X.509
The standard format for public-key certificates used in TLS and PKI. An X.509 certificate binds a public key to a subject and is signed by a certificate authority.
X.509 is everywhere and rarely thought about as identity, which is how estates end up with certificates nobody owns. The fields that carry identity are the subject and subject alternative names, and the trust decision depends entirely on the chain to a root the verifier accepts. Misissuance and template misconfiguration in enterprise CAs have produced some of the most severe privilege escalation paths in Active Directory.
See also: PKI, certificate lifecycle, mTLS, identity CVE catalog
Related on Start with Identity
- GlossaryDPoP
Demonstrating Proof of Possession (RFC 9449). Binds an access token to a specific key held by the client, so a stolen bearer token cannot be replayed. Important
- GlossaryAnonCreds
A verifiable credential format, originating in Hyperledger Indy and now a standalone specification, built around zero-knowledge proofs for strong selective disc
- GlossaryAuthenticator Assurance Level (AAL)
NIST 800-63B levels describing authentication strength. AAL1: single factor. AAL2: multi-factor. AAL3: multi-factor with phishing-resistant cryptographic authen