X.509: The Digital ID Card
X.509 is a standard format for digital certificates — like an official ID card that proves a website or a service is who they say they are on the internet.
What is X.509?
Imagine someone says "Hi, I'm the real bank.com!" How do you know they're telling the truth?
An X.509 certificate is like a passport or driver's license for websites. It contains identifying information, a public key, validity dates, and a signature from a trusted authority to prove authenticity.
What is a digital certificate?
- Website name (e.g., www.example.com)
- Owner or organization info
- Expiration dates
- Public key used for encryption
- Digital signature from a Certificate Authority (CA)
How does X.509 work?
- You visit a website (e.g., https://www.bank.com).
- The website presents its X.509 certificate to your browser.
- Your browser checks: Is it signed by a trusted CA? Is it expired? Does the name match?
- If valid → browser shows a lock 🔒. If not → browser shows a warning.
What's inside an X.509 certificate?
- Subject: Who the certificate is for (the website)
- Issuer: The CA that issued the certificate
- Validity period: Start and end dates
- Public key: For encrypting data to the site
- Digital signature: CA’s cryptographic seal proving authenticity
- Serial number: Unique identifier
Who issues X.509 certificates?
Trusted organizations called Certificate Authorities (CAs) issue certificates after verifying the requester. Examples: Let's Encrypt, DigiCert, GlobalSign.
Types of X.509 certificates
- Domain Validation (DV): Proves domain ownership (fast, basic)
- Organization Validation (OV): Verifies organization details (more checks)
- Extended Validation (EV): Rigorous checks; highest level of trust
Where is X.509 used?
- HTTPS websites (the lock 🔒 in your browser)
- Email encryption (S/MIME)
- VPN authentication
- Code signing
- Enterprise Wi-Fi authentication
Chain of trust
X.509 uses a chain: Your certificate → Intermediate CA → Root CA. Root CAs are trusted by browsers and operating systems. If any link is broken, the certificate is not trusted.
What if a certificate is expired or fake?
- Expired: Browser warns "certificate expired" — like an expired passport.
- Fake or self-signed: Browser warns "not trusted" — like a fake ID.
How to view a certificate
Click the lock 🔒 in your browser → View Certificate. You can check issuer, validity dates, and subject.
問題1： X.509は、デジタル証明書の標準フォーマットである。
問題2： X.509証明書は、ウェブサイトが本物であることを証明するために使われる。
問題3： すべてのウェブサイトは、自分でX.509証明書を作成して自由に使える。
問題4： X.509証明書には有効期限があり、期限が切れるとブラウザが警告を表示することがある。
問題5： ブラウザの鍵マーク🔒は、X.509証明書が有効であることを示している。
