Quiz Entry - updated: 2026.10.20
What fields does an X.509 v3 certificate contain, and what makes it trustworthy?
Version, serial number, signature algorithm, issuer, validity, subject, the subject's public key and v3 extensions, all sealed by the issuer's signature.
| Field | Meaning |
|---|---|
| Version | Today always v3 (the version that added extensions) |
| Serial number | Unique per issuer, so (issuer, serial) identifies a certificate exactly; revocation lists name certificates by serial |
| Signature algorithm | Hash + signature scheme the issuer used, e.g. sha256WithRSAEncryption |
| Issuer | Distinguished Name (DN) of the CA that signed it |
| Validity | Not before / not after; end-entity certificates typically live about a year, CA certificates much longer |
| Subject | DN of the owner, e.g. CN=www.g001.ckteck.com, O=CKTECK, C=CH |
| Subject public key info | The public key being certified, plus its algorithm |
| Extensions (v3) | Key Usage, Extended Key Usage, Subject Alternative Name, Basic Constraints (CA or not), CRL Distribution Points, Authority Information Access (where to find the issuer certificate and OCSP) |
| Issuer's signature | Signature over everything above |
The certificate is public; anyone may copy it. What makes it trustworthy is the last field: the CA signed the binding of name and key. Change one byte, say the subject name or the key, and the signature check fails. A verifier therefore needs the issuer's public key, which comes from the issuer's own certificate, and so on up to a root certificate it already trusts.
Go deeper:
RFC 5280: Internet X.509 PKI Certificate and CRL Profile — the authoritative field and extension definitions (section 4).- Wikipedia: X.509 — structure, a decoded sample certificate and the chain-building logic.