diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
index 2a4d58eab..4659f8f6a 100644
--- a/src/libcharon/plugins/vici/vici_config.c
+++ b/src/libcharon/plugins/vici/vici_config.c
@@ -1469,7 +1469,7 @@ static bool parse_cert(auth_data_t *auth, auth_rule_t rule, chunk_t v)
 	certificate_t *cert;
 
 	cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
-							  BUILD_BLOB_PEM, v, BUILD_END);
+							  BUILD_BLOB, v, BUILD_END);
 	if (cert)
 	{
 		return add_cert(auth, rule, cert);
@@ -1504,7 +1504,7 @@ CALLBACK(parse_pubkeys, bool,
 	certificate_t *cert;
 
 	cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_TRUSTED_PUBKEY,
-							  BUILD_BLOB_PEM, v, BUILD_END);
+							  BUILD_BLOB, v, BUILD_END);
 	if (cert)
 	{
 		return add_cert(auth, AUTH_RULE_SUBJECT_CERT, cert);
diff --git a/src/libcharon/plugins/vici/vici_cred.c b/src/libcharon/plugins/vici/vici_cred.c
index 6310fdcb8..02a3db7f1 100644
--- a/src/libcharon/plugins/vici/vici_cred.c
+++ b/src/libcharon/plugins/vici/vici_cred.c
@@ -173,7 +173,7 @@ CALLBACK(load_cert, vici_message_t*,
 	ext_flag = (flag & X509_CA) ? X509_NONE : flag;
 
 	cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, type,
-							  BUILD_BLOB_PEM, data,
+							  BUILD_BLOB, data,
 							  BUILD_X509_FLAG, ext_flag,
 							  BUILD_END);
 	if (!cert)
diff --git a/src/libstrongswan/plugins/pubkey/pubkey_cert.c b/src/libstrongswan/plugins/pubkey/pubkey_cert.c
index a7bf87e5b..177785865 100644
--- a/src/libstrongswan/plugins/pubkey/pubkey_cert.c
+++ b/src/libstrongswan/plugins/pubkey/pubkey_cert.c
@@ -17,6 +17,7 @@
 
 #include <time.h>
 
+#include <credentials/certificates/x509.h>
 #include <utils/debug.h>
 
 typedef struct private_pubkey_cert_t private_pubkey_cert_t;
@@ -264,15 +265,20 @@ pubkey_cert_t *pubkey_cert_wrap(certificate_type_t type, va_list args)
 {
 	public_key_t *key = NULL;
 	chunk_t blob = chunk_empty;
+	builder_part_t part, blob_type = BUILD_END;
 	identification_t *subject = NULL;
 	time_t notBefore = UNDEFINED_TIME, notAfter = UNDEFINED_TIME;
 
 	while (TRUE)
 	{
-		switch (va_arg(args, builder_part_t))
+		part = va_arg(args, builder_part_t);
+		switch (part)
 		{
+			case BUILD_BLOB:
+			case BUILD_BLOB_PEM:
 			case BUILD_BLOB_ASN1_DER:
 				blob = va_arg(args, chunk_t);
+				blob_type = part;
 				continue;
 			case BUILD_PUBLIC_KEY:
 				key = va_arg(args, public_key_t*);
@@ -286,6 +292,10 @@ pubkey_cert_t *pubkey_cert_wrap(certificate_type_t type, va_list args)
 			case BUILD_SUBJECT:
 				subject = va_arg(args, identification_t*);
 				continue;
+			case BUILD_X509_FLAG:
+				/* just ignore the flags */
+				va_arg(args, x509_flag_t);
+				continue;
 			case BUILD_END:
 				break;
 			default:
@@ -300,7 +310,7 @@ pubkey_cert_t *pubkey_cert_wrap(certificate_type_t type, va_list args)
 	else if (blob.ptr)
 	{
 		key = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
-								 BUILD_BLOB_ASN1_DER, blob, BUILD_END);
+								 blob_type, blob, BUILD_END);
 	}
 	if (key)
 	{
@@ -308,4 +318,3 @@ pubkey_cert_t *pubkey_cert_wrap(certificate_type_t type, va_list args)
 	}
 	return NULL;
 }
-