Choose the label for the actual inner structure
03A label names a container, not a particular cryptographic algorithm. Changing the label does not convert the bytes into the named structure. The four scenes are separate label families, not one conversion sequence.
PUBLIC KEY names SubjectPublicKeyInfo, not a whole Certificate. ATTRIBUTE CERTIFICATE is another specific structure. All nine labels select an inner syntax; none verifies identity by itself.
Source for this drawing: RFC 7468 · Read RFC section 4 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Route by the correct structure; a familiar name is not a substitute for parsing.
- CERTIFICATE, X509 CRL and CERTIFICATE REQUEST require BER-encoded Certificate, CertificateList and CertificationRequest structures respectively; DER is strongly preferred. A CRL is a certificate revocation list; a request is not an issued certificate.
- PKCS7 and CMS require BER-encoded ContentInfo of their respective specifications. PKCS means Public-Key Cryptography Standards; CMS means Cryptographic Message Syntax. Implementations SHOULD generate CMS and SHOULD NOT generate PKCS #7 when CMS is an alternative.
- PRIVATE KEY contains unencrypted PrivateKeyInfo or OneAsymmetricKey. ENCRYPTED PRIVATE KEY contains EncryptedPrivateKeyInfo. PUBLIC KEY contains SubjectPublicKeyInfo, including algorithm information and public-key bits. These require BER with DER preferred.
- ATTRIBUTE CERTIFICATE contains AttributeCertificate in BER, with DER strongly preferred. It is a separate authorization-related structure, not an alternate spelling for a public-key certificate.
- Generators MUST use CERTIFICATE, X509 CRL and CERTIFICATE REQUEST, not X509 CERTIFICATE, X.509 CERTIFICATE, CRL or NEW CERTIFICATE REQUEST. Parsers SHOULD NOT equate the first three old certificate/CRL labels with the standard ones, but MAY accept NEW CERTIFICATE REQUEST. Generators MUST NOT emit CERTIFICATE CHAIN; parsers SHOULD NOT equate it with PKCS7.
The label map covers all nine types in §4. PKCS #1 RSA PRIVATE KEY and OpenSSH formats are outside this RFC. File suffixes do not prove the encoding: §5.3 recommends .crt for textual certificates while noting common .cer practice.
Read the RFC section ↗