# PKCS#7 — .p7b and .p7c

PKCS#7 is a container format that bundles several certificates into one file, commonly with a `.p7b` or `.p7c` extension. It cannot hold a private key — the structure has no provision for one — which is the main thing distinguishing it from PKCS#12. It is used to distribute certificate chains to Windows and Java tooling. The certificates inside are an unordered set, so a P7B records no information about which certificate signed which; anything consuming the bundle has to work the chain out from subject and issuer names.

Source: https://certguru.io/formats/pkcs7-p7b/
Last updated: 2026-08-19
Commands verified against OpenSSL 3.5.7.

---

## What it is for

PKCS#7 — also called Cryptographic Message Syntax — is a general-purpose structure for signed and
enveloped data. In certificate work it is used for one narrow thing: shipping a group of
certificates as one file.

That is genuinely useful. A chain distributed as a P7B is one attachment rather than three, and
Windows and Java import dialogs understand it natively. What it does not do is record any
relationship between the certificates it contains.

*Look inside*

```bash
openssl pkcs7 -in bundle.p7b -print_certs -noout
```

Expected output:

```
subject=CN = example.com
issuer=C = US, O = Example CA, CN = Example Intermediate CA

subject=C = US, O = Example CA, CN = Example Intermediate CA
issuer=C = US, O = Example CA, CN = Example Root CA
```

## No private key, ever

This is the defining constraint and the most common misunderstanding:

| Format | Certificates | Private key | Password |
| --- | --- | --- | --- |
| [PEM](/formats/pem/) | Many | Optional | No |
| **PKCS#7** | Many | **Never** | No |
| [PKCS#12](/formats/pkcs12-pfx-p12/) | Many | Usually | Yes |

Because there is no key, a P7B needs no password and is safe to email or attach to a ticket. That
is a real advantage when all you are distributing is a chain.

## PEM or DER

Like everything else in this space, a `.p7b` may be Base64 text or raw binary:

```bash
head -n1 bundle.p7b
```

Expected output:

```
-----BEGIN PKCS7-----
```

If that shows binary instead, add `-inform der` to every command on this page:

```bash
openssl pkcs7 -inform der -in bundle-der.p7b -print_certs -noout
```

## Unpacking one

```bash
openssl pkcs7 -print_certs -in bundle.p7b -out certificates.pem
```

Full detail, including how to identify the leaf and rebuild the chain in order, at
[convert P7B to PEM](/convert/p7b-to-pem/).

## Creating one

```bash
openssl crl2pkcs7 -nocrl -certfile certificate.crt -certfile chain.crt -out bundle.p7b
```

The subcommand name is a historical accident — it was written to wrap CRLs, and `-nocrl` says you
are not supplying one. See [convert PEM to P7B](/convert/pem-to-p7b/).

> **When to reach for it**
>
> Use PKCS#7 when a Windows or Java tool asks for a chain in that format, or when you want to hand
>   someone a set of certificates as a single file with no key involved. For anything else, plain
>   concatenated PEM is simpler and universally readable.


## Frequently asked questions

### What is the difference between P7B and PFX?

A P7B holds certificates only. A PFX holds certificates and the private key, protected by a password. If you are moving a server's identity to another machine you need PFX; if you are only distributing a chain, P7B is sufficient and safer because there is no key to leak.

### Can I extract a private key from a .p7b?

No. There is no private key in the file. If someone told you a P7B contains one, they are thinking of PKCS#12.

### Why are my certificates in the wrong order after extracting?

PKCS#7 stores certificates as a set, not a list, so no order is preserved or promised. Read each certificate's subject and issuer and rebuild the chain leaf-first before using it.

### What is a .p7s file?

The same PKCS#7 structure used to carry a detached signature, most often an S/MIME email signature. It is a different application of the format rather than a different format.


## References

- [RFC 5652: cryptographic message syntax](https://www.rfc-editor.org/rfc/rfc5652) — CMS, which PKCS#7 became

## Related pages

- https://certguru.io/convert/p7b-to-pem/
- https://certguru.io/convert/pem-to-p7b/
- https://certguru.io/errors/keytool-not-an-x509-certificate/
- https://certguru.io/formats/pkcs12-pfx-p12/
- https://certguru.io/formats/pem/
- https://certguru.io/concepts/certificate-chain/

--
CertGuru — https://certguru.io