Is it bad idea to upload SSL Certificate as base64 encoded string?

Question

I have to create an API for uploading a certificate file. Unfortunately, the library that I'm using (graphQL) does not support file upload. It only supports primitive types like string, int, float etc. so I have to go the other ways around. I'm considering using base64 encoded string approach since the certificate file is not that big (less than 5mb I would say). Is it safe to do that ?

Answer 1

If your question is whether it's safe to encode a certificate to base64 format, in order to send it over the wire, then the answer is yes. Keep in mind that a usual representation of certificates is PEM, which is already base64 encoded.

If your question is whether it's safe to send a base64 encoded certificate over the wire without any other protection, then the answer is still yes. Certificates are signed public keys, so there's no need to protect them - they are public info.

If, however, by saying "certificate" you somehow refer to a private key, then the answer to the question above is no. Base64 does not provide confidentiality, integrity or authenticity, so you need to find another method to protect the data in transit.

Answer 2

Is it safe to do that ?

In terms of safety/security it does not make a difference which kind of encoding is used to transfer a certificate. It could be binary, base64, hexadecimal, uuencode ... whatever. These are only different representations of the same thing which don't add any security nor remove security.

Of course, it might be that the library processing the data has some bugs which can be exploited - but this has nothing to do with the encoding itself but only with the specific library.