Certificates and PKI

Every time you see that padlock icon in your browser's address bar, you're witnessing the culmination of decades of cryptographic engineering. Behind that simple symbol lies a sophisticated system of digital certificates—electronic documents that prove identity, enable encryption, and form the foundation of trust on the internet.

At the heart of this system is the X.509 certificate, an international standard (ITU-T X.509) that defines the format for public key certificates. Originally developed in 1988 as part of the X.500 directory services standard, X.509 has evolved to become the universal credential for internet security. Every HTTPS connection, every digitally signed email, every VPN tunnel, and every secure API call relies on X.509 certificates.

Understanding X.509 certificates isn't merely academic—it's essential knowledge for any engineer working with secure systems. Misconfigurations in certificate handling are among the most common causes of security vulnerabilities and service outages. A single expired certificate can take down critical infrastructure; a compromised certificate can enable devastating man-in-the-middle attacks.

To appreciate why X.509 certificates exist, we must first understand the fundamental problem they solve: how do you verify identity in an anonymous, hostile network?

The Public Key Paradox:

Public key cryptography elegantly solves the key distribution problem—you can publish your public key openly, and anyone can use it to send you encrypted messages that only your private key can decrypt. But this introduces a new challenge: how does a sender know that a public key actually belongs to the intended recipient?

Consider this scenario:

1. Alice wants to send a confidential message to Bob
2. Alice needs Bob's public key to encrypt the message
3. Alice downloads a key claiming to be "Bob's Public Key"
4. But how does Alice verify this is actually Bob's key?

Without verification, an attacker (Mallory) could intercept Alice's request and substitute her own key. Alice would unknowingly encrypt her message with Mallory's key. Mallory decrypts it, reads the confidential content, then re-encrypts it with Bob's actual key and forwards it. Neither Alice nor Bob would ever know the message was intercepted.

The Certificate Solution:

A digital certificate is essentially a cryptographically signed attestation that a particular public key belongs to a particular entity. The certificate contains:

1. The subject's identity (e.g., "www.example.com" or "Alice Smith")
2. The subject's public key
3. Metadata (validity period, permitted usages, etc.)
4. A digital signature from a trusted third party

The signature is the crucial element. It comes from a Certificate Authority (CA)—an entity that the relying party already trusts. By verifying the CA's signature on the certificate, Alice can confirm that the CA vouches for the binding between Bob's identity and Bob's public key.

This transforms the problem from "How do I trust this random public key?" to "Do I trust the entity that signed this certificate?" And if that entity is well-known and reputable (like DigiCert, Let's Encrypt, or GlobalSign), the answer is yes.

Understanding the history of X.509 helps explain some of its design choices and the existence of multiple versions.

The Genesis (1988):

X.509 was developed by the International Telecommunication Union (ITU-T) as part of the X.500 directory services standard. The original vision was ambitious: create a global directory service (like a worldwide phone book for the digital age) with built-in authentication. X.509 certificates were the authentication mechanism.

The first version (X.509v1) was simple: subject name, public key, validity dates, and a CA signature. It assumed a hierarchical, centralized world of tightly controlled directories—a vision that never materialized.

The Internet Adoption (1990s):

When the web emerged and e-commerce required secure transactions, the internet community adapted X.509 for its needs. The IETF's PKIX working group (Public Key Infrastructure using X.509) extended and profiled the standard for internet use (RFC 5280).

X.509v2 (1993) added issuer and subject unique identifiers—rarely used in practice. X.509v3 (1996) introduced the extension mechanism that proved transformative, allowing the certificate format to evolve without breaking backward compatibility.

An X.509v3 certificate contains three main sections, each with specific fields. Understanding every field is essential for proper certificate handling and debugging.

The Three Primary Sections:

1. TBSCertificate ("To Be Signed") — All certificate data that the CA signs
2. Signature Algorithm — The algorithm used to create the signature
3. Signature Value — The actual digital signature from the CA

The TBSCertificate contains all the meaningful content. The signature algorithm appears twice (in TBS and separately) as a security measure to prevent algorithm substitution attacks.

Detailed Field Analysis:

Extensions are the mechanism that makes X.509 certificates adaptable and powerful. Each extension has:

1. Extension OID — Identifies the extension type
2. Critical Flag — Boolean indicating if the extension is critical
3. Extension Value — The actual extension data (ASN.1 encoded)

The Critical Flag:

This flag has profound implications:

• If an extension is marked critical and the software doesn't recognize it, the certificate must be rejected
• If an extension is marked non-critical and not recognized, it can be safely ignored

This mechanism allows new extensions to be added while maintaining backward compatibility (non-critical) or enforcing new requirements (critical).

Deep Dive: The Most Important Extensions:

Basic Constraints: This extension is crucial for security. It has two components:

• cA boolean: TRUE if the subject can issue certificates, FALSE otherwise
• pathLenConstraint: Maximum number of non-self-issued intermediate certs below this

Without proper Basic Constraints, an end-entity certificate could be used to sign other certificates, enabling massive fraud.

Key Usage: A 9-bit field specifying permitted operations:

• digitalSignature (bit 0): Sign data (except certificates/CRLs)
• nonRepudiation/contentCommitment (bit 1): Binding signature
• keyEncipherment (bit 2): Encrypt other keys (e.g., in RSA key exchange)
• dataEncipherment (bit 3): Encrypt data directly
• keyAgreement (bit 4): Key agreement protocols (DH, ECDH)
• keyCertSign (bit 5): Sign certificates (CA only)
• cRLSign (bit 6): Sign CRLs (typically CA only)
• encipherOnly (bit 7): Only encipher during key agreement
• decipherOnly (bit 8): Only decipher during key agreement

Subject Alternative Name (SAN): Modern web certificates rely heavily on SAN. It allows multiple identities:

• DNS names (dNSName): www.example.com, *.example.com
• IP addresses (iPAddress): 192.168.1.1, 2001:db8::1
• Email addresses (rfc822Name): user@example.com
• URIs (uniformResourceIdentifier): https://example.com

Browsers now require domain names in SAN, not just CN. A certificate without SAN for the accessed domain will be rejected.

X.509 certificates can exist in multiple encoding formats. Understanding these formats is essential for working with certificates across different systems and applications.

ASN.1: The Foundation:

X.509 certificates are defined using Abstract Syntax Notation One (ASN.1), a standard for describing data structures. ASN.1 is a schema language (similar to JSON Schema or Protocol Buffers definitions) that precisely specifies what data a certificate contains.

ASN.1 definitions are then encoded using Distinguished Encoding Rules (DER) or Basic Encoding Rules (BER). DER is a subset of BER that ensures deterministic encoding—given the same data, you always get the same bytes. This property is essential for digital signatures.

Common File Formats:

PEM Format Details:

PEM (Privacy-Enhanced Mail) is the most common format for certificates in Unix/Linux systems. The format consists of:

1. A header line: -----BEGIN CERTIFICATE-----
2. Base64-encoded DER data (64 characters per line, typically)
3. A footer line: -----END CERTIFICATE-----

PEM files can contain multiple objects (certificates, keys, etc.) concatenated together. Order often matters—for a certificate chain, the order is typically: end-entity cert, intermediate(s), root.

Working with Formats:

Let's examine a real-world certificate to see how all these concepts come together. The following is an actual certificate (anonymized) from a production web server:

Certificate Analysis:

Let's decode what each part tells us:

Identity and Authority:

• Subject: CN = www.example.com — This certificate identifies the web server at www.example.com
• Issuer: C = US, O = Let's Encrypt, CN = R3 — Let's Encrypt's R3 intermediate CA signed this
• Serial Number: Unique identifier assigned by Let's Encrypt

Validity:

• Valid from January 15 to April 15, 2024 — 90 days (Let's Encrypt's standard period)
• Short validity reduces exposure if key is compromised

Cryptography:

• Algorithm: RSA with 2048-bit key (industry standard minimum)
• Exponent: 65537 (0x10001) — the universally standard RSA public exponent
• Signature: SHA-256 with RSA — modern, secure algorithm

Extension Analysis:

• Key Usage: Digital Signature, Key Encipherment (critical) — Can sign data and encrypt session keys
• Extended Key Usage: TLS Server and Client auth — Can be used by servers and clients
• Basic Constraints: CA:FALSE (critical) — This is NOT a CA certificate; cannot sign other certs
• Subject Alternative Name: Covers both www.example.com AND example.com
• Authority Information Access: OCSP responder for revocation checking; URL to download issuing CA cert
• CRL Distribution Points: URL for Certificate Revocation List

Not all certificates serve the same purpose. Understanding the different types helps you select and configure the right certificate for each use case.

Validation Levels (for TLS Server Certificates):

CAs offer different validation levels, each with different verification rigor and visual indicators:

Wildcard and SAN Certificates:

Wildcard Certificates:

• Cover one level of subdomains: *.example.com matches www.example.com, api.example.com, but NOT login.api.example.com
• Cannot be EV validation
• Single point of compromise if private key is leaked

Multi-Domain (SAN) Certificates:

• Multiple distinct domains in one certificate
• Can combine example.com, example.org, example.net
• More flexible but requires re-issuance to add domains

Wildcard + SAN:

• Best of both: *.example.com AND *.example.org in one cert
• Common for large organizations managing multiple domains

We've explored X.509 certificates in comprehensive depth. Let's consolidate the essential knowledge:

What's Next:

Now that you understand certificates themselves, the next critical question is: Who issues these certificates and why should we trust them?

The next page explores Certificate Authorities—the entities that vouch for certificate holders. We'll examine how CAs verify identity, the trust model that makes web PKI work, and the implications of CA compromise.