# How is decided if a certificate is valid in verificationMode: full mode **URL:** \ **Category:** Elasticsearch\ **Created:** [April 23, 2025, 5:51am UTC](https://discuss.elastic.co/t/how-is-decided-if-a-certificate-is-valid-in-verificationmode-full-mode/377417 "2025-04-23T05:51:08Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![jack\_a](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jack_a/32/133082_2.png) [@jack\_a](https://discuss.elastic.co/u/jack_a)\ **Post date:** [April 23, 2025, 5:51am UTC](https://discuss.elastic.co/t/how-is-decided-if-a-certificate-is-valid-in-verificationmode-full-mode/377417/1 "2025-04-23T05:51:08Z")
Sorry if it is a simple question but, when i set `verificationMode` to `full` how is decided that certificate is valid or not? Which part of certificate is compared to what to check the certificate validation? ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [April 30, 2025, 5:49am UTC](https://discuss.elastic.co/t/how-is-decided-if-a-certificate-is-valid-in-verificationmode-full-mode/377417/2 "2025-04-30T05:49:44Z")
A verification mode of `full` uses 1. PKIX (see [RFC 5280](https://www.rfc-editor.org/rfc/rfc5280)) validation rules for certificate validity 2. A HTTPS Server identity check (see [RFC 2818; ยง3.1](https://www.rfc-editor.org/rfc/rfc2818#section-3.1)) for the hostname. Explaining the full PKIX rules is a bit too complex to cover in details but it includes: - The signing chain - The validity dates - Extensions such as `KeyUsage`, if present. ---
**Author:** ![jack\_a](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jack_a/32/133082_2.png) [@jack\_a](https://discuss.elastic.co/u/jack_a)\ **Post date:** [April 30, 2025, 5:56am UTC](https://discuss.elastic.co/t/how-is-decided-if-a-certificate-is-valid-in-verificationmode-full-mode/377417/3 "2025-04-30T05:56:18Z")
Thanks for providing links.