Skip to main content
MI Support IT logo

IT security

What is X.509?

X.509 is the standard all digital certificates follow: from the padlock in the browser to signed code. See what a certificate contains, and how the chain works.

In short

X.509 is the international standard that defines how digital certificates are structured, and it is followed by virtually all certificates in use today, from the TLS certificate behind the padlock in the browser to the certificates behind signed code and secure email.

An X.509 certificate binds a public key to an identity, for example a domain, a person or a device, and contains among other things the subject, the issuer, the validity period, the public key and the permitted usage, all of it signed by a certificate authority.

Trust arises through the certificate chain: each certificate is signed by the level above, up to a root CA that operating systems and browsers trust out of the box. The standard originates in ITU's X.500 directory series from 1988, and the internet profile is defined in RFC 5280. For businesses the point is practical: X.509 certificates are infrastructure that expires and must be operated.

MI Support IT manages customers' certificate portfolios as a standing service.

Back to the glossary

What is X.509?

X.509 is the standard for digital certificates: the common format that lets a browser from one vendor verify a certificate issued by a completely different one, across systems, countries and decades. Virtually all digital certificates in practical use follow X.509: TLS certificates, code signing certificates, S/MIME certificates for email and machine certificates in internal infrastructure.

The standard has its roots in ITU's X.500 directory series from 1988; the version the internet uses is profiled in RFC 5280.

What does an X.509 certificate contain?

At its core, a certificate is a signed statement: "This public key belongs to this identity." The most important fields:

  • Subject: Who the certificate is issued to: a domain, an organisation, a person or a device. For web certificates, the domains sit in the Subject Alternative Name (SAN) field.
  • Issuer: Which certificate authority (CA) issued and signed it.
  • Validity period: From and to dates. After expiry, the certificate is invalid, regardless of everything else.
  • The public key: The key itself being bound to the identity, typically RSA or elliptic curve.
  • Usage and extensions: What the certificate may be used for (server, client, signing), and in version 3 a set of extensions governing constraints and policies.
  • The CA's signature: A digital signature over the whole thing: the proof that the issuer vouches for the contents.

The certificate chain: how trust arises

Nobody trusts a single certificate on its own. The trust comes from the chain. Your web certificate is signed by an issuing CA, whose certificate is in turn signed by a root CA. The root certificates come pre-installed in operating systems and browsers, and verification consists of following the signatures all the way up: If the chain is unbroken, and no link is expired or revoked, the padlock is shown. One weak link (an expired intermediate certificate, a revoked root), and the whole chain falls. The system of issuers, policies and processes behind the chains is what is collectively called PKI.

Why should your business care about X.509?

Because certificates are infrastructure with an expiry date. The average SMB has more certificates than anyone has an overview of: website and webshop, mail, VPN, internal servers, integrations and devices. Each of them can take down operations or security when it expires or is misconfigured, and certificate lifetimes keep getting shorter, so manual management in a calendar is no longer realistic. Automation via ACME and central monitoring of the portfolio is the way forward; see also the TLS certificate lifecycle.

How MI Support IT can help

We manage customers' X.509 portfolios as a standing service: complete inventory, automated renewal, correctly configured chains and protected private keys (in an HSM where appropriate), all under PKI management. If you want to go deeper, download the e-book PKI and HSM in practice, or contact us.

Shall we talk about your business and your needs?

Real people talking to real people. We get back to you the same day.

Write to usBook a meeting