X.509
The standard format for public-key certificates used in TLS and PKI. An X.509 certificate binds a public key to a subject and is signed by a certificate authority.
X.509 is everywhere and rarely thought about as identity, which is how estates end up with certificates nobody owns. The fields that carry identity are the subject and subject alternative names, and the trust decision depends entirely on the chain to a root the verifier accepts. Misissuance and template misconfiguration in enterprise CAs have produced some of the most severe privilege escalation paths in Active Directory.
See also: PKI, certificate lifecycle, mTLS, identity CVE catalog, certificate authority
Related on Start with Identity
- GlossaryACME (Automated Certificate Management Environment)
ACME (Automated Certificate Management Environment) is the IETF protocol, [RFC 8555](https://www.rfc-editor.org/rfc/rfc8555) (March 2019, Proposed Standard), th
- GlossaryDPoP
Demonstrating Proof of Possession (RFC 9449). Binds an access token to a specific key held by the client, so a stolen bearer token cannot be replayed. Important
- BlogBrowsers block eight eMudhra intermediate CAs after their private keys are exposed
A researcher reported on October 17 that the private keys of eight eMudhra (emSign) intermediate CAs, six for TLS and two for code signing, were exposed (later
- BlogLXD and MicroCloud flaw let attackers pose as any trusted client using only its public certificate
Canonical's CVE-2026-112816 let an attacker authenticate to the LXD and MicroCloud HTTPS API as any trusted client by attaching that client's public certificate
- GlossaryMachine Identity
A machine identity is the credential that lets a device, server, application or workload prove who it is to another system without a person signing in: most oft
- PodcastSectigo
Short, frequent episodes on PKI, certificate policy, and post-quantum migration from two certificate industry veterans at Sectigo. 670 episodes and counting.