Certificate v2
Creates self-signed certificates and validates the certificates presented by live TLS endpoints.
Revision History
0.0.0.1 - Introduces Create and Validate.
Connection
Create uses a Certificate Password Connection. Validate does not require a Connection.
| Property | Type | Description |
|---|---|---|
PFX Password |
Masked | Required password protecting the exported certificate and private key. Supply 1–1,024 characters without null characters. |
Setup Notes
For Create, create a Connection containing the PFX password. Supply the names clients will use to verify the certificate as subject alternative names (SANs); the Node does not copy the subject's common name into a SAN automatically.
For Validate, the selected Cluster must be able to reach the target TCP/TLS service. When revocation checking is enabled, certificate issuer and revocation endpoints may also need to be reachable.
Methods
Create
Generates a new self-signed RSA certificate for TLS server and client authentication. Each invocation generates a new key; it does not install the certificate or key in a certificate store.
| Parameter | Type | Description |
|---|---|---|
Connection |
Connection | The Certificate Password Connection used to protect the PFX. |
Subject Name |
String | Required X.500 distinguished name, for example CN=service.example.test. |
Not Before |
DateTime | Required start of validity, including a UTC offset. |
Not After |
DateTime | Required end of validity, later than Not Before, including a UTC offset. |
DNS Names |
Array | DNS names to include as SANs. Include the names clients will verify. |
IP Addresses |
Array | IP-address SANs for clients that verify an IP address. |
Key Size |
Integer | RSA key size: 2048, 3072, or 4096. Defaults to 4096. |
| Return | Type | Description |
|---|---|---|
Pfx |
Stream | Password-protected certificate and private key in PFX format. |
Cer |
Stream | Public certificate in DER format, without the private key. |
Pem |
String | Public certificate in PEM format, without the private key. |
At most 100 SAN entries are accepted across DNS names and IP addresses. Names and passwords are not trimmed. Keep the PFX and its password protected; the public CER or PEM output can be distributed where only the public certificate is required.
Validate
Checks a live TLS server's certificate for hostname, trust chain, validity, server usage, and the selected revocation policy. It does not inspect an uploaded certificate or send an HTTP request.
| Parameter | Type | Description |
|---|---|---|
Host |
String | Required DNS hostname or IP address to validate. Supply no scheme, path, or port. |
Endpoint |
String | Optional DNS name or IP address to connect to instead of Host. The certificate is still checked against Host. |
Port |
Integer | TCP port serving TLS. Defaults to 443. STARTTLS is not supported. |
Trusted Roots PEM |
String | Optional public PEM certificates used as explicit trust anchors. When supplied, they replace system trust for this invocation without changing certificate stores. |
Check Revocation |
Boolean | Defaults to true. Checks revocation online; missing or stale revocation evidence fails validation. false skips the check. |
Timeout Seconds |
Integer | Connection and handshake timeout from 1 to 120 seconds. Defaults to 15. |
| Return | Type | Description |
|---|---|---|
Response |
Object | Validation result containing IsValid, Certificate, Policy, PolicyErrors, ChainStatus, and TlsProtocol. |
Use Response.IsValid to choose the next action. Rejected certificates return false with available public certificate details and policy errors. Certificate includes subject, issuer, serial number, SHA-256 thumbprint, validity dates, signature algorithm, and PEM. TlsProtocol is available after successful TLS authentication.
A certificate must have a matching SAN; the subject common name is not used as a fallback. Invalid inputs, DNS/connectivity failures, and transport failures can fail the Step rather than return an invalid-certificate result. Handle those failures separately from IsValid=false.
Usage Notes
Create produces a self-signed, non-CA certificate. It does not request issuance from a certificate authority, renew an existing certificate, or generate a certificate signing request. Consumers must trust the resulting certificate explicitly where appropriate. The PFX uses modern AES protection, which very old importers may not support.
Validate uses the operating system's TLS and certificate-chain support. Trust stores and revocation availability can differ between Clusters. Disabling revocation also disables issuer downloads, so the server must supply the needed intermediate certificates. Some native chain operations can finish after the cancellation deadline.
Examples
To check the certificate served by an origin behind a proxy, set Host to the public DNS name and Endpoint to the origin's address. For example, use service.example.test as Host, 192.0.2.10 as Endpoint, and 443 as Port, replacing both example addresses with your service's values. The TCP connection goes to the origin, while TLS identity validation still uses the public name.