CertificateID

CertificateID is a general term used to refer to an identifier that uniquely references a digital certificate within a system, protocol, or repository. Its exact meaning depends on the context, but it typically serves to locate or manage a certificate without needing to handle the certificate data itself.

In many PKI environments, a certificate identifier is formed from the certificate’s issuer name and serial number, which together uniquely identify the certificate within the issuing authority’s scope. In other contexts, systems may adopt a certificate fingerprint—usually a cryptographic hash of the DER-encoded certificate—as a compact, globally unique identifier.

A well-known example of a certificate identifier is the CertificateID used in the Online Certificate Status Protocol (OCSP). In OCSP, the CertificateID is a data structure that includes the hash algorithm, the issuer’s name hash, the issuer’s key hash, and the certificate’s serial number. This allows a verifier to reference the target certificate when querying revocation status without transmitting the certificate itself.

Applications such as certificate repositories, directory services, and network gateways may define their own certificateID fields or tokens. The choice of representation affects interoperability, revocation checking, auditing, and search performance.

Key considerations include uniqueness within the relevant scope, stability across the certificate’s lifetime, and privacy and security implications of exposing certain identifiers. See also X.509, PKI, OCSP, CRL, certificate fingerprint, and serialNumber.