SSL certificate validation in Postman - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to disable SSL certificate verification in Postman settings.

Postman

pm.settings.set('[1]', false);

Drag options to blanks, or click blank then click option'

AsslVerification

BcertificateCheck

CverifySSL

DsslCertValidation

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect setting names like 'certificateCheck' or 'verifySSL'.

Forgetting to set the value to false.

In Postman, the setting to disable SSL certificate verification is sslVerification. Setting it to false turns off SSL checks.

2fill in blank

medium

Complete the test script to check if SSL certificate verification is enabled.

Postman

pm.test('SSL verification is enabled', () => { pm.expect(pm.settings.get('[1]')).to.be.true; });

Drag options to blanks, or click blank then click option'

AcertificateValidation

BsslCheck

CsslVerification

DverifyCertificate

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong setting keys like 'sslCheck' or 'verifyCertificate'.

Checking for false instead of true.

The correct setting to get SSL verification status is sslVerification. This test checks if it is enabled (true).

3fill in blank

hard

Fix the error in the test script to correctly assert SSL verification is disabled.

Postman

pm.test('SSL verification disabled', () => { pm.expect(pm.settings.get('[1]')).to.be.false; });

Drag options to blanks, or click blank then click option'

AcertificateCheck

BsslVerify

CsslCertValidation

DsslVerification

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect keys that cause the test to fail or throw errors.

Mixing up true and false in the assertion.

The correct key to check SSL verification status is sslVerification. Using this key ensures the assertion works properly.

4fill in blank

hard

Fill both blanks to create a test that disables SSL verification and confirms it is disabled.

Postman

pm.settings.set('[1]', false);
pm.test('SSL verification is disabled', () => { pm.expect(pm.settings.get('[2]')).to.be.false; });

Drag options to blanks, or click blank then click option'

AsslVerification

BcertificateCheck

DverifySSL

Attempts:

3 left

💡 Hint

Common Mistakes

Using different keys for setting and getting the SSL verification status.

Using keys that do not exist in Postman settings.

Both setting and getting the SSL verification status use the key sslVerification. This ensures the test disables and verifies the setting correctly.

5fill in blank

hard

Fill all three blanks to write a test that disables SSL verification, sends a request, and checks the response status is 200.

Postman

pm.settings.set('[1]', false);
pm.sendRequest('https://example.com', (err, res) => {
  pm.test('Response status is [2]', () => {
    pm.expect(res.code).to.eql([3]);
  });
});

Drag options to blanks, or click blank then click option'

AsslVerification

B200

DsslCheck

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong setting keys or status codes.

Not matching the status code type (string vs number).

The test disables SSL verification with sslVerification, sends a request, and asserts the response status is 200, indicating success.

Practice

1. What does enabling SSL certificate validation in Postman do?

easy

A. It ensures Postman verifies the server's SSL certificate for secure connections.

B. It disables all SSL checks to speed up requests.

C. It automatically fixes invalid SSL certificates.

D. It encrypts the request body before sending.

Solution

1. Step 1: Understand SSL certificate validation purpose

   SSL certificate validation checks if the server's certificate is valid and trusted to secure data.

2. Step 2: Relate to Postman setting

   Enabling this setting makes Postman verify the SSL certificate before sending requests.

3. Final Answer:

   It ensures Postman verifies the server's SSL certificate for secure connections. -> Option A

4. Quick Check:

   SSL validation = verify server certificate [OK]

Hint: SSL validation means checking server certificates [OK]

Common Mistakes:

• Thinking SSL validation disables checks
• Believing it fixes certificates automatically
• Confusing encryption with validation

2. Which Postman setting controls SSL certificate validation?

easy

A. Enable Proxy in Settings > Proxy

B. Disable SSL verification toggle in Settings > General

C. Turn on Interceptor in Settings > Proxy

D. Set Environment variable SSL_VALIDATE

Solution

1. Step 1: Locate SSL validation setting in Postman

   Postman has a toggle named 'Disable SSL verification' under Settings > General.

2. Step 2: Understand toggle effect

   Turning this toggle ON disables SSL validation; turning it OFF enables validation.

3. Final Answer:

   Disable SSL verification toggle in Settings > General -> Option B

4. Quick Check:

   SSL toggle = Disable SSL verification [OK]

Hint: Look for 'Disable SSL verification' in General settings [OK]

Common Mistakes:

• Confusing proxy settings with SSL validation
• Thinking Interceptor controls SSL validation
• Assuming environment variables control SSL validation

3. What will happen if you send a request in Postman with SSL validation OFF to a server with an expired SSL certificate?

medium

A. Postman will block the request and show an SSL error.

B. Postman will automatically renew the server's certificate.

C. Postman will encrypt the request twice.

D. Postman will send the request ignoring the expired certificate.

Solution

1. Step 1: Understand SSL validation OFF effect

   When SSL validation is OFF, Postman does not check the server's certificate validity.

2. Step 2: Predict behavior with expired certificate

   Postman will ignore the expired certificate and send the request without error.

3. Final Answer:

   Postman will send the request ignoring the expired certificate. -> Option D

4. Quick Check:

   SSL off = ignore certificate errors [OK]

Hint: SSL off means ignore certificate problems [OK]

Common Mistakes:

• Assuming Postman blocks requests with SSL off
• Thinking Postman renews certificates
• Confusing encryption with validation

4. You enabled SSL certificate validation in Postman but still receive SSL errors for a trusted server. What is the likely cause?

medium

A. The server's SSL certificate is self-signed or not trusted by your system.

B. Postman does not support SSL validation for HTTPS.

C. You forgot to enable proxy settings in Postman.

D. Your internet connection is offline.

Solution

1. Step 1: Analyze SSL error despite validation enabled

   If SSL validation is ON but errors appear, the certificate might be self-signed or untrusted.

2. Step 2: Exclude other causes

   Postman supports SSL validation; proxy or internet issues cause different errors.

3. Final Answer:

   The server's SSL certificate is self-signed or not trusted by your system. -> Option A

4. Quick Check:

   SSL errors usually mean untrusted certificate [OK]

Hint: Untrusted certs cause SSL errors even if validation is ON [OK]

Common Mistakes:

• Thinking Postman lacks SSL validation support
• Blaming proxy settings for SSL errors
• Assuming offline connection causes SSL errors

5. You want to test an API with a self-signed SSL certificate in Postman without errors. What is the best approach?

hard

A. Use a different tool that ignores SSL by default.

B. Turn OFF SSL certificate validation in Postman settings temporarily.

C. Import the self-signed certificate into your system's trusted store and keep validation ON.

D. Send requests only over HTTP instead of HTTPS.

Solution

1. Step 1: Understand testing with self-signed certificates

   Self-signed certificates cause SSL errors unless trusted by the system.

2. Step 2: Choose best practice for secure testing

   Importing the certificate into the trusted store allows validation ON without errors, ensuring real security testing.

3. Step 3: Evaluate other options

   Turning off validation skips security checks; using HTTP or other tools reduces test accuracy.

4. Final Answer:

   Import the self-signed certificate into your system's trusted store and keep validation ON. -> Option C

5. Quick Check:

   Trust certs to keep SSL validation ON [OK]

Hint: Trust self-signed certs to keep SSL validation ON [OK]

Common Mistakes:

• Disabling SSL validation permanently
• Ignoring security by using HTTP
• Switching tools instead of fixing trust