Perform full certificate chain validation for SSL certificates.
|Imports:||base/frameworks/cluster, base/frameworks/notice, base/protocols/ssl|
||Result values for recently validated chains along with the validation status are kept in this table to avoid constant validation every time the same certificate chain is seen.|
||Use intermediate CA certificate caching when trying to validate certificates.|
||Store the valid chain in c$ssl$valid_chain if validation succeeds.|
Result values for recently validated chains along with the validation status are kept in this table to avoid constant validation every time the same certificate chain is seen.
Use intermediate CA certificate caching when trying to validate certificates. When this is enabled, Zeek keeps track of all valid intermediate CA certificates that it has seen in the past. When encountering a host certificate that cannot be validated because of missing intermediate CA certificate, the cached list is used to try to validate the cert. This is similar to how Firefox is doing certificate validation.
Disabling this will usually greatly increase the number of validation warnings that you encounter. Only disable if you want to find misconfigured servers.
Type: Attributes: Default:
Store the valid chain in c$ssl$valid_chain if validation succeeds. This has a potentially high memory impact, depending on the local environment and is thus disabled by default.
Event from a manager to workers when encountering a new, valid intermediate.