WAF++ Validation Registry

Verify a Server Certificate

Check whether a wafpass-server sub-CA certificate was issued by this gateway and is still trusted.

Paste the gateway-issued server.crt (the first certificate in the chain, not the full chain). Verification is performed in your browser via the public API.

How it works

This page calls POST /api/v1/validations/server/verify. The gateway checks the certificate signature against the WAF++ root CA, validates the time window, and reports whether the certificate is registered and whether it has been revoked.

No API key is required. You can also use the endpoint from the command line: 

curl -X POST https://waf.lew-app.de/api/v1/validations/server/verify \
  -H "Content-Type: application/json" \
  -d '{"server_certificate": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n"}'

The response looks like this:

{
  "server_id": "wafpass-prod-1",
  "valid": true,
  "registered": true,
  "revoked": false,
  "message": "server certificate valid",
  "not_before": "2026-09-15T07:20:59Z",
  "not_after": "2027-09-15T07:20:59Z",
  "fingerprint_sha256": "a1b2c3..."
}