> What is inside an X.509 certificate, how you ask for one and how the CA checks you own the name. Chapters, guides and fixes in one place. Source: https://pkizerotohero.com/topics/certificates/ Topic # Certificates A certificate is a signed statement that binds a name, such as a website's domain, to a public key. A certificate authority (CA) signs it after checking that the requester controls the name. This hub covers what is inside an X.509 certificate, the names and jobs it allows, how to make a key and a certificate signing request (CSR), how domain validation works, and the file formats you will meet. Certificates do not encrypt anything: they let others check whose public key they are using. ## Understand it: handbook chapters Plain words first, then the real mechanism, what it looks like at work and why it matters. Chapter 8 ### [Anatomy of an X.509 certificate](https://pkizerotohero.com/handbook/x509-certificates/) An X.509 certificate is a public, signed record that ties one public key to names for a fixed period, and you can read every field with openssl. - Developer - IT ops - Beginner Chapter 9 ### [Names and jobs: SANs, wildcards, key usage and the CA flag](https://pkizerotohero.com/handbook/names-and-key-usage/) A certificate is valid only for the names in its Subject Alternative Name list, and only for the jobs that its key usage, extended key usage and CA flag allow. - Developer - IT ops - Expert Chapter 10 ### [Asking for a certificate: key generation and the CSR](https://pkizerotohero.com/handbook/csr/) You generate a key pair, keep the private key, and send the CA a certificate signing request (CSR) carrying only your public key and the names you want. - Developer - IT ops - Beginner Chapter 11 ### [Proving you own the name: DV, OV, EV and CAA](https://pkizerotohero.com/handbook/domain-validation/) Before issuing, a CA checks that you control each name, using a file, a DNS record or a TLS response, and reads CAA records; OV and EV check the organisation. - IT ops - Developer - Leader Chapter 3 ### [Key pairs: public and private keys](https://pkizerotohero.com/handbook/key-pairs/) A key pair is two keys: a public key anyone may have and a private key only you hold, so strangers can encrypt to you without sharing a secret first. - Beginner - Developer - IT ops Chapter 7 ### [Whose key is it? Binding identity to keys](https://pkizerotohero.com/handbook/binding-identity/) Encryption and signatures only help if you use the right person's public key, so something you already trust must vouch that a key belongs to a name. - Beginner - Developer - IT ops Appendix ### [File formats: PEM, DER, PKCS #12 and friends](https://pkizerotohero.com/handbook/file-formats/) The formats are wrappings of the same data: DER is binary, PEM is DER in Base64, PKCS #12 bundles a key with its certificates, and PKCS #7 carries certificates only. - Developer - IT ops - Expert Appendix ### [Cheat sheet: the certificate commands you actually need](https://pkizerotohero.com/handbook/cheat-sheet/) Tested OpenSSL, curl, keytool, Windows and Kubernetes commands for everyday certificate work, grouped by the task you are trying to do. - Developer - IT ops - Expert ## Do it: how-to guides Step-by-step, with real commands and a way to check it worked. ### [How to inspect a certificate with OpenSSL](https://pkizerotohero.com/guides/inspect-certificate-openssl/) You will have read a certificate file or a server's certificate with OpenSSL and found its names, dates, issuer, key and fingerprint. - Linux - macOS - Windows - Java ### [How to check that a private key matches a certificate](https://pkizerotohero.com/guides/check-key-matches-certificate/) You will have proved, without exposing the key, that a private key, its CSR and a certificate share one public key, or found the file that does not belong. - Linux - macOS - Windows - Java ### [How to create a key and a CSR with OpenSSL (with SANs)](https://pkizerotohero.com/guides/create-csr-openssl/) You will have a new private key that never leaves your server, and a verified certificate signing request that lists every name your certificate needs. - Linux - macOS - Windows ### [How to create a CSR on Windows (certreq and IIS)](https://pkizerotohero.com/guides/create-csr-windows/) You will have a CSR with all your names, whose private key stays inside the Windows key store, and know how to install the certificate when it returns. - Windows - IIS ### [How to create a CSR with Java keytool](https://pkizerotohero.com/guides/create-csr-java-keytool/) You will have a key pair in a PKCS #12 keystore, a CSR whose SAN list really reaches the CA, and the signed certificate chain installed under the same alias. - Java ### [How to convert PFX (PKCS #12) to PEM and back](https://pkizerotohero.com/guides/convert-pfx-pem/) You will have split a PFX into PEM files for the certificate, the chain and the key, or packed PEM files into a PFX that Windows and Java can import. - Linux - macOS - Windows - IIS ### [How to convert between DER and PEM](https://pkizerotohero.com/guides/convert-der-pem/) You will have identified whether a file is DER or PEM and converted certificates, keys, CSRs, CRLs and bundles between the two, with proof that nothing changed. - Linux - macOS - Windows - Java ### [How to convert a Java keystore (JKS) to PKCS #12](https://pkizerotohero.com/guides/convert-jks-pkcs12/) You will have moved every key and trusted certificate from a JKS keystore into a standard PKCS #12 file that Java, OpenSSL and Windows can read, and updated your settings. - Java ### [How to set CAA records for your domain](https://pkizerotohero.com/guides/caa-records/) You will have DNS CAA records that let only the CAs you really use issue certificates for your names, with separate wildcard rules and an address for violation reports. - Linux - macOS - Windows ### [How to get a wildcard certificate with DNS-01](https://pkizerotohero.com/guides/wildcard-dns-01/) You will have a publicly trusted certificate for \*.example.com and example.com, issued through the ACME DNS-01 challenge with a narrowly scoped DNS key, and renewing by itself. - Linux - Windows ## Fix it: error pages The exact messages tools and browsers print, with likely causes and safe fixes. - [Chrome, EdgeNET::ERR\_CERT\_COMMON\_NAME\_INVALID](https://pkizerotohero.com/errors/chrome-err-cert-common-name-invalid/) - [FirefoxSSL\_ERROR\_BAD\_CERT\_DOMAIN](https://pkizerotohero.com/errors/firefox-ssl-error-bad-cert-domain/) - [Node.jsERR\_TLS\_CERT\_ALTNAME\_INVALID](https://pkizerotohero.com/errors/node-err-tls-cert-altname-invalid/) - [Pythoncertificate verify failed: Hostname mismatch, certificate is not valid for '…'](https://pkizerotohero.com/errors/python-hostname-mismatch/) - [JavaNo subject alternative names matching IP address … found](https://pkizerotohero.com/errors/java-no-subject-alternative-names/) ## Check yours: browser tools They run in your browser. Nothing you paste is sent anywhere. Tool ### [Certificate decoder](https://pkizerotohero.com/tools/decoder/) Paste a PEM certificate and read every field in plain words. Tool ### [CSR decoder](https://pkizerotohero.com/tools/csr/) Check a certificate signing request before you send it to a CA. Tool ### [Hostname matcher](https://pkizerotohero.com/tools/hostname/) Test whether a name matches a certificate's SANs and wildcards. ## The big picture: crash course Short lessons of about nine minutes each, with check questions. - [Lesson 2: Two keys](https://pkizerotohero.com/course/two-keys/) - [Lesson 4: Whose key is it?](https://pkizerotohero.com/course/whose-key-is-it/) - [Lesson 5: Names, jobs and asking for a certificate](https://pkizerotohero.com/course/names-and-requests/) ## Look it up: glossary terms Every term in plain words, linked to its full entry. - [ASN.1](https://pkizerotohero.com/handbook/glossary/#asn1 "Abstract Syntax Notation One: the language used to describe the structure of certificates, CSRs, CRLs and keys.") - [Asymmetric encryption](https://pkizerotohero.com/handbook/glossary/#asymmetric-encryption "Encryption with a key pair: anyone can encrypt with the public key, and only the holder of the matching private key can decrypt.") - [Baseline Requirements](https://pkizerotohero.com/handbook/glossary/#baseline-requirements "The CA/Browser Forum's rules that every publicly trusted TLS certificate authority must follow.") - [Basic Constraints](https://pkizerotohero.com/handbook/glossary/#basic-constraints "The certificate extension that says whether a certificate belongs to a CA (CA:TRUE) and may sign other certificates.") - [CAA record](https://pkizerotohero.com/handbook/glossary/#caa-record "A DNS record in which a domain owner lists the certificate authorities allowed to issue certificates for that domain.") - [Certificate](https://pkizerotohero.com/handbook/glossary/#certificate "A signed document that binds a public key to a name, such as a website's domain, issued by a certificate authority.") - [Certificate signing request (CSR)](https://pkizerotohero.com/handbook/glossary/#certificate-signing-request "A signed message that asks a CA for a certificate. It holds the public key and the requested names; the private key stays with you.") - [Clock skew](https://pkizerotohero.com/handbook/glossary/#clock-skew "A difference between a computer's clock and the real time, which can make valid certificates look expired or not yet valid.") - [Common Name (CN)](https://pkizerotohero.com/handbook/glossary/#common-name "A field in a certificate's subject, often holding a hostname. Browsers ignore it for hostname checks; the subject alternative name counts.") - [CSR](https://pkizerotohero.com/handbook/glossary/#csr "Short for certificate signing request: the signed message with your public key and names that you send to a CA.") - [DER](https://pkizerotohero.com/handbook/glossary/#der "Distinguished Encoding Rules: the strict binary encoding of ASN.1 used for certificates, CSRs, CRLs and keys.") - [Distinguished name (DN)](https://pkizerotohero.com/handbook/glossary/#distinguished-name "A structured name made of attributes such as CN, O and C, used for the subject and issuer of a certificate.") - [Domain validation (DV)](https://pkizerotohero.com/handbook/glossary/#domain-validation "A CA checking that the requester controls a domain name before issuing a certificate for it, by an HTTP, DNS or TLS challenge.") - [Elliptic-curve cryptography](https://pkizerotohero.com/handbook/glossary/#elliptic-curve-cryptography "Public-key cryptography based on the maths of elliptic curves, giving strong security with small keys.") - [Extended Key Usage (EKU)](https://pkizerotohero.com/handbook/glossary/#extended-key-usage "A certificate extension that lists what the certificate may be used for, such as server authentication, client authentication or code signing.") - [Extended validation (EV)](https://pkizerotohero.com/handbook/glossary/#extended-validation "The strictest identity check for public TLS certificates, verifying the legal organisation behind a website.") - [Issuer](https://pkizerotohero.com/handbook/glossary/#issuer "The CA that signed a certificate, named in the certificate's issuer field.") - [Key pair](https://pkizerotohero.com/handbook/glossary/#key-pair "A matching public key and private key. What one key does, only the other can check or undo.") - [Key substitution](https://pkizerotohero.com/handbook/glossary/#key-substitution "An attack in which someone swaps a public key for their own, so you encrypt to them or trust their signatures by mistake.") - [Key Usage](https://pkizerotohero.com/handbook/glossary/#key-usage "A certificate extension that limits the cryptographic operations the key may be used for, such as digital signatures or signing certificates.") - [Keystore](https://pkizerotohero.com/handbook/glossary/#keystore "A file or system store that holds private keys with their certificate chains, and often trusted CA certificates, for an application.") - [Man-in-the-middle](https://pkizerotohero.com/handbook/glossary/#man-in-the-middle "An attacker who sits between two parties, relays their messages and can read or change them, often by swapping keys.") - [Multi-perspective issuance corroboration (MPIC)](https://pkizerotohero.com/handbook/glossary/#multi-perspective-issuance-corroboration "A CA checking domain validation and CAA from several network locations, so one hijacked network path cannot fool it.") - [Organization validation (OV)](https://pkizerotohero.com/handbook/glossary/#organization-validation "A TLS certificate check that confirms the organisation behind a domain, in addition to domain control.") - [PEM](https://pkizerotohero.com/handbook/glossary/#pem "A text format for certificates and keys: Base64-encoded DER between lines such as -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.") - [PKCS #12](https://pkizerotohero.com/handbook/glossary/#pkcs12 "A password-protected file format that bundles a private key with its certificate and chain, with the extension .p12 or .pfx.") - [PKCS #7](https://pkizerotohero.com/handbook/glossary/#pkcs7 "A container format, now called CMS, used for signed and encrypted data and for bundles of certificates without a private key (.p7b).") - [PKCS #8](https://pkizerotohero.com/handbook/glossary/#pkcs8 "The standard format for a single private key, optionally encrypted, shown in PEM as BEGIN PRIVATE KEY or BEGIN ENCRYPTED PRIVATE KEY.") - [PKI](https://pkizerotohero.com/handbook/glossary/#pki "Short for public key infrastructure: everything needed to issue, trust, check and revoke certificates that bind public keys to identities.") - [Private key](https://pkizerotohero.com/handbook/glossary/#private-key "The secret half of a key pair. Whoever holds it can sign as you or decrypt messages meant for you, so never share it.") - [Proof of possession](https://pkizerotohero.com/handbook/glossary/#proof-of-possession "Showing that you hold the private key for a public key, usually by signing something with it, as a CSR does.") - [Public key](https://pkizerotohero.com/handbook/glossary/#public-key "The shareable half of a key pair. Others use it to check your signatures or send you secrets only your private key opens.") - [Public key infrastructure (PKI)](https://pkizerotohero.com/handbook/glossary/#public-key-infrastructure "The people, policies, systems and standards that create, distribute, check and revoke certificates binding public keys to identities.") - [RSA](https://pkizerotohero.com/handbook/glossary/#rsa "The oldest widely used public-key algorithm, for signatures and encryption, based on the difficulty of factoring large numbers.") - [Serial number](https://pkizerotohero.com/handbook/glossary/#serial-number "A number, unique per CA, that identifies a certificate. Revocation lists and OCSP refer to certificates by it.") - [SPKI (SubjectPublicKeyInfo)](https://pkizerotohero.com/handbook/glossary/#spki "The certificate field that holds the subject's public key and its algorithm. Its hash identifies a key independently of any certificate.") - [Subject](https://pkizerotohero.com/handbook/glossary/#subject "The certificate field naming who or what the certificate was issued to, as a distinguished name.") - [Subject Alternative Name (SAN)](https://pkizerotohero.com/handbook/glossary/#subject-alternative-name "The certificate extension that lists the DNS names, IP addresses, email addresses or URIs the certificate is valid for.") - [Validity period](https://pkizerotohero.com/handbook/glossary/#validity-period "The time window between a certificate's notBefore and notAfter dates during which it may be accepted.") - [Wildcard certificate](https://pkizerotohero.com/handbook/glossary/#wildcard-certificate "A certificate for a name like *.example.com, which matches any single label in that position but not the bare domain or deeper names.") - [X.509](https://pkizerotohero.com/handbook/glossary/#x509 "The standard format for public-key certificates used in TLS, code signing, email and most other PKIs.") ## Other topics - [Chains and trust stores](https://pkizerotohero.com/topics/chains-and-trust/) - [TLS and HTTPS](https://pkizerotohero.com/topics/tls/) - [Lifecycle and automation](https://pkizerotohero.com/topics/lifecycle-and-automation/) - [Revocation and transparency](https://pkizerotohero.com/topics/revocation-and-transparency/) - [Private PKI](https://pkizerotohero.com/topics/private-pki/) - [Hashes and signatures](https://pkizerotohero.com/topics/signing/) - [Post-quantum cryptography](https://pkizerotohero.com/topics/post-quantum/)