X.509 Certificate Formatieren Referenz
Referenz für X.509 v3 certificates: Struktur, extensions, und validation Regeln.
Certificate Structure
X.509 v3 certificates contain version, serial number, signature algorithm, issuer, validity period, subject, subject public key, and extensions. The signature covers the TBSCertificate structure. Distinguished Names use RDN sequences (CN, O, OU, C). Validity period includes notBefore and notAfter. The subject and issuer fields identify the entity and the CA. Certificates are DER-encoded ASN.1 structures, often Base64-encoded as PEM.
- TBSCertificate
- To-be-signed data
- validity
- notBefore, notAfter
- PEM
- Base64 DER
version, serial, ...time window-----BEGIN CERT-----Extensions and Validation
Key extensions: SubjectAltName (SAN) for multiple DNS/IP identities, KeyUsage for purpose restriction, ExtendedKeyUsage for specific applications, BasicConstraints for CA flag, AuthorityKeyIdentifier and SubjectKeyIdentifier for chain building. Certificate validation checks signature, validity, revocation (CRL/OCSP), and chain to a trusted root. Name constraints limit CA scope. Path validation follows RFC 5280 algorithms. CT logs provide transparency for CA-issued certificates.
- SAN
- Subject Alternative Name
- KeyUsage
- Purpose restriction
- revocation
- CRL or OCSP
DNS, IP, emaildigitalSignature, keyEnciphermentcheck validity