Title: So What is a PKI Certificate?
Course: Introduction to SSL/PKI > Section: PKI

What is a PKI certificate?

What Does A Certificate Do?

A PKI certificate is basically a collection of identifying information bound together with a public key and signed by a trusted third party to prove its authenticity. X.509 is the standard format for digital certificates, although there are other, specialized formats.

A PKI certificate binds a public key to a particular Distinguished Name (DN) in a directory, and/or to an alternative name such as an email address (tom@xyz.com) or a DNS-entry (www.xyz.com).

What does A Certificate A Contain?

- Certificate format
- Identity of the issuing CA
- Identity of the subscriber
- The public key corresponding to a private key under the control of the subscriber
- Date issued
- Date expires
- Certificate serial number
- Certificate usage

Why Is A PKI Certificate Is Signed By The Issuing CA?

The signature provides...

- Proof that the certificate was created by the CA
- Proof that the certificate has not been modified since it was created and signed

Note: If you trust the CA you trust the certificate.

What Does A Certificate Look Like?

There are several different encoding formats

DER (Distinguished Encoding Rules)
- This is a BINARY format
- ASN.1 format

PEM (Privacy Enhanced Mail)
- This is a TEXT format
- BASE-64 ASCII text encoding of DER formatted ASN.1
- PEM formats always have BEGIN and END lines
- Many applications require PEM encoded certificates
For example:

-----BEGIN TRUSTED CERTIFICATE---
MIIC4zCCAkygAwIBAgIBADANBgkqhkiG9w0BAQQFADBbMQswCQYDVQQGEwJVUzET
MBEGA1UECBMKQ2FsaWZvcm5pYTERMA8GA1UEBxMIUGFzYWRlbmExEjAQBgNVBAoT
CVNTTC1DbGFzczEQMA4GA1UEAxMHVGVzdCBDQTAeFw0wNzA0MDkxODA2MjVaFw0x
NzAxMDYxODA2MjVaMFsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlh
MREwDwYDVQQHEwhQYXNhZGVuYTESMBAGA1UEChMJU1NMLUNsYXNzMRAwDgYDVQQD
EwdUZXN0IENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDKs+/2MkSNuWX3
rR2bhgSrwsA7gI8jNsJgkaz2qIoccPSc75yZVGel0NyfQ9iSs4VlhMBXDRteBZNG
sm/9NNn1df+a/QGh04VOdyxg3j3J7LLIXy5hrLu/OaThVyEkkUNQcyj+Gg7fxpbR
xv6si+r8PqkUkgFrBtcZeGA+l7ph8wIDAQABo4G2MIGzMB0GA1UdDgQWBBRHKNQx
yqpWsg83VKJyBEWpKcU0XDCBgwYDVR0jBHwweoAURyjUMcqqVrIPN1SicgRFqSnF
NFyhX6RdMFsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMREwDwYD
VQQHEwhQYXNhZGVuYTESMBAGA1UEChMJU1NMLUNsYXNzMRAwDgYDVQQDEwdUZXN0
IENBggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAak21PTXUozKK
wSXfLjIacN3imyv+X6m7+lSPmgbg4DnFDWbMVp8wgZs/MdWkf5AK+wq5eSWmpQA9
97PUVqlnctNlknnR6qw/JmtE+Q446BvEsYCQ18HZVCDTudfcrTrzLocbDakKoWNE
Txs4rx/2TL5M5oVI0f7Ub1k8YK9zu20=
-----END TRUSTED CERTIFICATE-----