X.509

This is where we return to the concept of the wax seal, but translated into complex mathematics.

Instead of a metal family crest, the remote online notary utilizes cryptography, specifically a public key infrastructure, or PKI, and an X.509 digital certificate.

I wanna make sure we make this abstract technology incredibly tangible for you listening.

How does an X.509 certificate act like a wax seal?

Think of the digital certificate as a highly complex mathematical wrapper that encases the digital document.

Mm-hmm.

Abort the handshake when there is no ALPN protocol overlap, as required by RFC 730, not reachable from Smtpd.

Const correctness for X.509 name in preparation for OpenSSL 4.

Open certificate key files with o chown exec.

Uh, there's the checksums and the verification, uh, commands that you need to do to verify the code is correct.

And we know it's strange because the cable industry already solved this problem and solved it the other way.

DOCSIS cable modems use X.509 certificates burned into the device plus BPI plus encryption.

That's a genuine cryptographic identity.

The modem proves it's the modem, not just that a modem with that number was manufactured.

That is such a critical distinction.

A true digital certificate, specifically an X.509 certificate used in public key infrastructure, performs functions that a simple image file could never achieve.

Okay, break that down for us.

First, it cryptographically links the notary's strongly verified identity directly to the digital signature.

And so to allow these customers to be able to move from dedicated to the cloud HSM, we had customers that had X509 certificates in object storage and dedicated HSM.

And so we extended the PK-611 library for Azure Cloud HSM to support the creation of X.509 certificates.

So that way the private key remains in the Cloud HSM and the public certificate is placed within the customer's controlled storage account.

A clear distinction though is that Cloud HSM does not provide certificate lifecycle management.

Your issuing CA would be used to sign certificates.

and it would use the key that's inside CloudHSM.

If you're generating an X.509 certificate and you're not using ADCS, but you're using our PKC11 library to generate an X.509 certificate, you essentially would generate a key within the CloudHSM and then use that key to sign that certificate that you generated before placing it within your storage account and using that certificate to perform whatever specific workload operation that you were trying to perform.

So the most frictionless would probably be using ADCS, right? Because you've got the whole life cycle going on with ADCS rather than doing it yourself.

The first part is going to be device trust.

So that's your standard sort of X.509 attestation.

And then we'll throw user auth kind of into that.

So it'll be another way that you can authenticate.

At the heart of PKI is the Certificate Authority, or CA.

The CA is the trusted third party that validates the identity of an entity and cryptographically binds that identity to a public key by issuing a digital certificate, formatted under the International Standard X.509.

Your operating system and browser ship with a pre-installed trust store containing the public keys of recognized root CAs.

When you navigate to a secure site, your browser examines the presented certificate and traces it back through intermediate CIS to a trusted root of trust.