SSL

SSL trust boundaries

Separate trust expectations per environment and dependency so validation errors are actionable under pressure.

Doctrine

Keep staging and production trust stores explicit and versioned.
Define who can approve trust boundary exceptions and for what duration.
Require boundary-aware fallback behavior for broken-chain and policy-change conditions.
Track trust-store changes with a traceable change record.

Is a request entering a sensitive trust zone?
- Yes → validate client cert, identity claims, and endpoint policy before proceed.
- No → keep at service-tier trust check and log boundary outcome.
Is chain validation failing?
- Yes → block and inspect chain components; do not bypass trust checks.
- No → continue and verify hostname matching.
Are trust stores changing this cycle?
- Yes → run pre-merge and post-merge trust acceptance probes.
- No → continue standard monitoring.

Check trust chain and environment mapping:

openssl verify -CAfile /etc/pki/tls/certs/ca-bundle.crt /etc/ssl/certs/site.pem

Collect TLS negotiation details:

echo | openssl s_client -connect app.example.com:443 -servername app.example.com -state -prexit 2>&1 | rg -i "verify return code|Verify return code"

Correlate security and load logs:

rg -n "chain|x509|verify|ssl" /var/log/*/error.log

Validate boundary docs against deploy state:
```
git status --short config/trust/*.yml
```

Run boundary drift report weekly and before any certificate distribution cycle.
Keep trust map and exception register on-call visible during incidents.
Never merge changes that alter trust roots without update of boundary documentation.