How do I share my S/MIME public key?

Question

I have setup S/MIME encryption for my email address, and I'd like to allow people to download the public key from my website, rather than having to first receive an email from me.

I want the public key next to the email address on my website's "contact me" page.

Is there a file format/extension commonly supported by various S/MIME compatible email programs?

Answer 1

For a single certificate, a PEM encoded format is common, this is the text/base64 one that is delimited by:

-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----

Most systems should accept .crt and .pem extensions for this file type, the former is slightly preferable for a certificate, .cer may work too.

PEM is an encoding of data using base64 for the data, the underlying binary format is referred to as DER format. Certificates in DER format are often named with .der, but may be named with .crt or .cer too.

PEM and DER are encodings, the extensions .der and .pem are sometimes used, regardless of the type(s) of the encoded data. Sometimes the extension indicates the nature of the data (certificate, key, CRL), but not the encoding...

When MIME is involved (as it will be with HTTP, and email attachments), the MIME type is also an important consideration, some clients may rely on, or prefer this, to determine the action for a file.

The PEM format has delimiters which indicate the nature of the data, and lends itself to "bundling" multiple PEM encoded objects in a single file. This is often used to provide multiple related certificates e.g. a CA chain (but not everything will process all certificates in such a file), or a cert/key pair. PKCS#7 or CMS (Cryptographic Message Syntax) is the preferred way of encapsulating things, notionally it's for signed and/or encrypted messages, but it's valid for it to contain no message, just certificates.

I recommend you:

• make your certificate available in a PEM encoded file with a .crt extension
• check the web server MIME mappings are present and correct
• optionally create and make available a .p7b file containing the cert and CA chain, this will allow clients to update/install anything missing from their local intermediate CA cache and enable proper verification the chain

Unlike PGP, and presumably related to the different design and distribution mechanism, it's not common to publish a certificate fingerprint, though you can do so, and you may also publish your SKI (Subject Key Identifier) to be thorough.

If you're not familiar with OpenSSL use, this reference site or this online tool and command reference should help with converting. Do not under any circumstances upload a .key or .pfx file ;-)