Validation authority (VA)

A validation authority, or VA, is the part of a public key infrastructure that answers, at the moment somebody asks, whether a certificate is still valid.

Issuing a certificate is a statement made once. Trusting it is a decision made every time it is presented, and those are not the same thing: a certificate can be perfectly well formed, unexpired and signed by a trusted authority, and still have been revoked this morning because its private key was stolen.

The validation authority exists to answer that second question, and it is consulted on every connection rather than once at issue.

What it checks

Revocation status. The central job. Whether the issuing authority has withdrawn this certificate, and if so from when.

Validity in time. Whether the certificate is being presented inside the window it was issued for.

Chain and signature. Whether it was really issued by the authority it claims, and whether that authority is itself trusted.

The answers are served through the mechanisms a PKI publishes for the purpose: revocation lists, and online status responses queried per certificate.

A worked example

A customer reaches an online shop over TLS.

The shop’s server presents its certificate. Before trusting it, the client checks the chain, the dates, and the status.

The validation authority answers that the certificate has not been revoked. The connection proceeds, and the customer sees the padlock.

Change one detail. The shop’s private key leaked last week and the certificate was revoked the same day. If the client checks status, the connection fails and the customer is protected. If it does not check, everything looks exactly the same as before, and a key that everybody knows is compromised is still being accepted.

VA, CA and RA: who does what

The three authorities of a PKI are separated by when they act.

The validation authority, which is this entry, answers a question that comes after issuance: is this certificate still valid today? It is the piece that makes revocation mean anything.

The certification authority is the one that issued and signed it. It has its own entry: certificate authority.

The registration authority is the one that, before any of that, checked that the applicant was who they said.

In one line: the RA looks before, the CA signs, the VA answers after.

And this is why revocation is the silent failure of a PKI. If nobody checks status, a compromised key keeps being accepted by everyone until it expires on its own. The safety net exists, it is installed, and it is not switched on. When reviewing a PKI, the question worth asking is not whether revocation is published; it is whether anything actually consults it, and what the client does when the check times out.