Hi, What should I do, as an end-user, to 'validate' an (end-entity) certificate? Is it enough to check the certificate path on (delta-)CRL,OCSP? Or should I do more: for example check to repository and look whether or not the certificate was ever issued? Should I check the fingerprint of the root CA against a published fingerprint? Thanks, Haaino