DataTerminology.comNEW
A digital certificate binding a public key to an identity using the X.509 standard.
DESCRIPTION
X.509 certificates define a standard format for public key certificates used in TLS, S/MIME, and other protocols. They bind a subject’s identity to a public key through a signature by a trusted issuer. Certificates include metadata like validity periods, key usage, and extensions. Revocation is managed via CRLs or OCSP. X.509 is profiled for internet use by IETF RFCs and widely implemented in OpenSSL and platform trust stores.
ALTERNATIVE DEFINITIONS
IETF RFC 5280
This document specifies a profile for X.509 v3 certificates and X.509 v2 certificate revocation lists (CRLs) for use in the Internet.
Internet-oriented profile and revocation list scope.
Wikipedia
X.509 is a standard defining the format of public key certificates.
Concise statement of the standard’s purpose.
Microsoft
An X.509 certificate is a digital certificate that conforms to the X.509 standard and binds a public key to a subject.
Platform perspective emphasizing subject binding.
Cloudflare
An SSL certificate is a digital certificate that authenticates a website’s identity and enables an encrypted connection.
Explains web identity and encryption within X.509 usage.
RELATED TERMS
Public Key Infrastructure Certificate Authority TLS Digital Signature Certificate Signing Request PEM DER Online Certificate Status Protocol Certificate Revocation List RSA
COMPETING TERMS
RELATIONS
- Broader: Certificate
KNOWLEDGE AREAS
Data Security Data Privacy & Compliance Infrastructure
TARGET AUDIENCE
Security Architect Cybersecurity Engineer DevOps Engineer Cloud Architect Application Administrator Chief Information Security Officer
EXTERNAL SOURCES
- Wikipedia - X.509
- IETF - X.509 Internet certificate profile
- OpenSSL - OpenSSL x509 utility documentation
- Mozilla - CA certificate policy governance
TOP QUESTIONS
Why are X.509 Certificates foundational to TLS?
They bind identities to public keys, enabling trust via certificate authorities. Browsers verify chains to establish encrypted connections.
Category: Relevancy
What is the biggest misunderstanding about X.509 Certificates?
People confuse self-signed certificates with invalid ones. Self-signed are valid cryptographically but not trusted without explicit configuration.
Category: Misunderstanding
How do X.509 Certificates get revoked?
Through CRLs or OCSP responses published by the issuer. Clients check revocation status during validation.
Category: Management
What is a competing term to X.509 Certificates?
OpenPGP certificates provide identity and encryption in a web-of-trust model rather than CA hierarchies.
Category: Alternatives
What risks arise from poor X.509 Certificate management?
Expired or compromised certificates cause outages or man-in-the-middle vulnerabilities. Weak validation risks impersonation.
Category: Risks
How should organizations manage X.509 Certificates at scale?
Use automation (ACME), inventory systems, short lifetimes, monitoring, and standardized issuance policies.
Category: Requirements
What extensions are common in X.509 Certificates?
Subject Alternative Name, Key Usage, Extended Key Usage, and Basic Constraints guide validation and permitted operations.
Category: Example
Who maintains the X.509 Internet profile?
The IETF defines X.509 profiles like RFC 5280 for Internet use, complementing the ITU-T standard.
Category: Opinion
How does OCSP differ from CRLs in X.509 validation?
OCSP provides real-time status for a certificate; CRLs list many revoked certs periodically.
Category: Distinction