X.509 (X.509 v3 certificate)
Definition
X.509 is the ITU-T standard format for public key certificates; its Internet profile, RFC 5280, defines the certificates used in TLS.
X.509 defines what a certificate contains and how it is signed. A version 3 certificate has a to-be-signed part holding the version, serial number, signature algorithm, issuer name, validity period, subject name, the subject's public key and extensions such as Subject Alternative Name and Basic Constraints; the issuer's signature over that part follows. The structure is written in ASN.1 and encoded in DER, and the familiar -----BEGIN CERTIFICATE----- PEM form is simply Base64 of the DER bytes.
Why it matters
Every tool that inspects or validates certificates, from browsers to OpenSSL to Java's keytool, reads the same X.509 fields, so knowing them makes error messages readable. Hostnames live in the SAN, trust decisions depend on the issuer and extensions, and the validity fields drive expiry warnings. RFC 5280 is the reference for how these fields are profiled for the Internet and how path validation works.
Example
openssl x509 -in cert.pem -noout -text
openssl x509 -in cert.pem -outform der -out cert.der
The first command prints every field; the second converts the same certificate from PEM to DER.
Common misconceptions
- PEM and DER are different kinds of certificate. They are two encodings of the same X.509 structure.
- The file extension tells you the format.
.crt,.cerand.pemfiles can each hold PEM or DER; check the content. - X.509 is only for TLS. The same format is used for S/MIME, code signing and client authentication; extensions decide the purpose.