X.509
The standard format for public-key certificates used in TLS and PKI. An X.509 certificate binds a public key to a subject and is signed by a certificate authority.
X.509 is everywhere and rarely thought about as identity, which is how estates end up with certificates nobody owns. The fields that carry identity are the subject and subject alternative names, and the trust decision depends entirely on the chain to a root the verifier accepts. Misissuance and template misconfiguration in enterprise CAs have produced some of the most severe privilege escalation paths in Active Directory.
See also: PKI, certificate lifecycle, mTLS, identity CVE catalog
Related on Start with Identity
- GlossaryDPoP
Demonstrating Proof of Possession (RFC 9449). Binds an access token to a specific key held by the client, so a stolen bearer token cannot be replayed. Important
- BlogBrowsers block eight eMudhra intermediate CAs after their private keys leak
A researcher reported on October 17 that the private keys of eight eMudhra (emSign) intermediate CAs, six for TLS and two for code signing, were compromised. Ch
- GlossaryProof of Possession (PoP)
Proof of possession (PoP) is a property of a token or credential that requires the presenter to show it controls a specific cryptographic key, so holding the to
- PodcastSectigo
Short, frequent episodes on PKI, certificate policy, and post-quantum migration from two certificate industry veterans at Sectigo. 670 episodes and counting.
- GlossaryAnonCreds
A verifiable credential format, originating in Hyperledger Indy and now a standalone specification, built around zero-knowledge proofs for strong selective disc