Certification path validation algorithm

The certification path validation algorithm is the algorithm which verifies that a given certificate path is valid under a given public key infrastructure (PKI).

Path validation is necessary for a relying party to make an informed trust decision when presented with any certificate that is not already explicitly trusted.

For example, in a hierarchical PKI, a certificate chain starting with a web server certificate might lead to a small CA, then to an intermediate CA, then to a large CA whose trust anchor is present in the relying party's web browser.

(This is an explanatory summary of the scope of the algorithm, not a rigorous reproduction of the detailed steps.)

If this procedure reaches the last certificate in the chain, with no name constraint or policy violations or any other error condition, then the certificate path validation algorithm terminates successfully.