Certificates 101

Help
1

What follows is a self-guided study of certificate fundamentals that provides a deep and solid foundation of knowledge regarding these things we call certificates. The information and tools that follow are enough to bring anyone up to nearly an expert level when it comes to certificates. Please don't feel that you need to absorb it all. :slightly_smiling_face:

ASN.1 and DER

When you look at a certificate issued by Let's Encrypt, your initial impression might be that it's a collection of encrypted gobbledygook encased within header and footer lines. If you look closer, you'll realize that there are actually multiple certificates in sequence. Each of those is in PEM format. The "header" and "footer" lines are called the "armor". The seemingly-encrypted gobbledygook inside the armor isn't actually encrypted; it's Base64-encoded ASN.1 in DER format.

Certificate Chains

For an RSA certificate chain, Let's Encrypt provides these certificates in the following order:

  1. Your leaf (aka subscriber) certificate
  2. Let's Encrypt's R3 intermediate certificate
  3. Let's Encrypt's ISRG Root X1 root certificate signed by IdenTrust's DST Root CA X3 root certificate

To communicate successfully, a client connecting to a server serving that RSA certificate chain must have at least one of the following certificates installed in its trust store:

For an ECDSA certificate chain, Let's Encrypt provides these certificates in the following order:

  1. Your leaf (aka subscriber) certificate
  2. Let's Encrypt's E1 intermediate certificate
  3. Let's Encrypt's ISRG Root X2 root certificate signed by Let's Encrypt's ISRG Root X1 root certificate

To communicate successfully, a client connecting to a server serving that ECDSA certificate chain must have at least one of the following certificates installed in its trust store:

Certificate Transparency

Should you wish to research any certificate issued by Let's Encrypt (or most any publicly-trusted certificate authority (CA)), you can use the following tool, which aggregates certificate transparency (CT) logs:

Certificate Decoding

Should you wish to view the information contained in any certificate, you can use the following tool:

https://redkestrel.co.uk/products/decoder/

Certificate Inspection

Should you wish to inspect the certificate service of a website, you can use the following tool (where port 443 is HTTPS):

8 Likes