x509certificate - Can the same x509 certificate have two different PEM encoding?

Question

It was my belief that the PEM encoding were unique.

But I have seen that the same certificate can have two different pem versions. Or at least, I have two PEM certificates that contain the same information (serial number, CA issuer etc...) so they should be the same.

Can the same certificate have two different PEM encoding?

标签： x509certificatex509

Answer 1

There are no two different encoding versions for same set of certificate data.

Presentation in PEM may be slightly different. I mean, PEM may include or missing PEM header and footer, Base64-encoded payload may or may not have line breaks after 64 characters, but it doesn't affect the Base64-encoded value, because line breaks are not part of encoding and ignored by Base64 encoder/decoder. The raw value unchanged for single certificate.

Update:

Exact PEM format is defined in RFC 1421, but it is not always followed and I see different presentations which can be called PEM as well (even though they don't strictly follow RFC). For example, I saw such as:

-----BEGIN XYX-----
<Base64 string split in 64 chars per line>
<Base64 string split in 64 chars per line>
<Base64 string split in 64 chars per line>
-----END XYZ-----

or

-----BEGIN XYX-----
<Long Base64 string split in single line (without line breaks>
-----END XYZ-----

or even this:

-----BEGIN XYX-----<Long Base64 string split in single line (without line breaks>-----END XYZ-----

or variations of these formats. Only first example is legit PEM format, while the rest are not-compliant, but can be called PEM, because they have PEM header and footer, and Base64-encoded payload.