Certificate-Validation | CRL Certificate Validation Feature made for Apache Synapse | TLS library

When you are running multiple CloudFormation stacks within the same region, you are able to share references across stacks using CloudFormation Outputs

However, outputs cannot be used for cross region references as that documentation highlights.

You can't create cross-stack references across regions. You can use the intrinsic function Fn::ImportValue to import only values that have been exported within the same region.

How do you reference values across regions in CloudFormation?

For an example to follow, I have a Route 53 hosted zone deployed in us-east-1. However, I have a backend in us-west-2 that I want to create a DNS-validated ACM certificate which requires a reference to the hosted zone in order to be able to create the appropriate CNAME for prove ownership.

How would I go about referencing that hosted zone id created in us-east-1 from within us-west-2?

I am trying to setup a server and some clients using TLS in node. I am using self-signed certificates on the clients and the server. The server runs ok, but when I try to connect a client I end up with the following error on the client side:

I have two API projects, one that's based on the .NET Framework 4.6.2 (an old API) and one that's based on .NET Core 2.0. The old API can disable self-signed certificate validation quite simply:

Below is a snippet from the debug output of a failing SSL handshake with client authentication. I'm nearly certain I have all relevant certificates in my keystore. I've also attempted to trust all servers like this -Dcom.sun.net.ssl.checkRevocation=false and based Medhi's answer to this Is there a java setting for disabling certificate validation?. I always get the same unknown_ca exception.

Is it possible this exception is coming from the server not liking the credentials i'm supplying as a client instead? How can one tell which side this error is from?

In a application I have developed, I check the certificate sended by a client in an incoming message : in addition of basic certificate validity check (certificate signature, expiry date ...), I check if the client is trusted.

For this, I've created a keystore containing only trusted certificates : if a received certificate is not in the list, i reject the incoming message. A client certificate is in a certificate path, I check all the certification path.

For certification path validation, i'm using the following algo : (wikipedia)

1) Starting from the client certificate

2) While the current certificate is not the root :

3) Searching a parent certificate in the keystore : for this, i search a certificate in the keystore where SubjectDN = IssuerDN of the current certificate. If not found, the tested certificate is not valid

4) The signature of the current certificate is checked by using the public key of the parent certificate

So, the entire path is validated

Here the full code of the validator : (thanks to the author of this article)

Please note, that here, the revocation list (CRL) check is disabled.