Skip to content
Lesson 7 of 10

Step 1 of 5 · Reading · ~1 min

Read

Validation & Revocation

Path Validation

When TLS server presents [end-entity, intermediate1, intermediate2, ...]:

python

Real implementations also check:

  • Name constraints: some intermediates restricted to certain domains.
  • Algorithm policy: reject SHA-1, MD5, RSA < 2048.
  • Cross-signing: a cert may be signed by multiple roots (transition periods).
  • Pin enforcement: HSTS-style pinning (HPKP deprecated; CT replaced it).

This is genuinely complex. CVEs find their way into validation regularly. Use vetted libraries.

Up nextRevocation: CRL & OCSPValidation & Revocation

Discussion

Ask a question, share an insight, or help someone who’s stuck.

Sign in to post a comment or reply.

Loading…