# What Is X.509 (X.509 v3 certificate)? Definition and Examples

> X.509 is the ITU-T standard format for public key certificates; its Internet profile, RFC 5280, defines the certificates used in TLS.

Source: https://ssl.sh/glossary/x509/
Last updated: 2026-11-10

X.509 defines what a certificate contains and how it is signed. A version 3 certificate has a to-be-signed part holding the version, serial number, signature algorithm, issuer name, validity period, subject name, the subject's public key and extensions such as [Subject Alternative Name](https://ssl.sh/glossary/san/) and [Basic Constraints](https://ssl.sh/glossary/basic-constraints/); the issuer's signature over that part follows. The structure is written in ASN.1 and encoded in DER, and the familiar `-----BEGIN CERTIFICATE-----` [PEM](https://ssl.sh/glossary/pem/) form is simply Base64 of the DER bytes.

## Why it matters
Every tool that inspects or validates certificates, from browsers to OpenSSL to Java's keytool, reads the same X.509 fields, so knowing them makes error messages readable. Hostnames live in the SAN, trust decisions depend on the issuer and extensions, and the validity fields drive expiry warnings. [RFC 5280](https://www.rfc-editor.org/rfc/rfc5280) is the reference for how these fields are profiled for the Internet and how path validation works.

## Example
```bash
openssl x509 -in cert.pem -noout -text
openssl x509 -in cert.pem -outform der -out cert.der
```

The first command prints every field; the second converts the same certificate from PEM to DER.

## Common misconceptions
- **PEM and DER are different kinds of certificate.** They are two encodings of the same X.509 structure.
- **The file extension tells you the format.** `.crt`, `.cer` and `.pem` files can each hold PEM or DER; check the content.
- **X.509 is only for TLS.** The same format is used for S/MIME, code signing and client authentication; extensions decide the purpose.

## Related terms

- [SSL 证书](https://ssl.sh/zh/glossary/ssl-certificate/): SSL 证书是由 CA 签名的 X.509 证书，把公钥与一个或多个域名（或 IP 地址）绑定，供 TLS 客户端验证服务器身份。
- [PEM](https://ssl.sh/zh/glossary/pem/): PEM 是一种把 DER 二进制数据做 Base64 编码、再用 BEGIN 和 END 行包起来的文本格式，是存放证书和私钥最常见的方式。
- [DER](https://ssl.sh/zh/glossary/der/): DER 是 ASN.1 的二进制编码规则，保证每个值只有唯一一种字节表示，X.509 证书和密钥都以它为基础。
- [DN](https://ssl.sh/zh/glossary/distinguished-name/): DN 即可分辨名称，是由 C、O、CN 等属性组成的 X.500 风格结构化名称，用来标识 X.509 证书的主体和颁发者。
- [SAN](https://ssl.sh/zh/glossary/san/): SAN 即主体备用名称，是 X.509 证书中列出其适用的所有域名、IP 地址等身份的扩展，客户端按它校验主机名。
- [基本约束](https://ssl.sh/zh/glossary/basic-constraints/): 基本约束是 X.509 证书扩展，用来声明该证书是否属于 CA，以及其下方还允许出现多少层 CA。
- [证书序列号](https://ssl.sh/zh/glossary/certificate-serial-number/): 证书序列号是 CA 为每张证书分配的正整数，与颁发者名称一起唯一标识一张证书，吊销列表和 OCSP 都靠它定位证书。
- [密钥用途](https://ssl.sh/zh/glossary/key-usage/): 密钥用途是 X.509 证书扩展，限定证书公钥可执行的密码学操作，例如数字签名、密钥加密或签发证书。