openssl to create a X.509 certificate but I don't quite understand the relationship between a X.509 and a SSL certificate. Are they the same? Is a SSL certificate just a X.509 certificate that is used for SSL?
SSL is by far the largest use of X.509 certificates, many people use the terms interchangeably. They're not the same however; a "SSL Certificate" is a X.509 Certificate with Extended Key Usage: Server Authentication (18.104.22.168.22.214.171.124.1).
Other "common" types of X.509 certs are Client Authentication (126.96.36.199.188.8.131.52.2), Code Signing (184.108.40.206.220.127.116.11.3), and a handful of others are used for various encryption and authentication schemes.
X.509 certificates are a generic, highly flexible format. SSL (now known as "TLS") uses X.509 certificates. A "SSL certificate" is a certificate whose contents make it usable for SSL (usually, usable for a SSL server).
In particular, in most usages of SSL, the client will want to see the intended server name in the certificate. In a Web context (HTTPS), the "intended server name" is the one which appears in the URL; the checks performed by the client are described in RFC 2818 (section 3.1). Also, when a client and server "talk SSL", they agree on cryptographic algorithms to use, some of which implying use of the server's public key, as it appears in the certificate; for instance, if client and server choose a cipher suite which says "RSA key exchange", then the server certificate must contain a RSA public key, and if the certificate contains extensions which limit the authorized ways to use that key (e.g. the
Key Usage extension), then these extensions must allow the "encryption" use because that's what is implied by "RSA key exchange" in SSL.
Other features of certificates may prohibit usage for a SSL server, where "prohibit" means "the client will shriek and stammer and display a red scary warning at the user". For instance, a certificate may contain an
Extended Key Usage extension which lists the exhaustive list of "roles" for the entity which uses it; if the extension is present, then it should contain "server authentication" or the special "any usage" indicator.
There are a lot of details to care about. Commercial CA summarize the whole thing as "a SSL certificate", really meaning "an X.509 certificate which is all kosher for SSL, all clients will be happy with it".