📜X.509

NEW

A standard defining the format of public key certificates and related structures used widely in PKI and TLS.

DESCRIPTION

X.509 specifies the structure and encoding of public key certificates, CRLs, and associated extensions. Internet profiles of X.509 are defined by RFC 5280, which standardizes fields, extensions, and validation rules. X.509 certificates are encoded using ASN.1 and typically transported in DER or PEM formats. They are foundational to TLS, S/MIME, and code signing, enabling identity binding and trust chains. Extensions like key usage, extended key usage, and subject alternative name tailor certificates to their intended purposes. Correct profile adherence ensures interoperability across platforms and applications.

ALTERNATIVE DEFINITIONS

Wikipedia

In cryptography, X.509 is a standard defining the format of public key certificates.

Concise, focused on the certificate format aspect.

Source

IETF RFC 5280

This document specifies an Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) profile.

Clarifies the Internet profile of X.509 certificates and CRLs.

Source

RELATED TERMS

Certificate Public Key Infrastructure Certificate Authority Certificate Revocation List Online Certificate Status Protocol ASN.1 DER Encoding PEM Encoding TLS Subject Alternative Name

COMPETING TERMS

PGP Web of Trust

KNOWLEDGE AREAS

Data Security Infrastructure Software Engineering

TARGET AUDIENCE

Security Architect Cybersecurity Engineer Cloud Architect Software Developer DevOps Engineer Application Administrator

EXTERNAL SOURCES

• Wikipedia - X.509
• ITU-T - Official X.509 recommendation page
• IETF RFC 5280 - Internet profile for X.509 certificates

TOP QUESTIONS

Which encodings does X.509 use for certificates?

X.509 uses ASN.1 structures encoded in DER, commonly represented as PEM for portability. Tools like OpenSSL convert between these formats.

Category: Encoding

How does X.509 relate to TLS?

TLS uses X.509 end-entity and intermediate certificates to authenticate servers (and sometimes clients) and to establish trust chains to known root authorities.

Category: Relation

What are common X.509 extensions?

Key Usage, Extended Key Usage, Subject Alternative Name, Basic Constraints, and CRL Distribution Points are frequently used to scope certificate purpose and validation.

Category: Content

What is the role of RFC 5280 for X.509?

RFC 5280 profiles X.509 for Internet use, defining certificate fields, extensions, and path validation requirements for interoperability.

Category: Standards

What mistakes occur when creating X.509 certificates?

Omitting Subject Alternative Name for HTTPS, misconfiguring key usage, or using weak algorithms causes validation failures or security issues.

Category: Mistakes

How does X.509 handle revocation?

It defines CRLs and supports OCSP via RFC 5280/6960. Clients check revocation status during path validation.

Category: Operations

Can X.509 be used for code signing?

Yes. Specialized EKUs indicate code signing usage, with platforms enforcing policies for signed executables and packages.

Category: Usage

Is X.509 compatible with post-quantum cryptography?

X.509 can carry post-quantum keys and signatures once standardized OIDs and profiles are defined and supported by ecosystems.

Category: Future

What is the difference between X.509 and PGP Web of Trust?

X.509 relies on hierarchical CAs and trust stores, while PGP uses decentralized trust endorsements between users.

Category: Comparison