well, if its 'true', the certificate needs to be a valid certificate - if its false, the certificate must match the thumbprint, but need not be valid ... .. so, the interesting question is, what constitutes a valid certificate ? I can think of two possibilites off hand, a) one that has not expired, b) one that has not been revoked - sorry I dont have enough cycles spare right now to look it up - those are just the obvious ones btw .. http://msdn.microsoft.com/en-us/library/system.security.cryptography.x509certificates.x509certificate2collection.find.aspx[^]
Wolfram Steinke wrote:
When true does it actually go off to an external server for the validation or does it all happen locally?
Im pretty sure its up to {whomever} maintains the certificates on a machine to download and apply CRL's/revoke certificates manually - so Im pretty sure that the system doesnt go off to a remote machine - some PGP frameworks could be set up like this iirc