X509Certificate

An X.509 certificate is a digital certificate that binds a public key to an entity’s identity according to the X.509 standard. Issued by a certificate authority or self-signed, it enables authentication, confidentiality, and data integrity in many network protocols and applications, notably TLS/SSL. In software libraries, the term x509Certificate is commonly used to denote an X.509 certificate object.

A certificate contains version, serial number, the issuer’s algorithm and signature, issuer and subject identities, a validity period (notBefore, notAfter), and the subject’s public key information. Most modern certificates are version 3, which allows various extensions.

Common extensions include subjectAltName, keyUsage, extendedKeyUsage, BasicConstraints (CA flag), AuthorityKeyIdentifier, SubjectKeyIdentifier, and CRLDistributionPoints. Extensions convey constraints and attributes needed for policy and path building.

X.509 certificates are encoded in DER and commonly stored or transmitted in PEM format (base64 with header/footer). They can be self-signed or issued by a trusted CA and are arranged in chains from an end-entity certificate to a root CA in a trust store.

Validation requires verifying the issuer’s signature with the issuer’s public key, checking validity dates, and building a trusted path. Revocation mechanisms such as CRLs and OCSP help determine if a certificate should no longer be trusted.

X.509 certificates underpin TLS for secure web traffic, as well as code signing, email protection, and other security services. They are defined by ITU-T X.509 and implemented by most software libraries and hardware devices.