<< Back to article

Certification

Digital certificates bind public keys to identities, enabling trust in digital communications. They are issued by Certificate Authorities (CAs) and form the foundation of Public Key Infrastructure (PKI).

X.509 Certificates

The X.509 standard defines the format of public key certificates. A certificate contains:

  • Subject: The entity the certificate identifies (domain, organisation, person).
  • Public Key: The public key associated with the subject.
  • Issuer: The CA that issued the certificate.
  • Validity Period: Not Before and Not After dates.
  • Serial Number: Unique identifier assigned by the CA.
  • Signature Algorithm: The algorithm used to sign the certificate.
  • Signature: The CA's digital signature over the certificate data.
  • Extensions: Subject Alternative Names (SAN), Key Usage, Extended Key Usage, etc.

Certificate Chain

Certificates form a chain of trust:

  1. Root CA certificate: Self-signed, distributed in trust stores (browsers, OS).
  2. Intermediate CA certificates: Issued by root CAs, used to sign end-entity certificates.
  3. End-entity certificate: Issued to servers, users, or devices.

When a client verifies a server certificate, it traces the chain up to a trusted root CA.

Certificate Formats

  • PEM: Base64-encoded ASCII with -----BEGIN CERTIFICATE----- headers. Used by Apache, Nginx, OpenVPN.
  • DER: Binary encoding. Used by Java keystores and Windows.
  • PKCS#12/PFX: Binary format storing certificate + private key + CA chain. Used for import/export.
  • P7B/P7C: Certificate chain without private key.

OpenSSL Basics

# Generate private key
openssl genrsa -out server.key 2048

# Generate CSR (Certificate Signing Request)
openssl req -new -key server.key -out server.csr

# Generate self-signed certificate
openssl req -x509 -key server.key -out server.crt -days 365

# View certificate details
openssl x509 -in server.crt -text -noout

# Verify certificate chain
openssl verify -CAfile ca.crt server.crt

Let's Encrypt

Let's Encrypt provides free, automated TLS certificates. Use certbot to obtain and renew certificates:

certbot certonly --standalone -d example.com -d www.example.com
certbot renew                    # Renew all certificates

Certificates are stored in /etc/letsencrypt/live/.

Certificate Revocation

Certificates may be revoked before expiration:

  • CRL (Certificate Revocation List): Periodic list of revoked serial numbers.
  • OCSP (Online Certificate Status Protocol): Real-time query to CA for certificate status.

Public Key Pinning

Pin a certificate's public key or issuer to prevent MITM attacks with rogue certificates. Use with caution—pin to a backup key to avoid lockout.