Skip to main content
QMSQMS
QMS
  • Welcome to your QMS
  • Quality Manual
  • Procedures
  • Records
  • TF_Legit.Health_Plus
    • Legit.Health Plus TF index
    • Legit.Health Plus STED
    • Legit.Health Plus description and specifications
    • R-TF-001-007 Declaration of conformity
    • GSPR
    • Clinical
    • Design and development
    • Design History File (DHF)
      • Version 1.0.0.0
        • Requirements
        • Test plans
          • PLAN-001 Users submit their credentials to receive an access token
          • PLAN_002 Token expiration in user authentication process
          • PLAN_003 Account lockout for user authentication
          • PLAN_004 Enforcing HTTPS protocol for API communications
          • PLAN_005 Valid SSL/TLS certificates
          • PLAN_006 Rate limiting for anonymous users
          • PLAN_007 Rate limiting for authenticated users
          • PLAN_008 Logging and monitoring of rate limit violations
          • PLAN_009 Validation of request and response data against FHIR schemas
          • PLAN_010 Base64 encoded images are accepted
          • PLAN_011 Non-Base64 encoded images are rejected
          • PLAN_012 Diagnosis support endpoint accepts multiple images
          • PLAN_013 Improved accuracy with multiple images
          • PLAN_014: Password hashing during user registration
          • PLAN_015: Password hash comparison during login
          • PLAN_016: Registration of a new user by authorized individuals
          • PLAN_017 Specification of body zone for scoring systems requiring zone factor
          • PLAN_018 The device's API maintains an uptime of at least 99% over a one-month period
          • PLAN_019 API penetration testing with Intruder.io
        • Test runs
        • 🥣 SOUPs
    • IFU and label
    • Post-Market Surveillance
    • Quality control
    • Risk Management
  • Licenses and accreditations
  • External documentation
  • Procedures
  • Records
  • TF_Legit.Health_Plus
  • Design History File (DHF)
  • Version 1.0.0.0
  • Test plans
  • PLAN_005 Valid SSL/TLS certificates

PLAN_005 Valid SSL/TLS certificates

Description​

This test ensures that the SSL/TLS certificates used by the REST API are valid and correctly installed on the host.

System requirements​

No special hardware or software is required to run this test.

Preconditions​

  • The entire system (including the reverse proxy, REST API, and all upstream services) is deployed, operational, and accessible online.
  • All communications with the REST API are conducted over HTTPS, either through the reverse proxy server or directly with the hosting server.
  • A web domain name is linked to the IP address of the server hosting the API.
  • Let's Encrypt is configured for automatic certificate generation.

Input data​

No specific data is needed to perform this test.

Steps​

  1. Access the API via a web browser using HTTPS (e.g., https://medical-device-pre.legit.health).
  2. In your browser, you'll see an icon to the left of the URL. Hover over it to see a message like "View site information" (the wording may vary depending on your browser). Click on this icon to open a dialog box.

Expected outcome​

  • The browser dialog box shows that the connection is secure and confirms a valid SSL certificate.
  • The certificate is issued by Let's Encrypt and has not expired.

For the last expected outcome, please include a screenshot similar to the one below (though the exact appearance may vary depending on your web browser), along with the actual result of the test run:

Valid SSL certificate

Verifies software requirements​

  • REQ_005

Risk control for​

    1. Data breach or unauthorized access

Signature meaning

The signatures for the approval process of this document can be found in the verified commits at the repository for the QMS. As a reference, the team members who are expected to participate in this document and their roles in the approval process, as defined in Annex I Responsibility Matrix of the GP-001, are:

  • Tester: JD-017, JD-009, JD-004
  • Approver: JD-005
Previous
PLAN_004 Enforcing HTTPS protocol for API communications
Next
PLAN_006 Rate limiting for anonymous users
  • Description
  • System requirements
  • Preconditions
  • Input data
  • Steps
  • Expected outcome
  • Verifies software requirements
  • Risk control for
All the information contained in this QMS is confidential. The recipient agrees not to transmit or reproduce the information, neither by himself nor by third parties, through whichever means, without obtaining the prior written permission of Legit.Health (AI LABS GROUP S.L.)