[Info] Certificate terminology

[heinezen]

This issue is meant to explain and list some of the technical terminology used to explain certificates. If you are writing or editing an FAQ entry, you can use this issue as guidance for selecting the proper word in your text. Choosing the right words is especially important in this context because most users know nothing about the technology behind digital certificates and can easily be confused.

(I have not looked at all existing FAQ entries, so there might be deviations from the already used wordings)

Certificate Basics

• All digital certificates have an issuer (Aussteller). This is the instance that signs the certificate content (in Germany: the RKI).
• The person/thing that is certified is called the subject ((Zertifkats-)Gegenstand). However, since this is a technical term, it's usually better to use the more verbose person the certificate was issued for (Person auf die das Zertifikat ausgestellt wurde) in this context, even if it is less precise
• The person keeping/showing a certificate is called certificate bearer (Inhaber). Note that this does not have to be the same person as the subject, e.g. in case of family certificates.
• Certificates usually have an expiration date. After this date, the certificate is no longer valid. This does not mean that the verified data is wrong, it's a technical limitation for security reasons. Certificates should be renewed before this date.
• The signature of the certificate is computed over the header and payload of the signature. The header contains information about the used signature algorithms, while the payload contains the subject's data and other meta information. You can refer to either as the signed content instead of using the two technical terms.

A few pitfalls to avoid:

• Don't use "owner" (Besitzer/Eigentümer) for a digital certificate and use either the subject or bearer definition from above. The reason is that the subject and bearer can be two different people.
• For the same reason, don't call a certificate an "ID" (Ausweis). A certificate certifies its subject, not its bearer. Calling it an ID may lead to users (and verifiers) to think that showing the certificate is enough. The subject and the bearer always have to be linked by an actual ID like the Personalausweis.
• A certificate can neither be "extended" or "corrected" because all health information and metadata is signed and therefore fixed. Certificates must either be renewed (in case the expiration date is near) or reissued (in case the data is wrong).