X.509

lastmod 2024-05-21created 2014-04-168 edits

X.509 is an ITU-T standard for public key infrastructure (PKI), among the standards for public key certificates and authentication algorithms in cryptography.

Categories

• OpenSSL:X509

Certificates

In the X.509 system, a CA issues certificates with distinct public keys according to the X.500 convention.

An organization's trusted root certificate can be distributed to all employees who use that PKI system. Browsers such as Internet Explorer, Mozilla, and Opera have pre-installed root certificates called SSL certificates. Users can remove or disable these root certificates, but they rarely do.

X.509 also includes a standard for implementing a CRL (certificate revocation list). The certificate validity checking method approved by the IETF is OCSP (Online Certificate Status Protocol).

Certificate structure

The structure of an X.509 v3 digital certificate is as follows.

• Certificate
  • Version Indicates the certificate version
  • Serial Number A unique integer number assigned by the CA
  • Algorithm ID
  • Issuer
  • Validity
    • Not Before
    • Not After
  • Subject
  • Subject Public Key Info
    • Public Key Algorithm
    • Subject Public Key
  • Issuer Unique Identifier (Optional)
  • Subject Unique Identifier (Optional)
  • Extensions (Optional)
    • ...*Certificate Signature Algorithm
• Certificate Signature

Certificate file extensions

The file extensions of X.509 certificates are as follows:

• .CER: CER-encrypted certificate. Multiple certificates are also possible.
• .DER: DER-encrypted certificate.
• .PEM: (Privacy Enhanced Mail) Base64-encrypted certificate. Placed between "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----".
• .P7B: See .p7c.
• .P7C: PKCS#7 signed data structure (without the data), a certificate or CRL (multiple also possible).
• .PFX: See .p12.
• .P12: PKCS#12, can hold a public certificate and a password-protected private key (multiple also possible).

How to register a trusted root certificate

See OpenSSL:X509#How to register a trusted root certificate.

Favorite site

• Wikipedia (en) Description of X.509
• Fully understanding k8s authentication #1 - X.509 Client Certs | Coffeewhale's notes ¹

References