For a single certificate, a PEM encoded format is common, this is the text/base64 one that is delimited by:
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
Most systems should accept .crt
and .pem
extensions for this file type, the former is slightly preferable for a certificate, .cer
may work too.
PEM is an encoding of data using base64 for the data, the underlying binary format is referred to as DER format. Certificates in DER format are often named with .der
, but may be named with .crt
or .cer
too.
PEM and DER are encodings, the extensions .der
and .pem
are sometimes used, regardless of the type(s) of the encoded data. Sometimes the extension indicates the nature of the data (certificate, key, CRL), but not the encoding...
When MIME is involved (as it will be with HTTP, and email attachments), the MIME type is also an important consideration, some clients may rely on, or prefer this, to determine the action for a file.
The PEM format has delimiters which indicate the nature of the data, and lends itself to "bundling" multiple PEM encoded objects in a single file. This is often used to provide multiple related certificates e.g. a CA chain (but not everything will process all certificates in such a file), or a cert/key pair.
PKCS#7 or CMS (Cryptographic Message Syntax) is the preferred way of encapsulating things, notionally it's for signed and/or encrypted messages, but it's valid for it to contain no message, just certificates.
I recommend you:
- make your certificate available in a PEM encoded file with a
.crt
extension
- check the web server MIME mappings are present and correct
- optionally create and make available a
.p7b
file containing the cert and CA chain, this will allow clients to update/install anything missing from their local intermediate CA cache and enable proper verification the chain
Unlike PGP, and presumably related to the different design and distribution mechanism, it's not common to publish a certificate fingerprint, though you can do so, and you may also publish your SKI (Subject Key Identifier) to be thorough.
If you're not familiar with OpenSSL use, this reference site or this online tool and command reference should help with converting. Do not under any circumstances upload a .key
or .pfx
file ;-)