What is X.509 certificate?

In a network that uses the concept of public and private keys for encrypting data, X.509 certificates define a standard of encryption for packets sent over the internet. It is a digital certificate that proves the ownership of a public key.

Encrypted connections, such as SSL Encryption, use this public essential encryption standard for authentication.

Content

An X.509 certificate includes the following information:

• Serial number of the certificate

• Identity of the owner

• Validity of the certificate

• The issuer of the certificate

• Public key

• Signature of the issuer

The following is an example of an X.509 certificate:

How to issue certificates

X.509 certificates are signed by trusted third parties called Certificate Authorities (CA). Therefore, the contents of a certificate signed by a CA can always be trusted.

How to verify the certificates

Here's how clients verify certificates:

Here's a brief explanation for the illustration shown above:

1. At the start of the TLS/SSL connection, the server shares its certificate (containing its public key) with the client.

2. The client verifies the server's public key by checking the certificate's validity with a CA.

3. After the certificate has been validated, the client can continue sending information to the server.

Though, this isn't always the case. Sometimes certificates are compromised; in this case, the certificate authority adds the leaked certificate to a revocation listA list of revoked certificates that are not to be trusted..

Compromised certificates

Below is a step-by-step illustration of the process when an X.509 certificate is compromised:

Need for the X.509 certificates

X.509 certificates are required to ensure that the entity we are reaching out to is the one we want to contact. For this very purpose, their public key is required to encrypt the data to be sent, which can only be decrypted by them using their private keys.

In the worst-case scenario, if someone else was to pose as the entity that a user wants to contact and provide them with a fake public key, the unsuspecting user would send the packet over the internet encrypted with the fake public key, hence giving access to the third party of the contents inside the encrypted packet.