Certificates and public key infrastructure
The X.509 certificate field by field, the leaf, intermediate and root chain, the roles in a public key infrastructure, the life cycle (request, issuance, renewal, revocation) and the most common certificate errors.
- 26 cards
- 4 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- Scenarios
A few cards from the deck
Public key infrastructure: what is it?
Show the answer
The set of roles, rules and software that issue, distribute, renew and revoke the certificates binding keys to identities.
Knowing that a public key really belongs to a given site cannot be deduced from the key itself: you need a trusted third party and the whole life cycle around it.
This certificate is presented by www.exemple.fr on 6 November 2026 and the browser refuses it. What is the cause?
```text
Subject: CN = www.exemple.fr
Issuer: CN = Exemple Issuing CA
Validity
Not Before: Oct 1 00:00:00 2026 GMT
Not After : Dec 30 00:00:00 2026 GMT
X509v3 Subject Alternative Name:
DNS:exemple.fr, DNS:blog.exemple.fr`- The name www.exemple.fr is missing from the alternative names, which the browser checks instead of the CN
- Today's date falls outside the certificate's validity period
- The subject and the issuer do not share the same name, which is forbidden for a leaf
- The validity period exceeds two months, which a browser no longer accepts
Show the answer
The name www.exemple.fr is missing from the alternative names, which the browser checks instead of the CN
The period covers 6 November. The CN does say www.exemple.fr but browsers no longer rely on it: only the SAN counts. Chrome shows ERR_CERT_COMMON_NAME_INVALID. A subject different from the issuer is, on the contrary, normal.
The domain names a certificate is valid for are listed in the … extension.
Show the answer
The domain names a certificate is valid for are listed in the Subject Alternative Name extension.
Modern browsers ignore the subject CN. A certificate for exemple.fr does not cover www.exemple.fr unless it lists it or carries a wildcard *.exemple.fr.
X.509 certificate: what is it?
Show the answer
A signed document that binds a public key to an identity, with an issuer, a validity period, alternative names and allowed usages.
It never contains the private key. Browsers check the site name in the subject alternative names (SAN), not in the CN field.
curl https://api.exemple.franswers “curl: (60) SSL certificate problem: unable to get local issuer certificate”, yet browsers accept the site. What is the probable cause and the fix?- The certificate has expired; renew it before the end date
- The server does not send the intermediate; configure the server with the full chain
- The site name is missing from the SANs; reissue a certificate with the right name
- The root is revoked; move to another certificate authority
Show the answer
The server does not send the intermediate; configure the server with the full chain
Browsers often find the intermediate on their own (cache, download), curl does not. An expired certificate or a wrong name gives other messages (certificate has expired, no alternative certificate subject name matches).