SSL certificate validation in Postman - Framework Patterns

Framework Mode - SSL certificate validation

Folder Structure

postman-project/
├── collections/
│   └── api-tests.postman_collection.json
├── environments/
│   ├── dev.postman_environment.json
│   ├── staging.postman_environment.json
│   └── prod.postman_environment.json
├── scripts/
│   ├── pre-request-scripts/
│   │   └── ssl-validation.js
│   └── test-scripts/
│       └── ssl-validation-tests.js
├── reports/
│   └── test-report.html
├── postman.config.json
└── README.md

Test Framework Layers

• Collections: Group of API requests to be tested, including SSL validation scenarios.
• Environments: Define variables like base URLs and SSL settings for different deployment stages.
• Scripts:
  • Pre-request scripts: Setup or modify requests before sending, e.g., toggling SSL verification flags.
  • Test scripts: Validate SSL certificate details and response behavior after request execution.
• Reports: Store generated test execution reports for review.
• Configuration: Central settings for Postman CLI (Newman) runs, including SSL verification options.

Configuration Patterns

• Environment Variables: Use variables like sslVerify to enable or disable SSL certificate validation per environment.
• Postman Settings: Configure SSL certificate verification in Postman app or Newman CLI using flags like --insecure to skip SSL validation when needed.
• Credential Management: Store sensitive data securely in environment variables, never hard-coded in collections.
• Dynamic SSL Handling: Use pre-request scripts to conditionally set SSL verification based on environment or test case.

Test Reporting and CI/CD Integration

• Newman CLI: Run Postman collections in CI pipelines with SSL validation enabled or disabled as needed.
• Report Generation: Generate HTML or JSON reports from Newman runs to capture SSL validation test results.
• CI/CD Integration: Integrate Newman commands in pipelines (GitHub Actions, Jenkins, GitLab CI) to automate SSL certificate validation tests on API deployments.
• Alerts: Configure pipeline to fail and notify teams if SSL validation tests fail, ensuring secure API endpoints.

Framework Design Principles

1. Separate SSL Validation Logic: Keep SSL certificate checks in dedicated test scripts for clarity and reuse.
2. Use Environment Variables: Control SSL verification behavior without changing test code, supporting multiple environments.
3. Fail Fast on SSL Errors: Ensure tests fail immediately if SSL certificates are invalid to catch security issues early.
4. Automate in CI/CD: Run SSL validation tests automatically on every deployment to maintain API security continuously.
5. Document SSL Settings: Clearly document how to enable or disable SSL validation in the framework for all team members.

Self Check

Where would you add a new test script to verify the SSL certificate expiration date in this framework structure?

Key Result

Organize Postman SSL certificate validation tests using collections, environment variables, scripts, and CI/CD integration for secure and maintainable API testing.