DocID027745 Rev 1

9/31

AN4683

SSL/TLS protocol overview

31

The contents of a certificate, according to the X.509 version 3 specifications, may include:

–

The version number of the X.509 standard supported by the certificate.

–

The certificate’s serial number. Every certificate issued by a CA has a serial

number that is unique among the certificates issued by that CA.

–

Information about the user’s public key, including the algorithm used and a

representation of the key itself.

–

The DN of the CA that issued the certificate.

–

The period during which the certificate is valid.

–

The DN of the certificate subject, which is also called the subject name. For

example, in an SSL client certificate, this is the user’s DN.

–

Optional certificate extensions, which may provide additional data used by the

client or server.

–

The cryptographic algorithm, or cipher, used by the issuing CA to create its own

digital signature.

–

The CA’s digital signature, obtained by hashing all of the data in the certificate

together and encrypting it with the CA’s private key.

The certificate text format begins with the following line:

-----BEGIN CERTIFICATE-----

followed by certificate data, which should be base-64 encoded, as described by RFC 1113.

The certificate information must end with this last line:

-----END CERTIFICATE-----

When you receive the certificate from another entity, you may need to use a certificate

chain, also known as the certification path, which is a list of certificates used to authenticate

an entity. The chain, or path, begins with the certificate of that entity, and each certificate in

the chain is signed by the entity identified by the next certificate in the chain. The chain

terminates with a root CA certificate. The root CA certificate is always signed by the CA

itself; it must be considered as a trusted CA and must be available in the application (e.g.

SSL/TLS client, web browser). The signatures of all certificates in the chain must be verified

until the root CA certificate is reached. Figure 4 illustrates a certification path from the

certificate owner to the root CA, where the chain of trust begins. Notice that different chains

can have multiple or even none intermediate CAs.