In contrast to private keys, public keys don't need to be stored on a secure place. But what if somebody changes a certificate with a public key to just another one? To ensure certificate authenticity, its validation chain can be verified up to the root CA certificate, which could be an unchangeable part of the software.
When a partner system updates my system with a new certificate (for whatever reason), I would, of course, check the chain validity before storing it on a proper place in the system. Now, should this kind of validation be carried out
- everytime I use the certificate or
- just before it is accepted as a new certificate?
I feel, that the first option would be the answer, but I want to avoid the overhead of validation against CA every time the certificate is used.
How would it be to store a validated certificate together with its hash (SHA-256) based on an individual system key, and to check only the hash when using the certificate?