X.509 / PKIX

X.509 is the certificate format, and PKIX is the set of rules for deciding whether a chain of them means anything. Together they are how the internet decides that a server is who it says it is.

The model, and its single assumption

A certificate says a key belongs to a name, signed by an authority. Validation walks upward until it reaches an authority the verifier already trusts. Everything rests on that root list, which is why the interesting questions in PKI are governance questions: who is in the store, who audits them, and what happens when one misbehaves.

Why decentralized identity defines itself against it

Not because certificates are broken, but because the root list is a permission system. Being trusted means being included, and inclusion is granted. A DID method replaces the authority with a resolution mechanism, which moves the problem rather than removing it: something still has to be trusted, and it is now the ledger and the method's rules.

Where Solidus actually uses it

Passports, and only passports. Reading a travel document's chip requires validating a country's certificate chain, so a trust store exists for that purpose. Nothing about issuing or verifying a Solidus credential involves a certificate authority.