2026-08-31 · 8 min read
- jwt
- security
- pki
The x5c JWT header parameter carries a JSON array of Base64-encoded DER certificates, normally beginning with the certificate whose public key verifies the token and followed by intermediate issuers. It is evidence to validate, not a trust policy supplied by the token.
A successful JWT signature check establishes possession of the leaf private key. Acceptance additionally requires the expected token algorithm, a valid certificate path to a preconfigured trust anchor, an appropriate certificate profile, and valid claims.
Constrain token processing first
Select an allowlisted algorithm from endpoint configuration rather than accepting whatever the header requests. Parse x5c with strict size, count, and certificate-format limits before attempting path construction.
- Require the leaf certificate as the first array element.
- Reject duplicate, malformed, and unexpectedly large chains.
- Confirm the JWT algorithm matches the leaf public-key type.
- Do not fall back to an unrelated key source after validation fails.
Build trust independently of supplied certificates
Construct a path from the leaf through allowed intermediates to a trust anchor configured by the application or platform. Do not trust a self-signed root merely because it appears at the end of x5c.
Validate certificate signatures, validity windows, basic constraints, path length, and key usage. Apply extended key usage, subject, policy, or name restrictions when the token profile requires them; web-server hostname rules do not automatically describe every JWT issuer profile.
Plan revocation and rollover
Define whether the environment checks certificate revocation and how it behaves when status services are unavailable. Short token lifetimes limit exposure but do not by themselves replace a required revocation policy.
- Cache validated chains only within bounded certificate and policy lifetimes.
- Keep old trusted signing material through the maximum token lifetime.
- Alert on unexpected issuers, fingerprints, and path changes.
- Never log full bearer tokens or private key material.
Create safe certificate fixtures
Use Flashman's JWT tool for synthetic headers and claims, Base64 tool for public DER fixtures, PEM newline helper for test PEM formatting, hash tool for documented fingerprints, and timestamp converter for validity boundaries. Authoritative validation belongs in the server's PKI and JWT libraries.
Test correct and reversed chain order, absent intermediates, untrusted and self-signed roots, expired and future certificates, wrong key usage, algorithm mismatch, malformed Base64, rollover overlap, revocation behavior, and invalid JWT claims.