====== Validacija ====== Kompaktni primjeri za validaciju certifikata. → **Detalji:** [[..:validierung:start|Scenariji validacije]] ---- ===== Pojedinačni certifikat =====


var cert = new X509Certificate2("certificate.crt");

// Vremenska valjanost
bool timeValid = DateTime.UtcNow >= cert.NotBefore &&
                 DateTime.UtcNow <= cert.NotAfter;

// Provjera PQ-potpisa
bool hasPq = cert.HasPqSignature();
if (hasPq)
{
    bool pqValid = cert.VerifyPqSignature();
}

---- ===== Lanac certifikata =====


var endEntity = new X509Certificate2("server.crt");

var chain = new X509Chain();
chain.ChainPolicy.RevocationMode = X509RevocationMode.Online;
chain.ChainPolicy.CustomTrustStore.Add(new X509Certificate2("root-ca.crt"));
chain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;

bool isValid = chain.Build(endEntity);

foreach (var element in chain.ChainElements)
{
    Console.WriteLine($"{element.Certificate.Subject}");
    Console.WriteLine($"  PQ: {element.Certificate.HasPqSignature()}");
}

→ **Detalji:** [[..:validierung:chain_validation|Chain-validacija]] ---- ===== Validacija hostname-a =====


var cert = new X509Certificate2("server.crt");
string hostname = "api.example.com";

var san = cert.Extensions["2.5.29.17"] as X509SubjectAlternativeNameExtension;
bool valid = san?.EnumerateDnsNames().Any(n => MatchesHostname(n, hostname)) ?? false;

bool MatchesHostname(string pattern, string host)
{
    if (pattern.StartsWith("*."))
        return host.EndsWith(pattern[2..]);
    return pattern.Equals(host, StringComparison.OrdinalIgnoreCase);
}

---- ===== Provjera Key Usage =====


var kuExt = cert.Extensions["2.5.29.15"] as X509KeyUsageExtension;
bool canSign = kuExt?.KeyUsages.HasFlag(X509KeyUsageFlags.DigitalSignature) ?? false;

var ekuExt = cert.Extensions["2.5.29.37"] as X509EnhancedKeyUsageExtension;
bool isTlsServer = ekuExt?.EnhancedKeyUsages
    .Cast().Any(o => o.Value == "1.3.6.1.5.5.7.3.1") ?? false;

---- ===== Kontrolna lista ===== ^ Provjera ^ Kritično ^ | Vremenska valjanost | Da | | Potpis (klasični + PQ) | Da | | Lanac do Trust Anchor | Da | | Opoziv (CRL/OCSP) | Da | | Hostname (SAN) | Za TLS | | Key Usage | Da | ---- << [[.:start|← Kratka referenca]] | [[..:validierung:start|→ Scenariji validacije (Detalji)]] >> ---- //Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional// {{tag>kurzreferenz validierung chain hostname key-usage}}