Question

We are adding server certificates verification in SSL handshake for one of our clients. Being very new to Cryptography and C world, thought I would first clear my concepts about these things and then start with implementation.

So, I googled a lot looking mostly for Certificates concepts, but couldn’t clear up my concepts any better to my satisfaction. Actually it added more confusion. 🙂

Here are some things which I don’t understand almost at all:
1. What is base64 format? Is it same as DER?
2. PEM file always contains base64 content?
3. What is the format used by Windows Certificate Store? Is it binary?

Can someone please help me here.
Would be very much thankful if these things get cleared for me.

Answer 1

The structure of an X.509 certificate is defined using ASN.1. Here is an excerpt of the overall structure definition of an X.509 certificate:

Certificate  ::=  SEQUENCE  {
    tbsCertificate       TBSCertificate,
    signatureAlgorithm   AlgorithmIdentifier,
    signatureValue       BIT STRING  }

TBSCertificate  ::=  SEQUENCE  {
    version         [0]  EXPLICIT Version DEFAULT v1,
    serialNumber         CertificateSerialNumber,
    signature            AlgorithmIdentifier,
    issuer               Name,
    validity             Validity,
    subject              Name,
    subjectPublicKeyInfo SubjectPublicKeyInfo,
    issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
                         -- If present, version MUST be v2 or v3
    subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
                         -- If present, version MUST be v2 or v3
    extensions      [3]  EXPLICIT Extensions OPTIONAL
                         -- If present, version MUST be v3
    }

A Certificate value (with the contained values filled in) is encoded using the DER format, which is a binary format.

Base64 is a general way of encoding binary sequences into text, by reducing the set of bytes used to readable ASCII characters (so this representation is longer).

A certificate in PEM format is the Base64-encoding of the DER-encoding of the certificate, with a line-return at the end of each 64-character chunk, placed between delimiters:

-----BEGIN CERTIFICATE-----
MIIB2zCCAUSgAwIBAwIBADANBgkqhkiG9w0BAQQFADAYMRYwFAYDVQQDEw1OZXRn
...
-----END CERTIFICATE-----

You could also have the private key in PEM format, in which case the delimiters would be -----BEGIN RSA PRIVATE KEY----- (and matching END), for example.

On the wire, during a TLS connection, DER is used.

It doesn’t really matter what the Windows Certificate store uses internally, it should be able to import/export DER or PEM/Base64 certificates.

---

Certificate "types" is a wider topic than the DER/base64 format. Most certificates used for SSL/TLS are X.509 certificates. Then you get usage profiles. The most common one is the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile, which essentially defines how Certification Authorities should issue certificates and how entities should verify remote certificates.

You might also be interested in these questions:

• What does it mean for a digital certificate to be “signed”?
• What is an SSL certificate intended to prove, and how does it do it?

More generally, getting a book on PKI should help.