For a single certificate, a PEM encoded format is common, this is the text/base64 one that is delimited by:
Most systems should accept
.pem extensions for this file type, the former is slightly preferable for a certificate,
.cer may work too.
PEM is an encoding of data using base64 for the data, the underlying binary format is referred to as DER format. Certificates in DER format are often named with
.der, but may be named with
PEM and DER are encodings, the extensions
.pem are sometimes used, regardless of the type(s) of the encoded data. Sometimes the extension indicates the nature of the data (certificate, key, CRL), but not the encoding...
When MIME is involved (as it will be with HTTP, and email attachments), the MIME type is also an important consideration, some clients may rely on, or prefer this, to determine the action for a file.
The PEM format has delimiters which indicate the nature of the data, and lends itself to "bundling" multiple PEM encoded objects in a single file. This is often used to provide multiple related certificates e.g. a CA chain (but not everything will process all certificates in such a file), or a cert/key pair.
PKCS#7 or CMS (Cryptographic Message Syntax) is the preferred way of encapsulating things, notionally it's for signed and/or encrypted messages, but it's valid for it to contain no message, just certificates.
I recommend you:
- make your certificate available in a PEM encoded file with a
- check the web server MIME mappings are present and correct
- optionally create and make available a
.p7b file containing the cert and CA chain, this will allow clients to update/install anything missing from their local intermediate CA cache and enable proper verification the chain
Unlike PGP, and presumably related to the different design and distribution mechanism, it's not common to publish a certificate fingerprint, though you can do so, and you may also publish your SKI (Subject Key Identifier) to be thorough.
If you're not familiar with OpenSSL use, this reference site or this online tool and command reference should help with converting. Do not under any circumstances upload a
.pfx file ;-)