Public key certificate

Chain of trust v2

A public key certificate is a digital document used to prove the ownership of a public key. The certificate includes information about the key, the identity of its owner, and the digital signature of an entity that has verified the certificate's contents. If the signature is valid, and the software examining the certificate trusts the signer, then it can use the public key to communicate securely with the certificate's subject.

Structure

A public key certificate typically contains the following fields:

• **Version**: The version of the X.509 standard being used.
• **Serial Number**: A unique identifier for the certificate.
• **Signature Algorithm**: The algorithm used to create the signature.
• **Issuer**: The entity that verified the information and issued the certificate.
• **Validity Period**: The dates during which the certificate is valid.
• **Subject**: The entity that the certificate represents.
• **Subject Public Key Info**: The public key and the algorithm associated with it.
• **Extensions**: Optional fields that provide additional information.

Types of Certificates

There are several types of public key certificates, including:

• **SSL/TLS Certificates**: Used to secure communications over the internet.
• **Code Signing Certificates**: Used to verify the authenticity of software.
• **Email Certificates**: Used to secure email communications.
• **Client Certificates**: Used to authenticate users to a server.

Certificate Authorities

A Certificate Authority (CA) is an entity that issues public key certificates. The CA verifies the identity of the certificate requester and signs the certificate to attest to its validity. Common CAs include Let's Encrypt, DigiCert, and GlobalSign.

Certificate Revocation

Certificates can be revoked before their expiration date if the private key is compromised or if the certificate is no longer needed. Revocation is typically handled through:

• **Certificate Revocation Lists (CRLs)**: Lists of revoked certificates published by the CA.
• **Online Certificate Status Protocol (OCSP)**: A protocol used to check the revocation status of a certificate in real-time.

Usage

Public key certificates are used in various applications, including:

• **HTTPS**: To secure web traffic.
• **Email encryption**: To secure email communications.
• **VPN**: To secure virtual private network connections.
• **Digital signatures**: To verify the authenticity of digital documents.

Related Pages

• Public key infrastructure
• Digital signature
• Certificate Authority
• X.509
• SSL/TLS
• HTTPS
• Email encryption