Public key certificate

In <a href="/facts/Cryptography/e94PEVau">cryptography</a>, a public key certificate, also known as a digital certificate or identity certificate, is an <a href="/facts/Electronic_document/7ee80Ee4">electronic document</a> used to prove the validity of a <a href="/facts/Key_authentication/0k9mJ9wS">public key</a>. The certificate includes the public key and information about it, information about the identity of its owner (called the subject), and the <a href="/facts/Digital_signature/tY7e2pnW">digital signature</a> of an entity that has verified the certificate's contents (called the issuer). If the device examining the certificate trusts the issuer and finds the signature to be a valid signature of that issuer, then it can use the included public key to communicate securely with the certificate's subject. In <a href="/facts/Email_encryption/2erDQc0k">email encryption</a>, <a href="/facts/Code_signing/xnLHJYRa">code signing</a>, and <a href="/facts/Electronic_signature/FnVNSGMT">e-signature</a> systems, a certificate's subject is typically a person or organization. However, in <a href="/facts/Transport_Layer_Security/pGy16TnA">Transport Layer Security</a> (TLS) a certificate's subject is typically a computer or other device, though TLS certificates may identify organizations or individuals in addition to their core role in identifying devices. TLS, sometimes called by its older name <a href="/facts/Secure_Sockets_Layer/pGy16TnA">Secure Sockets Layer</a> (SSL), is notable for being a part of <a href="/facts/HTTPS/MSWYz4zo">HTTPS</a>, a <a href="/facts/Communications_protocol/5uady7cB">protocol</a> for securely browsing the <a href="/facts/World_Wide_Web/wvnTrWFq">web</a>.
In a typical <a href="/facts/Public-key_infrastructure/7fwMLxF4">public-key infrastructure</a> (PKI) scheme, the certificate issuer is a <a href="/facts/Certificate_authority/WAo8vMTN">certificate authority</a> (CA), usually a company that charges customers a fee to issue certificates for them. By contrast, in a <a href="/facts/Web_of_trust/H2cy9v6s">web of trust</a> scheme, individuals sign each other's keys directly, in a format that performs a similar function to a public key certificate. In case of key compromise, a certificate may need to be <a href="/facts/Certificate_revocation/JSP12aR0">revoked</a>.
The most common format for public key certificates is defined by <a href="/facts/X.509/rs0JuYDd">X.509</a>. Because X.509 is very general, the format is further constrained by profiles defined for certain use cases, such as <a href="/facts/PKIX/rs0JuYDd">Public Key Infrastructure (X.509)</a> as defined in <a href="/facts/RFC_(identifier)/esftTvE7">RFC</a> <a href="https://www.rfc-editor.org/rfc/rfc5280">5280</a>.

Public key certificate open-in-new

Public key certificate