RSA (the company) devises and publishes the public key cryptography standards. In those standards, PKCS #7 is a standard which defines how to encrypt and sign messages using PKI.

PKCS#7 defines a format to store the public key certificates alone whereas PKCS#12 defines a format to store both public and private key pairs. The list of file extensions for PKCS#12 was (.pfx and .p12) which I believe both are same.

My doubt is around PKCS# 7 certificate file extensions. I have many file extensions like .p7,.p7a,.p7b,.p7c etc. Is there a difference/significance between these file extensions? If there is, what is that?

Harvested whole internet unable to find the useful info to know the difference. So came here to see if anybody knows the same.

2 Answers 2


The S/MIME standard (RFC 5751) in section 3.2.1 states that the file extensions SHOULD be appropriate:

  • certificate management message: .p7c
  • CompressedData: .p7z
  • SignedData: .p7s
  • SignedData + EnvelopedData: .p7m
  • 1
    True, but this standard only applies to application/pkcs7-mime, and the CMS standards have far more utility than just encrypted email. There isn't a similar convention for filenames or extensions defined by other standards. Also note this standard still includes out-of-date advice: the very next sentence is "the file name SHOULD be limited to eight characters followed by a three-letter extension." This advice was valid for DOS file systems when it was introduced in 1999, but has long since lost any relevance to modern file systems that no longer have such filename restrictions. Feb 15, 2019 at 15:58

File name "extensions" are immaterial. There is no real standard for these few letters, only loosely maintained traditions. The PKCS#7 standard (now called CMS) describes how to encode and decode signed and/or encrypted and/or authenticated "messages" into sequences of bytes. How these sequences of bytes are stored or exchanged is completely out of scope; in particular, CMS has no concept of "file", let alone "file name".

These name extensions matter only for user interaction; namely, what happens when you double-click on the file. Operating systems derived from MS-Dos (e.g. Windows) will try to infer a reasonable behaviour by looking at the end of the file name; but that's the end of it. In any case, a CMS object has the following overall structure:

  ContentInfo ::= SEQUENCE {
    contentType ContentType,
    content [0] EXPLICIT ANY DEFINED BY contentType }


which means that the file contents begin with an explicit header which unambiguously identifies the type of data (e.g. 1.2.840.113549.1.7.2, which means "signed data, following the SignedData syntax from CMS section 5.1).

Since the contents are unambiguous, all you need to do is use as file name whatever triggers the right interface behaviour for what you want to use the CMS file for. There are several usages. For instance, since a CMS SignedData has a field for embedding certificates, it has often been (ab)used as a kind of archive format for certificates "with a chain" (but without a private key). I have seen the file extension ".p7b" used for this role.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .