X.509

wikipedia:X.509 standard format for Public key certificate base on a Certificate authority (CA). It is used in TLS.

Tools: openssl, keytool, certinfo (Cloudflare) https://github.com/cloudflare/cfssl/blob/master/certinfo/certinfo.go

Examples

• openssl x509 -inform pem -noout -text
• openssl x509 -noout -text -in /path/to/your/cert.pem
• openssl x509 -noout -dates
• keytool -printcert -file certificate.pem

• openssl x509 -req

• openssl s_client -showcerts -connect YOUR_DOMAIN.COM:443 </dev/null 2>/dev/null | openssl x509 -outform PEM > MY_CERTFILE.pem

Errors

• Error response from daemon: Get https://URL/: x509: certificate signed by unknown authority
• SSL certificate problem: unable to get local issuer certificate

Security

• ASN.1 and x509 parsers in the kernel have historically been quite problematic (CVE-2008-1673, CVE-2016-2053),

Activities

• Read GitLab: S/MIME X509 verification of commits https://gitlab.com/gitlab-org/gitlab/issues/29782
• How to check certification expiration date from command line: openssl x509 -dates
• Create new x509 certificate: openssl req -x509 -newkey

Related terms

• Vault
• Kubernetes cert-manager
• E1207 14:22:57.502748 1 scraper.go:140] "Failed to scrape node" err="Get \"https://172.30.2.2:10250/metrics/resource\": x509: cannot validate certificate for 172.30.2.2 because it doesn't contain any IP SANs" node="node01"
• Subject Alternative Name (SAN)
• /etc/ssl/certs/
• X509v3
• Certificate revocation list

See also

• openssl x509[ -inform | -text | -dates | -req | -subject | -issuer | --help]
• X.509, ASN.1, openssl x509, .pem, der, PFX, PKCS, SAN, openssl x509, CSR, Java KeyStore (JKS), Certificate Revocation List (CRL), Extended Key Usages (ECU), PKIX
• Certificate, CSR (PKCS10), /etc/letsencrypt/csr/, openssl req, X.509, [.pem, .cer, .csr], Kubernetes CertificateSigningRequest

https://prefetch.net/blog/2019/12/10/converting-x509-certificates-to-json-objects/