Certificates and Certificate Chains
This section describes certificate and certificate chain. A certificate contains someone's public key signed by a trusted authority.
What is Certificate: A certificate is digitally signed statement from the issuer saying
that the public key of the subject has some specific value.
The above definition is copied from the JDK documentation. It has
a couple of important terms:
- "signed statement" - The certificate must be signed by the issuer with
a digital signature.
- "issuer" - The person or organization who is issuing this certificate.
- "public key" - The public key of a key pair selected by the subject.
- "subject" - The person or organization who owns the public key.
X.509 Certificate - A certificate written in X.509 standard format.
X.509 standard was introduction in 1988. It requires a certificate to have
the following information:
- Version - X.509 standard version number.
- Serial Number - A sequence number given to each certificate.
- Signature Algorithm Identifier - Name of the algorithm used
to sign this certificate by the issuer
- Issuer Name - Name of the issuer.
- Validity Period - Period during which this certificate is valid.
- Subject Name - Name of the owner of the public key.
- Subject Public Key Information - The public key and its related information.
How can you get a certificate for your own public key?
- Requesting it from a Certificate Authority (CA), like VeriSign, Thawte or Entrust.
- Doing it yourself - using tools like JDK "keytool" to generate a self-signed certificate.
What is Certificate Chain: A certificate chain is a series of certificates that one certificate signs the
public key of the issuer of the next certificate. Usually the top certificate
(the first certificate) is self-signed, where issuer signed its own public key.
Last update: 2014.
Table of Contents
About This JDK Tutorial Book
Downloading and Installing JDK 1.8.0 on Windows
Downloading and Installing JDK 1.7.0 on Windows
Downloading and Installing JDK 1.6.2 on Windows
Java Date-Time API
Date, Time and Calendar Classes
Date and Time Object and String Conversion
Number Object and Numeric String Conversion
Locales, Localization Methods and Resource Bundles
Calling and Importing Classes Defined in Unnamed Packages
HashSet, Vector, HashMap and Collection Classes
Character Set Encoding Classes and Methods
Character Set Encoding Maps
Encoding Conversion Programs for Encoded Text Files
Socket Network Communication
Datagram Network Communication
DOM (Document Object Model) - API for XML Files
SAX (Simple API for XML)
DTD (Document Type Definition) - XML Validation
XSD (XML Schema Definition) - XML Validation
XSL (Extensible Stylesheet Language)
Message Digest Algorithm Implementations in JDK
Private key and Public Key Pair Generation
PKCS#8/X.509 Private/Public Encoding Standards
Digital Signature Algorithm and Sample Program
►"keytool" Commands and "keystore" Files
►Certificates and Certificate Chains
What Is "keystore"?
"keytool" - Key and Certificate Management Tool
"keytool -genkey" - Generating Keys and Self-Signed Certificates
"keytool -export/import" - Exporting and Importing Certificates
"keytool -keyclone" - Cloning Certificates with New Identities
KeyStore and Certificate Classes
Secret Key Generation and Management
Cipher - Secret Key Encryption and Decryption
The SSL (Secure Socket Layer) Protocol
SSL Socket Communication Testing Programs
SSL Client Authentication
HTTPS (Hypertext Transfer Protocol Secure)
PDF Printing Version