Text Formats; Importing Certificate Chains - Red Hat CERTIFICATE SYSTEM 7.1 - ADMINISTRATOR Administrator's Manual

Importing Certificate Chains

• PKCS #7 certificate chain
This is a PKCS #7
object is the certificates. In particular, the signature and the contents are ignored. In
future versions of the software, the CRLs will also be used. The PKCS #7 format
allows multiple certificates to be downloaded at once. See "Importing Certificate
Chains," on page 722 for more information about handling multiple certificates.
• Red Hat Certificate Sequence
This is a simpler format for downloading certificate chains. It consists of a PKCS #7
ContentInfo
contentType
page 724), while the content field has the following structure:
CertificateSequence ::= SEQUENCE OF Certificate
This format allows multiple certificates to be downloaded at once. See "Importing
Certificate Chains," on page 722 for more information about handling multiple
certificates.

Text Formats

Any of the above binary formats can also be imported in text form. The text form begins
with the following line:
-----BEGIN CERTIFICATE-----
Following this line is the certificate data, which can be in any of the binary formats just
described. This data should be base 64 encoded as described by RFC 1113. The data is
followed by this line:
-----END CERTIFICATE-----
Importing Certificate Chains
Several of the supported formats can contain multiple certificates. When the Red Hat
certificate decoder encounters a collection of certificates, it handles them as follows:
• The first certificate is processed in a context-specific manner, which varies according
to how it is being imported. For Communicator, this handling depends upon the MIME
content type that is used on the object being downloaded. For Red Hat servers, it
depends upon the options selected in the server administration interface.
722 Red Hat Certificate System Administrator's Guide • September 2005
object. The only significant field in the
SignedData
structure, wrapping a sequence of certificates. The value of the
field should be
redhat-cert-sequence
SignedData
(see "Object Identifiers," on