Valve for validating X.509 certificates
Supports request/response and item iteration mode. In request/response mode, valve fails the pipe if certificate status is not GOOD.
In item iteration mode, certificate status is added to the current item and the pipe must evaluate the result (using for example FlowFailPipe).
To validate a certificate, the issuer certificate and all intermediate certificates must be available in the trust store. The trust store can be located in configuration (as a resource) or in the file system. All certificates in the trust store are used.
Certificate validation consist of three steps:
- Local validation
- OCSP (if enabled)
- CRL (if enabled)
Local validation is always enabled and validates the following properties of the certificate:
- If the certificate is self signed (never allowed)
- Integrity (the certificate signature)
- Path (trust)
If any of the above validations fails, the certificate validation fails.