Glossary

PKI terms

AIA - Authority Information Access. A certificate extension pointing at the issuer’s certificate and its OCSP responder. Missing AIA is a common cause of chains that validate on your laptop and fail on a server.

ACME - RFC 8555. The protocol behind Let’s Encrypt: automated domain validation and issuance. Commercial CAs offering ACME require EAB.

CA/Browser Forum - Where browser and CA vendors agree the Baseline Requirements. Its ballots set certificate lifetimes; see certificate lifetimes.

CDP - CRL Distribution Point. The extension saying where to fetch the CRL.

CRL - Certificate Revocation List. A signed list of revoked serials. Simple, cacheable, and potentially large.

CSR - Certificate Signing Request, PKCS#10. Contains the public key and requested identity, signed by the corresponding private key to prove possession. Contains no private key, which is why it is safe to send.

CT - Certificate Transparency. Public append-only logs of issued certificates. Browsers require inclusion, which makes CT a reliable way to find certificates issued for your domains by anyone. See CT monitoring.

EAB - External Account Binding. Ties an ACME account to your existing commercial account at a CA. Why you cannot point certbot at a commercial ACME endpoint without configuration from that CA.

EKU - Extended Key Usage. What a certificate may be used for: server authentication, client authentication, code signing, OCSP signing.

eIDAS - EU regulation on electronic identification and trust services. Relevant here through QWAC and qualified trust service providers.

Fingerprint - A hash of the whole certificate, SHA-256 here. NextPKI’s identity for a certificate, because serial numbers are only unique per issuer.

HSM - Hardware Security Module. Holds private keys so they cannot be exported. Accessed via PKCS#11.

mTLS - Mutual TLS. Both sides present certificates. How sensors authenticate.

MPIC - Multi-Perspective Issuance Corroboration. Domain validation from several network vantage points, so a local hijack cannot fool a CA.

ML-DSA - FIPS 204, the post-quantum signature standard replacing RSA and ECDSA. Represented in key_algorithm, including hybrid values.

OCSP - Online Certificate Status Protocol, RFC 6960. Ask about one certificate instead of downloading a whole CRL.

OCSP signer, delegated - A certificate with id-kp-OCSPSigning and ocsp-nocheck that signs OCSP responses, so the issuing CA’s key is not used for online operations.

PKCS#11 - Standard API for talking to HSMs and smartcards.

QWAC - Qualified Website Authentication Certificate. An eIDAS-qualified certificate from a qualified trust service provider.

RFC 5280 - The X.509 profile for internet PKI. Where rules like “encode times before 2050 as UTCTime” live - ignore them and other TLS stacks reject your certificates.

SAN - Subject Alternative Name. The names a certificate is actually valid for. Common Name has been decorative for years; SAN is what clients check.

SCT - Signed Certificate Timestamp. Proof of CT log submission.

SNI - Server Name Indication. The hostname the client asks for during the handshake, so one IP can serve many certificates. The sensor records which SNI produced which certificate.

STARTTLS - Upgrading a plaintext protocol to TLS in-band, as SMTP on 587 does. Distinct from implicit TLS on 465.

S/MIME - Certificates for signing and encrypting email, with their own Baseline Requirements and four validation profiles.

NextPKI terms

Connector - Your account at a CA, configured in NextPKI. Renewals are ordered through one. See CA connectors.

Discovery source - Anything that reports certificates: a sensor, CT, a CA account. See sources.

Observation - A record that a specific certificate was seen at a specific place and time. One certificate, many observations.

Organisation - A tree inside a tenant, for subsidiaries or sites. Not a tenant.

Renewal - A lifecycle request with its own state machine. Called a “request” in the API (/v1/requests).

Scan profile - conservative, standard or aggressive; sets sensor concurrency.

Sensor - The discovery agent that runs in your network. See what it does.

Tenant - A customer account and the hard isolation boundary. Pinned to a region.

Trust status - The verdict of chain validation, distinct from whether the certificate is well-formed. See enumerations.