X.509
PCIComplianceHubLast updated
The standard format for digital certificates in a public key infrastructure: it binds a public key to a name and records the issuing certificate authority, validity period and signature, and it is the certificate type TLS uses. Under PCI DSS these are the certificates that must be trusted, valid and unrevoked when PAN crosses open, public networks.
Applies to. PCI DSS v4.0.1 does not name X.509, but the certificates Requirement 4 refers to are X.509 certificates in practice, since TLS uses them and TLS is how PAN is normally protected on open, public networks. The requirement asks that they be trusted, confirmed valid, unexpired and unrevoked, that untrusted ones be rejected, and that the protocol not fall back to insecure versions, algorithms or key sizes, a check that in general practice extends to the certificate's own key size and signature algorithm.
Related. Digital Certificate, Certificate Authority (CA), PKI (Public Key Infrastructure), Transport Layer Security (TLS)
Sources. PCI DSS v4.0.1 (June 2024)