Title: Certificate Validation
Course: Introduction to SSL/PKI > Section: PKI

Certificate Validation

When a PKI certificate is received, it must be validated to insure:

1. The certificate (identity) is valid (They are who they say they are)
2. The certificate (identity) has not expired
3. The certificate (identity) has not been revoked

The certificate receiver maintains a list of trusted CAs. When they receive a certificate that is signed by a trusted CA, it is assumed to be OK (They are who they say they are). OK also means that the certificate has not been tampered with or modified.

The certificate contains an expiration date. Once the receiver knows the certificate is OK, the expirtation date can be checked.

Certificates can be revoked by the issuing CA before the have expired. A list of revoked certificates is maintained in public location that can be downloaded and checked.This is usually an LDAP Directory containing PKI information.