Skip to content
Security

X.509 certificate

A standard digital document that binds a public key to an identity and is signed by a certificate authority, used by devices and servers to authenticate each other.

An X.509 certificate contains a subject name, a public key, a validity period, the issuer’s name and the issuer’s signature over all of it. A device presents its certificate when connecting; the server checks the signature chain up to a trusted root and then challenges the device to prove it holds the matching private key. Servers present their own certificates in the same way, which is what TLS relies on.

For IoT the details matter. Validity periods should match the product’s expected life or be renewable over the air, the private key should never leave a secure element, and the certificate chain must fit in the memory of a constrained device. These choices are part of designing device identity and are covered in Device identity, certificates and PKI for IoT.

Part of the IoT Glossary. Spotted an error or a missing term? Tell us.