What is the difference between P7B and PFX?

A P7B holds certificates only. A PFX holds certificates and the private key, protected by a password. If you are moving a server's identity to another machine you need PFX; if you are only distributing a chain, P7B is sufficient and safer because there is no key to leak.

Can I extract a private key from a .p7b?

No. There is no private key in the file. If someone told you a P7B contains one, they are thinking of PKCS#12.

Why are my certificates in the wrong order after extracting?

PKCS#7 stores certificates as a set, not a list, so no order is preserved or promised. Read each certificate's subject and issuer and rebuild the chain leaf-first before using it.

The same PKCS#7 structure used to carry a detached signature, most often an S/MIME email signature. It is a different application of the format rather than a different format.

PKCS#7 — .p7b and .p7c

PKCS#7 is a container format that bundles several certificates into one file, commonly with a `.p7b` or `.p7c` extension. It cannot hold a private key — the structure has no provision for one — which is the main thing distinguishing it from PKCS#12. It is used to distribute certificate chains to Windows and Java tooling. The certificates inside are an unordered set, so a P7B records no information about which certificate signed which; anything consuming the bundle has to work the chain out from subject and issuer names.

Updated August 19, 2026 Verified against OpenSSL 3.5.7

What it is for #

PKCS#7 — also called Cryptographic Message Syntax — is a general-purpose structure for signed and enveloped data. In certificate work it is used for one narrow thing: shipping a group of certificates as one file.

That is genuinely useful. A chain distributed as a P7B is one attachment rather than three, and Windows and Java import dialogs understand it natively. What it does not do is record any relationship between the certificates it contains.

Look inside

openssl pkcs7 -in bundle.p7b -print_certs -noout

Expected output

subject=CN = example.com
issuer=C = US, O = Example CA, CN = Example Intermediate CA

subject=C = US, O = Example CA, CN = Example Intermediate CA
issuer=C = US, O = Example CA, CN = Example Root CA

No private key, ever #

This is the defining constraint and the most common misunderstanding:

Format	Certificates	Private key	Password
PEM	Many	Optional	No
PKCS#7	Many	Never	No
PKCS#12	Many	Usually	Yes

Because there is no key, a P7B needs no password and is safe to email or attach to a ticket. That is a real advantage when all you are distributing is a chain.

PEM or DER #

Like everything else in this space, a .p7b may be Base64 text or raw binary:

head -n1 bundle.p7b

Expected output

-----BEGIN PKCS7-----

If that shows binary instead, add -inform der to every command on this page:

openssl pkcs7 -inform der -in bundle-der.p7b -print_certs -noout

Unpacking one #

openssl pkcs7 -print_certs -in bundle.p7b -out certificates.pem

Full detail, including how to identify the leaf and rebuild the chain in order, at convert P7B to PEM.

Creating one #

openssl crl2pkcs7 -nocrl -certfile certificate.crt -certfile chain.crt -out bundle.p7b

The subcommand name is a historical accident — it was written to wrap CRLs, and -nocrl says you are not supplying one. See convert PEM to P7B.

Frequently asked questions

What is the difference between P7B and PFX?: A P7B holds certificates only. A PFX holds certificates and the private key, protected by a password. If you are moving a server's identity to another machine you need PFX; if you are only distributing a chain, P7B is sufficient and safer because there is no key to leak.
Can I extract a private key from a .p7b?: No. There is no private key in the file. If someone told you a P7B contains one, they are thinking of PKCS#12.
Why are my certificates in the wrong order after extracting?: PKCS#7 stores certificates as a set, not a list, so no order is preserved or promised. Read each certificate's subject and issuer and rebuild the chain leaf-first before using it.
What is a .p7s file?: The same PKCS#7 structure used to carry a detached signature, most often an S/MIME email signature. It is a different application of the format rather than a different format.

References

RFC 5652: cryptographic message syntax — CMS, which PKCS#7 became