---
title: "X.509 certificate: definition | KYA glossary"
url: https://knowyouragent.ch/en/knowledge/glossary/x509-certificate
lang: en
updated: 2026-10-12
license: © Innopulse Consulting GmbH
---

# X.509 certificate

An X.509 certificate is a signed data structure following RFC 5280 that links a public key with an identity and is issued by a certificate authority.

A certificate contains details of the holder, the public key, the validity, the issuer and extensions, for example on intended use. The certificate authority signs it; its own certificate is in turn signed by a higher authority, up to a root certificate. Whoever trusts the root can verify the whole chain.

X.509 is the foundation of TLS, electronic signatures and RFC 3161 timestamps. For agent evidence, it matters above all for timestamps and qualified trust services.

## Example

A [timestamp](https://knowyouragent.ch/en/knowledge/glossary/rfc-3161-timestamp) contains the timestamp authority's certificate and its chain up to an intermediate authority. The [verifying party](https://knowyouragent.ch/en/knowledge/glossary/verifying-party) provides the root certificate as anchor; KYA checks whether the chain ends there and whether the certificate is intended for timestamping.

## How it differs

A JWKS lists keys without identity; an X.509 certificate links a key with a verified identity and an issuer. A [trust anchor](https://knowyouragent.ch/en/knowledge/glossary/trust-anchor) is the certificate or key the verifying party explicitly trusts.

## In practice

- Provide as anchors only root or intermediate certificates from a trusted source.
- Pay attention to the validity and intended use of certificates, not only to the signature.
- Keep anchors and certificates as long as evidence must be verified.

## Role in KYA

KYA verifies timestamp certificate chains up to the anchor the verifying party provides as PEM. Without an anchor, the engine reports tsa_anchor_not_provided; for a chain without a matching anchor, tsa_not_trusted.

Related check: [Timestamp](https://knowyouragent.ch/en/method/checks) (`timestamp_assurance`). Is the RFC 3161 timestamp valid, bound to the content and traceable to an anchor of the verifying party?

[Verify now: open a matching example](https://knowyouragent.ch/en/verify?beispiel=paket)

## Frequently asked questions

### What is an X.509 certificate?

A signed data structure that links a public key with an identity. It is issued by a certificate authority and described in RFC 5280.

### What is a certificate chain?

The sequence of certificates from the holder through intermediate authorities up to a root. Each certificate is signed by the next higher one.

### What does KYA need X.509 for?

Above all for RFC 3161 timestamps. KYA verifies their signature and certificate chain up to the verifying party's anchor.

### What does PEM mean?

A text format for certificates and keys with header and footer lines such as BEGIN CERTIFICATE. KYA accepts timestamp anchors in this format.

### What happens if a certificate has expired?

What generally counts is whether it was valid at the time of signing. A timestamp can prove this time independently, so it can still be shown later.

## Sources

- [RFC 5280: Internet X.509 Public Key Infrastructure](https://www.rfc-editor.org/rfc/rfc5280)
- [RFC 3161: Time-Stamp Protocol](https://www.rfc-editor.org/rfc/rfc3161)

## Related terms

- [Trust anchor](https://knowyouragent.ch/en/knowledge/glossary/trust-anchor)
- [JWKS (JSON Web Key Set)](https://knowyouragent.ch/en/knowledge/glossary/jwks)
- [Qualified timestamp](https://knowyouragent.ch/en/knowledge/glossary/qualified-timestamp)
- [Mutual TLS (RFC 8705)](https://knowyouragent.ch/en/knowledge/glossary/mutual-tls)

---
Quelle: https://knowyouragent.ch/en/knowledge/glossary/x509-certificate · KYA – Know Your Agent