What is X.509?
The X.509 digital certificate standard is an ITU-T framework for public-key and attribute certificates. In an X.509 public-key certificate, an issuer uses Digital Signatures to bind a subject name or identity attributes to a public key. Core fields include issuer, subject, serial number, validity period, subject public-key information, and signature algorithm. Extensions refine permitted use and validation behavior: key usage, extended key usage, basic constraints, and subject alternative name are common examples, and a validator must reject an unrecognized critical extension. The Internet profile in RFC 5280 standardizes certificate, certificate-revocation-list, and path-validation processing. X.509 is a framework, not a particular certificate authority, trust provider, or Public Key Infrastructure (PKI) product.
What is X.509 used for?
X.509 certificates support Transport Layer Security (TLS) server and client authentication, code and document signing, device identity, secure email, and enterprise PKI. Trust requires more than parsing a valid certificate. A relying party builds and validates a certification path to an accepted trust anchor, applies name or identity matching, checks validity and constraints, enforces algorithm policy, and evaluates revocation information through CRLs or OCSP where policy requires it. Issuance, renewal, inventory, and private-key protection are therefore operational controls, not clerical tasks. A compromised issuer, misplaced trust anchor, expired certificate, weak key, or incorrect extension can undermine the intended assurance. Security leaders should govern certificate lifecycles and validation policy as interconnected trust services.
