0Pricing
Cryptology Academy · Lesson

What Is a Certificate? X.509 Structure

Decode the fields inside an SSL/TLS certificate.

What Is a Certificate? X.509 Structure is a free Cryptology Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Welcome

An X.509 certificate binds a public key to an identity. It is the foundation of HTTPS, email encryption, and code signing. Let's decode every field.

What Problem Do Certificates Solve?

Anyone can generate an RSA key pair. Without certificates, an attacker could substitute their public key for Google's. A certificate is a CA-signed proof that a public key belongs to a specific entity.

X.509 Certificate Fields

Version (v3), Serial Number (unique per CA), Issuer (CA identity), Validity period (Not Before/Not After), Subject (owner identity), Subject Public Key Info, Extensions, Signature Algorithm, Signature.

Subject Name (DN)

Distinguished Name uses LDAP-style attributes: CN=example.com (Common Name) O=Example Corp (Organization) C=US (Country) For modern TLS, the Subject Alternative Name (SAN) extension carries the actual hostnames.

Subject Alternative Names (SAN)

SANs list all hostnames/IPs covered by the certificate: DNS:example.com DNS:www.example.com DNS:*.api.example.com Browsers require SANs since 2017; the CN field is ignored for hostname validation.

Validity Period

Not Before: earliest valid date. Not After: expiration date. Let's Encrypt issues 90-day certs to force regular renewal (limits damage from compromise). Most commercial CAs offer 1-2 year certs.

Public Key in the Certificate

The certificate contains the subject's public key in SubjectPublicKeyInfo: - Algorithm: rsaEncryption or id-ecPublicKey - Key: DER-encoded public key bytes This is the key used for TLS key exchange or signature verification.

Reading a Certificate with OpenSSL

# Inspect certificate from HTTPS site: openssl s_client -connect google.com:443 < /dev/null 2>/dev/null | openssl x509 -text -noout # Or from file: openssl x509 -in cert.pem -text -noout

DER vs PEM Encoding

DER: binary ASN.1 encoding of the certificate structure. PEM: Base64-encoded DER wrapped in -----BEGIN CERTIFICATE----- headers. PEM is human-readable and used by web servers. DER is compact for devices.

Certificate Extensions v3

Key extensions: - Basic Constraints: isCA (true/false) and pathLen - Key Usage: digitalSignature, keyEncipherment, etc. - Extended Key Usage: serverAuth, clientAuth, codeSigning - Subject Key Identifier (SKI) and Authority Key Identifier (AKI)

Wildcard Certificates

A wildcard certificate (*.example.com) covers all first-level subdomains: api.example.com, www.example.com, etc. It does NOT cover sub-subdomains (deep.api.example.com).

Quick Check

What field in an X.509 v3 certificate contains the list of valid hostnames for TLS?

Recap

You can read and understand X.509 certificates. Next we study how certificate authorities and trust chains validate those certificates.

Frequently asked questions

Is the “What Is a Certificate? X.509 Structure” lesson free?

Yes — the full text of “What Is a Certificate? X.509 Structure” is free to read here on the web, and the Cryptology Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO.

What will I learn in “What Is a Certificate? X.509 Structure”?

Decode the fields inside an SSL/TLS certificate. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “What Is a Certificate? X.509 Structure” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. What Is a Certificate? X.509 Structure
  2. Certificate Authorities & Trust Chains
  3. Certificate Revocation: CRL & OCSP
  4. Creating Self-Signed Certs with OpenSSL
← Back to Cryptology Academy