ssl-certificate - SSL 证书文件类型

Question

有点愚蠢的问题，但是:

当您从受信任的 CA 购买 SSL 证书时，您会获得什么样的文件？

有 .pfx 文件吗？

我正在开发一个管理 SSL 证书的小工具，但我不确定除了我自己创建的自签名证书之外，我将处理哪种类型的证书。

谢谢!

Answer 1

.pfx 文件扩展名是其中之一。以下来自 IBM 的文本包含一些深入的信息。

Certificate file types

Certificates and keys are stored in several types of files.

Files that store certificates and keys can have the following formats:

.pem

A privacy-enhanced mail file, which has a file extension of .pem, begins and ends with the following lines:

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

A privacy-enhanced mail format supports multiple digital certificates, including a certificate chain. If your organization uses certificate chaining, use this format to create CA certificates.

.arm

A file with an extension of .arm contains a base-64 encoded ASCII representation of a certificate, including its public key, but not its private key. An .arm format is generated and used by the IBM® Key Management utility. Specify this format to extract a self-signed certificate from the machine on which the self-signed certificate was generated to the machine that will use the self-signed certificate as the CA certificate.

.der

A file with an extension of .der contains binary data. This format can be used only for a single certificate, unlike a file with a privacy-enhanced mail format, which can contain multiple certificates. Specify this format to extract a self-signed certificate from the machine on which the self-signed certificate was generated to the machine that will use the self-signed certificate as the CA certificate.

.pfx (PKCS12)

A PKCS12 file, which has an extension of .pfx, contains a certificate (CA-issued certificate or self-signed certificate) and a corresponding private key. Use this format to transfer the contents of a keystore to a separate machine. For example, you can create and install a certificate and private key using key management utility, export the certificate and key to a PKCS12 file, then import the file into another keystore. This format is also useful for converting from one type of SSL implementation to a different implementation. For example, you can create and export a PKCS12 file using the IBM Key Management utility, then import the file on another machine using the OpenSSL CertTool utility.

上面的文字是从 IBM Eclipse Help 逐字复制的.