An OVF package may be signed by signing its manifest. The digest of the manifest
is stored, signed, in a certificate file with the extension .cert, with the base64-encoded X.509
certificate. The file has the same base name as the .ovf and is a sibling of it, and, like the manifest, is
not listed in References. The grammar is DSP0243 2.1.1 clause 5.1 (read in full).
Grammar
certificate_file = manifest_digest certificate_part
manifest_digest = algorithm "(" file_name ")" "=" sp signed_digest nl
algorithm = "SHA1" | "SHA256"
signed_digest = *( hex-digit )
certificate_part = certificate_header certificate_body certificate_footer
certificate_header = "-----BEGIN CERTIFICATE-----" nl
certificate_footer = "-----END CERTIFICATE-----" nl
certificate_body = base64-encoded-certificate nl ; may be split across linesThe first line names the algorithm and the manifest file, and gives the manifest's digest signed with the private key of the certificate (the specification's example signs a SHA1 digest with a 512-bit key, so the signed value has 512 bits, 128 hexadecimal digits). The rest is a PEM block holding the base64 of the DER X.509 certificate.
Rules: the certificate file has the extension and sibling name above; a consumer shall verify the signature and should validate the certificate (the media type template quotes this); the manifest and certificate shall not be in References. The extensions .mf and .cert may be used for other files of a package if they are not at the sibling names.
In the viewer
The viewer splits the file into the signed digest and the certificate block, checks the form (an algorithm of the grammar, a signed digest of whole hexadecimal bytes, the BEGIN and END lines, base64 characters and length, and a DER SEQUENCE byte at the start) and offers the certificate block as a PEM file. It does not verify the signature and does not decode the certificate: those are in the not described list of the OVF page.