REQ-PKI-11

Basic validation of the server certificate

Service consumers shall do basic validation of the server certificate:

• Verify Server Identity:

  • Clients shall validate the server's identity to ensure they are communicating with the intended server and not a malicious actor.

• Trust Chain Verification:

  • Clients check if the server’s certificate is issued by a trusted Certificate Authority (CA) and verify the entire chain of trust up to a root CA.

• Certificate Revocation Checks:

  • Clients may check for certificate revocation using Certificate Revocation Lists (CRLs) or the Online Certificate Status Protocol (OCSP).

• Certificate Expiry and Validity:

  • Ensure the server’s certificate is within its valid date range and hasn’t expired.

• Certificate Usage and Extensions:

  • Confirm that the server’s certificate is intended for server authentication.

AF5 Information and System Requirements UNDER REVIEW