OpenSSL crl2pkcs7: Create PKCS#7 and P7B Certificate Bundles

Overview

A certificate authority sends you three PEM files:

server.crt
intermediate-ca.crt
root-ca.crt

Your Linux tools are perfectly happy with them.

Then the administrator of another system asks:

Can you send me the certificate chain as a .p7b file?

This is where:

openssl crl2pkcs7

becomes useful.

The command can take one or more PEM certificates and optionally a Certificate Revocation List and place them into a PKCS#7 structure.

The resulting file can be encoded as:

PEM

or:

DER

and may use familiar extensions such as:

.p7b
.p7c
.p7

The official OpenSSL crl2pkcs7 documentation describes the output as a PKCS#7 SignedData structure containing certificates and optionally a CRL, but no signers.

This guide uses a practical system-administration scenario:

An administrator has a server certificate, intermediate CA, and root CA in separate PEM files. A destination system requires the complete certificate chain as a DER-encoded PKCS#7 .p7b file.

We will use OpenSSL to:

1. inspect the source certificates;
2. verify the certificate chain;
3. create a PKCS#7 certificate bundle;
4. create a Windows-friendly DER .p7b;
5. inspect the resulting PKCS#7 file;
6. extract the certificates back to PEM;
7. include a CRL when necessary;
8. convert a DER CRL before using it;
9. handle multiple certificate files;
10. troubleshoot common crl2pkcs7 errors.

What does openssl crl2pkcs7 do?

The command syntax is:

openssl crl2pkcs7 [options]

Despite its name, a CRL is optional.

This is probably the most important thing to understand about the command.

With:

-nocrl

you can use crl2pkcs7 simply to package certificates into PKCS#7.

For example:

openssl crl2pkcs7 \
  -nocrl \
  -certfile server.crt \
  -certfile intermediate-ca.crt \
  -certfile root-ca.crt \
  -out chain.p7b

OpenSSL documents -certfile as accepting one or more PEM certificates, and the option may be specified multiple times.

Why is it called crl2pkcs7 if I don’t need a CRL?

Historically, the command was designed to construct a PKCS#7 structure from:

certificate(s)
+
optional CRL

By default, OpenSSL expects a CRL.

The:

-nocrl

option tells OpenSSL not to read one.

That makes the command useful for the much more common administrator task of building a certificate-only PKCS#7 bundle.

The resulting object is sometimes called a degenerate SignedData structure because it uses the PKCS#7 SignedData container but contains no actual signer information.

What is a PKCS#7 certificate bundle?

PKCS#7 can contain multiple certificates in one structure.

For example:

PKCS#7
├── Server Certificate
├── Intermediate CA
└── Root CA

A .p7b file normally does not contain the server’s private key.

This makes PKCS#7 fundamentally different from PKCS#12.

PKCS#7

Commonly contains:

certificates
certificate chains
optional CRLs

but no private key in the certificate-only bundle created by crl2pkcs7.

PKCS#12

Commonly contains:

private key
certificate
certificate chain

with extensions such as:

.p12
.pfx

For more on PKCS#7 structures, see PKCS7 as SignedData and a Certificate Bundle. Your existing MisterPKI guide already covers inspecting and extracting certificates from P7B bundles.

OpenSSL version compatibility

This guide applies to:

• OpenSSL 3.0;
• OpenSSL 3.1;
• OpenSSL 3.2;
• OpenSSL 3.3;
• OpenSSL 3.4;
• OpenSSL 3.5 LTS;
• OpenSSL 4.0.

Check your version:

openssl version

For detailed build information:

openssl version -a

The core command syntax is essentially unchanged across OpenSSL 3.0, 3.5, and 4.0:

openssl crl2pkcs7 \
  -nocrl \
  -certfile certificate.pem \
  -out bundle.p7b

The common options include:

-inform
-outform
-in
-out
-certfile
-nocrl
-provider
-provider-path
-propquery

OpenSSL 3.5 and OpenSSL 4.0 additionally document:

-provparam

for provider configuration.

For ordinary certificate-bundle creation, these version differences do not materially change the workflow.

Real-world scenario

Assume you have:

server.crt
intermediate-ca.crt
root-ca.crt

All three are PEM-encoded X.509 certificates.

A destination system expects:

server-chain.p7b

in binary DER format.

The desired bundle is:

server.crt
      ↓
intermediate-ca.crt
      ↓
root-ca.crt
      ↓
PKCS#7 / P7B

Before creating the bundle, verify that the files actually belong together.

Step 1: Confirm each file is a certificate

Check the server certificate:

openssl x509 \
  -in server.crt \
  -noout \
  -subject \
  -issuer \
  -serial \
  -dates

Do the same for the intermediate:

openssl x509 \
  -in intermediate-ca.crt \
  -noout \
  -subject \
  -issuer \
  -serial \
  -dates

And the root:

openssl x509 \
  -in root-ca.crt \
  -noout \
  -subject \
  -issuer \
  -serial \
  -dates

You should be able to follow the relationship:

Server issuer
    =
Intermediate subject
Intermediate issuer
    =
Root subject

A root CA is normally self-signed, so its:

subject

and:

issuer

normally match.

For a deeper explanation of this relationship, see Certificate Chains Explained.

Step 2: Verify the chain before packaging it

Do not assume that placing three certificates into one P7B file makes them a valid certificate chain.

Verify them first:

openssl verify \
  -CAfile root-ca.crt \
  -untrusted intermediate-ca.crt \
  server.crt

Expected:

server.crt: OK

If this fails, fix the chain before creating the PKCS#7 bundle.

For more certificate-chain troubleshooting, see OpenSSL Verify: Certificate, Chain, CRL, and Key Examples.

Step 3: Create a PEM PKCS#7 certificate bundle

Create the simplest certificate-only bundle:

openssl crl2pkcs7 \
  -nocrl \
  -certfile server.crt \
  -certfile intermediate-ca.crt \
  -certfile root-ca.crt \
  -out server-chain.p7b

Because no:

-outform

was specified, OpenSSL uses PEM output by default.

Inspect the beginning:

head server-chain.p7b

You should see a PEM PKCS#7 header similar to:

-----BEGIN PKCS7-----

This file can contain all three certificates inside one PKCS#7 structure.

Step 4: Create a DER-encoded P7B file

Many Windows and enterprise applications expect .p7b files in binary DER format.

Use:

openssl crl2pkcs7 \
  -nocrl \
  -certfile server.crt \
  -certfile intermediate-ca.crt \
  -certfile root-ca.crt \
  -outform DER \
  -out server-chain.p7b

The output is now binary.

Check it:

file server-chain.p7b

Do not expect:

cat server-chain.p7b

to produce readable output.

DER is binary ASN.1 encoding.

Step 5: Inspect the resulting PKCS#7 bundle

Use the related:

openssl pkcs7

command.

For a DER bundle:

openssl pkcs7 \
  -inform DER \
  -in server-chain.p7b \
  -print_certs \
  -noout

You should see the subject and issuer for every certificate.

For example:

subject=CN=app.example.internal
issuer=CN=Example Issuing CA
subject=CN=Example Issuing CA
issuer=CN=Example Root CA
subject=CN=Example Root CA
issuer=CN=Example Root CA

This is one of the most important checks after creating the bundle.

Do not simply assume all certificates were added correctly.

Step 6: Display complete certificate details from the P7B

Use:

openssl pkcs7 \
  -inform DER \
  -in server-chain.p7b \
  -print_certs \
  -text \
  -noout

This can display:

• subjects;
• issuers;
• validity dates;
• public keys;
• X.509 extensions;
• signature algorithms.

For a large bundle, the output may be extensive.

For a quick inventory, prefer:

openssl pkcs7 \
  -inform DER \
  -in server-chain.p7b \
  -print_certs \
  -noout

Step 7: Extract the certificates back to PEM

A useful validation test is to extract the certificates:

openssl pkcs7 \
  -inform DER \
  -in server-chain.p7b \
  -print_certs \
  -out extracted-chain.pem

Inspect:

grep -- 'BEGIN CERTIFICATE' extracted-chain.pem

If the bundle contains three certificates, you should see three:

-----BEGIN CERTIFICATE-----

entries.

Count them:

grep -c \
  'BEGIN CERTIFICATE' \
  extracted-chain.pem

Expected:

3

This gives you confidence that the PKCS#7 bundle contains the intended number of certificates.

Step 8: Use one certificate file containing multiple certificates

The:

-certfile

option accepts a PEM file containing one or more certificates. OpenSSL adds all certificates found in that file to the PKCS#7 structure.

Suppose:

chain.pem

contains:

-----BEGIN CERTIFICATE-----
server certificate
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
intermediate certificate
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
root certificate
-----END CERTIFICATE-----

Then run:

openssl crl2pkcs7 \
  -nocrl \
  -certfile chain.pem \
  -outform DER \
  -out server-chain.p7b

This can be easier than supplying three separate:

-certfile

options.

Step 9: Build the PEM chain file

If your certificates are already separate:

cat \
  server.crt \
  intermediate-ca.crt \
  root-ca.crt \
  > chain.pem

Confirm:

grep -c \
  'BEGIN CERTIFICATE' \
  chain.pem

Expected:

3

Then package:

openssl crl2pkcs7 \
  -nocrl \
  -certfile chain.pem \
  -outform DER \
  -out server-chain.p7b

Again, remember:

concatenating certificates creates a PEM certificate bundle; crl2pkcs7 creates an actual PKCS#7 structure.

They are not the same format.

Step 10: Include a CRL

The command can also include a Certificate Revocation List.

Assume you have:

issuing-ca.crl

Inspect it first:

openssl crl \
  -in issuing-ca.crl \
  -noout \
  -issuer \
  -lastupdate \
  -nextupdate

Then create:

openssl crl2pkcs7 \
  -in issuing-ca.crl \
  -certfile server.crt \
  -certfile intermediate-ca.crt \
  -certfile root-ca.crt \
  -outform DER \
  -out server-chain-with-crl.p7b

Without:

-nocrl

OpenSSL reads the CRL supplied through:

-in

and includes it in the output PKCS#7 structure.

Step 11: Why would you include a CRL?

A CRL contains information about certificates revoked by a certificate authority.

Bundling a CRL with certificates may be useful when:

• an application expects certificate and revocation data together;
• transferring PKI material into an isolated environment;
• working with a legacy enrollment process;
• supplying certificate-chain information to software that consumes PKCS#7 structures.

However, including a CRL does not automatically cause every application importing the P7B to perform revocation checking.

The consuming software determines how it uses the included CRL.

For practical revocation verification, see OpenSSL verify.

Step 12: View the CRL before adding it

Use:

openssl crl \
  -in issuing-ca.crl \
  -noout \
  -text

Look for:

Issuer
Last Update
Next Update
Revoked Certificates
CRL Number

You can also use the MisterPKI SSL Tools CRL decoder to inspect a PEM CRL.

Never package an unknown CRL simply because it was delivered alongside a certificate.

Confirm that its issuer corresponds to the CA whose revocation information you intend to distribute.

Step 13: Convert a DER CRL before using it

The:

-inform

option controls the format of the CRL supplied through:

-in

If the CRL is binary DER:

openssl crl2pkcs7 \
  -inform DER \
  -in issuing-ca.crl \
  -certfile chain.pem \
  -outform DER \
  -out chain-with-crl.p7b

You do not necessarily need to convert the CRL first.

However, if you want a PEM copy for troubleshooting:

openssl crl \
  -inform DER \
  -in issuing-ca.crl \
  -outform PEM \
  -out issuing-ca.pem.crl

Then inspect:

openssl crl \
  -in issuing-ca.pem.crl \
  -noout \
  -issuer \
  -lastupdate \
  -nextupdate

Important: -inform controls the CRL, not the certificates

This is easy to misunderstand.

The:

-inform DER

or:

-inform PEM

setting describes the CRL supplied through:

-in

The certificate files supplied through:

-certfile

must be PEM encoded. OpenSSL’s documentation explicitly defines -certfile as a file containing one or more certificates in PEM format.

So this is not valid merely because you specified:

-inform DER

openssl crl2pkcs7 \
  -nocrl \
  -inform DER \
  -certfile certificate.der

Convert the certificate first:

openssl x509 \
  -inform DER \
  -in certificate.der \
  -outform PEM \
  -out certificate.pem

Then:

openssl crl2pkcs7 \
  -nocrl \
  -certfile certificate.pem \
  -outform DER \
  -out certificate.p7b

Step 14: Convert PEM certificates to a P7B

This is probably the most common real-world use of crl2pkcs7.

Given:

server.pem
intermediate.pem
root.pem

run:

openssl crl2pkcs7 \
  -nocrl \
  -certfile server.pem \
  -certfile intermediate.pem \
  -certfile root.pem \
  -outform DER \
  -out certificate-chain.p7b

Then verify the contents:

openssl pkcs7 \
  -inform DER \
  -in certificate-chain.p7b \
  -print_certs \
  -noout

This is the practical PEM-to-P7B conversion workflow.

Step 15: Convert a PEM PKCS#7 file to DER

If you already have:

certificate-chain.pem.p7b

in PEM PKCS#7 format, use:

openssl pkcs7 \
  -inform PEM \
  -in certificate-chain.pem.p7b \
  -outform DER \
  -out certificate-chain.p7b

You do not need crl2pkcs7 merely to change an existing PKCS#7 object’s encoding.

Use:

openssl pkcs7

for an existing PKCS#7 structure.

Use:

openssl crl2pkcs7

when constructing a new PKCS#7 structure from certificates and an optional CRL.

Step 16: Convert P7B back to PEM certificates

Given:

certificate-chain.p7b

run:

openssl pkcs7 \
  -inform DER \
  -in certificate-chain.p7b \
  -print_certs \
  -out certificate-chain.pem

The output contains consecutive PEM certificates.

Inspect:

grep \
  -E 'subject=|issuer=' \
  certificate-chain.pem

Or split the certificates into separate files if the destination requires them individually.

Your existing PKCS#7 guide covers this reverse conversion in more detail.

Step 17: Certificate order in the bundle

When creating a certificate chain bundle, a sensible order is:

Leaf certificate
Intermediate CA
Root CA

For example:

openssl crl2pkcs7 \
  -nocrl \
  -certfile server.crt \
  -certfile intermediate-ca.crt \
  -certfile root-ca.crt \
  -outform DER \
  -out chain.p7b

This makes the bundle easier for administrators to inspect and understand.

However, PKCS#7 is fundamentally a collection of certificates rather than a guarantee that consuming applications will treat their physical sequence as authoritative chain-building order.

The certificate:

issuer

and:

subject

relationships are what define the chain cryptographically.

Always verify the chain independently with:

openssl verify

before distribution.

Step 18: Should the root certificate be included?

It depends on the destination.

A complete P7B may contain:

server
intermediate
root

but many TLS deployments only require:

server
intermediate

because the client is expected to already trust the root certificate.

For importing a complete PKI chain into another management system, including the root may be useful.

For configuring a web server, sending the root as part of the TLS server chain is normally unnecessary.

Think about the goal:

Import complete chain?
        ↓
Root may be useful
Configure TLS server chain?
        ↓
Usually leaf + intermediates

Do not automatically add every certificate you have.

Step 19: Create an intermediate-only P7B

Some systems request only CA certificates.

Create:

openssl crl2pkcs7 \
  -nocrl \
  -certfile intermediate-ca.crt \
  -certfile root-ca.crt \
  -outform DER \
  -out ca-chain.p7b

Inspect:

openssl pkcs7 \
  -inform DER \
  -in ca-chain.p7b \
  -print_certs \
  -noout

This is useful when the destination already has the server or client certificate but requires the CA chain separately.

Step 20: Create a certificate-only P7B without the root

For a server plus intermediate:

openssl crl2pkcs7 \
  -nocrl \
  -certfile server.crt \
  -certfile intermediate-ca.crt \
  -outform DER \
  -out server-and-intermediate.p7b

This can be appropriate when the destination already trusts the root CA.

Step 21: Understand what -nocrl actually does

If you run:

openssl crl2pkcs7 \
  -certfile chain.pem \
  -out bundle.p7b

without:

-nocrl

OpenSSL expects a CRL from:

-in

or standard input.

That can lead to confusing behavior when you only intended to package certificates.

For certificate-only bundles, explicitly use:

-nocrl

This makes the administrator’s intent clear:

openssl crl2pkcs7 \
  -nocrl \
  -certfile chain.pem \
  -outform DER \
  -out chain.p7b

Step 22: Verify the P7B does not contain a private key

Extract its contents:

openssl pkcs7 \
  -inform DER \
  -in chain.p7b \
  -print_certs \
  -out extracted.pem

You should find:

-----BEGIN CERTIFICATE-----

but not:

-----BEGIN PRIVATE KEY-----

or:

-----BEGIN RSA PRIVATE KEY-----

or:

-----BEGIN EC PRIVATE KEY-----

The crl2pkcs7 command creates a certificate/CRL PKCS#7 structure and does not take a private-key input.

This is one reason P7B files are commonly used for distributing certificate chains without exposing private keys.

Step 23: Compare PKCS#7 with PKCS#12

If a destination asks for:

.p7b

do not send:

.pfx

without checking what it actually requires.

P7B / PKCS#7

Usually contains:

certificate
intermediate certificates
root certificates
possibly CRLs

No corresponding private key is packaged by crl2pkcs7.

PFX / P12 / PKCS#12

May contain:

private key
certificate
certificate chain

For PKCS#12 examples, see the MisterPKI PKCS12 guide.

This distinction is critical when exporting or transferring TLS credentials.

Step 24: Inspect the ASN.1 structure

A DER P7B is ASN.1.

Run:

openssl asn1parse \
  -inform DER \
  -in server-chain.p7b \
  -i

You should see a PKCS#7/CMS-style structure containing certificates.

For low-level ASN.1 troubleshooting, see OpenSSL asn1parse.

Normally:

openssl pkcs7 -print_certs

is much easier to use for certificate inventory.

Use asn1parse when you need to investigate encoding or structural problems.

Common openssl crl2pkcs7 errors

Unable to load certificates

Test the input:

openssl x509 \
  -in certificate.pem \
  -noout \
  -subject

Possible causes include:

• file is DER rather than PEM;
• file contains a CSR;
• file contains a private key;
• PEM boundaries are damaged;
• file path is incorrect.

Remember that:

-certfile

expects PEM certificates.

Unable to load CRL

Check:

openssl crl \
  -in ca.crl \
  -noout \
  -issuer

If the CRL is DER:

openssl crl \
  -inform DER \
  -in ca.crl \
  -noout \
  -issuer

Then specify:

-inform DER

to crl2pkcs7.

OpenSSL waits for input

If you intended to create a certificate-only bundle but forgot:

-nocrl

OpenSSL may expect a CRL from standard input.

Cancel and rerun:

openssl crl2pkcs7 \
  -nocrl \
  -certfile chain.pem \
  -outform DER \
  -out chain.p7b

The P7B contains fewer certificates than expected

Inspect the source file:

grep -c \
  'BEGIN CERTIFICATE' \
  chain.pem

Then inspect the P7B:

openssl pkcs7 \
  -inform DER \
  -in chain.p7b \
  -print_certs \
  -noout

Make sure every desired certificate was included using either:

-certfile

multiple times or a multi-certificate PEM file.

Unable to parse the P7B

You may have the wrong encoding.

Try PEM:

openssl pkcs7 \
  -inform PEM \
  -in chain.p7b \
  -print_certs \
  -noout

Then DER:

openssl pkcs7 \
  -inform DER \
  -in chain.p7b \
  -print_certs \
  -noout

Do not rely solely on:

.p7b

to determine encoding.

Windows says the P7B is invalid

Create an explicit binary DER file:

openssl crl2pkcs7 \
  -nocrl \
  -certfile chain.pem \
  -outform DER \
  -out chain.p7b

Then verify locally:

openssl pkcs7 \
  -inform DER \
  -in chain.p7b \
  -print_certs \
  -noout

If OpenSSL can parse it correctly, investigate whether the destination expects:

• DER P7B;
• PEM PKCS#7;
• only CA certificates;
• leaf plus intermediates;
• another certificate format entirely.

The certificate chain is still invalid after import

PKCS#7 packaging does not repair an invalid certificate chain.

Verify the original chain:

openssl verify \
  -CAfile root-ca.crt \
  -untrusted intermediate-ca.crt \
  server.crt

Expected:

server.crt: OK

If that fails, troubleshoot the actual chain rather than recreating the P7B.

Important crl2pkcs7 options

The full syntax is available in the official OpenSSL 3.5 crl2pkcs7 documentation.

Frequently asked questions

What does openssl crl2pkcs7 do?

It creates a PKCS#7 SignedData structure containing one or more certificates and optionally a CRL. The structure contains no signers.

Do I need a CRL to use crl2pkcs7?

No.

Use:

openssl crl2pkcs7 \
  -nocrl \
  ...

to create a certificate-only PKCS#7 bundle.

How do I convert PEM certificates to P7B?

Run:

openssl crl2pkcs7 \
  -nocrl \
  -certfile chain.pem \
  -outform DER \
  -out chain.p7b

How do I put several certificates into one P7B?

Use multiple -certfile options:

openssl crl2pkcs7 \
  -nocrl \
  -certfile server.crt \
  -certfile intermediate.crt \
  -certfile root.crt \
  -outform DER \
  -out chain.p7b

Or place all certificates into one PEM file and specify that file once.

How do I view certificates inside a P7B?

Use:

openssl pkcs7 \
  -inform DER \
  -in chain.p7b \
  -print_certs \
  -noout

How do I convert P7B to PEM?

Run:

openssl pkcs7 \
  -inform DER \
  -in chain.p7b \
  -print_certs \
  -out chain.pem

Does a P7B contain a private key?

The certificate-only PKCS#7 structure created with openssl crl2pkcs7 does not contain a private key. The command accepts certificates and an optional CRL, not a private key.

What is the difference between P7B and PFX?

P7B/PKCS#7 generally carries certificates and possibly CRLs.

PFX/PKCS#12 can carry certificates plus a corresponding private key.

Should I use PEM or DER output?

Use the format required by the destination.

For text-oriented processing:

PEM

may be easier.

For .p7b imports into many enterprise applications:

DER

is commonly appropriate.

Always confirm the destination’s requirements.

Does the certificate order matter?

Keeping the logical order:

leaf
intermediate
root

makes the bundle easier to inspect, but chain validation ultimately depends on certificate issuer/subject relationships and trust rather than filename order.

Can I include a CRL?

Yes.

Omit:

-nocrl

and supply the CRL with:

-in

For example:

openssl crl2pkcs7 \
  -in ca.crl \
  -certfile chain.pem \
  -outform DER \
  -out chain-with-crl.p7b

Does openssl crl2pkcs7 work with OpenSSL 4.0?

Yes.

The core command remains available with the same certificate and CRL packaging workflow. OpenSSL 3.5 and 4.0 additionally document the provider parameter option -provparam.

Practical P7B conversion workflow

Start with:

server.crt
intermediate-ca.crt
root-ca.crt

Verify the certificates

openssl verify \
  -CAfile root-ca.crt \
  -untrusted intermediate-ca.crt \
  server.crt

Expected:

server.crt: OK

Create the P7B

openssl crl2pkcs7 \
  -nocrl \
  -certfile server.crt \
  -certfile intermediate-ca.crt \
  -certfile root-ca.crt \
  -outform DER \
  -out server-chain.p7b

Inspect the P7B

openssl pkcs7 \
  -inform DER \
  -in server-chain.p7b \
  -print_certs \
  -noout

Extract it back to PEM for validation

openssl pkcs7 \
  -inform DER \
  -in server-chain.p7b \
  -print_certs \
  -out extracted-chain.pem

Count the certificates

grep -c \
  'BEGIN CERTIFICATE' \
  extracted-chain.pem

Expected:

3

You now have a DER-encoded:

server-chain.p7b

containing the server certificate and its CA chain without including a private key.

Security and privacy considerations

PKCS#7 certificate bundles generally contain public certificate material rather than private keys.

That does not mean the content is always harmless to publish.

Certificates can expose:

• internal DNS names;
• organization names;
• email addresses;
• internal CA names;
• certificate serial numbers;
• private OIDs;
• internal PKI hierarchy information.

Before sharing:

openssl pkcs7 \
  -print_certs \
  -text

output in:

• support tickets;
• GitHub;
• forums;
• documentation;
• screenshots;

review the content and replace internal values when appropriate.

Never accidentally package or publish unrelated private-key material from the same working directory.

Related OpenSSL guides

• Browse the complete OpenSSL Commands Guide.
• Learn how to inspect and extract PKCS#7 certificate bundles.
• Understand certificate chains before packaging them.
• Validate a chain with OpenSSL verify.
• Inspect low-level encoding with OpenSSL asn1parse.
• Compare P7B with PKCS#12/PFX certificate stores.
• Decode PKCS#7 bundles and CRLs with the MisterPKI SSL Tools.

External references

• OpenSSL 3.5 crl2pkcs7 documentation
• OpenSSL 3.0 crl2pkcs7 documentation
• OpenSSL 4.0 crl2pkcs7 documentation
• OpenSSL pkcs7 documentation
• OpenSSL crl documentation
• OpenSSL x509 documentation
• OpenSSL verify documentation

Conclusion

The openssl crl2pkcs7 command has a misleadingly specialized name.

You do not need a CRL to use it.

For system administrators, its most useful role is often:

PEM certificate files
        ↓
openssl crl2pkcs7
        ↓
PKCS#7 / P7B certificate bundle

The command worth remembering is:

openssl crl2pkcs7 \
  -nocrl \
  -certfile chain.pem \
  -outform DER \
  -out chain.p7b

Then always inspect the result:

openssl pkcs7 \
  -inform DER \
  -in chain.p7b \
  -print_certs \
  -noout

For a complete server chain, the practical workflow is:

Verify leaf + intermediate + root
            ↓
Create PKCS#7 bundle
            ↓
Inspect bundle
            ↓
Extract and confirm certificates
            ↓
Deliver P7B to destination system

If a CRL is required, omit -nocrl and provide the CRL through -in.

Most importantly, remember that PKCS#7 packaging does not validate or repair a certificate chain. Verify the certificates first, then package the known-good chain into the format required by the destination system.