Questions tagged [x.509]

X.509 is a standard for a public key infrastructure used for authentication and access control. X.509 specifies standard formats for certificates, revocation lists, attribute certificates, and path validation.

In cryptography, X.509 is an ITU-T standard for a public key infrastructure (PKI) for single sign-on (SSO) and Privilege Management Infrastructure (PMI). X.509 specifies, amongst other things, standard formats for public key certificates, certificate revocation lists, attribute certificates, and a certification path validation algorithm.

X.509 was initially issued on July 3, 1988 and was begun in association with the X.500 standard. It assumes a strict hierarchical system of certificate authorities (CAs) for issuing the certificates. This contrasts with web of trust models, like PGP, where anyone (not just special CAs) may sign and thus attest to the validity of others' key certificates. Version 3 of X.509 includes the flexibility to support other topologies like bridges and meshes (RFC 4158).

From Wikipedia X.509

468 questions
96
votes
2 answers

What is the difference between serial number and thumbprint?

I have problems to understand what is the difference between the serial number of a certificate and its SHA1 hash. The MSDN says: Serial number A number that uniquely identifies the certificate and is issued by the certification authority. So can I…
reox
  • 1,112
  • 1
  • 9
  • 10
77
votes
2 answers

What's the difference between X.509 and PKCS#7 Certificate?

Am I correct calling file with .p7b file extension saved as 'Cryptographic Message Syntax Standard - PKCS#7 Certificates (.P7B)' in Windows - a 'PKCS#7 certificate'? Or is it better called 'X.509 certificate saved in PKCS#7 format'? When would one…
golem
  • 1,033
  • 2
  • 11
  • 14
70
votes
1 answer

Why is there no certificate error while visiting google.net although it presents a certificate issued to google.com?

The following output shows that google.net is presenting a certificate that has been issued to www.google.com . $ openssl s_client -connect google.net:443 < /dev/null > out.txt 2>&1; cat out.txt depth=2 /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA…
Lone Learner
  • 958
  • 2
  • 9
  • 19
55
votes
2 answers

What is the difference between SSL and X.509 Certificates?

I used openssl to create a X.509 certificate but I don't quite understand the relationship between a X.509 and a SSL certificate. Are they the same? Is a SSL certificate just a X.509 certificate that is used for SSL?
vernomcrp
49
votes
2 answers

Do SSL / X.509 certs cover all ports for a host?

Or are certs both host- and port-specific (excepting wildcard certs)? I would assume they aren't, because they're supposed to verify a domain, but at the same time I've never seen anyone run HTTPS on any port other than 443, and I've only seen X.509…
Parthian Shot
  • 971
  • 2
  • 10
  • 18
49
votes
4 answers

Determine if private key belongs to certificate?

Given a certificate¹ and a private key file², how can I determine if the public key on the certificate matches the private key? My initial thought was to simply encrypt some text with the public key on the cert, and attempt to decrypt it with the…
Thanatos
  • 1,106
  • 2
  • 11
  • 16
45
votes
5 answers

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will automatically be granted access to the linked…
Tobias Kienzler
  • 8,028
  • 11
  • 48
  • 74
44
votes
1 answer

Which properties of a X.509 certificate should be critical and which not?

RFC5280's section 4.2 states Each extension in a certificate is designated as either critical or non-critical. A certificate-using system MUST reject the certificate if it encounters a critical extension it does not recognize or a critical extension…
Tobias Kienzler
  • 8,028
  • 11
  • 48
  • 74
43
votes
2 answers

Can a SSL certificate have longer validity period than its parent in X.509 chain?

When a X.509 certificate chain is composed of X1, X2 ... Xn and Xn is root CA, Can a certificate in lower level have longer validity period than its parents? I think that lower level should be proper sub-range of high level at least in practice.…
Chul-Woong Yang
  • 643
  • 1
  • 6
  • 8
36
votes
7 answers

Could governments and banks become CAs?

When you apply for a passport, driver's license, home mortgage, bank account, credit card, etc., the issuing organization must verify your identity. In the course of doing so, would it be feasible for them to issue an x.509 certificate? These could…
shadowtalker
  • 541
  • 4
  • 11
34
votes
6 answers

Missing X509 extensions with an openssl-generated certificate

My goal is to create a certificate with openssl similar to this one generated with cfssl Certificate: Data: Version: 3 (0x2) Serial Number: 60:44:dc:0d:80:f4:54:55:e8:0d:95:61:f8:8f:b7:7e:f7:8d:29:69 Signature Algorithm: ecdsa-with-SHA384 Issuer:…
user15194
33
votes
1 answer

Which key usages are required by each key exchange method?

I'm only really concerned with RSA keys, so the exchange methods are RSA (generate a key, encrypt it, and send it over) and [EC]DHE_RSA (generate an ephemeral [EC]DH key, sign it, and use it for key agreement). The actual operation in RSA is "Key…
Ben Jencks
  • 431
  • 1
  • 4
  • 3
33
votes
5 answers

What is the use of cross signing certificates in X.509?

In X.509 architecture what are the uses of cross signing certificates from other hierarchy? Does it just expand trust? So from the answer I am assuming that if CA3 is cross signed by CA2 (from another hierarchy) and CA1 (a parent in its own…
epsilon8
  • 455
  • 1
  • 4
  • 8
32
votes
1 answer

The difference between Subject Key Identifier and sha1Fingerprint in X509 Certificates

I have some SW that extracts certificates data and the SW utilizes OpenSSL. I am confused what is the difference between the subjectKeyIdentifier and the sha1Fingerprint . Both are hash values. My intuition is that the subjectKeyIdentifier is the…
user9371654
  • 589
  • 2
  • 8
  • 18
27
votes
4 answers

What's the point of certificates in SSL/TLS?

A valid certificate cannot guarantee that I'm not being MITM'd right now, as either the private key or CA may have been compromised. For this reason, I have to contact a CA through CRL/OCSP to check if it's been revoked. Best case, I can have a CA's…
David Davidson
  • 599
  • 5
  • 9
1
2 3
…
31 32