MSTG-NETWORK-3: Certificate checks sufficient?

[daMatz]

The requirement for MSTG-NETWORK-3 is:

The app verifies the X.509 certificate of the remote endpoint when the secure channel is established. Only certificates signed by a trusted CA are accepted.

Is this sufficient as a requirement for this topic?
What about additional checks like:

• certificate validation check
• certificate revocation check
• signature check
• certificate chain check

[TheDauntless]

That's a valid point, and we should think about rephrasing this. I would love to say 'let the OS do it for you', but with all the third party frameworks that's probably not clear/secure enough.