X.509 certificate
An X.509 certificate is the standardized data structure, defined in RFC 5280, that binds a public key to an identity -- typically a hostname -- and is signed by the certificate authority that issued it. Every TLS certificate a browser or mail server checks is an X.509 certificate: it carries a subject, an issuer, a validity period, the public key itself, a Subject Alternative Name (SAN) list of the hostnames it actually covers, and extensions like key usage that constrain what the certificate may be used for. The format predates the web -- it was originally designed for the X.500 directory standard -- but RFC 5280 profiles it specifically for internet PKI use, which is why nearly every modern certificate, regardless of the CA that issued it, follows the exact same field layout a client can parse and validate the same way.
By AdminKit team, Netbase JSC · Updated