The ASN.1 module for X.509 certificates as specified in RFC 5912 - Section 14 is as follows:

TBSCertificate  ::=  SEQUENCE  {
      version         [0]  Version DEFAULT v1,
      serialNumber         CertificateSerialNumber,
      signature            AlgorithmIdentifier{SIGNATURE-ALGORITHM,
      issuer               Name,
      validity             Validity,
      subject              Name,
      subjectPublicKeyInfo SubjectPublicKeyInfo,
      ... ,
      [[2:               -- If present, version MUST be v2
      issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
      subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL
      [[3:               -- If present, version MUST be v3 --
      extensions      [3]  Extensions{{CertExtensions}} OPTIONAL
      ]], ... }

The field names are the same in RFC 5280.

The decoded example certificate on the X.509 Wikipedia page however has completely different field names:

        Version: 3 (0x2)
        Serial Number:
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2
            Not Before: Nov 21 08:00:00 2016 GMT
            Not After : Nov 22 07:59:59 2017 GMT
        Subject: C=US, ST=California, L=San Francisco, O=Wikimedia Foundation, Inc., CN=*.wikipedia.org
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Agreement


Signature Algorithm instead of algorithm, X509v3 extensions instead of just extensions.

Since the certificate has version 3, i would assume it doesn't have anything to do with the version...

Of course i searched for various field names like X509v3 Key Usage or X509v3 CRL Distribution Points but couldn't find any reference.

So where are the field names of the decoded human readable X.509 certificate specified or mapped?


The example from the Wikipedia page does not look like x.509 to me. Rather, it looks like the way openssl displays certificate information.

Perhaps openssl is trying to display the certificate information in a way that is more human readable, and therefore the developers of openssl took the liberty of changing some of the field names in a way that they thought would be more descriptive (e.g. Signature Algorithm instead of algorithm, X509v3 extensions instead of just extensions, etc.).

If you run the command below, you'll see that the output produced is very similar to the example from Wikipedia that you posted:

echo | openssl s_client -connect wikipedia.com:443 2>/dev/null | openssl x509 -noout -text

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.