5.1.1 X.509 certificates

An X.509 certificate usually contains information about the certificate holder, the signer, a unique serial number, expiration dates and some other fields [RFC3280] (See RFC3280.) as shown in the table below.

version:

The field that indicates the version of the certificate.

serialNumber:

This field holds a unique serial number per certificate.

issuer:

Holds the issuer's distinguished name.

validity:

The activation and expiration dates.

subject:

The subject's distinguished name of the certificate.

extensions:

The extensions are fields only present in version 3 certificates.

The certificate's subject or issuer name is not just a single string. It is a Distinguished name and in the ASN.1 notation is a sequence of several object IDs with their corresponding values. Some of available OIDs to be used in an X.509 distinguished name are defined in gnutls/x509.h.

The Version field in a certificate has values either 1 or 3 for version 3 certificates. Version 1 certificates do not support the extensions field so it is not possible to distinguish a CA from a person, thus their usage should be avoided.

The validity dates are there to indicate the date that the specific certificate was activated and the date the certificate's key would be considered invalid.

Certificate extensions are there to include information about the certificate's subject that did not fit in the typical certificate fields. Those may be e-mail addresses, flags that indicate whether the belongs to a CA etc. All the supported X.509 version 3 extensions are shown in the table below.

subject key id (2.5.29.14):

An identifier of the key of the subject.

authority key id (2.5.29.35):

An identifier of the authority's key used to sign the certificate.

subject alternative name (2.5.29.17):

Alternative names to subject's distinguished name.

key usage (2.5.29.15):

Constraints the key's usage of the certificate.

extended key usage (2.5.29.37):

Constraints the purpose of the certificate.

basic constraints (2.5.29.19):

Indicates whether this is a CA certificate or not.

CRL distribution points (2.5.29.31):

This extension is set by the CA, in order to inform about the issued CRLs.

In GnuTLS the X.509 certificate structures are handled using the gnutls_x509_crt_t type and the corresponding private keys with the gnutls_x509_privkey_t type. All the available functions for X.509 certificate handling have their prototypes in gnutls/x509.h. An example program to demonstrate the X.509 parsing capabilities can be found at section ex:x509-info.