Public Key Infrastructure · 4.2
📄 Digital Certificates & X.509
The digital equivalent of a government-issued ID⏱ ~2 min
A digital certificate is a signed data structure that binds a public key to an identity. The X.509 standard (defined by the ITU-T and used universally in TLS, email, and code signing) specifies what a certificate contains.
What's Inside an X.509 Certificate
| Field | What It Contains | Example |
|---|---|---|
| Subject | Who this certificate identifies | CN=example.com, O=Example Inc, C=US |
| Public Key | The entity's public key | RSA 2048-bit or ECC P-256 public key |
| Issuer | Which CA signed this certificate | CN=DigiCert TLS RSA SHA256 2020 CA1 |
| Validity Period | Not Before / Not After dates | 2024-01-01 to 2025-01-01 |
| Subject Alternative Names | All domains this cert is valid for | DNS:example.com, DNS:www.example.com |
| Key Usage | What operations the key is allowed for | Digital Signature, Key Encipherment |
| CA Signature | The CA's digital signature over all the above | SHA-256 with RSA/ECDSA |
Certificate Types
| Type | Validation Level | What's Verified | Use |
|---|---|---|---|
| DV (Domain Validated) | Low | Applicant controls the domain (automated) | General websites — cheapest, instant |
| OV (Organization Validated) | Medium | Domain + legal existence of organization | Business sites — shows company name |
| EV (Extended Validation) | High | Domain + legal entity + physical location | Financial, healthcare — green bar (legacy) |
| Wildcard | Varies | All subdomains (*.example.com) | Multi-subdomain deployments |
| Code Signing | Medium/High | Identity of software publisher | Signing executables, installers |
Certificate Formats
bash
# View a certificate's contentsopenssl x509 -in certificate.pem -text -noout # Download and inspect a website's certificateopenssl s_client -connect google.com:443 -showcerts # Check certificate expiryecho | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates # Common certificate file formats:# .pem — base64 encoded, -----BEGIN CERTIFICATE----- header# .der — binary encoding of the same structure# .pfx/.p12 — PKCS#12: certificate + private key bundled (password-protected)# .crt/.cer — usually PEM format, different file extension💡 TipClick the padlock icon in your browser's address bar to inspect a website's certificate. You'll see the issuer, subject, validity dates, and the full certificate chain. This is also where you'd detect a certificate that looks wrong or is issued by an unexpected CA.
🧠Quick Checkfirst try = +5 XP
What binds a public key to a domain name?
🎮 Practice what you learned
⭐ 0 XP🔥 0 days