# Certificate verification This directory contains the core code for verifying server certificates. Limited support is also included for verifying client certificates, but only to the extent they chain to a server-supplied set of issuers. Server certificate verification emphasizes the standards/policy for publicly trusted certificates: * Basic X.509 digital certificates * RFC 5280 * CA/Browser Forum Baseline Requirements * CRLSets * Certificate Transparency The core logic of certificate verification is implemented synchronously, as it may need to integrate with synchronous OS-provided APIs. This synchronous implementation is performed through the [CertVerifyProc](cert_verify_proc.h) interface, which is a thread-agnostic/thread-safe interface that can be used to verify certificates synchronously on arbitrary worker threads. The top-level interface for verifying server certificates is the asynchronous [CertVerifier](cert_verifier.h). [MultiThreadedCertVerifier](multi_threaded_cert_verifier.h) is an implementation of `CertVerifier` that executes `CertVerifyProc` synchronously on worker threads. [CertVerifyProcBuiltin](cert_verify_proc_builtin.h) is a cross-platform implementation which implements path building internally. It only relies on platform integrations for obtaining the trusted root certificates. The other `CertVerifyProc` implementations are for integrating with the underlying platform's certificate verification library. For example, [CertVerifyProcWin](cert_verify_proc_win.h) delegates certificate verification to Windows' CryptoAPI. Browser-specific policy checks are applied even when using the platform's certificate verifier. For instance, a certificate chain the OS deemed valid could ultimately be rejected by `CertVerifyProc` since it independently checks the chain for CRLSet revocation, use of weak keys, Baseline Requirements validity, name constraints, weak signature algorithms, and more.