secure boot - runs fine with .cer - fails with .crt certificate

Question

I have Asus X200MA notebook with Windows 8.1 64bit. I have setup shellx64.efi to run under secure boot. File is signed with my own key (created using openssl) and it runs fine when .cer format public key is appended in the certificate db. UEFI setup option accepts .crt certificate format too but with that shellx64.efi simply fails to run.

What is the difference between .crt & .cer format when it comes to public key certificates? Why would secure boot efi execution fail with .crt certificate and run just fine with .cer?

UEFI secure boot setup inline help mentions that it can accept Public Key Certificates as EFI Signature List / CERT X.509 (der encoded) / CERT RSA2048 (bin) or CERT SHA256 (bin) formats.

Thanks.

Answer 1

There is no difference – neither extension is actually defined to mean anything specific, and most of the time they mean the same thing.

X.509 certificates have just one "main" storage format, which is DER. It can be however Base64-encoded (aka PEM-encoded) or not (raw DER). A .crt file can really be either.

So first take a look at the files' contents. If they start with "-----BEGIN CERTIFICATE", you have a PEM-encoded DER file. If they contain raw binary data, most likely you have a raw DER file.

(Sometimes multiple X.509 certificates are packed into some sort of PKCS#7 file, however it almost always has a .p7b or .pkcs7 or something similar as the extension.)