Visual RFC.
ALL RFCs / RFC 5280
Read the RFC ↗

RFC 5280 / START HERE

X.509 certificates, before the details

X.509 certificates and PKI

A certificate binds a public key to information about its subject, under an issuer's signature. PKI means Public Key Infrastructure: the surrounding system for issuing and validating these bindings.

Start the guide See the 5 chapters ↓

The idea in one picture

  1. An issuer signs a certificate

  2. Certificates form a trust chain

  3. A recipient validates the binding

A simplified picture of the idea; the chapters explain the actual mechanisms.

Why it exists

Knowing a public key is not enough; a recipient needs a reason to trust its binding and a way to evaluate the certificate chain.

A familiar example

A browser evaluates a server certificate's chain and validity as part of deciding whether to trust a secure connection.

Helpful background

You can start here without reading another RFC. The guide introduces its essential concepts as you go.

What you’ll learn next

Begin with chapter one, or choose a topic.

  1. A certificate binds a public keyThe signed certificate body binds a subject and other information to a public key.
  2. A chain ends at configured trustPath validation starts with a trusted anchor and processes certificates toward the target.
  3. Extensions constrain authorityExtensions limit how a certificate or subordinate CA can be used.
  4. Validity is a bounded intervalA certificate’s notBefore and notAfter fields describe its validity period.
  5. Revocation is separate evidenceA CRL is signed, time-bounded status information issued by an authorized CRL issuer.
Start with chapter one →

This introduction explains RFC 5280 (2008). Read the original RFC ↗