Anyone familiar with certificate decoding?

I seem to have 3 more bytes at the end of a certificate than the length indicates.

I have 3 certificates in the chain. The first one is 0x645 bytes, which is indicated right before the 30 82 bytes of the beginning of the certificate. However, if I count 1605 bytes, there are 3 more after that in my Wireshark certificate before the next 30 82 bytes of the 2nd certificate.

I've seen examples on line where that length before the 30 82 certificate start was exact, so I'm not sure what the 3 extra bytes are. Anyone know?


I figured it out. It's the 3 byte length of the next certificate, but not part of any actual certificate.

  • That's only for TLS 1.0 to 1.2 (and SSL 3, which you shouldn't be using but has almost the same message formats). TLS 1.3 adds an extensions block to each element of the cert sequence; see rfc8446 4.4.2 (and each RFC links to the prior version if you want to compare) – dave_thompson_085 Feb 14 at 4:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.