How to identify certificate package type?

Question

I am trying to identify a certificate CA distributed on https://acraiz.icpbrasil.gov.br/repositorio/Cadeia_FIREFOX.der (which is served signed by itself, while all pages leading to it are signed by a 3rd party that is included in all browsers, sigh. great start)

Firefox does read it without a problem. But all it does is accept it or not, no info shown besides the contents. And i'm posting here to avoid the weeklong process of looking info FF source...

Back on track, Firefox read it, but openssl does not.

I can try to read it as x509, pcks12, and all i get is

Could not read certificate from Cadeia_FIREFOX.der
40878589F37F0000:error:1608010C:STORE routines:ossl_store_handle_load_result:unsupported:crypto/store/store_result.c:151:

even trying to use it as a CA, as firefox happily does, fails:

$ openssl s_client -CAfile Cadeia_FIREFOX.der acraiz.icpbrasil.gov.br:4443
40979FA5F07F0000:error:05800088:x509 certificate routines:X509_load_cert_crl_file_ex:no certificate or crl found:crypto/x509/by_file.c:251:

is there any way to effectively identify the envelope using openssl or other means?

Answer 1

The file is in PKCS #7 format. You can read it with

openssl pkcs7 -in Cadeia_FIREFOX.der -inform der -print_certs -noout

The file is a chain of certificates, not just a single CA certificate.

To identify the file format, you can use the ASN.1 parser of OpenSSL:

openssl asn1parse -inform der -in Cadeia_FIREFOX.der