Knowledge Base

Solution

The following fields are attributes that may be included in the SSL certificate details.

Note: with changing PKI standards, these attributes may change at any time without notice to comply with CA/B Forum requirements. 

Version
Serial Number
Signature Algorithm
Issuer
Valid From and Valid To
Subject
Public Key
Subject Alternative Name (SAN)
Basic Constraints
Subject Key Identifier (SKI)
Key Usage
CRL Distribution Points
Certificate Policies
Extended Key Usage (EKU)
Authority Key Identifier (AKI)
Authority Info Access
SCT List
Thumbprint

Version

This field describes the version of the encoded certificate.  For SSL certificates, the X.509 version is 3 since certificate extensions are used.

Serial Number

The Serial Number is an alphanumeric string assigned by DigiCert to each SSL certificate.  It is unique for each certificate issued by DigiCert (i.e. the issuer name and serial number identify a unique certificate).

Signature Algorithm

The Signature Algorithm identifies the cryptographic algorithm used by DigiCert to sign this certificate. DigiCert signs all SSL certificates using the SHA-256 Algorithm.

Issuer

The Issuer field identifies the entity that has signed and issued the certificate. For SSL certificates, this would contain the Distinguished Name (DN) information for the Intermediate CA Certificate.

Valid From and Valid To

These fields indicate the validity period of the SSL certificate.

Subject

This contains the Distinguished Name (DN) information for the certificate.  The fields included in a typical SSL certificate are:

Common Name (CN)
Organization (O)
Locality or City (L)
State or Province (S)
Country Name (C)

For Extended Validation (EV) SSL certificates, these additional fields are also included:

Business Category
Serial Number (Business Registration Number)
Jurisdiction State
Jurisdiction Locality

Public Key

This field is used to identify the algorithm with which the SSL certificate is used, such as RSA or ECC. It also displays the size of the key in bits (e.g.: 2048 bits).

Subject Alternative Name (SAN)

The Subject Alternative Name extension allows additional identities to be bound to the subject of the certificate. The DNS name (dNSName) extension is used to add an additional fully qualified domain name to an SSL certificate.

Basic Constraints

This extension indicates whether a certificate is a Certificate Authority (CA) or not. If the certificate is a CA, then additional information, such as the depth of the hierarchy it can sign, is specified. SSL certificates are end-entity certificates, not CA certificates.

Subject Key Identifier (SKI)

The Subject Key Identifier extension provides a means of identifying certificates that contain a particular public key. This is a hash value of the SSL certificate.

Key Usage

The Key Usage extensions define what a particular certificate may be used for (assuming the application can parse this extension). The following extensions are included in an SSL certificate:

Digital Signature: (Taken from http://www.ietf.org/rfc/rfc3280.txt) The digitalSignature bit is asserted when the subject public key is used with a digital signature mechanism to support security services other than certificate signing (bit 5), or CRL signing (bit 6). Digital signature mechanisms are often used for entity authentication and data origin authentication with integrity.

Key Encipherment: (Taken from http://www.ietf.org/rfc/rfc3280.txt) The keyEncipherment bit is asserted when the subject public key is used for key transport. An example of Key Encipherment is the SSL handshake, where the two applications use asymmetric encryption to wrap around the exchange of a secret key that is ultimately used for the session.

CRL Distribution Points

The CRL Distribution Points extension provides the location of the corresponding Certificate Revocation List (CRL) for the SSL certificate.

Certificate Policies

The Certificate Policies extension defines the legal rules associated with a particular certificate’s usage.  For DigiCert SSL certificates, a link to the DigiCert Relying Party Agreements is provided: https://www.digicert.com/legal-repository

Extended Key Usage (EKU)

Also referred to as Enhanced Key Usage, this extension indicates one or more purposes for which the certified public key may be used, in addition to or in place of the basic purposes already indicated in the key usage extension.DigiCert SSL Certificates include the following extensions:

Server Authentication: (Taken from http://www.ietf.org/rfc/rfc3280.txt) TLS WWW server authentication. Key usage bits that may be consistent: digitalSignature, keyEncipherment or keyAgreement

Client Authentication: (Taken from http://www.ietf.org/rfc/rfc3280.txt) TLS WWW client authentication. Key usage bits that may be consistent: digitalSignature and/or keyAgreement

Authority Key Identifier (AKI)

The Authority Key Identifier extension provides the key identifier of the Issuing CA certificate that signed the SSL certificate. This AKI value would match the SKI value of the Intermediate CA certificate.

Authority Info Access

The Authority Info Access extension provides information about how to access information about a CA, such as OCSP validation and CA policy data.

SCT List

This contains a list of signed certificate timestamps as required for Certificate Transparency (CT). CT is a framework of logs that assist domain owners to oversee digital certificates issued for their domains.

Thumbprint

This extension provides the actual hash to ensure that the certificate has not been tampered with.

This information has been taken from RFC 3280: http://www.ietf.org/rfc/rfc3280.txt