Public key certificate

In cryptography, a public key certificate (also known as a digital certificate or identity certificate) is an electronic document used to prove ownership of a public key. The certificate includes information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.

In a typical public-key infrastructure (PKI) scheme, the signer is a certificate authority (CA), usually a company which charges customers to issue certificates for them. In a web of trust scheme, the signer is either the key's owner (a self-signed certificate) or other users ("endorsements") whom the person examining the certificate might know and trust.

Certificates are an important component of Transport Layer Security (TLS, sometimes called by its older name SSL, Secure Sockets Layer), where they prevent an attacker from impersonating a secure website or other server. They are also used in other important applications, such as email encryption and code signing.

Operating systems

Certificates can be created for Unix-based servers with tools such as OpenSSL's ca command,[1] or SuSE's gensslcert. These may be used to issue unmanaged certificates, certification authority (CA) certificates for managing other certificates, and user or computer certificate requests to be signed by the CA, as well as a number of other certificate related functions.

Similarly, Windows Server contains a CA as part of Certificate Services for the creation of digital certificates. In Windows Server 2008 and later the CA may be installed as part of Active Directory Certificate Services. The CA is used to manage and centrally issue certificates to users or computers. Microsoft also provides a number of different certificate utilities, such as SelfSSL.exe for creating unmanaged certificates, and Certreq.exe for creating and submitting certificate requests to be signed by the CA, and certutil.exe for a number of other certificate related functions.

Mac OS X comes with the Keychain Access program, which is able to perform various certificate-related services.

Contents of a typical digital certificate

• Serial Number: Used to uniquely identify the certificate.
• Subject: The person, or entity identified.
• Signature Algorithm: The algorithm used to create the signature.
• Signature: The actual signature to verify that it came from the issuer.
• Issuer: The entity that verified the information and issued the certificate.
• Valid-From: The date the certificate is first valid from.
• Valid-To: The expiration date.
• Key-Usage: Purpose of the public key (e.g. encipherment, signature, certificate signing...).
• Public Key: The public key.
• Thumbprint Algorithm: The algorithm used to hash the public key certificate.
• Thumbprint (also known as fingerprint): The hash itself, used as an abbreviated form of the public key certificate.

Classification

Vendor defined classes

VeriSign uses the concept of classes for different types of digital certificates:

• Class 1 for individuals, intended for email.
• Class 2 for organizations, for which proof of identity is required.
• Class 3 for servers and software signing, for which independent verification and checking of identity and authority is done by the issuing certificate authority.
• Class 4 for online business transactions between companies.
• Class 5 for private organizations or governmental security.

Other vendors may choose to use different classes or no classes at all as this is not specified in the PKI standards.

Certificate authorities

In this model of trust relationships, a CA is a trusted third party - trusted both by the subject (owner) of the certificate and by the party relying upon the certificate. According to NetCraft, the industry standard for monitoring Active TLS certificates, states that "Although the global [TLS] ecosystem is competitive, it is dominated by a handful of major CAs — three certificate authorities (Symantec, Comodo, GoDaddy) account for three-quarters of all issued [TLS] certificates on public-facing web servers. The top spot has been held by Symantec (or VeriSign before it was purchased by Symantec) ever since [our] survey began, with it currently accounting for just under a third of all certificates. To illustrate the effect of differing methodologies, amongst the million busiest sites Symantec issued 44% of the valid, trusted certificates in use — significantly more than its overall market share