Software And Architecture

May be this post is kind of well known to many. I have encountered this couple of days back, while working with a custom authorization server. Hence posted here. There are two types of digital certificate, 1. .pfx, an archive kind of certificate which contains a public key, private key and other public keys like the CA(certifying authority) public keys. 2. .cer, which contains only the public keys. Pfx certificates are meant to be only on the server, whereas the car or cert files are meant to be shared with the client's that will talk to the server. In authorization server, the server uses pfx files and the clients use the .cer or the .cert files.