Celebrating the First X.509 Day: Looking Back on 30+ Years of the X.509 Standard

Today marks the first official ITU-T X.509 Day, with celebrations led by The International Telecommunications Union (ITU). To honor 33 years of successful implementations of the X.509 standard, ITU is celebrating by:

• Looking back on the development of the X.509 standard
• Promoting applications for X.509
• Reviewing public key cryptography and public key infrastructure (PKI)
• Discussing the implementation of X.509 by looking at past use cases
• Exploring potential future developments for the X.509 standard

Whether you’re new to the PKI world, have been around since the development of the standard, or fall somewhere in between, it’s clear that without X.509, there would be no PKI today. With that in mind, let’s take a look at how we got here and why today is without a doubt a day worth celebrating.

The X.509 standard is the common global language for certificates used in public key infrastructure. Specifically, it defines the data structures that underpin certificates and Certificate Revocation Lists (CRLs) used across everything from internet protocols (TLS/SSL encryption) to electronic signatures to enterprise security.

In terms of certificates, the X.509 standard creates certificates using a public and private key pair. Together, this key pair can encrypt (public key) and decrypt (private key) communications as well as verify someone’s identity and the integrity of communications (public key, when something is signed with the private key). 

Specifically, the X.509 standard defines several fields of information that all valid certificates must contain. These fields include:

• version: The version number of the x.509 certificate. 
• serialNumber: A unique serial number for each certificate created by a Certificate Authority (CA). 
• signature: The algorithm used to generate the signature, which must match the signatureAlgorithm. 
• issuer: The distinguished name (DN) of the issuing CA. 
• validity: The issue date and expiration date for the certificate. 
• subject: The DN of the validated entity to which the certificate is issued. 
• subjectPublicKeyInfo: The public key algorithm and value (RSA, DSA, or Diffie-Hellman).

Looking at CRLs, the X.509 standard helps to ensure standardization lists, which indicate when certificates are no longer valid even though they haven’t reached their expiration date. This ensures that all browsers and consuming applications can read CRLs to check the validity of a certificate.  

The introduction of the X.509 standard in 1988 led to a formal format for issuing certificates. In the 33 years since, several benefits have emerged that have led to the wide adoption of X.509 certificates. Three benefits, in particular, are quite cyclical in nature:

• Standardization: X.509 certificates standardized the underlying data contained in certificates in numerous use cases. This standardization supports a variety of communications and the use of PKI across entities.
  

• Trustworthiness: By standardizing the information contained within certificates and supporting CRLs, the X.509 standard builds trust in the digital world. For example, the use of X.509 certificates allows us to safely visit websites and to trust in digitally signed documents.
  

• Applicability: Finally, because of the standardization and trustworthiness brought about by the X.509 standard, these certificates are widely adopted across a variety of companies and use cases. This broad applicability allows the PKI community to work off a common framework for points of trust and future improvements, which reinforces the importance of standardization and kicks off the whole cycle again.

Given those benefits, it’s no surprise that X.509 certificates are used quite commonly in all kinds of situations. Here’s a look at some of the most well-known examples of these certificates in action:

• TLS/SSL Certificates: We have X.509 certificates to thank for the fact that we can browse the internet securely. The X.509 standard is used in TLS/SSL certificates, which underpin the https protocol used in websites. Quick: check the lock icon in your URL bar, and click into the “Connection is secure” section that comes up. Within that, you’ll see a message that reads “Certificate is valid.” That’s an X.509 certificate at work.
  

• S/MIME Certificates: Equally as important to our everyday lives, the X.509 standard makes email secure by powering S/MIME certificates. These certificates verify email senders to help protect against phishing attacks and encrypt email messages to provide a layer of security for messages so that we know what we received wasn’t modified in transit. As a result, X.509 certificates have played a huge role in making email such a trustworthy mode of communication.
• Digital Signatures: Digital signatures make life easy in the digital world – just imagine the hassle if you had to print, sign, and scan every time you had to give your signature. Once again, X.509 certificates have saved the day. In this case, the X.509 standard gets used to verify the identity of the signer and to ensure that the document doesn’t get altered in transit before or after signature.
• Code Signing: In our software-driven world, code signing matters – a lot. It’s how we know we can trust a piece of software because it signals that it’s from a legitimate source, not some malicious hacker. X.509 certificates support code signing similarly to how they support digital signatures since a code signing certificate verifies the identity of the developer and the company and protects against modification to the program that gets delivered. 

It’s easy to see why in the past 33 years, X.509 certificates have become a fundamental backbone of security and the use of these certificates continues to grow. In the next few years, almost every connected device will have an X.509 certificate to provide strong authentication and secure data communications. 

Where once enterprises only had a few hundred x.509 certificates, they now have hundreds of thousands. And with the next frontier for X.509 being the security of IOT devices, millions of these certificates will be issued and used every day.

X.509 certificates are critical to establishing digital trust in the digital world and without proper management, security teams leave their company open to outages, breaches, and failed audits.  X.509 Day is a great opportunity to take an inventory of your current certificate management capabilities and evaluate if a new solution is required to address the continuous increase of your digital certificates.