one should I use for what purpose? I'm guessing one is a private key and one is the certificate? Why are they named like that?

  • and got 4 files in return - I'm pretty sure that there is a documentation of what you got and how to use it, either included with the files or on the website of the CA you order the certificates from. – Steffen Ullrich May 23 '17 at 8:10
  • I got it through the company IT department, they didn't give me any documentation, just those files. – d.a.vorm May 23 '17 at 8:15
  • Welcome to Information Security SE. Please take the tour so you can get the most out of this site: security.stackexchange.com/Tour. – SDsolar May 23 '17 at 8:21
4

It is not clear what is exactly in the files but might guess from the names:

  • X509Cert - probably the leaf certificate, i.e. the server certificate
  • interCert - probably the intermediate certificates
  • rootCert - the root certificate which should not be included in the server configuration. If this is no public root CA it have to be installed as trusted on the TLS client instead
  • PKCS7Cert - a container with probably all of these together in PKCS#7 format. See also What's the difference between X.509 and PKCS#7 Certificate?

I'm guessing one is a private key

Probably not. The private key is usually created by the one requesting the certificate and kept private. Thus if you created a certificate signing request and got these files in response you should already have your private key. If not they might have included the key in the X509Cert file and/or the PKCS7Cert.

I got it through the company IT department, they didn't give me any documentation, just those files.

I'm not sure how processes in your company work. But where I work the usual procedure is to ask the ones you got the files from on what to do with the files.

  • "The private key is usually created by the one requesting the certificate and kept private." - RIGHT! Yes, I did create the CSR and I have the private key, I completely forgot because it's been months. The IT department staff are not familiar with these things, so I can't ask them – d.a.vorm May 23 '17 at 8:34
  • "PKCS7Cert - a container with probably all of these together" - Does this mean I can just use this one in place of the others? – d.a.vorm May 23 '17 at 8:42
  • @d.a.vorm: yes, but only if the software you use can handle PKCS#7. – Steffen Ullrich May 23 '17 at 9:44
  • I just tried to install the certificates and you were right, X509 is the server certificate, and I needed to use only the intermediate certificates. Everything works fine. Thanks a lot! – d.a.vorm May 24 '17 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.