Category: Import/Export
Complexity: (Low)
Prerequisites: Certificate chain
Estimated Time: 10-15 minutes </WRAP> —- ===== Description ===== This scenario describes export and import of certificate chains in PKCS#7 format. PKCS#7 (also CMS - Cryptographic Message Syntax) is ideal for distributing certificate chains without private keys. PKCS#7 Properties: * Content: Certificates only (no private keys!) * Usage: Chain distribution, S/MIME * Extensions: .p7b, .p7c * Encoding: DER (Binary) or PEM (Base64) —- ===== Workflow ===== <mermaid> flowchart TD subgraph Input ROOT[Root CA] INT[Intermediate CA] EE[End-Entity] end subgraph PKCS7[„PKCS#7 Container“] CERTS[SignedData.Certificates] end ROOT –> CERTS INT –> CERTS EE –> CERTS PKCS7 –> DER[.p7b Binary] PKCS7 –> PEM[.p7b PEM] </mermaid> —- ===== Code Example: Export Chain as PKCS#7 ===== <code csharp> using System.Security.Cryptography.Pkcs; using System.Security.Cryptography.X509Certificates; public class Pkcs7ChainExporter { public byte[] ExportChain(X509Certificate2Collection certificates) { SignedCms without signature (certificates only) var content = new ContentInfo(Array.Empty<byte>()); var signedCms = new SignedCms(content, detached: true); Add certificates foreach (var cert in certificates) { signedCms.Certificates.Add(cert); } Export as PKCS#7 (DER) return signedCms.Encode(); } public void ExportToFile( X509Certificate2Collection certificates, string outputPath, bool asPem = false) { var p7bBytes = ExportChain(certificates); if (asPem) { PEM format var pem = new StringBuilder(); pem.AppendLine(„—–BEGIN PKCS7—–“); pem.AppendLine(Convert.ToBase64String(p7bBytes, Base64FormattingOptions.InsertLineBreaks)); pem.AppendLine(„—–END PKCS7—–“); File.WriteAllText(outputPath, pem.ToString()); } else { Binary (DER) File.WriteAllBytes(outputPath, p7bBytes); } Console.WriteLine($„PKCS#7 exported: {outputPath} ({certificates.Count} certificates)“); } } </code> —- ===== Code Example: Create and Export Full Chain ===== <code csharp> using WvdS.Security.Cryptography.X509Certificates.Extensions.PQ; public class FullChainExporter { public void ExportFullChain( X509Certificate2 endEntity, string outputPath) { using var ctx = PqCryptoContext.Initialize(); Build chain using var chain = new X509Chain(); chain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck; chain.ChainPolicy.VerificationFlags = X509VerificationFlags.AllFlags; chain.Build(endEntity); Collect all certificates var collection = new X509Certificate2Collection(); collection.Add(endEntity); foreach (var element in chain.ChainElements) { if (element.Certificate.Thumbprint != endEntity.Thumbprint) { collection.Add(element.Certificate); } } Export as PKCS#7 var exporter = new Pkcs7ChainExporter(); exporter.ExportToFile(collection, outputPath); Output details Console.WriteLine(„Chain exported:“); foreach (var cert in collection) { Console.WriteLine($„ [{cert.Thumbprint.Substring(0, 8)}] {cert.Subject}“); } } } </code> —- ===== Code Example: Import PKCS#7 ===== <code csharp> public class Pkcs7ChainImporter { public X509Certificate2Collection ImportChain(byte[] p7bBytes) { var collection = new X509Certificate2Collection(); collection.Import(p7bBytes); Console.WriteLine($„{collection.Count} certificates imported“); return collection; } public X509Certificate2Collection ImportFromFile(string filePath) { byte[] data; var content = File.ReadAllText(filePath); if (content.Contains(„—–BEGIN PKCS7—–“)) { PEM format var base64 = Regex.Match( content, @„—–BEGIN PKCS7—–(.*?)—–END PKCS7—–“, RegexOptions.Singleline ).Groups[1].Value.Trim(); data = Convert.FromBase64String(base64); } else { Binary (DER) data = File.ReadAllBytes(filePath); } return ImportChain(data); } public void InstallChainToStore( string p7bPath, StoreName storeName = StoreName.CertificateAuthority, StoreLocation location = StoreLocation.LocalMachine) { var certs = ImportFromFile(p7bPath); using var store = new X509Store(storeName, location); store.Open(OpenFlags.ReadWrite); foreach (var cert in certs) { Check if self-signed (Root) var targetStore = cert.Subject == cert.Issuer ? new X509Store(StoreName.Root, location) : store; if (targetStore.Name != store.Name) { targetStore.Open(OpenFlags.ReadWrite); } Check if already present var existing = targetStore.Certificates.Find( X509FindType.FindByThumbprint, cert.Thumbprint, validOnly: false ); if (existing.Count == 0) { targetStore.Add(cert); Console.WriteLine($„Installed: {cert.Subject}“); } if (targetStore.Name != store.Name) { targetStore.Close(); } } store.Close(); } } </code> —- ===== Code Example: CA Bundle for Webserver ===== <code csharp> public class CaBundleCreator { public void CreateCaBundle( X509Certificate2 rootCa, X509Certificate2Collection intermediateCas, string outputPath) { var collection = new X509Certificate2Collection(); Intermediates first (closest to server) foreach (var intermediate in intermediateCas.OrderByDescending(c ⇒ c.NotAfter)) { collection.Add(intermediate); } Root last collection.Add(rootCa); var exporter = new Pkcs7ChainExporter(); exporter.ExportToFile(collection, outputPath); Console.WriteLine(„CA Bundle created:“); Console.WriteLine($„ Intermediates: {intermediateCas.Count}“); Console.WriteLine($„ Root: {rootCa.Subject}“); } public void CreateNginxCaBundle( X509Certificate2 serverCert, X509Certificate2Collection chain, string outputPath) { Nginx expects PEM chain (server first, then intermediates) var sb = new StringBuilder(); Server certificate sb.AppendLine(ToPem(serverCert)); Intermediates (not root!) foreach (var cert in chain.Where(c ⇒ c.Subject != c.Issuer)) { sb.AppendLine(ToPem(cert)); } File.WriteAllText(outputPath, sb.ToString()); Console.WriteLine($„Nginx CA Bundle: {outputPath}“); } private string ToPem(X509Certificate2 cert) { var sb = new StringBuilder(); sb.AppendLine(„—–BEGIN CERTIFICATE—–“); sb.AppendLine(Convert.ToBase64String(cert.RawData, Base64FormattingOptions.InsertLineBreaks)); sb.AppendLine(„—–END CERTIFICATE—–“); return sb.ToString(); } } </code> —- ===== PKCS#7 with OpenSSL ===== <code bash> # Create PKCS#7 from multiple certificates openssl crl2pkcs7 -nocrl \ -certfile root-ca.pem \ -certfile intermediate-ca.pem \ -certfile server.pem \ -out chain.p7b \ -outform DER # PKCS#7 as PEM openssl crl2pkcs7 -nocrl \ -certfile chain.pem \ -out chain.p7b \ -outform PEM # Inspect PKCS#7 openssl pkcs7 -in chain.p7b -print_certs -noout # Extract certificates from PKCS#7 openssl pkcs7 -in chain.p7b -print_certs -out extracted.pem # PKCS#7 information openssl pkcs7 -in chain.p7b -inform DER -text </code> —- ===== Usage in Various Systems ===== ^ System ^ PKCS#7 Usage ^ Format ^ | Windows | Intermediate CA Store | .p7b (DER) | | IIS | SSL Certificate Chain | .p7b | | Java | Trust Store Import | .p7b (DER) | | S/MIME | Email Encryption | Part of message | | Code Signing | Timestamp + Chain | Embedded | —- ===== Related Scenarios ===== ^ Relationship ^ Scenario ^ Description ^ | Alternative | 12.1 PEM Export | Chain as PEM | | Related | 12.2 PFX Export | With Private Key | | Prerequisite | 1.3 CA Hierarchy | Build chain | | Related** | 5.1 Chain Building | Validate chain |

« <- 12.2 PFX Export | ^ Import/Export | 12.4 Interoperability -> »

Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional