Chapter 8
Anatomy of an X.509 certificate
An X.509 certificate is a public, signed record that ties one public key to names for a fixed period, and you can read every field with openssl.
Topic
Certificates
A certificate is a signed statement that binds a name, such as a website's domain, to a public key. A certificate authority (CA) signs it after checking that the requester controls the name.
This hub covers what is inside an X.509 certificate, the names and jobs it allows, how to make a key and a certificate signing request (CSR), how domain validation works, and the file formats you will meet. Certificates do not encrypt anything: they let others check whose public key they are using.
Understand it: handbook chapters
Plain words first, then the real mechanism, what it looks like at work and why it matters.
Chapter 9
Names and jobs: SANs, wildcards, key usage and the CA flag
A certificate is valid only for the names in its Subject Alternative Name list, and only for the jobs that its key usage, extended key usage and CA flag allow.
Chapter 10
Asking for a certificate: key generation and the CSR
You generate a key pair, keep the private key, and send the CA a certificate signing request (CSR) carrying only your public key and the names you want.
Chapter 11
Proving you own the name: DV, OV, EV and CAA
Before issuing, a CA checks that you control each name, using a file, a DNS record or a TLS response, and reads CAA records; OV and EV check the organisation.
Chapter 3
Key pairs: public and private keys
A key pair is two keys: a public key anyone may have and a private key only you hold, so strangers can encrypt to you without sharing a secret first.
Chapter 7
Whose key is it? Binding identity to keys
Encryption and signatures only help if you use the right person's public key, so something you already trust must vouch that a key belongs to a name.
Appendix
File formats: PEM, DER, PKCS #12 and friends
The formats are wrappings of the same data: DER is binary, PEM is DER in Base64, PKCS #12 bundles a key with its certificates, and PKCS #7 carries certificates only.
Appendix
Cheat sheet: the certificate commands you actually need
Tested OpenSSL, curl, keytool, Windows and Kubernetes commands for everyday certificate work, grouped by the task you are trying to do.
Do it: how-to guides
Step-by-step, with real commands and a way to check it worked.
How to inspect a certificate with OpenSSL
You will have read a certificate file or a server's certificate with OpenSSL and found its names, dates, issuer, key and fingerprint.
How to check that a private key matches a certificate
You will have proved, without exposing the key, that a private key, its CSR and a certificate share one public key, or found the file that does not belong.
How to create a key and a CSR with OpenSSL (with SANs)
You will have a new private key that never leaves your server, and a verified certificate signing request that lists every name your certificate needs.
How to create a CSR on Windows (certreq and IIS)
You will have a CSR with all your names, whose private key stays inside the Windows key store, and know how to install the certificate when it returns.
How to create a CSR with Java keytool
You will have a key pair in a PKCS #12 keystore, a CSR whose SAN list really reaches the CA, and the signed certificate chain installed under the same alias.
How to convert PFX (PKCS #12) to PEM and back
You will have split a PFX into PEM files for the certificate, the chain and the key, or packed PEM files into a PFX that Windows and Java can import.
How to convert between DER and PEM
You will have identified whether a file is DER or PEM and converted certificates, keys, CSRs, CRLs and bundles between the two, with proof that nothing changed.
How to convert a Java keystore (JKS) to PKCS #12
You will have moved every key and trusted certificate from a JKS keystore into a standard PKCS #12 file that Java, OpenSSL and Windows can read, and updated your settings.
How to set CAA records for your domain
You will have DNS CAA records that let only the CAs you really use issue certificates for your names, with separate wildcard rules and an address for violation reports.
How to get a wildcard certificate with DNS-01
You will have a publicly trusted certificate for *.example.com and example.com, issued through the ACME DNS-01 challenge with a narrowly scoped DNS key, and renewing by itself.
Fix it: error pages
The exact messages tools and browsers print, with likely causes and safe fixes.
Check yours: browser tools
They run in your browser. Nothing you paste is sent anywhere.
Tool
Certificate decoder
Paste a PEM certificate and read every field in plain words.
Tool
CSR decoder
Check a certificate signing request before you send it to a CA.
Tool
Hostname matcher
Test whether a name matches a certificate's SANs and wildcards.
The big picture: crash course
Short lessons of about nine minutes each, with check questions.
Look it up: glossary terms
Every term in plain words, linked to its full entry.
- ASN.1
- Asymmetric encryption
- Baseline Requirements
- Basic Constraints
- CAA record
- Certificate
- Certificate signing request (CSR)
- Clock skew
- Common Name (CN)
- CSR
- DER
- Distinguished name (DN)
- Domain validation (DV)
- Elliptic-curve cryptography
- Extended Key Usage (EKU)
- Extended validation (EV)
- Issuer
- Key pair
- Key substitution
- Key Usage
- Keystore
- Man-in-the-middle
- Multi-perspective issuance corroboration (MPIC)
- Organization validation (OV)
- PEM
- PKCS #12
- PKCS #7
- PKCS #8
- PKI
- Private key
- Proof of possession
- Public key
- Public key infrastructure (PKI)
- RSA
- Serial number
- SPKI (SubjectPublicKeyInfo)
- Subject
- Subject Alternative Name (SAN)
- Validity period
- Wildcard certificate
- X.509