X.509 Certificates Explained

Anirban Bhattacherji

Published in

ITNEXT

7 min readJan 16, 2024

Introduction to X.509 Certificates

Definition and Overview

X.509 certificates are a crucial component of many digital security and encryption protocols. Serving as digital passports or identity cards, they play a key role in securing communications over networks, especially the internet. An X.509 certificate is essentially a digital document used to prove the identity of a party or to secure communications between two entities.

The primary function of an X.509 certificate is to link a public key with the identity of its owner, typically an individual, organization, or device. This link is crucial for establishing secure, encrypted communication channels over insecure networks like the internet. The certificate contains information about the key, information about its owner’s identity, and the digital signature of an entity that has verified the certificate’s contents. This verifying entity is usually a trusted third party known as a Certificate Authority (CA).

X.509 certificates are an integral part of the Transport Layer Security (TLS) protocol, which is widely used for securing web communications. When you visit a website with HTTPS, for instance, your browser is presented with an X.509 certificate from the server. This certificate is then used to authenticate the server and establish a secure connection.

The structure of an X.509 certificate adheres to a standard format defined by the International Telecommunication Union (ITU). This format specifies various fields that contain information such as:

Serial Number: A unique identifier for the certificate.
Issuer: The authority that issued the certificate.
Validity Period: The time frame during which the certificate is valid.
Subject: The entity to which the certificate is issued.
Subject’s Public Key: The public key that is being certified.

The use of X.509 certificates extends beyond just web communications. They are also used in email encryption, signing software codes, securing VPN connections, and in various other scenarios where identity verification and data security are paramount.

The development and implementation of X.509 certificates have evolved over the years, adapting to new security challenges and technological advancements. Their role in cybersecurity continues to be of utmost importance, as they form the backbone of trust on which secure digital communications are built.

X.509 Certificate Architecture

+---------------------------------------+
|              X.509 Certificate        |
+---------------------------------------+
| - Version                             |
| - Serial Number                       |
| - Signature Algorithm                 |
| - Issuer                              |
| - Validity Period                     |
|   - Not Before                        |
|   - Not After                         |
| - Subject                             |
| - Subject Public Key Info             |
|   - Subject Public Key Algorithm      |
|   - Subject Public Key                |
| - Issuer Unique Identifier (Optional) |
| - Subject Unique Identifier (Optional)|
| - Extensions (Optional)               |
|   - keyUsage (Optional)               |
|   - extKeyUsage (Optional)            |
|   - basicConstraints (Optional)       |
|   - subjectKeyIdentifier (Optional)   |
|   - authorityKeyIdentifier (Optional) |
|   - subjectAltName (Optional)         |
| - Certificate Signature Algorithm     |
| - Certificate Signature               |
| - SHA-256 Fingerprint (Optional)      |
| - SHA-1 Fingerprint (Optional)        |
+---------------------------------------+

X.509 certificate architecture is a framework for creating a digital certificate that is used to verify the identity of entities over a network. The architecture is designed to ensure secure and trusted communication between parties in an online environment. Let’s delve into the details of its structure, components, and the role of Certificate Authorities and Trust Chains.

Certificate Fields

An X.509 certificate comprises several fields that store information about the entity’s identity, the certificate itself, and the authority that issued it. Let’s try to understand them one by one

Version: This field specifies the version of the X.509 standard that the certificate adheres to. There are three versions, with Version 3 being the most recent and commonly used one, as it supports the use of extensions.

Serial Number: A unique identifier assigned to each certificate by the entity that issued it. It helps differentiate certificates and manage them effectively.

Signature Algorithm: The algorithm used by the Certificate Authority (CA) to sign the certificate. Common algorithms include SHA-256 with RSA Encryption, SHA-3, and ECDSA.

Issuer: This field contains the name of the CA that issued the certificate. It indicates who has authenticated the information in the certificate.

Validity Period: The time frame during which the certificate is valid and can be reliably used for securing communications. It includes two sub-fields:

Not Before: The date and time from which the certificate is valid.
Not After: The expiration date and time of the certificate.

Subject: Information about the entity to whom the certificate was issued. This could be an individual, organization, device, etc.

Subject Public Key Info: This section contains the public key of the certificate subject, including:

Subject Public Key Algorithm: The algorithm of the public key (e.g., RSA, DSA, ECDSA).

Subject Public Key: The actual public key data, used in asymmetric encryption systems.

Extensions: Additional fields in Version 3 certificates that provide extra information. Common extensions include:

Key Usage: Specifies the intended purpose of the public key (e.g., digital signature, key encipherment).
Extended Key Usage (extKeyUsage): Further refines the purposes for which the public key can be used (e.g., server authentication, client authentication).
Basic Constraints: Indicates whether the certificate is for a CA or not and the depth of the CA chain.
Subject Key Identifier: A unique identifier of the certificate’s public key, useful for identifying the specific key in a CA system.
Authority Key Identifier: Identifies the public key of the CA that signed the certificate.
Subject Alternative Name (subjectAltName): Allows for additional names/identifiers for the subject, such as email addresses, DNS names, IP addresses.

Certificate Signature Algorithm: The algorithm used to sign the certificate, typically the same as the Signature Algorithm field.

Certificate Signature: The actual digital signature to verify that the certificate comes from the issuer.

SHA-256 Fingerprint: A SHA-256 hash of the entire certificate. It provides a way to uniquely identify the certificate and is used for verifying its integrity.

SHA-1 Fingerprint: Similar to the SHA-256 fingerprint, but uses the SHA-1 hash algorithm. Although SHA-1 is now considered less secure and is being phased out in favor of SHA-256.

These fields collectively ensure the security and reliability of the certificate. They are used for various purposes, such as establishing secure connections over the internet, encrypting data, and verifying the identity of the parties involved in the communication.

Use Cases in Authentication (AuthN) and Authorization (AuthZ) with X.509 Certificates

X.509 certificates play a crucial role in both authentication (AuthN) and authorization (AuthZ) processes in various security protocols and systems. Below is a detailed explanation of how X.509 certificates are used in these contexts.

Authentication Process with X.509

Client Authentication

Process Overview:

In client authentication, the client (typically a user or a device) presents its X.509 certificate to a server to prove its identity.
This is common in scenarios where enhanced security is required, like in VPN connections or secure email communications.

How it Works:

+-------------+            +-------------+
|             |            |             |
|    Client   |            |    Server   |
|             |            |             |
+------+------+            +------+------+
       |                          |
       |----- Request --------->  |
       |    (Connect)             |
       |                          |
       |<---- Request ----------- |
       |   Certificate            |
       |                          |
       |----- Certificate ------> |
       |    (Present)             |
       |                          |
       |<---- Validate -----------|
       |   Certificate            |
       |                          |
       |----- Establish ----------|
       |   Secure Session         |
       +------------------------->|

When a client attempts to connect to a server, the server requests the client’s certificate.
The client sends its X.509 certificate to the server.
The server validates the certificate by checking its digital signature, ensuring it’s issued by a trusted Certificate Authority (CA), and verifying that it has not expired or been revoked.
If the validation is successful, the client is considered authenticated. The server may then use the public key in the client’s certificate for establishing an encrypted session.

Server Authentication:

Process Overview:

Server authentication is the most common use of X.509 certificates, typically observed in HTTPS (HTTP Secure) connections.
It allows clients (like web browsers) to verify the identity of the server they are connecting to.

How it Works:

+-------------+            +-------------+
|             |            |             |
|    Client   |            |    Server   |
|             |            |             |
+------+------+            +------+------+
       |                          |
       |----- Request --------->  |
       |    (Connect)             |
       |                          |
       |<---- Request ----------- |
       |   Certificate            |
       |                          |
       |----- Certificate ------> |
       |    (Present)             |
       |                          |
       |<---- Validate -----------|
       |   Certificate            |
       |                          |
       |----- Establish ----------|
       |   Secure Session         |
       +------------------------->|

When a client initiates a connection to a server (e.g., accessing a website), the server presents its X.509 certificate.
The client checks the server’s certificate for validity: it verifies the digital signature, confirms the issuing CA is trusted, and ensures the certificate is not expired or revoked.
If the server’s identity is successfully verified, the client proceeds to establish a secure connection, often using the server’s public key to initiate a secure TLS (Transport Layer Security) session.

Authorization Mechanisms Involving X.509:

Role-Based Access Control (RBAC):

X.509 certificates can be used in RBAC systems. Here, the certificate not only authenticates a user but also contains information (like in the extensions field) about the user’s role or permissions.
The system then grants access to resources based on the roles or permissions embedded in the certificate.

Attribute-Based Access Control (ABAC):

Similar to RBAC, but access decisions are based on a set of attributes and policies, which can be included in the X.509 certificate’s extensions.
This allows for more granular and dynamic control, as access can be determined by various attributes like department, location, etc.

Client Certificate for API Access:

In API security, X.509 certificates can be used to authorize clients or applications seeking to access the API.
The API server validates the client’s certificate and maps it to predefined access rights.

Smart Card Authentication:

Smart cards often contain X.509 certificates. When a user attempts to access a system with a smart card, the embedded certificate is used to authenticate and authorize the user, providing access based on the credentials stored on the card.

In summary, X.509 certificates are integral to both authentication and authorization processes. They provide a means of establishing identity (authentication) and can also carry information used to determine access rights (authorization) in various secure communication scenarios.