API Reference

The Certificate Validation Service provides RESTful JSON endpoints for validating X.509 certificates and managing local validation policies.

POST /vss/v2/validate

Validates an X.509 certificate against a given policy and its trust anchors.

Request Body (VssRequest)

Field	Type	Description
validationPolicyId	string	The Object Identifier (OID) or name of the validation policy to use (e.g. 1.3.6.1.5.5.7.19.1 or default).
x509Certificate	string	The base64-encoded DER representation of the certificate to validate.

Request Examples

cURLPythonJavaGoLangRust

curl -X POST https://keysupport.net/vss/v2/validate \
     -H "Content-Type: application/json" \
     -d '{"validationPolicyId": "default", "x509Certificate": "MIIFYjCC...[Base64 DER]..."}'

import requests

url = "https://keysupport.net/vss/v2/validate"
payload = {
    "validationPolicyId": "default",
    "x509Certificate": "MIIFYjCC...[Base64 DER]..."
}

response = requests.post(url, json=payload)
print(response.json())

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class VssClient {
    public static void main(String[] args) throws Exception {
        String json = "{\"validationPolicyId\":\"default\",\"x509Certificate\":\"MIIFYjCC...[Base64 DER]...\"}";

        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create("https://keysupport.net/vss/v2/validate"))
                .header("Content-Type", "application/json")
                .POST(HttpRequest.BodyPublishers.ofString(json))
                .build();

        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }
}

package main

import (
    "bytes"
    "fmt"
    "io/ioutil"
    "net/http"
)

func main() {
    url := "https://keysupport.net/vss/v2/validate"
    payload := []byte(`{"validationPolicyId":"default","x509Certificate":"MIIFYjCC...[Base64 DER]..."}`)

    req, err := http.NewRequest("POST", url, bytes.NewBuffer(payload))
    req.Header.Set("Content-Type", "application/json")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := ioutil.ReadAll(resp.Body)
    fmt.Println(string(body))
}

use reqwest::Client;
use serde_json::json;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let client = Client::new();
    let payload = json!({
        "validationPolicyId": "default",
        "x509Certificate": "MIIFYjCC...[Base64 DER]..."
    });

    let res = client.post("https://keysupport.net/vss/v2/validate")
        .json(&payload)
        .send()
        .await?
        .text()
        .await?;

    println!("{}", res);
    Ok(())
}

Response (VssResponse)

The response includes the details of the validated certificate, the validation result, and the certificate path.

Field	Type	Description
requestId	string	Unique identifier for the validation request.
validationPolicyId	string	The policy OID that was used.
x5t#S256	string	Base64-encoded SHA-256 thumbprint of the certificate.
x509SubjectName	string	The X.509 Subject Distinguished Name.
x509IssuerName	string	The X.509 Issuer Distinguished Name.
x509SerialNumber	string	The certificate serial number.
validationResult	object	The detailed validation result (SUCCESS or FAIL).
validationResult.result	string	"SUCCESS" or "FAIL".
validationResult.invalidityReasonText	string	Text description of the failure reason if the result is FAIL.
validationResult.x509CertificatePath	array	Array of objects representing the full trust chain.

Example Success Response

{
  "requestId": "5DF15D6EAFE39B0FB...",
  "validationPolicyId": "1.3.6.1.5.5.7.19.1",
  "x5t#S256": "Z5iBG5CpbiEljkCd...",
  "x509SubjectName": "CN=Example Leaf, OU=PKI, O=Example, C=US",
  "x509IssuerName": "CN=Example Issuing CA, OU=PKI, O=Example, C=US",
  "x509SerialNumber": "1234567890",
  "validationResult": {
    "result": "SUCCESS",
    "x509CertificatePath": [
      {
        "x509Certificate": "MII..."
      },
      {
        "x509Certificate": "MII..."
      }
    ]
  }
}

---

GET /vss/v2/policies

Retrieves a list of all configured validation policies, their properties, user policy sets, and their respective trust anchors.

Response

Returns a ValidationPolicies object containing an array of ValidationPolicy items.

Example Response

{
  "validationPolicies": [
    {
      "validationPolicyId": "1.3.6.1.5.5.7.19.1",
      "validationPolicyName": "default",
      "validationPolicyDescription": "Derived from Default SCVP Policy",
      "trustAnchors": [
        {
          "x5t#S256": "X5rswkYWshkTcmAN...",
          "x509Certificate": "MIIF...",
          "X509SubjectName": "CN=Federal Common Policy CA G2..."
        }
      ],
      "userPolicySet": ["2.5.29.32.0"],
      "inhibitPolicyMapping": false,
      "requireExplicitPolicy": true,
      "inhibitAnyPolicy": true
    }
  ]
}

---

GET /vss/v2/policies/{validationPolicyId}

Retrieves the specific validation policy by its OID or name.

Parameters

• validationPolicyId (Path, required): The ID/OID of the policy (e.g. 1.3.6.1.5.5.7.19.1).

Response

Returns a single ValidationPolicy object matching the requested ID.

---

GET /vss/v2/intermediates

Retrieves the current set of cached intermediate certificates used by the service for path building.

Response

Returns an array of intermediate certificates (JsonX509Certificate), exposing their Base64-encoded DER format.

Example Response

[
  {
    "x509Certificate": "MIIGGjCCBQKgAw..."
  },
  {
    "x509Certificate": "MIIHQTCCBimgAw..."
  }
]