Subject: Validation

From: "Haaino Beljaars" <[email-masked]>
Date: Mon, 3 Jun 2002 10:13:32 +0200

Hi,

What should I do, as an end-user, to 'validate' an (end-entity) certificate?
Is it enough to check the certificate path on (delta-)CRL,OCSP? Or should I do more: for example check to repository and look whether or not the certificate was ever issued? Should I check the fingerprint of the root CA against a published fingerprint?

Thanks,
Haaino

---

From: Denis Pinkas <[email-masked]>
Date: Mon, 03 Jun 2002 11:37:53 +0200

> Is it enough to check the certificate path on (delta-)CRL,OCSP? Or should I do more: for example check to repository and look whether or not the certificate was ever issued? Should I check the fing…

The full details are provided in RFC 3280:

   6.1  Basic Path Validation . . . . . . . . . . . . . . . . .  63
   6.2  Extending Path Validation . . . . . . . . . . . . . . .  80

There is no "more" to do.

How the root keys are determined is local matter. Using a fingerprint is 
one possibility.

Denis