X.509 Certificate
An X.509 certificate binds a public key to an identity, signed by a CA for verification, containing validity, issuer, subject, and extension fields.
Purpose
Verify server/client identity and establish TLS encrypted channels.
Mechanism
A certificate contains version, serial number, signature algorithm, issuer, validity, subject, public key, and extensions (SAN/Key Usage). The CA signs the certificate with its private key. Verification: check the CA signature, validity, revocation status (OCSP/CRL), and domain match.
Use cases
- TLS certificates
- Identity verification
- PKI