certs

Certs, short for certificates, are digital credentials used to verify identity and establish encrypted communications in computer networks. They bind a public key to a subject and are part of a public key infrastructure (PKI). A certificate typically includes the subject name, the issuer, the public key, a validity period, a serial number, and extensions such as the subject alternative name and usage constraints. It is digitally signed by a trusted issuer, creating a chain of trust up to a root certificate.

Types include TLS/SSL certificates for websites, code signing certificates, client certificates for mutual TLS, and email S/MIME or device/IoT certificates. Certificates can be issued as standard certificates or self-signed for internal or testing use.

Issuance and trust: Certificates are issued by Certificate Authorities (CAs). Validation levels range from domain validation (DV) to organization validation (OV) and extended validation (EV). The trust chain can be revoked via Certificate Revocation Lists (CRLs) or Online Certificate Status Protocol (OCSP). Certificates have finite lifetimes, commonly one to two years; many issuers automate renewal. ACME protocol enables automated provisioning (e.g., Let’s Encrypt).

Usage: In web traffic, TLS certificates enable HTTPS by encrypting traffic and authenticating the server. Client certificates enable mutual TLS. Code signing certificates verify software origins. S/MIME certs enable email encryption and signing.

Management considerations: Protect private keys, often in hardware security modules or secure keystores; monitor expiry and revocation; consider certificate transparency logs and pinning where appropriate.

Standards and formats: X.509 is the prevailing certificate standard; data encodings include PEM and DER; PKCS#12 stores combine cert and private key; TLS and PKI frameworks define issuance and validation processes.

Common providers include major certificate authorities and services like Let’s Encrypt.