Cryptology Academy · Lesson

What Is a Certificate? X.509 Structure

Decode the fields inside an SSL/TLS certificate.

Lesson 1 of 413 steps

What Is a Certificate? X.509 Structure is a free Cryptology Academy lesson on CoddyKit. This is lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, and your progress syncs across the web and the CoddyKit app. The Cryptology Academy course includes 4 lessons in total.

Welcome

An X.509 certificate binds a public key to an identity. It is the foundation of HTTPS, email encryption, and code signing. Let's decode every field.

What Problem Do Certificates Solve?

Anyone can generate an RSA key pair. Without certificates, an attacker could substitute their public key for Google's. A certificate is a CA-signed proof that a public key belongs to a specific entity.

X.509 Certificate Fields

Version (v3), Serial Number (unique per CA), Issuer (CA identity), Validity period (Not Before/Not After), Subject (owner identity), Subject Public Key Info, Extensions, Signature Algorithm, Signature.

Subject Name (DN)

Distinguished Name uses LDAP-style attributes: CN=example.com (Common Name) O=Example Corp (Organization) C=US (Country) For modern TLS, the Subject Alternative Name (SAN) extension carries the actual hostnames.

Subject Alternative Names (SAN)

SANs list all hostnames/IPs covered by the certificate: DNS:example.com DNS:www.example.com DNS:*.api.example.com Browsers require SANs since 2017; the CN field is ignored for hostname validation.

Validity Period

Not Before: earliest valid date. Not After: expiration date. Let's Encrypt issues 90-day certs to force regular renewal (limits damage from compromise). Most commercial CAs offer 1-2 year certs.

Public Key in the Certificate

The certificate contains the subject's public key in SubjectPublicKeyInfo: - Algorithm: rsaEncryption or id-ecPublicKey - Key: DER-encoded public key bytes This is the key used for TLS key exchange or signature verification.

Reading a Certificate with OpenSSL

# Inspect certificate from HTTPS site: openssl s_client -connect google.com:443 < /dev/null 2>/dev/null | openssl x509 -text -noout # Or from file: openssl x509 -in cert.pem -text -noout

DER vs PEM Encoding

DER: binary ASN.1 encoding of the certificate structure. PEM: Base64-encoded DER wrapped in -----BEGIN CERTIFICATE----- headers. PEM is human-readable and used by web servers. DER is compact for devices.

Certificate Extensions v3

Key extensions: - Basic Constraints: isCA (true/false) and pathLen - Key Usage: digitalSignature, keyEncipherment, etc. - Extended Key Usage: serverAuth, clientAuth, codeSigning - Subject Key Identifier (SKI) and Authority Key Identifier (AKI)

Wildcard Certificates

A wildcard certificate (*.example.com) covers all first-level subdomains: api.example.com, www.example.com, etc. It does NOT cover sub-subdomains (deep.api.example.com).

Quick Check

What field in an X.509 v3 certificate contains the list of valid hostnames for TLS?

Answer it in the interactive lesson

Recap

You can read and understand X.509 certificates. Next we study how certificate authorities and trust chains validate those certificates.

Free to start

Learn Cryptology Academy with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses: 67
Lessons: 261

Start learning free View the full course

Frequently Asked Questions

Is the “What Is a Certificate? X.509 Structure” lesson free?

Yes — the full text of “What Is a Certificate? X.509 Structure” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO. The Cryptology Academy course includes 4 lessons in total.

What will I learn in “What Is a Certificate? X.509 Structure”?

Decode the fields inside an SSL/TLS certificate. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 1 of 4.

How long does the “What Is a Certificate? X.509 Structure” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cryptology Academy