RFC 5967

The application/pkcs10 Media Type

📅 published August 2010, from ietf

RFC 5967: The application/pkcs10 Media Type ✨

Okay bestie, this one is the RFC that gives the application/pkcs10 media type its official paperwork 📄💖 It was written by Sean Turner of IECA, dated August 2010, and it's an Informational doc, so it's sharing knowledge, not setting a standards-track rule 🎀 It updates RFC 2986 (that's the PKCS #10 certification request spec). It doesn't list anything it obsoletes.

Abstract

This doc specifies a media type for carrying PKCS #10 certification requests, which are defined in RFC 2986 🔐 It carries over the original spec from RFC 2311, which has since been moved to Historic status, and it properly links that spec to RFC 2986 🦋

Status of This Memo

This is NOT an Internet Standards Track spec. It's published for informational purposes 🌸

It is a product of the Internet Engineering Task Force (IETF) and reflects IETF community consensus 🫶 It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). Not every IESG-approved doc is a candidate for any level of Internet Standard, so check Section 2 of RFC 5741 if you're curious 👀

For the current status, any errata, and how to send feedback, head to http://www.rfc-editor.org/info/rfc5967 ✨

Copyright Notice

This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stood on the publication date. Read those carefully, because they spell out your rights and restrictions for this doc 📜 Code Components pulled out of this doc must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as described in the Simplified BSD License 🌈

This doc may include material from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008. The people who control the copyright in some of that material may not have granted the IETF Trust the right to allow modifications outside the IETF Standards Process. So unless you get an adequate license from those copyright holders, this doc may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside that process. The exceptions are formatting it for publication as an RFC or translating it into languages other than English 🙈

1. Introduction ✨

RFC 2311 was the first to define the application/pkcs10 media type 🎀 When RFC 2633 came out, the application/pkcs10 section got dropped, but for some reason that text never made it into the PKCS #10 doc, which is RFC 2986 💀 RFC 2311 was later moved to Historic status by RFC 5751 💅 To make sure the IANA media type registration points to a non-Historic doc, this one updates RFC 2986 with the definition of application/pkcs10 and an IANA registration based on RFC 4288 🦋

Section 2 is adapted from Section 3.7 of RFC 2311 🌸

1.1. Requirements Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this doc are to be interpreted as described in RFC 2119 🔥

2. Creating a Certification Request 🧚

Okay so a typical app that lets a user generate cryptographic info has to submit that info to a Certification Authority (CA), who turns it into a certificate 🔐 PKCS #10 (RFC 2986) is the thing that describes the syntax for certification requests 💖

The details of certification requests and how you get a certificate are out of scope here. This doc only defines the format of the data used in application/pkcs10 🎀

2.1. Format of the application/pkcs10 Body

PKCS #10 defines the ASN.1 type CertificationRequest for submitting a certification request 🦋 To transfer it to a CA, that abstract syntax has to be encoded and identified in a unique way ✨ When the media type application/pkcs10 is used, the body MUST be a CertificationRequest 💅

A robust app SHOULD output Distinguished Encoding Rules (DER), but it should still accept Basic Encoding Rules (BER) or DER on input 🫶

BER or DER output is 8-bit, but some transports only handle 7-bit data 😭 In those cases a suitable 7-bit transfer encoding MUST be applied. In MIME-compatible transports, the base64 encoding (RFC 4648) SHOULD be used with application/pkcs10, although any 7-bit transfer encoding may work 🌈

2.2. Sending and Receiving an application/pkcs10 Body Part

When you're sending a certificate-signing request, the application/pkcs10 message format MUST be used to convey a PKCS #10 certificate-signing request 🔥 Now, for sending certificates and Certificate Revocation Lists (CRLs) with no signed content, the application/pkcs7-mime message format MUST be used to convey a degenerate PKCS #7 signedData "certs-only" message (RFC 5751) 💀

To send an application/pkcs10 body, the app generates the cryptographic info for the user. The details of that info are out of scope here 🌸

The process goes like this:

Step 1. The cryptographic information is placed within a PKCS #10
        CertificationRequest.

Step 2. The CertificationRequest is encoded according to BER or DER
        (preferred, DER).

Step 3. As a typical step, the encoded CertificationRequest is also
        base64 encoded so that it is 7-bit data suitable for transfer
        in ESMTP.  This then becomes the body of an
        application/pkcs10 body part.

The result might look like this:

   Content-Type: application/pkcs10; name=smime.p10
   Content-Transfer-Encoding: base64
   Content-Disposition: attachment; filename=smime.p10

   rfvbnj756tbBghyHhHUujhJhjH77n8HHGT9HG4VQpfyF467GhIGfHfYT6
   7n8HHGghyHhHUujhJh4VQpfyF467GhIGfHfYGTrfvbnjT6jH7756tbB9H
   f8HHGTrfvhJhjH776tbB9HG4VQbnj7567GhIGfHfYT6ghyHhHUujpfyF4
   0GhIGfHfQbnj756YT64V

A typical app only needs to send a certification request 🎀 It's the Certification Authority that has to receive and process the request 🦋 The steps for pulling the CertificationRequest back out of the message are straightforward, but they aren't covered here. The procedures for processing the certification request are also out of scope for this doc ✨

3. IANA Considerations 👑

IANA has updated the registration for the application/pkcs10 media subtype in the Application Media Types registry, using the filled-in template from BCP 13 (RFC 4288) shown below 💅

3.1. Registration of Media Subtype application/pkcs10

The media subtype for a PKCS #10 certification request is application/pkcs10 🌸

   Type name: application

   Subtype name: pkcs10

   Required parameters: None

   Optional parameters: None

   Encoding considerations: binary; see Section 2.

   Security considerations:

      Clients use a certification request to request that a
      Certification Authority certify a public key.  The
      certification request is digitally signed.  Also, see
      Section 6.

   Interoperability considerations: See Section 2.

   Published specification: This specification.

   Applications which use this media type:

      Applications that support PKCS #10 certification requests
      [RFC2986].

   Additional information:

      Magic number(s): None
      File extension(s): .p10
      Macintosh File Type Code(s):

   Person & email address to contact for further information:
     Sean Turner <turners@ieca.com>

   Restrictions on usage: none

   Author: Sean Turner <turners@ieca.com>

   Intended usage: COMMON

   Change controller: The IESG

4. Security Considerations 🙈

The security considerations of RFC 2986 and RFC 5751 apply here 😭 This doc doesn't introduce any new security considerations, so no new plot twists on that front 🔐

5. Acknowledgements 🫶

Sean wants to thank the authors of RFC 2311: Steve Dusse, Paul Hoffman, Blake Ramsdell, Laurence Lundblade, and Lisa Repka 💖

He also thanks Bjoern Hoehrmann for reviewing the media subtype application 🌷

6. References 📚

6.1. Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC2986]  Nystrom, M. and B. Kaliski, "PKCS #10: Certification
           Request Syntax Specification Version 1.7", RFC 2986,
           November 2000.

[RFC4288]  Freed, N. and J. Klensin, "Media Type Specifications and
           Registration Procedures", BCP 13, RFC 4288, December 2005.

[RFC4648]  Josefsson, S., "The Base16, Base32, and Base64 Data
           Encodings", RFC 4648, October 2006.

[RFC5751]  Ramsdell, B. and S. Turner, "Secure/Multipurpose Internet
           Mail Extensions (S/MIME) Version 3.2 Message
           Specification", RFC 5751, January 2010.

[X.690]    ITU-T Recommendation X.690 (2002) | ISO/IEC 8825-1:2002.
           Information Technology - ASN.1 encoding rules:
           Specification of Basic Encoding Rules (BER), Canonical
           Encoding Rules (CER) and Distinguished Encoding Rules
           (DER).

6.2. Informative References

[RFC2311]  Dusse, S., Hoffman, P., Ramsdell, B., Lundblade, L., and
           L. Repka, "S/MIME Version 2 Message Specification", RFC
           2311, March 1998.

[RFC2633]  Ramsdell, B., Ed., "S/MIME Version 3 Message
           Specification", RFC 2633, June 1999.

Author's Address 💌

Sean Turner
IECA, Inc.
3057 Nutley Street, Suite 106
Fairfax, VA 22031
USA

EMail: turners@ieca.com

📦 where this page comes from

ietf: rfc5967 2010-08
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms