Editing Delegated Path Validation (section)

== Certificate path validation ==
{{Main|Certification path validation algorithm}}
[[File:Digital certificates chain of trust.png|thumb|upright=1.7|Diagram illustrating the [[chain of trust]] of a digital certificate, showing the hierarchy from the root CA to the end-entity certificate.]]
Certificate path validation is a crucial process in PKI that ensures the authenticity and trustworthiness of a [[digital certificate]]. This process is standardized in {{IETF RFC|5280}} and involves verifying a [[Chain of trust|chain of certificates]], starting from the certificate being validated (the end-entity certificate) up to a trusted root [[certificate authority]] (CA).<ref name=RFC5280>{{IETF RFC|5280}} (May 2008), chapter 6, Internet [[X.509]] Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile.</ref> The validation process includes several key steps:<ref name="RFC5280" /> 
* Building the Path: the client constructs a path from the end-entity certificate to a trusted [[root certificate]] by following the chain of issuer and subject fields in each certificate. 
* Checking Signatures: each certificate in the chain is checked to ensure that it is correctly signed by its issuer, verifying the [[Integrity (computing)|integrity]] and authenticity of each certificate. 
* Verifying Expiration Dates: the validity period of each certificate is checked to ensure none of the certificates in the path are expired.
* Checking Revocation Status: each certificate is checked against [[Certificate Revocation List]] (CRL) or online status protocols (such as [[Online Certificate Status Protocol|OCSP]]) to ensure it has not been revoked. 
* Applying Policies: any additional policies specified by the relying party are applied to ensure the certificate path complies with required security standards and practices.

If all these checks are successfully passed, the certificate path is considered valid, and the end-entity certificate can be trusted.<ref name=RFC5280 />