I would like to check validity of x509 certificates of my clients. I would like to trust the certificates what big companies trust. For example I would like to trust what Microsoft Edge, Chrome browser or Apple Safari trust. However, I want it to be dynamic. When they give up to trust a certain certificate authority for example, I want to behave the same manner automatically. Is there a known web service that I can use to check my clients certificates validity or the certificate signing chain's validity (not sure yet it is safe to expose those certificate details publicly) in companies sight? How could I do this?

What I would like to achieve is to implement something like EIDAS certificate check like PSD2 to prevent impersonation. (there is no PSD2 standart in this country, so there is no authority to provide EIDAS)

  • Just use the trust store from curl.se/docs/sslcerts.html with some curl command or a few lines of Python code. No need to employ a web service for this. May 7, 2021 at 10:46
  • Note revocations of individual certs (by a still-trusted CA) are much more common than distrusts of a CA -- the latter are big news because there have been only a handful -- but revocation checking is one of the least consistent parts of cert software. For example OpenSSL doesn't check revocation by default, and it is not only used by itself but builtin to many other things like php, python, nodejs. @SteffenUllrich: curl either uses platform (which varies) or offers a copy of Mozilla -- is Mozilla a big company? :-) May 8, 2021 at 3:54


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy