PCI DSS 4.2.1 requires strong cryptography and security protocols to protect PAN sent over open, public networks. Only trusted keys and certificates are accepted, certificates are confirmed valid and not expired or revoked, and the protocol supports only secure versions with no fallback. 4.2.1.1 adds an inventory of trusted keys and certificates. This is not legal advice.
What the text lists
The SAQ D wording for 4.2.1:
- Only trusted keys and certificates are accepted.
- Certificates are confirmed valid and not expired or revoked.
- The protocol supports only secure versions or configurations and does not support fallback to, or use of, insecure versions, algorithms, key sizes or implementations.
- Encryption strength is appropriate for the method in use.
The validity bullet was a recommended practice until 31 March 2025 and part of 4.2.1 after. 4.2.1.1, the inventory of trusted keys and certificates used to protect PAN in transit, carried the same date.
Developer checklist
| Item | What to check |
|---|---|
| Protocol versions | Disable insecure versions and fallback in server and client config |
| Certificate validation | Clients verify chain, expiry and hostname, and never skip verification |
| Revocation or expiry | Monitor expiry dates with alerts |
| Cipher suites | Remove weak algorithms and key sizes |
| Inventory | List each certificate and key, owner, expiry and where used |
| Internal CAs | The note says self-signed certificates may be acceptable if issued by an internal CA, the author is confirmed and verified, and unexpired. Same Distinguished Name for issuer and subject is not acceptable |
Common mistakes
- Turning off certificate verification in test code that ships.
- Pinning a certificate with no rotation plan.
- Letting a certificate expire in a payment flow.
- Leaving old protocol versions enabled "for one partner."
Unsolicited card data
The note says that if you receive cardholder data through an insecure channel not meant for it, you can bring that channel into the CDE and secure it, or prevent its use. Tell staff and customers not to send card numbers by email or chat.
Quick check
Does 4.2.1 apply to traffic inside my network?
The text covers open, public networks. Other requirements deal with internal protection, so check scope with your assessor.
Is a self-signed certificate ever acceptable?
The note allows it in limited cases, such as one issued by an internal CA that has been verified and is unexpired.
On Safeguard: dependency scanning can flag known vulnerable TLS and cryptography libraries in your projects. Try the free scan at gold.safeguard.sh/scan.
Sources
Wording is from v4.0. Confirm in the current version.
Last reviewed: 19 October 2026.
