Definition
X.509 is an ITU-T standard defining the format of public-key certificates. An X.509 certificate is a structured data file containing a public key, an identity (typically a domain name or organization), a validity period, and a digital signature from a Certificate Authority asserting that the binding is genuine. X.509 certificates are the basis of TLS, S/MIME email signing, code signing, and most VPN authentication.
How They Work
When a VPN client connects, the server presents its X.509 certificate. The client checks: is the signature valid (signed by a trusted CA)? Is the certificate still within its validity period? Does the subject match the server it expected to connect to? Has it been revoked? If all checks pass, the client trusts the public key inside and uses it to authenticate the server during the handshake. A failure in any check stops the connection.
Practical Concerns
Certificate management is a perennial source of operational pain. Expired certificates cause outages. Misconfigured certificate chains break clients. Revocation infrastructure (CRLs, OCSP) is incomplete and frequently bypassed. Long-lived certificates with weak keys remain a risk; modern best practice is short-lived certificates (90 days for Let's Encrypt) with automated renewal. VPN providers running their own CAs accept these trade-offs in exchange for not depending on the public CA ecosystem for their core authentication.