a key pair and signs a Certificate Signing Request (CSR) with the private key: the CSR contains the applicant’s public key that is used to verify the signature of the CSR and a unique Distinguished Name within the organization. Then, one of the intermediate certificate authorities issues a certificate binding a public key to the requested Distinguished Name and that also contains information identifying the certificate authority that vouches for this binding.

The certificate validation chain algorithm checks the validity of an end-entity certificate following the next steps:

1.  The certificates are correct regarding the ASN.1 grammar of X.509 certificates.

2.  The certificates are within their validity periods (i.e., non-expired).

3.  If access to a Certificate Revocation List is granted, the algorithm checks that none of the certificates is included (i.e., the certificate has not been revoked).

4.  The certificate chain is traversed checking that:

    1.  The issuer matches the subject of the next certificate in the chain.

    2.  The signature is valid with the public key of the next certificate in the chain.

5.  The last certificate is a valid self-signed certificated trusted by the end-entity checker.

Additionally, the algorithm could also check complex application policies (i.e., the certificate 