| Identifier | REQ-PKI-11 |
|---|
| Title | Basic validation of the server certificate |
|---|
| Requirement | Service consumers shall do basic validation of the server certificate:
- Verify Server Identity:
- Clients shall validate the server's identity to ensure they are communicating with the intended server and not a malicious actor.
- Trust Chain Verification:
- Clients check if the server’s certificate is issued by a trusted Certificate Authority (CA) and verify the entire chain of trust up to a root CA.
- Certificate Revocation Checks:
- Clients may check for certificate revocation using Certificate Revocation Lists (CRLs) or the Online Certificate Status Protocol (OCSP).
- Certificate Expiry and Validity:
- Ensure the server’s certificate is within its valid date range and hasn’t expired.
- Certificate Usage and Extensions:
- Confirm that the server’s certificate is intended for server authentication.
|
|---|
| Source | AF5 Information and System Requirements UNDER REVIEW |
|---|
Guidance
NM 27.0 - NM B2B Reference Manual