Certificate
An X.509 certificate: a data structure signed by a certificate authority that binds a public key to a subject name and other attributes for a validity period (RFC 5280). A verifier checks the chain to a trusted root, the name, the dates, the key usage and the revocation status before trusting the key.
- Also called
- X.509 certificate · TLS certificate · certificate chain · leaf certificate · client certificate · server certificate · signing certificate
- Defined in
- RFC 5280
Covered in
Case study: certificate expiry outages at Ericsson (2018) and Microsoft Teams (2020), and Equifax's blind spot
How an expired certificate inside Ericsson's core-network software cut mobile data for millions in about 11 countries, how an expired authentication certificate took Microsoft Teams offline, how an expired inspection certificate left Equifax blind for 19 months, through its 2017 breach, and the inventory, automation and testing that prevent each.
Operate TLS and certificates: configuration, renewal and verification
Configure a modern TLS profile with hybrid post-quantum key exchange, automate renewal for certificate lifetimes that fall to 47 days, and verify every termination point with a fresh handshake.
Prevent subdomain takeover from dangling DNS records
A DNS record that outlives its cloud resource lets whoever claims the name serve content on your domain. Bind records to resources in IaC, remove the record first, verify domains and scan for dangling records.
Flame: MD5 certificate forgery
Follow how a weak digest and an overpowered certificate trust path enabled forged code-signing authority, without equating the event with RSA key theft.
ISO 27001, SOC 2, NIST CSF or FedRAMP: choose the framework by the question it answers
Distinguish management systems, technical controls, risk outcomes, independent reports and government cloud requirements before reusing evidence.
Authenticate workloads and authorize their service actions
Use service identities, mutual TLS and function permissions without mistaking an encrypted connection for complete authorization.