====== Validation ======

Compact examples for certificate validation. -> **Details:** [[en:int:pqcrypt:szenarien:validierung:start|Validation Scenarios]]

----

===== Single Certificate =====

<code csharp>
var cert = new X509Certificate2("certificate.crt");

// Time validity
bool timeValid = DateTime.UtcNow >= cert.NotBefore &&
                 DateTime.UtcNow <= cert.NotAfter;

// Check PQ signature
bool hasPq = cert.HasPqSignature();
if (hasPq)
{
    bool pqValid = cert.VerifyPqSignature();
}
</code>

----

===== Certificate Chain =====

<code csharp>
var endEntity = new X509Certificate2("server.crt");

var chain = new X509Chain();
chain.ChainPolicy.RevocationMode = X509RevocationMode.Online;
chain.ChainPolicy.CustomTrustStore.Add(new X509Certificate2("root-ca.crt"));
chain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;

bool isValid = chain.Build(endEntity);

foreach (var element in chain.ChainElements)
{
    Console.WriteLine($"{element.Certificate.Subject}");
    Console.WriteLine($"  PQ: {element.Certificate.HasPqSignature()}");
}
</code>

-> **Details:** [[en:int:pqcrypt:szenarien:validierung:chain_validation|Chain Validation]]

----

===== Hostname Validation =====

<code csharp>
var cert = new X509Certificate2("server.crt");
string hostname = "api.example.com";

var san = cert.Extensions["2.5.29.17"] as X509SubjectAlternativeNameExtension;
bool valid = san?.EnumerateDnsNames().Any(n => MatchesHostname(n, hostname)) ?? false;

bool MatchesHostname(string pattern, string host)
{
    if (pattern.StartsWith("*."))
        return host.EndsWith(pattern[2..]);
    return pattern.Equals(host, StringComparison.OrdinalIgnoreCase);
}
</code>

----

===== Check Key Usage =====

<code csharp>
var kuExt = cert.Extensions["2.5.29.15"] as X509KeyUsageExtension;
bool canSign = kuExt?.KeyUsages.HasFlag(X509KeyUsageFlags.DigitalSignature) ?? false;

var ekuExt = cert.Extensions["2.5.29.37"] as X509EnhancedKeyUsageExtension;
bool isTlsServer = ekuExt?.EnhancedKeyUsages
    .Cast<Oid>().Any(o => o.Value == "1.3.6.1.5.5.7.3.1") ?? false;
</code>

----

===== Checklist =====

^  Check  ^  Critical  ^
| Time validity | Yes |
| Signature (classical + PQ) | Yes |
| Chain to trust anchor | Yes |
| Revocation (CRL/OCSP) | Yes |
| Hostname (SAN) | For TLS |
| Key Usage | Yes |

----

<< [[.:start|<- Quick Reference]] | [[en:int:pqcrypt:szenarien:validierung:start|-> Validation Scenarios (Details)]] >>

----
//Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional//

{{tag>quickreference validation chain hostname key-usage}}