X.509 Certificate
Definition
A digitally signed data structure that binds a public key to a named identity (subject) and is issued by a Certificate Authority. Contains the subject's name and public key, validity period, issuing CA's name and signature, and extension fields for usage constraints and revocation endpoints.
- Binds
- A public key to a named subject identity
- Issued by
- A Certificate Authority (CA)
- Key fields
- Subject name, public key, validity period, CA signature
- Revocation check
- CRL or OCSP endpoint listed in extensions
Common questions
What forensic use does an X.509 certificate have in an e-signature case?+
The certificate lets an examiner verify who a digital signature claims to belong to and whether a trusted CA vouched for that claim at signing time; checking the certificate chain and revocation status as of the signing timestamp establishes whether the signature was trustworthy then.
Why does certificate revocation status matter after the fact?+
A signature made while a certificate was valid remains valid evidence of identity even if the certificate is later revoked, so examiners check CRL or OCSP status as of the signing timestamp rather than the current date, avoiding wrongly flagging a legitimate historical signature.
What is the difference between a self-signed certificate and a CA-issued one?+
A self-signed certificate is signed by its own private key with no third party vouching for the claimed identity, proving key possession but not control; a CA-issued certificate carries an independent CA's signature, giving the identity claim external verification.
Related terms
- Aadhaar E-Sign
- India's authentication-linked electronic signature service in which the user's Aadhaar biometric or OTP authentication triggers the generation of a short-validity signing certificate...
- ESIGN Act (Electronic Signatures in Global and National Commerce Act)
- US federal legislation (2000) providing that no electronic signature may be denied legal effect solely because it is in electronic form. Technology-neutral:...
- EU Trusted List (EUTL)
- The authoritative list maintained by the European Commission listing all Trust Service Providers per EU member state that are supervised to issue...
- Long-Term Validation (LTV)
- A PDF signature profile (PAdES-LTV, ETSI EN 319 102-1) in which the OCSP responses, CRL data, and TSA certificate chain information are...
- OCSP (Online Certificate Status Protocol)
- A real-time certificate revocation protocol in which the verifier queries the CA's OCSP responder with the certificate's serial number and receives a...
- Public Key Infrastructure (PKI)
- The system of hardware, software, policies, and standards that manage digital certificates and public-key encryption. Provides the trust architecture underpinning all cryptographic...
- QSCD (Qualified Signature Creation Device)
- A hardware or remote HSM-based device that stores the signer's private key such that it cannot be extracted, ensuring sole control under...
- Qualified Electronic Signature (QES)
- The highest tier of electronic signature under EU eIDAS Regulation 910/2014. Created by a Qualified Signature Creation Device (QSCD), backed by a...
- TSA Timestamp (Timestamp Authority)
- A cryptographically protected record of the time at which a signature was created, issued by a Timestamp Authority (TSA) whose own certificate...