Reading — step 1 of 5
Read
~1 min readValidation & Revocation
Path Validation
When TLS server presents [end-entity, intermediate1, intermediate2, ...]:
python
Real implementations also check:
- Name constraints: some intermediates restricted to certain domains.
- Algorithm policy: reject SHA-1, MD5, RSA < 2048.
- Cross-signing: a cert may be signed by multiple roots (transition periods).
- Pin enforcement: HSTS-style pinning (HPKP deprecated; CT replaced it).
This is genuinely complex. CVEs find their way into validation regularly. Use vetted libraries.
Discussion
Ask a question, share an insight, or help someone who’s stuck.
Sign in to post a comment or reply.
Loading…