RFC 7468 / START HERE
Certificate and key text, before the details
PKIX means Public-Key Infrastructure X.509; PKCS means Public-Key Cryptography Standards; CMS means Cryptographic Message Syntax. This RFC defines textual wrappers for their structured certificates, requests, keys and message containers. These wrappers are often called PEM, after Privacy-Enhanced Mail, but are not the entire old PEM format.
Binary security objects become printable Base64 data between exact BEGIN and END lines. A label such as CERTIFICATE or PRIVATE KEY identifies the expected inner structure so software can choose how to read it.
The idea in one picture
Structured bytes
Labeled text
Check the contents
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
Tools historically wrote slightly different wrappers. RFC 7468 documents interoperable labels, generation and parsing rules. It complements the certificate and Base64 specifications; it does not replace their cryptographic or trust requirements.
A familiar example
A fictional operator copies a test certificate block into a configuration file. The wrapper helps preserve the bytes through text tools. Decoding it does not prove the certificate is trusted, and Base64 does not hide a private key. No actual certificate or key is supplied here.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Turn bytes into a labeled text objectA certificate or key is a structured binary object. Base64 turns its bytes into printable characters; boundary lines identify the kind of structure inside. These wrappers are often called PEM, after Privacy-Enhanced Mail, but this RFC defines its own textual encoding.→
- Generate predictable lines and exact boundariesA generator writes a form that other tools can read reliably. Its formatting duties are stricter than every parser’s possible acceptance policy.→
- Choose the label for the actual inner structureA label names a container, not a particular cryptographic algorithm. Changing the label does not convert the bytes into the named structure. The four scenes are separate label families, not one conversion sequence.→
- Parse transport variations without inventing trustA parser receives text from files, mail or copied documents. It must cope safely with transport variations while applying a deliberate policy for what objects to accept.→
- Keep decoding, canonicalization and trust separateA readable block can still hold malformed, secret or untrusted data. Textual formatting is not a certificate check, a secure storage system or a canonical fingerprint format.→
This introduction explains RFC 7468 (2015). Read the original RFC ↗