An X.509 v3 certificate is a DER SEQUENCE of tbsCertificate, signatureAlgorithm and signatureValue. The to-be-signed part holds version, serial number, signature algorithm, issuer name, validity (notBefore and notAfter), subject name, SubjectPublicKeyInfo and extensions; the issuer signs exactly those DER bytes. Revocation lists (CRLs) and attribute certificates use the same family of structures.
Extensions do most of the work today: subject alternative names (the host names browsers match), key usage and extended key usage, basic constraints (whether the certificate may sign others), name constraints, authority and subject key identifiers, authority information access (issuer and OCSP URLs), CRL distribution points, certificate policies and embedded Certificate Transparency SCTs. Any extension marked critical that a verifier does not understand must cause rejection.
"X.509" also names the wider PKI model of CAs, chains and revocation, which is used well beyond TLS: S/MIME, code signing, document signing (PAdES), smart cards (PIV), mTLS and device identity. Post-quantum algorithms slot in through new algorithm identifiers, for example ML-DSA per RFC 9881. The certificate decoder shows every field of a certificate locally.