Certificates and Certification

The distribution of the public component, if not undertaken correctly, would defeat the objectives of a PKI. Therefore two mechanisms are required, firstly data integrity to ensure that the contents of the public key (and any other info attributed to it) is not modified without detection. Secondly a mechanism that binds the public key to the claimed owner is also required.

This is achieved using a public key certificate. There are numerous different types of certificates, but the most common and the one normally referred to as a certificate or digital certificate, is an X.509 public key certificate (RFC 3647).

An X.509 certificate contains the following information:

• Version
• Serial Number
• Signature – the algorithm identifier
• Issuer – the distinguished name (DN) of the CA that issued the signature
• Validity – the time window that the certificate should be considered valid
• Subject – The DN of the certificate owner
• Subject public key info – the public key and (algorithm identifier)
• Issuer Unique ID – rarely used