IPFYI
RFC 5280 Proposed Standard

Internet X.509 Public Key Infrastructure Certificate and CRL Profile

D. Cooper, S. Santesson, S. Farrell, S. Boeyen, R. Housley, W. Polk · 2008-05

Abstract

This memo profiles the X.509 v3 certificate and X.509 v2 certificate revocation list (CRL) for use in the Internet. An overview of the approach and model is provided as an introduction. The X.509 v3 certificate format is described in detail, with additional information regarding the format and semantics of Internet name forms.

Why This RFC Matters

RFC 5280 is the foundational specification for the PKI infrastructure that underpins HTTPS trust on the internet. Every TLS certificate issued by a Certificate Authority and validated by a browser or operating system must conform to the field encodings, extension semantics, name validation rules, and path-building algorithms defined here. The profile constrains the enormously complex ASN.1 X.509 standard into a practical subset with well-defined behavior, enabling interoperability between browsers, servers, CAs, and OCSP responders across the entire public web PKI ecosystem.

관련 프로토콜

SSL-TLS HTTPS OCSP

관련 용어

certificate ssl-tls authentication encryption hsts

Security에서 더 보기

RFC 2404 The Use of HMAC-SHA-1-96 within ESP and AH RFC 3602 The AES-CBC Cipher Algorithm and Its Use with IPsec RFC 4253 The Secure Shell (SSH) Transport Layer Protocol RFC 4254 The Secure Shell (SSH) Connection Protocol RFC 4301 Security Architecture for the Internet Protocol RFC 5246 The Transport Layer Security (TLS) Protocol Version 1.2 RFC 6125 Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS) RFC 6454 The Web Origin Concept