X.509

X.509 is an international standard for public-key certificates and related revocation data structures, most commonly used to support PKI for TLS, secure email, and other authentication and signing systems. In practice, “X.509 certificate” usually refers to an X.509 version 3 certificate encoded using Abstract Syntax Notation One (ASN.1) and commonly serialized using Distinguished Encoding Rules (DER), as profiled for Internet use by the IETF in RFC 5280.

Background and standardization

X.509 originated in the ITU-T X.500 series (directory services) and is jointly published as ITU-T Recommendation X.509 and ISO/IEC 9594-8. The standard defines frameworks for both a public-key infrastructure (PKI) and a privilege management infrastructure (PMI), including data types such as public-key certificates, attribute certificates, Certificate Revocation Lists (CRLs), and attribute certificate revocation lists (ACRLs).

For Internet deployment, the IETF’s PKIX work produced a widely used profile that constrains and clarifies how X.509 certificates and CRLs are represented and validated in Internet protocols, particularly via RFC 5280 and later updates (e.g., RFC 6818).

Core concepts

An X.509 public-key certificate binds an asserted identity (the “subject”) to a public key, using a digital signature from an issuer (typically a Certificate Authority). X.509 certificates support validation through a chain of issuers up to one or more trust anchors (e.g., root certificates distributed via software trust stores).

X.509 also defines revocation structures, primarily:

• Certificate Revocation Lists (CRLs): signed lists of revoked certificate serial numbers and related metadata.
• Attribute certificates (PMI): certificates that bind authorization attributes to a holder, distinct from binding a public key to a name.

Certificate structure

RFC 5280 profiles the X.509 v3 certificate for Internet use and specifies required and recommended behaviors for certificate processing. At a high level, an X.509 v3 certificate contains:

• Issuer and Subject names (distinguished names), represented using X.500 naming conventions.
• Subject public key information (algorithm identifier and public key).
• Validity period (notBefore / notAfter).
• Serial number and signature (algorithm + signature value from the issuer).
• Extensions (v3), which allow additional constraints and semantics.

Commonly used extensions in Internet profiles include constraints on how a certificate may be used and how it may issue other certificates (e.g., basicConstraints, keyUsage, extendedKeyUsage), as well as name forms such as DNS names carried in Subject Alternative Name for certificates used to authenticate domain names.

Internet deployment profile (PKIX)

RFC 5280 is the principal interoperability profile for X.509 in Internet protocols, covering certificate and CRL syntax, name forms, extension processing rules, and a baseline path validation algorithm. RFC 6818 updates RFC 5280 with targeted clarifications (including aspects of name handling relevant to internationalized labels) and additional guidance on trust anchors and self-signed certificates.

While X.509 is broader than the Web PKI, public TLS certificates used by web browsers are typically constrained further by ecosystem rules. For example, the CA/Browser Forum’s Baseline Requirements specify that publicly trusted TLS certificates must be X.509 v3 and define detailed profile requirements that build on the IETF profile and browser root program policies.

Governance and operational relevance

X.509 is not an ICANN standard, but it intersects operationally with the Domain Name System because the Web PKI commonly authenticates control over DNS names (for HTTPS and other TLS-based services) using certificates that carry domain name identifiers and validation constraints per Internet profiles and ecosystem rules. This creates an interdependent environment involving standards bodies (ITU-T/ISO and IETF); browser and operating system trust stores (distribution of trust anchors); industry governance mechanisms such as the CA/Browser Forum for publicly trusted certificate issuance profiles.

See also

• Let's Encrypt

X.509 Public Key Infrastructure for the Internet (RFC 5280).

Allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery (RFC 8446).

Internet Engineering Task Force

International Telecommunication Union Telecommunication Standardization Sector

International Organization for Standardization

Request For Comments. Archival series dedicated to documenting Internet technical specifications, including general contributions from the Internet research and engineering community as well as standards documents (RFC Editor Model, Version 3).

HTTP over Transport Layer Security (TLS), distinguishing secured traffic from insecure traffic by the use of a different server port (RFC 2818).