DataTerminology.comNEW
Also known as: Digital Certificates, Public Key Certificate
A digitally signed electronic document that binds a public key to an identified subject within a PKI.
DESCRIPTION
Digital certificates are core PKI artifacts used to establish trust in secure communications and code signing. Most Internet certificates follow the X.509 standard and include subject identity, public key, validity period, extensions, and a CA signature. Trust is established through a certificate chain anchored by a root certificate in a relying party’s trust store. Validation checks include signature verification, hostname matching, key usage constraints, and revocation status via CRLs or OCSP. Certificates enable TLS, S/MIME, document signing, and device authentication.
ALTERNATIVE DEFINITIONS
Wikipedia
A public key certificate, also known as a digital certificate or identity certificate, is an electronic document used to prove the ownership of a public key.
Emphasizes ownership proof of a public key with broad applicability.
IETF (RFC 4949 Internet Security Glossary, Version 2)
public-key certificate (PKC): A set of data that binds a public key value to a subject; the set, digitally signed by a CA, contains the subject name, the public key value, and possibly other information.
Formal glossary definition highlighting binding and CA signature.
NIST Computer Security Resource Center
A set of data that identifies a public key with a name (commonly of a person, an organization, or a device) and which is digitally signed by a certification authority.
Frames the certificate as identity-public key binding and stresses CA signature.
RELATED TERMS
Public Key Infrastructure Certificate Authority Online Certificate Status Protocol Certificate Revocation List Root Certificate Intermediate Certificate Certificate Chain TLS Private Key Subject Alternative Name
COMPETING TERMS
PGP Web of Trust Raw Public Key
RELATIONS
- Narrower: X.509 Certificate
KNOWLEDGE AREAS
Data Security Data Privacy & Compliance Infrastructure
TARGET AUDIENCE
Security Architect Cybersecurity Engineer Chief Information Security Officer Cloud Architect DevOps Engineer Software Developer
EXTERNAL SOURCES
- Wikipedia - Public key certificate
- IETF - X.509 certificate and CRL profile
- NIST - Digital identity guidelines referencing certificates
- Mozilla - Mozilla CA root program policies
- OpenSSL - x509 certificate tool usage documentation
TOP QUESTIONS
What is a Certificate in PKI and why does it matter?
A certificate binds an identity to a public key using a CA’s signature, enabling trust in TLS, code signing, and device authentication. It underpins secure communication on the internet.
Category: Overview
How is a Certificate validated during a TLS handshake?
Clients verify the CA signature, ensure hostname/SAN matches, check validity period and key usage, and confirm revocation status via OCSP or CRLs before establishing trust.
Category: Process
What are common mistakes when managing Certificates?
Letting certificates expire, using weak keys, misconfigured SANs, ignoring revocation, and failing to rotate or automate lifecycle management are frequent and costly errors.
Category: Mistakes
How do Certificate chains and trust anchors work?
A leaf certificate chains to intermediates and ultimately to a trusted root in the client’s store. Each link is verified via CA signatures to establish a trust path.
Category: Concepts
What is the risk of self-signed Certificates in production?
Self-signed certificates lack third-party validation, making man-in-the-middle attacks easier. They are acceptable for internal testing but risky for public services.
Category: Risks
How often should Certificates be rotated?
Industry practice favors shorter lifetimes (e.g., 90 days) for reduced risk and better agility. Automation via ACME and inventories helps ensure timely rotation.
Category: Best practices
What is the difference between a Certificate and a key pair?
A key pair consists of private and public keys. A certificate packages the public key with identity and CA signature for verification by relying parties.
Category: Misunderstanding
How do OCSP and CRLs relate to Certificates?
They provide revocation status for issued certificates. OCSP offers real-time checks; CRLs publish signed lists of revoked certificate serial numbers.
Category: Related
What standards define Certificates?
IETF RFC 5280 profiles X.509 certificates and CRLs. Platform trust stores and CA program policies (e.g., Mozilla) specify additional operational requirements.
Category: Standards