CertificateValidator Class
Properties Methods Events Configuration Settings Errors
The CertificateValidator class provides fine-grained validation of X.509 certificates.
Syntax
class secureblackbox.CertificateValidator
Remarks
This is a powerful and configurable class which can be used to validate all kinds of certificates and their chains.
The purpose of CertificateValidator is to validate certificate chains according to the X.509 specification. It supports a variety of technologies, including CRL and OCSP services, and can provide a comprehensive output on the certificate cryptographic validity, chain integrity, and trust levels. CertificateValidator is used internally in many other SecureBlackbox components, such as PDFSigner, HTTPClient, and OfficeVerifier.
To validate a certificate, please tune up the component as following:
- Assign the certificate to be validated to the certificate property.
- Set revocation_check in accordance with your revocation check preferences.
- Enable use_system_certificates property to trust certificates that are trusted by the operating system. Copy any certificates that are not available in the standard system locations to known_certificates and trusted_certificates collections (see Note 1 below).
- Optionally, adjust tls_settings and socket_settings.
- Adjust validation_moment if you would like to check the certificate validity at a different moment in time. Leave it unchanged to validate the certificate at the current time moment.
- Call validate or validate_for_ssl method to initiate chain validation.
Depending on the complexity of the chain and the configuration of the component, the validation routine may take certain amount of time. The validator reports chain validation progress using a selection of events, such as on_before_certificate_processing, on_after_certificate_processing, and on_crl_downloaded events. It may also ask you for missing objects using on_crl_needed or on_ca_certificate_needed events. In each such event handler you can access the currently validated certificate via the current_certificate property, and the interim validity figures via the interim_validation_result and interim_validation_details property.
The return of the validate (or similar) method indicates the completion of the validation procedure. The outcome of the chain validation is represented with the two parameters:
- chain_validation_result reports the general validation outcome: valid, valid-but-untrusted, invalid, and unknown. As a rule, only the valid result can be taken as a good reason to consider the chain valid.
- chain_validation_details provides insights into the factors that caused the validation to fail.
Note 1: On Windows, CertificateValidator can use CA and ROOT system stores to look for any missing CA certificates and trust anchors. No similar functionality is currently available for other platforms, so in most cases you must provide your own list of trusted and CA certificates via trusted_certificates and known_certificates collections to have your chains validate fully in Linux and macOS projects.
Note 2: The offline_mode property is a handy way to check the completeness of your revocation/validation information. When the offline mode is on, CertificateValidator won't go online for any missing certificates, CRLs, and OCSP responses. Paired with a switched-off use_system_certificates property, it allows to make sure that any content provided via known_certificates, known_cr_ls, and known_ocs_ps represents the complete set of validation information required to validate the chain.
Property List
The following is the full list of the properties of the class with short descriptions. Click on the links for further details.
| blocked_cert_count | The number of records in the BlockedCert arrays. |
| blocked_cert_bytes | Returns raw certificate data in DER format. |
| blocked_cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| cache_validation_results | Enables or disables validation result caching. |
| cert_bytes | Returns raw certificate data in DER format. |
| cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| chain_validation_details | The details of a certificate chain validation outcome. |
| chain_validation_result | The general outcome of a certificate chain validation routine. Use ChainValidationDetails to get information about the reasons that contributed to the validation result. |
| current_ca_cert_bytes | Returns raw certificate data in DER format. |
| current_ca_cert_ca | Indicates whether the certificate has a CA capability (a setting in BasicConstraints extension). |
| current_ca_cert_ca_key_id | A unique identifier (fingerprint) of the CA certificate's private key. |
| current_ca_cert_crl_distribution_points | Locations of the CRL (Certificate Revocation List) distribution points used to check this certificate's validity. |
| current_ca_cert_curve | Specifies the elliptic curve of the EC public key. |
| current_ca_cert_fingerprint | Contains the fingerprint (a hash imprint) of this certificate. |
| current_ca_cert_friendly_name | Contains an associated alias (friendly name) of the certificate. |
| current_ca_cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| current_ca_cert_hash_algorithm | Specifies the hash algorithm to be used in the operations on the certificate (such as key signing) SB_HASH_ALGORITHM_SHA1 SHA1 SB_HASH_ALGORITHM_SHA224 SHA224 SB_HASH_ALGORITHM_SHA256 SHA256 SB_HASH_ALGORITHM_SHA384 SHA384 SB_HASH_ALGORITHM_SHA512 SHA512 SB_HASH_ALGORITHM_MD2 MD2 SB_HASH_ALGORITHM_MD4 MD4 SB_HASH_ALGORITHM_MD5 MD5 SB_HASH_ALGORITHM_RIPEMD160 RIPEMD160 SB_HASH_ALGORITHM_CRC32 CRC32 SB_HASH_ALGORITHM_SSL3 SSL3 SB_HASH_ALGORITHM_GOST_R3411_1994 GOST1994 SB_HASH_ALGORITHM_WHIRLPOOL WHIRLPOOL SB_HASH_ALGORITHM_POLY1305 POLY1305 SB_HASH_ALGORITHM_SHA3_224 SHA3_224 SB_HASH_ALGORITHM_SHA3_256 SHA3_256 SB_HASH_ALGORITHM_SHA3_384 SHA3_384 SB_HASH_ALGORITHM_SHA3_512 SHA3_512 SB_HASH_ALGORITHM_BLAKE2S_128 BLAKE2S_128 SB_HASH_ALGORITHM_BLAKE2S_160 BLAKE2S_160 SB_HASH_ALGORITHM_BLAKE2S_224 BLAKE2S_224 SB_HASH_ALGORITHM_BLAKE2S_256 BLAKE2S_256 SB_HASH_ALGORITHM_BLAKE2B_160 BLAKE2B_160 SB_HASH_ALGORITHM_BLAKE2B_256 BLAKE2B_256 SB_HASH_ALGORITHM_BLAKE2B_384 BLAKE2B_384 SB_HASH_ALGORITHM_BLAKE2B_512 BLAKE2B_512 SB_HASH_ALGORITHM_SHAKE_128 SHAKE_128 SB_HASH_ALGORITHM_SHAKE_256 SHAKE_256 SB_HASH_ALGORITHM_SHAKE_128_LEN SHAKE_128_LEN SB_HASH_ALGORITHM_SHAKE_256_LEN SHAKE_256_LEN . |
| current_ca_cert_issuer | The common name of the certificate issuer (CA), typically a company name. |
| current_ca_cert_issuer_rdn | A collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate issuer. |
| current_ca_cert_key_algorithm | Specifies the public key algorithm of this certificate. |
| current_ca_cert_key_bits | Returns the length of the public key. |
| current_ca_cert_key_fingerprint | Returns a fingerprint of the public key contained in the certificate. |
| current_ca_cert_key_usage | Indicates the purposes of the key contained in the certificate, in the form of an OR'ed flag set. |
| current_ca_cert_key_valid | Returns True if the certificate's key is cryptographically valid, and False otherwise. |
| current_ca_cert_ocsp_locations | Locations of OCSP (Online Certificate Status Protocol) services that can be used to check this certificate's validity, as recorded by the CA. |
| current_ca_cert_origin | Returns the origin of this certificate. |
| current_ca_cert_policy_i_ds | Contains identifiers (OIDs) of the applicable certificate policies. |
| current_ca_cert_private_key_bytes | Contains the certificate's private key. |
| current_ca_cert_private_key_exists | Indicates whether the certificate has an associated private key. |
| current_ca_cert_private_key_extractable | Indicates whether the private key is extractable. |
| current_ca_cert_public_key_bytes | Contains the certificate's public key in DER format. |
| current_ca_cert_self_signed | Indicates whether the certificate is self-signed (root) or signed by an external CA. |
| current_ca_cert_serial_number | Returns the certificate's serial number. |
| current_ca_cert_sig_algorithm | Indicates the algorithm that was used by the CA to sign this certificate. |
| current_ca_cert_subject | The common name of the certificate holder, typically an individual's name, a URL, an e-mail address, or a company name. |
| current_ca_cert_subject_key_id | Contains a unique identifier (fingerprint) of the certificate's private key. |
| current_ca_cert_subject_rdn | A collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate holder (subject). |
| current_ca_cert_valid_from | The time point at which the certificate becomes valid, in UTC. |
| current_ca_cert_valid_to | The time point at which the certificate expires, in UTC. |
| current_cert_bytes | Returns raw certificate data in DER format. |
| current_cert_ca | Indicates whether the certificate has a CA capability (a setting in BasicConstraints extension). |
| current_cert_ca_key_id | A unique identifier (fingerprint) of the CA certificate's private key. |
| current_cert_crl_distribution_points | Locations of the CRL (Certificate Revocation List) distribution points used to check this certificate's validity. |
| current_cert_curve | Specifies the elliptic curve of the EC public key. |
| current_cert_fingerprint | Contains the fingerprint (a hash imprint) of this certificate. |
| current_cert_friendly_name | Contains an associated alias (friendly name) of the certificate. |
| current_cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| current_cert_hash_algorithm | Specifies the hash algorithm to be used in the operations on the certificate (such as key signing) SB_HASH_ALGORITHM_SHA1 SHA1 SB_HASH_ALGORITHM_SHA224 SHA224 SB_HASH_ALGORITHM_SHA256 SHA256 SB_HASH_ALGORITHM_SHA384 SHA384 SB_HASH_ALGORITHM_SHA512 SHA512 SB_HASH_ALGORITHM_MD2 MD2 SB_HASH_ALGORITHM_MD4 MD4 SB_HASH_ALGORITHM_MD5 MD5 SB_HASH_ALGORITHM_RIPEMD160 RIPEMD160 SB_HASH_ALGORITHM_CRC32 CRC32 SB_HASH_ALGORITHM_SSL3 SSL3 SB_HASH_ALGORITHM_GOST_R3411_1994 GOST1994 SB_HASH_ALGORITHM_WHIRLPOOL WHIRLPOOL SB_HASH_ALGORITHM_POLY1305 POLY1305 SB_HASH_ALGORITHM_SHA3_224 SHA3_224 SB_HASH_ALGORITHM_SHA3_256 SHA3_256 SB_HASH_ALGORITHM_SHA3_384 SHA3_384 SB_HASH_ALGORITHM_SHA3_512 SHA3_512 SB_HASH_ALGORITHM_BLAKE2S_128 BLAKE2S_128 SB_HASH_ALGORITHM_BLAKE2S_160 BLAKE2S_160 SB_HASH_ALGORITHM_BLAKE2S_224 BLAKE2S_224 SB_HASH_ALGORITHM_BLAKE2S_256 BLAKE2S_256 SB_HASH_ALGORITHM_BLAKE2B_160 BLAKE2B_160 SB_HASH_ALGORITHM_BLAKE2B_256 BLAKE2B_256 SB_HASH_ALGORITHM_BLAKE2B_384 BLAKE2B_384 SB_HASH_ALGORITHM_BLAKE2B_512 BLAKE2B_512 SB_HASH_ALGORITHM_SHAKE_128 SHAKE_128 SB_HASH_ALGORITHM_SHAKE_256 SHAKE_256 SB_HASH_ALGORITHM_SHAKE_128_LEN SHAKE_128_LEN SB_HASH_ALGORITHM_SHAKE_256_LEN SHAKE_256_LEN . |
| current_cert_issuer | The common name of the certificate issuer (CA), typically a company name. |
| current_cert_issuer_rdn | A collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate issuer. |
| current_cert_key_algorithm | Specifies the public key algorithm of this certificate. |
| current_cert_key_bits | Returns the length of the public key. |
| current_cert_key_fingerprint | Returns a fingerprint of the public key contained in the certificate. |
| current_cert_key_usage | Indicates the purposes of the key contained in the certificate, in the form of an OR'ed flag set. |
| current_cert_key_valid | Returns True if the certificate's key is cryptographically valid, and False otherwise. |
| current_cert_ocsp_locations | Locations of OCSP (Online Certificate Status Protocol) services that can be used to check this certificate's validity, as recorded by the CA. |
| current_cert_origin | Returns the origin of this certificate. |
| current_cert_policy_i_ds | Contains identifiers (OIDs) of the applicable certificate policies. |
| current_cert_private_key_bytes | Contains the certificate's private key. |
| current_cert_private_key_exists | Indicates whether the certificate has an associated private key. |
| current_cert_private_key_extractable | Indicates whether the private key is extractable. |
| current_cert_public_key_bytes | Contains the certificate's public key in DER format. |
| current_cert_self_signed | Indicates whether the certificate is self-signed (root) or signed by an external CA. |
| current_cert_serial_number | Returns the certificate's serial number. |
| current_cert_sig_algorithm | Indicates the algorithm that was used by the CA to sign this certificate. |
| current_cert_subject | The common name of the certificate holder, typically an individual's name, a URL, an e-mail address, or a company name. |
| current_cert_subject_key_id | Contains a unique identifier (fingerprint) of the certificate's private key. |
| current_cert_subject_rdn | A collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate holder (subject). |
| current_cert_valid_from | The time point at which the certificate becomes valid, in UTC. |
| current_cert_valid_to | The time point at which the certificate expires, in UTC. |
| grace_period | Specifies a grace period to apply during certificate validation. |
| interim_validation_details | Contains the validation details of the moment. |
| interim_validation_result | Contains the validation status of the moment. |
| known_cert_count | The number of records in the KnownCert arrays. |
| known_cert_bytes | Returns raw certificate data in DER format. |
| known_cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| known_crl_count | The number of records in the KnownCRL arrays. |
| known_crl_bytes | Returns raw CRL data in DER format. |
| known_crl_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| known_ocsp_count | The number of records in the KnownOCSP arrays. |
| known_ocsp_bytes | Buffer containing raw OCSP response data. |
| known_ocsp_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| max_validation_time | Specifies the maximum time the validation process may take. |
| offline_mode | Switches the class to the offline mode. |
| proxy_address | The IP address of the proxy server. |
| proxy_authentication | The authentication type used by the proxy server. |
| proxy_password | The password to authenticate to the proxy server. |
| proxy_port | The port on the proxy server to connect to. |
| proxy_proxy_type | The type of the proxy server. |
| proxy_request_headers | Contains HTTP request headers for WebTunnel and HTTP proxy. |
| proxy_response_body | Contains the HTTP or HTTPS (WebTunnel) proxy response body. |
| proxy_response_headers | Contains response headers received from an HTTP or HTTPS (WebTunnel) proxy server. |
| proxy_use_i_pv6 | Specifies whether IPv6 should be used when connecting through the proxy. |
| proxy_use_proxy | Enables or disables proxy-driven connection. |
| proxy_username | Specifies the username credential for proxy authentication. |
| qualified | Indicates a qualified electronic signature. |
| revocation_check | Specifies the kind(s) of revocation check to perform. |
| socket_dns_mode | Selects the DNS resolver to use: the class's (secure) built-in one, or the one provided by the system. |
| socket_dns_port | Specifies the port number to be used for sending queries to the DNS server. |
| socket_dns_query_timeout | The timeout (in milliseconds) for each DNS query. |
| socket_dns_servers | The addresses of DNS servers to use for address resolution, separated by commas or semicolons. |
| socket_dns_total_timeout | The timeout (in milliseconds) for the whole resolution process. |
| socket_incoming_speed_limit | The maximum number of bytes to read from the socket, per second. |
| socket_local_address | The local network interface to bind the socket to. |
| socket_local_port | The local port number to bind the socket to. |
| socket_outgoing_speed_limit | The maximum number of bytes to write to the socket, per second. |
| socket_timeout | The maximum period of waiting, in milliseconds, after which the socket operation is considered unsuccessful. |
| socket_use_i_pv6 | Enables or disables IP protocol version 6. |
| tls_client_cert_count | The number of records in the TLSClientCert arrays. |
| tls_client_cert_bytes | Returns raw certificate data in DER format. |
| tls_client_cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| tls_server_cert_count | The number of records in the TLSServerCert arrays. |
| tls_server_cert_bytes | Returns raw certificate data in DER format. |
| tls_server_cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| tls_auto_validate_certificates | Specifies whether server-side TLS certificates should be validated automatically using internal validation rules. |
| tls_base_configuration | Selects the base configuration for the TLS settings. |
| tls_ciphersuites | A list of ciphersuites separated with commas or semicolons. |
| tlsec_curves | Defines the elliptic curves to enable. |
| tls_force_resume_if_destination_changes | Whether to force TLS session resumption when the destination address changes. |
| tls_pre_shared_identity | Defines the identity used when the PSK (Pre-Shared Key) key-exchange mechanism is negotiated. |
| tls_pre_shared_key | Contains the pre-shared for the PSK (Pre-Shared Key) key-exchange mechanism, encoded with base16. |
| tls_pre_shared_key_ciphersuite | Defines the ciphersuite used for PSK (Pre-Shared Key) negotiation. |
| tls_renegotiation_attack_prevention_mode | Selects renegotiation attack prevention mechanism. |
| tls_revocation_check | Specifies the kind(s) of revocation check to perform. |
| tlsssl_options | Various SSL (TLS) protocol options, set of cssloExpectShutdownMessage 0x001 Wait for the close-notify message when shutting down the connection cssloOpenSSLDTLSWorkaround 0x002 (DEPRECATED) Use a DTLS version workaround when talking to very old OpenSSL versions cssloDisableKexLengthAlignment 0x004 Do not align the client-side PMS by the RSA modulus size. |
| tlstls_mode | Specifies the TLS mode to use. |
| tls_use_extended_master_secret | Enables Extended Master Secret Extension, as defined in RFC 7627. |
| tls_use_session_resumption | Enables or disables TLS session resumption capability. |
| tls_versions | Th SSL/TLS versions to enable by default. |
| trusted_cert_count | The number of records in the TrustedCert arrays. |
| trusted_cert_bytes | Returns raw certificate data in DER format. |
| trusted_cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| used_cert_count | The number of records in the UsedCert arrays. |
| used_cert_bytes | Returns raw certificate data in DER format. |
| used_cert_ca | Indicates whether the certificate has a CA capability (a setting in BasicConstraints extension). |
| used_cert_ca_key_id | A unique identifier (fingerprint) of the CA certificate's private key. |
| used_cert_crl_distribution_points | Locations of the CRL (Certificate Revocation List) distribution points used to check this certificate's validity. |
| used_cert_curve | Specifies the elliptic curve of the EC public key. |
| used_cert_fingerprint | Contains the fingerprint (a hash imprint) of this certificate. |
| used_cert_friendly_name | Contains an associated alias (friendly name) of the certificate. |
| used_cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| used_cert_hash_algorithm | Specifies the hash algorithm to be used in the operations on the certificate (such as key signing) SB_HASH_ALGORITHM_SHA1 SHA1 SB_HASH_ALGORITHM_SHA224 SHA224 SB_HASH_ALGORITHM_SHA256 SHA256 SB_HASH_ALGORITHM_SHA384 SHA384 SB_HASH_ALGORITHM_SHA512 SHA512 SB_HASH_ALGORITHM_MD2 MD2 SB_HASH_ALGORITHM_MD4 MD4 SB_HASH_ALGORITHM_MD5 MD5 SB_HASH_ALGORITHM_RIPEMD160 RIPEMD160 SB_HASH_ALGORITHM_CRC32 CRC32 SB_HASH_ALGORITHM_SSL3 SSL3 SB_HASH_ALGORITHM_GOST_R3411_1994 GOST1994 SB_HASH_ALGORITHM_WHIRLPOOL WHIRLPOOL SB_HASH_ALGORITHM_POLY1305 POLY1305 SB_HASH_ALGORITHM_SHA3_224 SHA3_224 SB_HASH_ALGORITHM_SHA3_256 SHA3_256 SB_HASH_ALGORITHM_SHA3_384 SHA3_384 SB_HASH_ALGORITHM_SHA3_512 SHA3_512 SB_HASH_ALGORITHM_BLAKE2S_128 BLAKE2S_128 SB_HASH_ALGORITHM_BLAKE2S_160 BLAKE2S_160 SB_HASH_ALGORITHM_BLAKE2S_224 BLAKE2S_224 SB_HASH_ALGORITHM_BLAKE2S_256 BLAKE2S_256 SB_HASH_ALGORITHM_BLAKE2B_160 BLAKE2B_160 SB_HASH_ALGORITHM_BLAKE2B_256 BLAKE2B_256 SB_HASH_ALGORITHM_BLAKE2B_384 BLAKE2B_384 SB_HASH_ALGORITHM_BLAKE2B_512 BLAKE2B_512 SB_HASH_ALGORITHM_SHAKE_128 SHAKE_128 SB_HASH_ALGORITHM_SHAKE_256 SHAKE_256 SB_HASH_ALGORITHM_SHAKE_128_LEN SHAKE_128_LEN SB_HASH_ALGORITHM_SHAKE_256_LEN SHAKE_256_LEN . |
| used_cert_issuer | The common name of the certificate issuer (CA), typically a company name. |
| used_cert_issuer_rdn | A collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate issuer. |
| used_cert_key_algorithm | Specifies the public key algorithm of this certificate. |
| used_cert_key_bits | Returns the length of the public key. |
| used_cert_key_fingerprint | Returns a fingerprint of the public key contained in the certificate. |
| used_cert_key_usage | Indicates the purposes of the key contained in the certificate, in the form of an OR'ed flag set. |
| used_cert_key_valid | Returns True if the certificate's key is cryptographically valid, and False otherwise. |
| used_cert_ocsp_locations | Locations of OCSP (Online Certificate Status Protocol) services that can be used to check this certificate's validity, as recorded by the CA. |
| used_cert_origin | Returns the origin of this certificate. |
| used_cert_policy_i_ds | Contains identifiers (OIDs) of the applicable certificate policies. |
| used_cert_private_key_bytes | Contains the certificate's private key. |
| used_cert_private_key_exists | Indicates whether the certificate has an associated private key. |
| used_cert_private_key_extractable | Indicates whether the private key is extractable. |
| used_cert_public_key_bytes | Contains the certificate's public key in DER format. |
| used_cert_self_signed | Indicates whether the certificate is self-signed (root) or signed by an external CA. |
| used_cert_serial_number | Returns the certificate's serial number. |
| used_cert_sig_algorithm | Indicates the algorithm that was used by the CA to sign this certificate. |
| used_cert_subject | The common name of the certificate holder, typically an individual's name, a URL, an e-mail address, or a company name. |
| used_cert_subject_key_id | Contains a unique identifier (fingerprint) of the certificate's private key. |
| used_cert_subject_rdn | A collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate holder (subject). |
| used_cert_valid_from | The time point at which the certificate becomes valid, in UTC. |
| used_cert_valid_to | The time point at which the certificate expires, in UTC. |
| used_crl_count | The number of records in the UsedCRL arrays. |
| used_crl_bytes | Returns raw CRL data in DER format. |
| used_crl_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| used_crl_issuer | The common name of the CRL issuer (CA), typically a company name. |
| used_crl_issuer_rdn | A collection of information, in the form of [OID, Value] pairs, uniquely identifying the CRL issuer. |
| used_crl_location | The URL that the CRL was downloaded from. |
| used_crl_next_update | The planned time and date of the next version of this CRL to be published. |
| used_crl_this_update | The date and time at which this version of the CRL was published. |
| use_default_ts_ls | Enables or disables the use of the default TSLs. |
| used_ocsp_count | The number of records in the UsedOCSP arrays. |
| used_ocsp_bytes | Buffer containing raw OCSP response data. |
| used_ocsp_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| used_ocsp_issuer | Indicates the issuer of this response (a CA or its authorized representative). |
| used_ocsp_issuer_rdn | Indicates the RDN of the issuer of this response (a CA or its authorized representative). |
| used_ocsp_location | Location of the OCSP responder. |
| used_ocsp_produced_at | Specifies the time when the response was produced, in UTC. |
| use_system_certificates | Enables or disables the use of the system certificates. |
| validation_log | Contains the complete log of the certificate validation routine. |
| validation_moment | The time point at which chain validity is to be established. |
Method List
The following is the full list of the methods of the class with short descriptions. Click on the links for further details.
| config | Sets or retrieves a configuration setting. |
| refresh_cache | Refreshes the certificate cache. |
| reset_cache | Clears all data contained in the validation cache. |
| terminate | Terminates the validation process. |
| validate | Validates the certificate chain. |
| validate_for_smime | Validates an e-mail signing certificate. |
| validate_for_ssl | Validates a server-side SSL/TLS certificate. |
Event List
The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.
| on_after_certificate_processing | Marks the end of a single certificate processing step. |
| on_after_certificate_validation | Marks the end of a single certificate validation step. |
| on_before_ca_certificate_download | Fires when a CA certificate is about to be downloaded. |
| on_before_certificate_processing | Reports the start of certificate processing. |
| on_before_certificate_validation | Reports the start of certificate validation. |
| on_before_crl_download | Fires when a CRL is about to be downloaded. |
| on_before_ocsp_download | Fires when a certificate's OCSP status is about to be requested. |
| on_ca_certificate_downloaded | Marks the success of a certificate download. |
| on_ca_certificate_needed | Requests a missing certificate from the user. |
| on_crl_downloaded | Marks the success of a CRL download. |
| on_crl_needed | Requests a missing CRL from the user. |
| on_error | Information about errors during certificate validation. |
| on_notification | This event notifies the application about an underlying control flow event. |
| on_ocsp_downloaded | Marks the success of an OCSP request. |
| on_tls_cert_validate | This event is fired upon receipt of the TLS server's certificate, allowing the user to control its acceptance. |
Configuration Settings
The following is a list of configuration settings for the class with short descriptions. Click on the links for further details.
| CacheValidityTime | Time period during which to keep validation cache. |
| CheckStrongAlgorithmForTrusted | Whether to check a 'strong' hash algorithm for trusted certificates. |
| CheckValidityPeriodForTrusted | Whether to check validity period for trusted certificates. |
| CrossCertificationValidationStrategy | Defines how the cross certification validation is performed. |
| ForceCompleteChainValidationForTrusted | Whether to validate the whole chain. |
| ForceRevocationCheckForRoot | Whether to check revocation info for root certificates. |
| IgnoreBadOCSPChains | Whether to ignore bad OCSP chains during validation. |
| IgnoreCABasicConstraints | Whether to ignore the Basic Constraints extension for the CA certificates. |
| IgnoreCAKeyUsage | Whether to ignore Key Usage extension for CA certificates. |
| IgnoreCANameConstraints | Whether to ignore the Name Constraints extension for the CA certificates. |
| IgnoreOCSPNoCheckExtension | Whether OCSP NoCheck extension should be ignored. |
| IgnoreRevocationKeyUsage | Whether to check the CA certs used to sign revocation info. |
| IgnoreSSLKeyUsage | Whether to check the CA certs used in SSL/TLS. |
| IgnoreSystemTrust | Whether trusted Windows Certificate Stores should be treated as trusted. |
| ImplicitlyTrustSelfSignedCertificates | Whether to trust self-signed certificates. |
| LookupCRLByNameIfDPNotPresent | Whether to look for implicit CRL Distribution Points. |
| PromoteLongOCSPResponses | Whether long OCSP responses are requested. |
| RevocationMomentGracePeriod | Grace period for revocation information propagation. |
| SkipSubjectNameIfAltNameExists | Whether to check CommonName if SubjectAltName is present. |
| UseMicrosoftCTL | Enables or disables automatic use of Microsoft online certificate trust list. |
| ValidateInvalidCertificates | Whether to do all checks on invalid certificates. |
| WeakAlgorithmHandlingMode | How to handle certificates signed with a 'weak' hash algorithm. |
| CustomTSLs | Specifies the custom TSLs. |
| QualifiedStatus | Indicates a qualified electronic signature. |
| TSLDistributionPoints | Contains XML content of distribution points of the TSL used. |
| TSLDistributionPoints[Idx] | Contains distribution point of the specified index of the TSL used. |
| TSLHistoricalInformationPeriod | Contains historical information period of the TSL used. |
| TSLLegalNotices | Contains XML content of legal notices of the TSL used. |
| TSLLegalNotices[lang] | Contains legal notices for the specified language of the TSL used. |
| TSLListIssueDateTime | Contains list issue date and time of the TSL used. |
| TSLNextUpdate | Contains next update date and time of the TSL used. |
| TSLPolicies | Contains XML content of policies of the TSL used. |
| TSLPolicies[lang] | Contains policies for the specified language of the TSL used. |
| TSLSchemeExtensions | Contains XML content of scheme extensions of the TSL used. |
| TSLSchemeExtensions[Idx] | Contains XML content of scheme extension of the specified index of the TSL used. |
| TSLSchemeInformationURI | Contains XML content of scheme information URI of the TSL used. |
| TSLSchemeInformationURI[lang] | Contains scheme information URI for the specified language of the TSL used. |
| TSLSchemeName | Contains XML content of scheme name of the TSL used. |
| TSLSchemeName[lang] | Contains scheme name for the specified language of the TSL used. |
| TSLSchemeOperatorAddress | Contains XML content of scheme operator address of the TSL used. |
| TSLSchemeOperatorName | Contains XML content of scheme operator name of the TSL used. |
| TSLSchemeOperatorName[lang] | Contains scheme operator name for the specified language of the TSL used. |
| TSLSchemeTerritory | Contains scheme territory of the TSL used. |
| TSLSchemeTypeCommunityRules | Contains XML content of scheme type/community/rules of the TSL used. |
| TSLSchemeTypeCommunityRules[lang] | Contains scheme type/community/rules for the specified language of the TSL used. |
| TSLSequenceNumber | Contains sequence number of the TSL used. |
| TSLsRetrieveLog | Contains the complete log of the TSLs retrieve. |
| TSLStatusDeterminationApproach | Contains status determination approach of the TSL used. |
| TSLsValidationLog | Contains the complete log of the TSLs validation. |
| TSLTSPAdditionalServiceInformation | Contains addtional service information of the TSP service used. |
| TSLTSPAddress | Contains XML content of the address of the TSP used. |
| TSLTSPHistoryInstance | Indicates that TSP service history instance used. |
| TSLTSPHistoryInstanceAdditionalServiceInformation | Contains addtional service information of the TSP service history instance used. |
| TSLTSPHistoryInstanceQualifiers | Contains list of qualifiers of the TSP service history instance used. |
| TSLTSPHistoryInstanceServiceInformationExtensions | Contains XML content of information extensions of the TSP service history instance used. |
| TSLTSPHistoryInstanceServiceInformationExtensions[Idx] | Contains XML content of information extension of the specified index of the TSP service history instance used. |
| TSLTSPHistoryInstanceServiceName | Contains XML content of name of the TSP service history instance used. |
| TSLTSPHistoryInstanceServiceName[lang] | Contains name for the specified language of the TSP service history instance used. |
| TSLTSPHistoryInstanceServiceStatus | Contains status of the TSP service history instance used. |
| TSLTSPHistoryInstanceServiceStatusStartingTime | Contains status starting time of the TSP service history instance used. |
| TSLTSPHistoryInstanceServiceTypeIdentifier | Contains type identifier of the TSP service history instance used. |
| TSLTSPHistoryInstanceXML | Contains XML content of the TSP service history instance used. |
| TSLTSPInformationExtensions | Contains XML content of information extensions of the TSP used. |
| TSLTSPInformationExtensions[Idx] | Contains XML content of information extension of the specified index of the TSP used. |
| TSLTSPInformationURI | Contains XML content of information URI of the TSP used. |
| TSLTSPInformationURI[lang] | Contains information URI for the specified language of the TSP used. |
| TSLTSPName | Contains XML content of name of the TSP used. |
| TSLTSPName[lang] | Contains name for the specified language of the TSP used. |
| TSLTSPSchemeServiceDefinitionURI | Contains XML content of scheme service definition URI of the TSP service used. |
| TSLTSPSchemeServiceDefinitionURI[lang] | Contains scheme service definition URI for the specified language of the TSP service used. |
| TSLTSPServiceDefinitionURI | Contains XML content of definition URI of the TSP service used. |
| TSLTSPServiceDefinitionURI[lang] | Contains definition URI for the specified language of the TSP service used. |
| TSLTSPServiceInformationExtensions | Contains XML content of information extensions of the TSP service used. |
| TSLTSPServiceInformationExtensions[Idx] | Contains XML content of information extension of the specified index of the TSP service used. |
| TSLTSPServiceName | Contains XML content of name of the TSP service used. |
| TSLTSPServiceName[lang] | Contains name for the specified language of the TSP service used. |
| TSLTSPServiceQualifiers | Contains list of qualifiers of the TSP service used. |
| TSLTSPServiceStatus | Contains status of the TSP service used. |
| TSLTSPServiceStatusStartingTime | Contains status starting time of the TSP service used. |
| TSLTSPServiceSupplyPoints | Contains XML content of the supply points of the TSP service used. |
| TSLTSPServiceTypeIdentifier | Contains type identifier of the TSP service used. |
| TSLTSPServiceXML | Contains XML content of the TSP service used. |
| TSLTSPTradeName | Contains XML content of trade name of the TSP used. |
| TSLTSPTradeName[lang] | Contains trade name for the specified language of the TSP used. |
| TSLTSPXML | Contains XML content of the TSP used. |
| TSLType | Contains TSL type of the TSL used. |
| TSLVersionIdentifier | Contains version identifier of the TSL used. |
| TSLXML | Contains XML content of the TSL used. |
| CheckKeyIntegrityBeforeUse | Enables or disable private key integrity check before use. |
| CookieCaching | Specifies whether a cookie cache should be used for HTTP(S) transports. |
| Cookies | Gets or sets local cookies for the class (supported for HTTPClient, RESTClient and SOAPClient only). |
| DefDeriveKeyIterations | Specifies the default key derivation algorithm iteration count. |
| EnableClientSideSSLFFDHE | Enables or disables finite field DHE key exchange support in TLS clients. |
| GlobalCookies | Gets or sets global cookies for all the HTTP transports. |
| HttpUserAgent | Specifies the user agent name to be used by all HTTP clients. |
| LogDestination | Specifies the debug log destination. |
| LogDetails | Specifies the debug log details to dump. |
| LogFile | Specifies the debug log filename. |
| LogFilters | Specifies the debug log filters. |
| LogFlushMode | Specifies the log flush mode. |
| LogLevel | Specifies the debug log level. |
| LogMaxEventCount | Specifies the maximum number of events to cache before further action is taken. |
| LogRotationMode | Specifies the log rotation mode. |
| MaxASN1BufferLength | Specifies the maximal allowed length for ASN.1 primitive tag data. |
| MaxASN1TreeDepth | Specifies the maximal depth for processed ASN.1 trees. |
| OCSPHashAlgorithm | Specifies the hash algorithm to be used to identify certificates in OCSP requests. |
| UseOwnDNSResolver | Specifies whether the client classes should use own DNS resolver. |
| UseSharedSystemStorages | Specifies whether the validation engine should use a global per-process copy of the system certificate stores. |
| UseSystemOAEPAndPSS | Enforces or disables the use of system-driven RSA OAEP and PSS computations. |
| UseSystemRandom | Enables or disables the use of the OS PRNG. |