STIR/SHAKEN Certificate Test

The x5u from the call’s Identity header: the https:// address in the PASSporT’s header (it is also the info= parameter on the Identity header) where verifiers download the signing certificate. Paste it as it is; quotes or angle brackets around it are ignored.

The signing certificate: whether it is valid right now, its names (O and CN), its key, and the SPC in its TNAuthList extension. The intermediate: the STI-CA certificate that signed it, its names and expiry, and whether it is allowed to issue certificates. The root: whether the chain ends at a root on the STI-PA’s trusted list. Then revocation, against the STI-PA CRL and any CRL the chain names, and how long the certificate took to fetch.

The Service Provider Code (SPC) in the signing certificate’s TNAuthList extension (1.3.6.1.5.5.7.1.26). It identifies the provider the STI-PA issued the SPC token to, usually by its OCN, and it is how a verifier knows who signed the call. A certificate without one is not a SHAKEN signing certificate.

From the STI-PA, the Policy Administrator (run by iconectiv). Once a day we download its trusted STI-CA list, its Cross Border Trust List and its CRL, check the STI-PA’s signature on each, and only then load them. The roots are listed above with when each was last verified and when it expires. A root that drops off the STI-PA’s list stops being trusted here the same day.

Verification happens while the call is being set up. A verifier that has not cached the certificate downloads it during that window, and a repository that takes more than a second to answer can make it time out and pass the call on as unverified. The test times the DNS lookup, connect, TLS handshake, the server’s response and the download separately, and warns about anything over one second.

Yes. The tool only fetches from public addresses, follows at most three redirects and checks each one, stops after 64 KB or a few seconds, and asks for no compression. What comes back is only ever read as certificate data. Nothing from it is run, saved as a file, or shown without escaping. If the file holds a private key, the test says so, and never shows it.