---
category: [Administration & Integrations, Administration & Integrations/Custom Integrations & Apps, Platform and Product Extensions, Platform and Product Extensions/Workday Extend, Platform and Product Extensions/Integration]
keyword: Extend
nav: wcp_docs
parent_url: /wcp_docs/
title: >- 
  Concept: Certificate Validation for External Apps Hosted in the Germany Region
layout: subsection
---

The API endpoints for Workday Extend in the Germany region use certificates obtained from Let's Encrypt. Let's Encrypt is a global Certificate Authority (CA) that makes it possible to automatically obtain a browser-trusted certificate, without any human intervention.

You can find more details on how that's achieved on [letsencrypt.org](https://letsencrypt.org/how-it-works/).

<b>Note:</b> All certificates obtained from Let's Encrypt expire after 90 days.

## <a id="section_v2g_scz_3tb"></a>Certificate Revocation and Constraints

Let's Encrypt supports only the Online Certificate Status Protocol (OCSP) mechanism for checking the validity of endpoint certificates.

-   Let's Encrypt revokes unexpired certificates that are no longer safe to use.
-   The Let's Encrypt [Certificate Policy](https://letsencrypt.org/documents/isrg-cp-v2.1/#4-9-certificate-revocation-and-suspension) and [Certification Practice Statement](https://letsencrypt.org/documents/isrg-cps-v4.2/#4.9-certificate-revocation-and-suspension) contain detailed sections dedicated to the practices around certificate revocation.
-   Let's Encrypt provides an OCSP endpoint to publish information about revoked endpoint certificates.


## <a id="section_lyd_12z_3tb"></a>TLS/SSL Clients Must Be OCSP Compliant

To verify the revocation status of presented endpoint certificates, TLS/SSL clients connecting to Workday Extend apps must check the published OCSP data. Let's Encrypt provides Certificate Revocation List (CRL) and OCSP for revoked intermediate certificates but does not provide CRL for revoked endpoint certificates. The TLS/SSL client initiating an HTTPS connection to an Extend app must be able to validate the OCSP status of any endpoint certificates that the client encounters.