Root Certificate | WAF++ Validation Registry

The validation gateway operates as the root certificate authority for all WAF++ PASS validations.

The public certificate below is the gateway root certificate (root.crt). It is used to verify the gateway intermediate certificate, which in turn signs the per-server sub-CA certificates issued to individual wafpass-server deployments.

Loading certificate…

Download root.crt

Verification

Download root.crt from the button above or from /api/v1/validations/root.crt.
Compute the SHA-256 fingerprint and compare it with the value published here:

openssl x509 -in wafpp-gateway-root.crt -noout -sha256 -fingerprint

Use the certificate to verify any validation envelope or badge JSON:

openssl verify -CAfile wafpp-gateway-root.crt -untrusted gateway-intermediate.crt envelope.pem

The gateway serves validation data directly from the gateway host. The certificate path for a typical validation is:

WAF++ root CA
  → WAF++ gateway intermediate CA
    → wafpass-server sub-CA
      → validation envelope / badge signature

Trust model

The gateway root is the long-term trust anchor.
The gateway intermediate is rotated by the gateway and signed by the root.
wafpass-server deployments receive a time-limited sub-CA certificate from the gateway. They sign validation envelopes with that sub-CA key.
Validations are independently verifiable without contacting the server that created them, because all required certificates are included in the envelope.