I'm using the Windows certreq command line tool to submit a CSR for signing to a Windows Server CA.

certreq.exe -attrib "CertificateTemplate:WebServer" -submit webapp.csr webapp.cer webapp.p7b

It's working as expected I'm getting the Base64-encoded certificate webapp.cer and the certificate with the certificate chain webapp.p7b. But the Microsoft documentation specifies that an extra parameter can be used named FullResponseFileOut which generates a Base64-encoded certificate file.

What is the purpose of this "Full Response File Out" and is there any way to display/decode it's content with OpenSSL or any tool?


The Full Response has additional information over and above the P7B file with information such as the CMC response and some chaining information. I'd go as far as to say it's not really relevant in day-to-day use.

You can look at them all with certutil.exe and make your own mind up though - simply pipe the outputs to a text file and read at your leisure. If the extra parameter to your command above is webapp.ful the following will allow you to read all of the files with a text editor:

certutil webapp.cer > cer.txt
certutil webapp.p7b > p7b.txt
certutil webapp.ful > ful.txt

Not the answer you're looking for? Browse other questions tagged or ask your own question.