Validation Authority is an on-premises solution for checking the validity status of issued certificates before they expire. When deployed on PKI Hub, this Entrust solution adds the following to the PKI Hub integration report.
Certificate information sources supported by Validation Authority
Validation Authority supports the following sources of certificate status information:
- Entrust CA Gateway integrated with an Entrust Certificate Authority instance
- Certificate Revocation Lists (CRLs) issued by Entrust or third‑party certificate authorities
Hardware security modules supported by Validation Authority
See the following table for versions supported by Validation Authority and other solutions.
Hardware | Client driver | Firmware | Certificate Authority | Timestamping Authority | Validation Authority |
|---|---|---|---|---|---|
Entrust nShield Connect XC | 13.9.0 (FIPS 140-2 Level 3 mode supported) | 12.60.15 & 12.60.2 |
|
|
|
Entrust nShield 5c | 13.9.0 | 13.2.4 |
|
|
|
Entrust nShield 5c 10G | Not supported | Not supported |
|
|
|
Epicom | EP990 v1.08-1 | — |
|
|
|
Thales Luna HSM 7 | 10.8.0 | 7.7.1-20 |
|
|
|
Thales TCT | 10.8.0 | 7.7.1-20 |
|
|
|
Signature key generation algorithms supported by Validation Authority
Validation Authority supports different key types and algorithms for generating the OCSP response signing key.
See the table below for the supported RSA key types.
Key type identifier | Key algorithm | Modulus size |
|---|---|---|
RSA2048 | RSA | 2048 bits |
RSA3072 | RSA | 3072 bits |
RSA4096 | RSA | 4096 bits |
See the table below for the supported ECDSA key types.
Key type identifier | Key algorithm | Curve |
|---|---|---|
ECDSAP256 | ECDSA | NIST P-256 |
ECDSAP384 | ECDSA | NIST P-384 |
ECDSAP521 | ECDSA | NIST P-521 |
See table below for the supported ML-DSA key types.
Key type identifier | ML-DSA key |
|---|---|
ML-DSA-44 | ML-DSA-44 key pair |
ML-DSA-65 | ML-DSA-65 key pair |
ML-DSA-87 | ML-DSA-87 key pair |
See table below for the supported composite key types.
Key type identifier | ML-DSA key | Classical algorithm | Classical parameter | Signature scheme | Hash |
|---|---|---|---|---|---|
MLDSA44-RSA2048-PSS-SHA256 | ML-DSA-44 key pair | RSA | 2048 bits | RSA-PSS | SHA-256 |
MLDSA44-RSA2048-PKCS15-SHA256 | ML-DSA-44 key pair | RSA | 2048 bits | RSA PKCS#1 v1.5 | SHA-256 |
MLDSA44-ECDSA-P256-SHA256 | ML-DSA-44 key pair | ECDSA | NIST P-256 | ECDSA | SHA-256 |
MLDSA65-RSA3072-PSS-SHA512 | ML-DSA-65 key pair | RSA | 3072 bits | RSA-PSS | SHA-512 |
MLDSA65-RSA3072-PKCS15-SHA512 | ML-DSA-65 key pair | RSA | 3072 bits | RSA PKCS#1 v1.5 | SHA-512 |
MLDSA65-RSA4096-PSS-SHA512 | ML-DSA-65 key pair | RSA | 4096 bits | RSA-PSS | SHA-512 |
MLDSA65-RSA4096-PKCS15-SHA512 | ML-DSA-65 key pair | RSA | 4096 bits | RSA PKCS#1 v1.5 | SHA-512 |
MLDSA65-ECDSA-P256-SHA512 | ML-DSA-65 key pair | ECDSA | NIST P-256 | ECDSA | SHA-512 |
MLDSA65-ECDSA-P384-SHA512 | ML-DSA-65 key pair | ECDSA | NIST P-384 | ECDSA | SHA-512 |
MLDSA87-RSA3072-PSS-SHA512 | ML-DSA-87 key pair | RSA | 3072 bits | RSA-PSS | SHA-512 |
MLDSA87-RSA4096-PSS-SHA512 | ML-DSA-87 key pair | RSA | 4096 bits | RSA-PSS | SHA-512 |
MLDSA87-ECDSA-P384-SHA512 | ML-DSA-87 key pair | ECDSA | NIST P-384 | ECDSA | SHA-512 |
MLDSA87-ECDSA-P521-SHA512 | ML-DSA-87 key pair | ECDSA | NIST P-521 | ECDSA | SHA-512 |
Database management systems supported by Validation Authority
PKI Hub, and the database-dependent solutions support the following DBMSs:
- PostgreSQL 15+
- The PKI DB Appliance
In addition, Validation Authority also supports:
- Oracle 21.3.0
- Microsoft SQL 2019 CU15 & 2022 CU13