Certificates & Formats

What Is PKCS#7 / P7B?

PKCS#7 (file extension .p7b or .p7c) is a container that holds one or more certificates — typically an end-entity certificate together with the intermediate chain — but never a private key. CAs commonly deliver newly issued certificates as P7B, and Windows and Java tooling import chains in this format.

What P7B is for

The format answers "give me the certificate and everything needed to trust it" in one file: leaf plus intermediates. That makes it the handover format from CAs (especially for Windows-oriented issuance), and a convenient way to install a full chain on servers that accept it directly.

Because it cannot contain a private key, a P7B alone is never enough to run a TLS server — the key stays wherever the CSR was generated. If someone asks for "the P7B and the key", they are really asking for a PFX.

Beyond certificate transport

PKCS#7 is also the underlying cryptographic message syntax (CMS) used by S/MIME signatures and by Windows catalog/Authenticode structures — the same envelope format carrying signed data instead of bare certificates. In day-to-day certificate work, though, "PKCS#7" almost always means "a P7B chain file".

Unpacking a P7B

Extract the individual PEM certificates from a P7B:

openssl pkcs7 -print_certs -in bundle.p7b -out certs.pem

Try it yourself — free tools

Certificate Converter — convert P7B to PEM and back
Certificate Checker — inspect every certificate inside a bundle

How MI Support IT can help

PKI Tools is built by MI Support IT, a Danish IT company with deep specialization in enterprise PKI: ADCS design and health checks, Venafi certificate automation, key ceremonies and CP/CPS documentation. Read about our PKI services or get in touch.