X509certifikat

X.509 certificate, often referred to in some contexts as X509certifikat, is a digital certificate that uses the X.509 standard to bind a public key to the identity of an entity within a public key infrastructure (PKI). It is widely used to enable secure communications and authenticated identities in protocols such as TLS/SSL, S/MIME, and code signing.

The certificate’s data is encoded in a structure called TBSCertificate and is signed by the issuer’s private key. Modern certificates are X.509v3, which support a range of extensions. They are typically encoded in DER and may be transported in PEM format, marked by the header or footer "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----".

Key fields include version, serialNumber, signatureAlgorithm, issuer (the cert authority), validity period (Not Before and Not After), subject (the entity the cert represents), and subjectPublicKeyInfo (the algorithm and public key). Extensions add information such as subjectAltName (additional identities), keyUsage, extendedKeyUsage, basicConstraints (e.g., whether it can act as a CA), AuthorityKeyIdentifier, and SubjectKeyIdentifier. The certificate is signed by the issuer; verification uses the issuer’s public key.

Usage covers TLS/SSL for securing web traffic, VPNs, and client authentication, as well as S/MIME and code signing. Certificates create a chain of trust from a root CA through intermediates to end-entity certificates. Self-signed certificates establish identity without a CA but require explicit trust from the user or system.

Validation and revocation: during use, the certificate’s signature, validity period, and issuer are checked, and the subject identity may be verified against the hostname or other identifiers. Revocation status can be checked via CRLs or OCSP; many contexts also rely on a trusted root CA store to determine trust.