Media type / application
application/x-x509-ca-cert
An X.509 certificate offered for installation into a trust store.
Served inline: Browsers have no renderer for this, so it downloads even without a Content-Disposition header. That makes it the quiet default for anything you do not want opened in place.
Browser behaviour
Downloads
Charset
no charset
Compression
Already compressed
Send it like this
Content-Type: application/x-x509-ca-certA binary payload has no character encoding. A charset parameter here is meaningless and occasionally confuses strict parsers.
Handling verdict
Browsers have no renderer for this, so it downloads even without a Content-Disposition header. That makes it the quiet default for anything you do not want opened in place.
A binary payload has no character encoding. A charset parameter here is meaningless and occasionally confuses strict parsers.
The format compresses internally. Another transport encoding costs CPU on both ends and typically changes the size by less than a percent — sometimes upward.
An `x-` prefix marks a type that was never registered. RFC 6838 discourages new ones, but several — like application/x-www-form-urlencoded — are now too widespread to change.
Anatomy of the name
RFC 6838Top-level type
application
Application
Subtype
x-x509-ca-cert
Registered in the unregistered tree.
Structured syntax
none
No suffix, so the payload format is defined entirely by the subtype itself.
Parameters
none
Beyond the charset rule above, this type defines no parameters of its own.
Response headers
Content-Type: application/x-x509-ca-cert
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="example.crt"nosniff stops the browser second-guessing the type you declared, which is what makes the rest of this reliable. Content-Disposition: attachment names the saved file and removes any doubt about rendering.
Server configuration
extension mappingnginx
types {
application/x-x509-ca-cert crt der cer;
}Apache
AddType application/x-x509-ca-cert .crt .der .cerCaddy
@type path *.crt *.der *.cer
header @type Content-Type "application/x-x509-ca-cert"Extensions and other spellings
declaredFile extensions
File signature
No fixed signature — this format has no reliable magic number, so identify it by parsing rather than by the first few bytes.