X509 Certificates: The Guardians of Digital Trust

In today’s age, Internet plays a very important role in interconnecting the world. Over the internet the data flows like a river throughout the world. Once this data has left our system (computer, mobile, IOT devices etc.) then we have no control over it. The data sent or received by us is mainly of two types i.e. sensitive data and non-sensitive data. Just like you are reading this blog, this is non-sensitive data. But when you are doing a financial transition over the internet then it becomes the sensitive data and you will never like to compromise the integrity, authenticity, and confidentiality of your sensitive data.

To protect these, at the heart of the whole cyberspace lies the X509 certificates, the unsung heroes of the digital age. You may not have heard of them, but these seemingly innocuous digital tokens are the standing guard at the gates of our online world and prevents the threats of cyberattacks and data breaches. They are the invisible force that keeps your emails private, your financial transactions secure, and your web browsing safe.

Join us on a journey through the cryptic realm of X509 certificates, where we will unravel the secrets of these digital guardians and explore how they play a pivotal role in safeguarding the modern internet. Prepare to be amazed, as we unveil the technology that makes your digital life not only possible but also profoundly secure. Welcome to the fascinating world of X509 certificates – where cryptography meets the digital age.

Before we dive into the world of X509 certificates, let’s establish a solid foundation by introducing key concepts that are essential to understanding them:

Certificate Authority (CA)

A Certificate Authority (CA) is a trusted organization or entity that is responsible for issuing, managing, validating, and revoking digital certificates. These trusted entities play a central role in the issuance and management of the digital certificates by ensuring that individuals and organizations are who, what they claim to be in the digital realm. [You can read in detail about the CA on this page]

Public Key Infrastructure (PKI)

A Public Key Infrastructure (PKI) is a comprehensive framework is made-up of 3 entities i.e. Certificate-Authority, Server & Client. PKI plays a critical role in ensuring data confidentiality, integrity, and authenticity, making it a fundamental technology for secure online transactions, email encryption, secure web browsing, and a wide range of other digital applications.

Certificate

A certificate is a digital document that acts as a kind of online identification card or credential. It contains important information and is used primarily for two purposes: authentication and encryption. X509 is a type of certificate.

1. Authentication: Just like an ID card proves your identity in the physical world, a digital certificate proves the identity of a device, or website in the online world. It includes details like a unique serial number, the name of the certificate holder (such as a website domain or an individual’s name), a public key (a special code for secure communication), and the name of the Certificate Authority (CA) that has issued it. When you connect to a secure website (https://), your web browser checks the website’s certificate to make sure it’s really the site it claims to be. If the certificate checks out, you can trust that you’re communicating with the real website and not an imposter.

2. Encryption: Certificates are also used for encryption, which is like putting your information in a secret box that only the intended recipient can open. When you send encrypted data, you use the recipient’s public key (found in their certificate) to lock the box. Only they have the matching private key (also in their certificate) to unlock and read the message. This ensures that even if someone intercepts the data, they can’t understand it because they don’t have the private key. It’s like sending a letter in a sealed envelope, but only the person with the right key can open it.

Certificate Lifecycle

The certificate lifecycle is the journey of a certificate in the online world. It goes through different stages from creation to expiration.

1. Creation: Just like getting a new ID card, the certificate is born when someone or something wants to be trusted online. A Certificate Authority (CA) verifies the identity, generates a unique key pair (one secret, one public), and creates the certificate with all the necessary information. It’s like giving the ID card a name, photo, and personal details.

2. Active Life: Once issued, the certificate is active and ready for use. It’s like your ID card being valid and allowing you to access secure websites or send encrypted emails. During this time, the certificate helps secure online communication by proving who you are or protecting data from prying eyes.

3. Renewal: As time goes by, the certificate’s expiration date gets closer, just like an ID card needing renewal. To keep things secure, you may need to renew the certificate before it expires. This usually involves getting a new certificate from the CA. It’s like getting a new ID card with an updated photo and information.

4. Revocation: Sometimes, certificates need to be canceled before they expire. This is called revocation and happens if the certificate is compromised or no longer needed. Think of it as reporting a lost ID card to the authorities.

Now we have the basic understanding of the certificates and other entities that play important roles. So, we can now jump to X509 and understand it in deep.

What Is X509 Certificate

X509 is an International Telecommunication Union (ITU) standard defining the format of public key certificates. It is widely used PKI standard to verify public keys of user/computer/websites/IOT devices etc. The primary purpose of X509 certificate is to verify and vouch for the identity of individuals/devices/ servers/organizations/IOT-devices etc in online interactions. They achieve this by binding a set of identity information (such as a website’s domain name or an individual’s name) to a unique public key. This binding is cryptographically signed by a trusted Certificate Authority (CA), which acts as a digital notary.

A X509 certificate have mainly 2 segments.

Certificate Data

This section contains the actual data about the entity or object being certified. It includes details like the entity’s name, public key, validity period, and other identifying information. The primary purpose of this segment is to provide the recipient with the necessary information to validate the certificate and establish trust. This segment also has the issuer information. It includes details about the CA’s name and digital signature. The recipient of the certificate can use this information to verify the certificate’s authenticity and ensure it was issued by a trusted CA.

Let us now understand each section of the certificate Data.

Version

Version: 3 (0x2)

It specifies what version of X509 is used while creating this certificate. Till today, 3 versions of X509 are available.

• 0x00: Version 1
• 0x01: Version 2
• 0x02: Version 3

Version 3 is most common used and recommended version of X509.

Serial Number

Serial Number:
            34:9b:c8:bf:bc:a9:5b:d2:10:1d:a0:3b:3f:af:4c:cf

The serial number is 20 bytes (where each byte separated by : ). This is the unique serial number issued by a CA. Every CA can generate 20 bytes serial number but that should be unique. It can be possible that the serial number of 2 certificates can be same only if those 2 certificates are issues by 2 different CA’s. CA’s track record of each certificate by using the serial number.

Signature Algorithm

Signature Algorithm: sha256WithRSAEncryption

It is the algorithm used by the CA to generate the certificate’s Signature. In above example “sha256WithRSAEncryption” is used to generate the signature. If we pay close attention to it then we can see that there are 2 information in the algorithm mentioned in the ‘signature algorithm’

1. Hashing algorithm: Here SHA256 is the hashing algorithm. SHA256 is considered strong hashing algorithm. MD5, SHA1, RIPEMD & RIPEMD-128 etc. are considered weak algorithm.
2. Encryption Algorithm: Here RSA Encryption algorithm is used in above mentioned certificate.

Issuer

Issuer: C = US, O = Google Trust Services LLC, CN = GTS CA 1C3

It tells the name of the CA that has issued the certificate. In the above example “Google Trust Services LLC” has issued this certificate. This section has some subsections

• C – Country
• ST – State
• L – Location
• O – Organization
• CN – Common Name

These attributes are known as DN i.e. distinguished Name.

Validity

Validity
            Not Before: Sep  4 08:23:29 2023 GMT
            Not After : Nov 27 08:23:28 2023 GMT

This section of certificate-data tells us about the validity. Just like any physical ID card, the digital certificate also has validity. This segment informs the user of the certificate that this certificate must be used in-between the time frame mentioned in “Not Before” and “Not After”

Subject

This segment gives the information about the entity to whom this certificate is issue. It can have CN and other optional DNs as mentioned in the issuer section.

You can read RFC 4519 for more details about DN.

Subject Public Key Info

Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:34:43:2f:58:06:34:4d:14:db:d3:0e:59:c5:b5:1b:5f:f6:7e:11:cb:e2:13:9d:12:cd:0c:ef:3f:fc:72:c9:52:1a:51:13:38:03:42:5e:af:d2:09:3b:fe:88:ab:aa:36:01:f0:d7:53:1a:dd:04:aa:52:ce:5c:da:78:50:9a:aa
                ASN1 OID: prime256v1
                NIST CURVE: P-256

Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
00:ce:30:90:d7:12:e4:3f:58:26:57:8d:c2:28:19:bd:5d:d0:c4:43:ab:58:38:8d:ea:a9:72:ee:ae:d5:78:dc:6d:5b:05:90:31:31:f1:37:64:51:95:09:17:70:37:51:4d:db:58:e8:cb:07:37:72:0a:b0:93:68:b0:9a:b2:3d:c9:b1:3d:00:f4:3e:3a:a2:d6:6b:ca:ee:50:35:67:ed:9a:72:78:16:97:20:8d:6d:e0:b0:ba:8f:18:ab:9b:f4:3a:36:88:39:db:7c:77:c4:e2:7e:36:f7:92:f4:49:69:29:96:d9:ba:0d:cb:05:80:1e:c9:89:c2:b0:8f:93:29:7c:33:e4:3d:4f:5a:30:bb:9b:35:8c:51:44:55:24:fb:15:53:e3:b1:65:c8:c1:7c:a2:45:da:7e:74:d3:12:2e:3f:80:24:ae:f:d3:1a:3e:47:13:03:60:b5:92:76:91:c6:f2:44:9d:7a:a5:11:cf:ff:12:30:12:42:7c:90:e4:70:04:37:d0:84:af:b8:60:da:59:7b:46:57:41:2a:f8:53:65:65:a7:91:6b:cb:d9:19:ea:0a:33:54:6b:63:0e:53:3d:ea:d4:b9:44:9f:e8:c6:2b:4e:7c:63:45:e4:5c:45:72:52:f7:e9:b9:99:a8:16:16:51:49:e0:aa
                Exponent: 65537 (0x10001)

This segment is crucial for various cryptographic operations, including encryption, digital signatures, and secure communication. Here’s a breakdown of what “Subject Public Key Info” includes:

1. Public Key: This is the heart of the “Subject Public Key Info” segment. It contains the actual public key of the entity or object for which the certificate is issued. The public key is used for encrypting data that only the holder of the corresponding private key can decrypt and for verifying digital signatures made with the private key.
2. Algorithm Identifier: This part specifies the cryptographic algorithm used to create the public key. Common algorithms include RSA, DSA (Digital Signature Algorithm), or ECC (Elliptic Curve Cryptography). This identifier ensures that the recipient knows how to correctly use the public key.

In above given example,

• on LHS cert, It has used id-ecPublicKey algorithm. The 256 Bit public key and type of Curve is also mentioned.
• on RHS cert, It has used rsaEncryption algorithm. The Modulus and Exponent is also mentioned in this section which are used in RSA ENcryption.

X509v3 extensions:

X509v3 extensions are additional fields or components that can be included in X509 certificates to provide extra information and functionalities beyond the basic certificate structure. These extensions enhance the flexibility and utility of X509 certificates in various applications. Here’s an explanation of X509v3 extensions and their significance:

1. Basic Constraints: This extension helps define whether the certificate represents a Certificate Authority (CA) or an end entity (e.g., a user or server). It specifies whether the certificate can be used to sign other certificates, establishing the certificate’s role in the Public Key Infrastructure (PKI).
2. Key Usage: This extension indicates how the public key in the certificate can be used. It defines whether the key is suitable for digital signatures, encryption, or other purposes. For example, a certificate may be marked for key encipherment only, making it suitable for encrypting data but not for signing messages.
3. Extended Key Usage (EKU): EKU extension specifies specific purposes or applications for which the certificate’s public key can be used. For instance, it can indicate that the certificate is intended for use in securing email communication (e.g., S/MIME) or client authentication in SSL/TLS.
4. Subject Alternative Name (SAN): The SAN extension allows for the inclusion of additional identities or domain names associated with the certificate holder. This is particularly useful in multi-domain SSL certificates, where a single certificate can secure multiple domains or subdomains.
5. Authority Key Identifier (AKI): This extension assists in identifying the public key associated with the issuing CA. It helps establish the link between certificates in a certificate chain, which is important for certificate validation.
6. Subject Key Identifier (SKI): The SKI extension provides a unique identifier for the public key within the certificate. It can be used to quickly locate the matching private key when managing certificates in a key pair.
7. CRL Distribution Points (CDP): CDP extension specifies the locations where the Certificate Revocation List (CRL) associated with the certificate can be found. CRLs are used to identify revoked certificates, helping to maintain the security of the PKI.
8. Authority Information Access (AIA): AIA extension provides information on how to access the CA’s certificate and additional services. This is helpful for certificate validation, as it allows the recipient to retrieve the issuer’s certificate for verification.
9. Certificate Policies: This extension defines the policies and practices under which the certificate was issued. It helps recipients understand the trustworthiness and intended usage of the certificate.
10. TLS/SSL Specific Extensions: For SSL/TLS certificates, additional extensions like the “Subject Alternative Name” (SAN) are particularly significant. They allow a single certificate to secure multiple domain names, which is crucial for web servers hosting multiple websites.

These X509v3 extensions provide a way to customize and enhance the functionality of certificates, making them more adaptable to various use cases and security requirements in the digital world.

Signature

X509 certificates are digitally signed by the CA to ensure their integrity and authenticity. The digital signature is a cryptographic checksum generated using the CA’s private key, and it covers the certificate’s contents. The recipient can use the CA’s public key to verify the signature, ensuring that the certificate has not been tampered with and was indeed issued by the claimed CA.

If we pay attention, then there are 2 parts of this segment.

1. Signature Algorithm: sha256WithRSAEncryption i.e. it tells that sha256WithRSAEncryption is used to encrypt the digest of the certificate.
2. The second part is prepared by below method
   • The Hash of the certificate data is calculated. Here it has used SHA256 to calculate the hash.
   • The Hash is then encrypted using the public key of the CA.

We can also observe that the Signature Algorithm is mentioned in the certificate data also. It needs to be mentioned at both the places. (why… it is a homework to you, just think and comment in the comment section).

Types of Public Key certificate

There are two primary types of public-key certificates, end-entity public-key certificates and CA certificates.

An end-entity public-key certificate is a public-key certificate issued by a CA to an entity acting as a PKI end entity that cannot use the corresponding private key to sign other public-key certificates.
A CA certificate is a public-key certificate issued by a CA to an entity that is also acting as a CA and therefore is capable of issuing and signing public-key certificates.
CA certificates can themselves be categorized by the following types:

• Self-issued certificate – This is a CA certificate where the issuer and the subject are the same CA. A CA might use self-issued certificates, for example, during a key rollover operation to provide trust from the old key to the new key.
• Self-signed certificate – This is a special case of self-issued certificates where the private key used by the CA to sign the certificate corresponds to the public key that is certified within the CA certificate. A CA might use a self-signed certificate, for example, to advertise their public key or other information about their operations.
• Cross-certificate – This is a CA certificate where the issuer and the subject are different CAs. CAs issue certificates to other CAs either as a mechanism to authorize the subject CA’s existence (e.g., in a strict hierarchy) or to recognize the existence of the subject CA (e.g., in a distributed trust model). The cross-certificate structure is used for both of these.