A public key certificate, usually just called a certificate, is a digitally signed statement that binds the value of a public key to the identity of the person, device, or service that holds the corresponding private key. One of the main benefits of certificates is that hosts no longer have to maintain a set of passwords for individual subjects who need to be authenticated as a prerequisite to access. Instead, the host merely establishes trust in a certificate issuer.

Most certificates in common use are based on the X.509 v3 certificate standard.

Typically, certificates contain the following information:

• The subject's public key value.
  
  
• The subject's identifier information, such as the name and e-mail address.
  
  
• The validity period (the length of time that the certificate is considered valid).
  
  
• Issuer identifier information.
  
  
• The digital signature of the issuer, which attests to the validity of the binding between the subject's public key and the subject's identifier information.
  
  

A certificate is valid only for the period of time specified within it; every certificate contains Valid From and Valid To dates, which set the boundaries of the validity period. Once a certificate's validity period has passed, a new certificate must be requested by the subject of the now-expired certificate.

• Using Certificates
  
  
• Public and Private Keys
  
  
• Certificate File Formats
  
  

⇒⇒Certificate Manager "certmgr.msc" Manual