Certificate Validation

Certificate validation verifies that a certificate is trusted, currently valid, appropriate for the connection, and correctly binds a public key to an identity. In Java backend systems, this is a core part of TLS authentication and is normally performed by the TLS implementation using a configured trust store.

A certificate is an X.509 document that associates an identity, such as a hostname, with a public key and is signed by a certificate authority (CA). During TLS, the peer presents a certificate chain, and the client validates that chain against trusted CA certificates.

Validation includes checking the certificate's validity period, its signature chain, and whether the chain terminates at a trusted trust anchor. For a TLS server certificate, the client also checks that the requested hostname is represented by the certificate's `subjectAltName` entries.

The certificate's intended use matters too. Extensions such as `keyUsage` and `extendedKeyUsage` can restrict how a certificate is used. Revocation mechanisms such as CRL or OCSP can also be involved, depending on the TLS stack and its configuration.

In Java, trust decisions are commonly based on a `TrustStore`, while the TLS implementation performs path construction and validation. A certificate being correctly signed is not sufficient by itself: the issuer must ultimately be trusted, the certificate must be appropriate for the connection, and relevant validity and usage checks must succeed.

Key points

• Build and validate the X.509 certificate chain to a trusted CA.
• Check the certificate validity period and relevant certificate extensions.
• For TLS servers, verify the requested hostname against `subjectAltName`.
• Java commonly obtains trusted CA certificates from a configured trust store.
• A valid signature alone does not establish trust.

Interview questions

What does certificate validation mean in TLS?

It means checking whether a peer's certificate can be trusted for the current TLS connection. The checks include building a valid chain to a trusted CA and verifying relevant validity and usage constraints. For a server connection, hostname verification also ensures the certificate identifies the requested host.

Why isn't a valid certificate signature enough to trust a certificate?

A signature proves that the certificate was signed by the stated issuer, but it does not prove that the issuer is trusted by the client. The client must establish a chain from the presented certificate to a configured trust anchor. It must also check whether the certificate is valid for the intended connection.

What is the role of a Java trust store in certificate validation?

A Java trust store provides trusted certificate authorities or other trust anchors used when validating peer certificates. During TLS, the Java security and TLS implementation uses this trust material when constructing and validating a certificate path. If the presented chain cannot be validated to an acceptable trust anchor, the handshake can fail.

What certificate checks are relevant when connecting to an HTTPS server?

The client validates the server's certificate chain against its trusted anchors and checks certificate validity and applicable extensions. It also performs hostname verification so the certificate identifies the host being contacted. Depending on the environment, revocation checking may also be part of the validation process.