Protocols & Standards
What Is X.509 Certificate Standard?
X.509 is the ITU standard (profiled for the Internet by RFC 5280) that defines the structure of digital certificates: which fields a certificate contains, how extensions work, and how chains are validated. Every TLS certificate, S/MIME certificate, code-signing certificate and smart-card certificate is an X.509 certificate.
Anatomy of an X.509 certificate
The core fields are: subject (who the certificate identifies) and issuer (the CA that signed it), a serial number unique per CA, validity dates (notBefore/notAfter), the subject’s public key, and the CA’s signature over all of it. Version 3 added extensions, where the real policy lives: Subject Alternative Names, Key Usage and Extended Key Usage, Basic Constraints (is this a CA?), CRL Distribution Points and Authority Information Access (where to check revocation).
Encoding: ASN.1 and DER
X.509 certificates are defined in ASN.1 and encoded as DER — the binary you see base64-wrapped in PEM files. This is why certificate parsing is precise but unforgiving: one wrong byte and the structure is invalid. Decoding tools exist precisely to translate this structure into something humans can review.
Validation is more than a signature
A relying party checks far more than the signature chain: are the validity dates current, does the hostname match a SAN, is the certificate revoked, do Basic Constraints allow the chain shape, are Key Usages appropriate for the operation? Most "certificate errors" in the wild are violations of one of these rules — and decoding the certificate shows which.
Try it yourself — free tools
- Certificate Checker — decode every X.509 field and extension of a certificate
- CSR Decoder & Analyzer — inspect the request that becomes an X.509 certificate
How MI Support IT can help
PKI Tools is built by MI Support IT, a Danish IT company with deep specialization in enterprise PKI: ADCS design and health checks, Venafi certificate automation, key ceremonies and CP/CPS documentation. Read about our PKI services or get in touch.
PKI Glossary
- Subject Alternative Name (SAN)The certificate extension that lists every hostname, IP or email address a certificate is valid for.
- Certificate Chain (Intermediate Certificates)How leaf, intermediate and root certificates link together — and why a missing intermediate breaks TLS.
- Certificate Formats (PEM, DER, P7B, PFX)PEM, DER, P7B and PFX explained — the same certificate in different wrappers, and how to convert between them.
- Browse all terms →