# @suaveplan/x509 - RFC 5280 X.509 v3 certificate parser and certification-path validator. Universal: pure TypeScript over Uint8Array/DataView; signature verify delegated to @suaveplan/crypto-rsa and @suaveplan/crypto-curve. ## Summary RFC 5280 X.509 v3 certificate parser and certification-path validator. Universal (zero browser, Node, or React deps). Pure TypeScript over `Uint8Array` / `DataView`; signature verify delegated to `@suaveplan/crypto-rsa` (RSA-PKCS1v1.5, RSA-PSS) and `@suaveplan/crypto-curve` (ECDSA-P{256,384,521}, Ed25519). ## Documentation tree - [__fixtures__](./src/__fixtures__/build-certs.md) — _(no submodules)_ - [build-certs](./src/__fixtures__/build-certs.md) — _(no submodules)_ - [decoder](./src/asn1/decoder.md) — Implements `decodeAsn1(bytes, mode)` covering every ASN.1 production used by RFC 5280 Appendix A: primitive scalars (`I… - [encoder](./src/asn1/encoder.md) — Implements `encodeAsn1(node)` producing canonical DER bytes per X.690 paragraph 10 for any `Asn1Node` the decoder accep… - [oid](./src/asn1/oid.md) — Encodes and decodes ASN.1 OBJECT IDENTIFIER bodies per X.690 paragraph 8.19. OIDs in X.509 identify algorithms, extensi… - [strings](./src/asn1/strings.md) — Decodes and encodes the typed ASN.1 string types used inside X.509 Names and SubjectAltName entries: `UTF8String`, `Pri… - [time](./src/asn1/time.md) — Decodes and encodes the two time formats RFC 5280 paragraph 4.1.2.5 permits inside a certificate's `Validity` field: `U… - [name](./src/certificate/name.md) — Decodes RFC 5280 paragraph 4.1.2.4 `Name` (`RDNSequence`) structures into a typed shape carrying both the raw DER bytes… - [parse](./src/certificate/parse.md) — Implements `parseCertificate(bytes)` decoding a DER- or PEM-encoded `Certificate` into a typed `X509Certificate` value… - [errors](./src/errors/error-codes.md) — _(no submodules)_ - [error-codes](./src/errors/error-codes.md) — _(no submodules)_ - [authority-key-id](./src/extensions/authority-key-id.md) — Decodes the `authority-key-id` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur… - [basic-constraints](./src/extensions/basic-constraints.md) — Decodes the basic-constraints extension into `BasicConstraints { cA: boolean; pathLenConstraint?: number }`. During pat… - [crl-distribution-points](./src/extensions/crl-distribution-points.md) — Decodes the `crl-distribution-points` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is… - [extended-key-usage](./src/extensions/extended-key-usage.md) — Decodes the `extended-key-usage` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is capt… - [key-usage](./src/extensions/key-usage.md) — Decodes the `key-usage` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured from… - [name-constraints](./src/extensions/name-constraints.md) — Decodes the `name-constraints` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur… - [registry](./src/extensions/registry.md) — Decodes the `registry` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured from… - [subject-alt-name](./src/extensions/subject-alt-name.md) — Decodes the `subject-alt-name` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur… - [subject-key-id](./src/extensions/subject-key-id.md) — Decodes the `subject-key-id` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured… - [chains-to](./src/helpers/chains-to.md) — The `helpers/chains-to` module exposes a pre-filtering / display helper around the parsed certificate data. It is indep… - [has-name-match](./src/helpers/has-name-match.md) — The `helpers/has-name-match` module exposes a pre-filtering / display helper around the parsed certificate data. It is… - [is-issuer-of](./src/helpers/is-issuer-of.md) — The `helpers/is-issuer-of` module exposes a pre-filtering / display helper around the parsed certificate data. It is in… - [observability](./src/observability/metrics.md) — _(no submodules)_ - [metrics](./src/observability/metrics.md) — _(no submodules)_ - [pem](./src/pem/pem.md) — _(no submodules)_ - [pem](./src/pem/pem.md) — _(no submodules)_ - [schemas](./src/schemas/schemas.md) — _(no submodules)_ - [schemas](./src/schemas/schemas.md) — _(no submodules)_ - [alg-map](./src/signature/alg-map.md) — The `signature/alg-map` module is part of the certificate signature-verify pipeline. Together with the rest of the `sig… - [decode-ecdsa-sig](./src/signature/decode-ecdsa-sig.md) — The `signature/decode-ecdsa-sig` module is part of the certificate signature-verify pipeline. Together with the rest of… - [verify](./src/signature/verify.md) — The `signature/verify` module is part of the certificate signature-verify pipeline. Together with the rest of the `sign… - [trust-anchor](./src/validate/trust-anchor.md) — `validate/trust-anchor` is the core of the certificate path-validation pipeline. `validateChain` walks the certificate… - [validate-chain](./src/validate/validate-chain.md) — `validate/validate-chain` is the core of the certificate path-validation pipeline. `validateChain` walks the certificat… - [build-certs](./src/__fixtures__/build-certs.md) — _(no submodules)_- [decoder](./src/asn1/decoder.md) — Implements `decodeAsn1(bytes, mode)` covering every ASN.1 production used by RFC 5280 Appendix A: primitive scalars (`I… - [encoder](./src/asn1/encoder.md) — Implements `encodeAsn1(node)` producing canonical DER bytes per X.690 paragraph 10 for any `Asn1Node` the decoder accep… - [oid](./src/asn1/oid.md) — Encodes and decodes ASN.1 OBJECT IDENTIFIER bodies per X.690 paragraph 8.19. OIDs in X.509 identify algorithms, extensi… - [strings](./src/asn1/strings.md) — Decodes and encodes the typed ASN.1 string types used inside X.509 Names and SubjectAltName entries: `UTF8String`, `Pri… - [time](./src/asn1/time.md) — Decodes and encodes the two time formats RFC 5280 paragraph 4.1.2.5 permits inside a certificate's `Validity` field: `U… - [name](./src/certificate/name.md) — Decodes RFC 5280 paragraph 4.1.2.4 `Name` (`RDNSequence`) structures into a typed shape carrying both the raw DER bytes… - [parse](./src/certificate/parse.md) — Implements `parseCertificate(bytes)` decoding a DER- or PEM-encoded `Certificate` into a typed `X509Certificate` value… - [errors](./src/errors/error-codes.md) — _(no submodules)_- [error-codes](./src/errors/error-codes.md) — _(no submodules)_- [authority-key-id](./src/extensions/authority-key-id.md) — Decodes the `authority-key-id` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur… - [basic-constraints](./src/extensions/basic-constraints.md) — Decodes the basic-constraints extension into `BasicConstraints { cA: boolean; pathLenConstraint?: number }`. During pat… - [crl-distribution-points](./src/extensions/crl-distribution-points.md) — Decodes the `crl-distribution-points` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is… - [extended-key-usage](./src/extensions/extended-key-usage.md) — Decodes the `extended-key-usage` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is capt… - [key-usage](./src/extensions/key-usage.md) — Decodes the `key-usage` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured from… - [name-constraints](./src/extensions/name-constraints.md) — Decodes the `name-constraints` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur… - [registry](./src/extensions/registry.md) — Decodes the `registry` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured from… - [subject-alt-name](./src/extensions/subject-alt-name.md) — Decodes the `subject-alt-name` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur… - [subject-key-id](./src/extensions/subject-key-id.md) — Decodes the `subject-key-id` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured… - [chains-to](./src/helpers/chains-to.md) — The `helpers/chains-to` module exposes a pre-filtering / display helper around the parsed certificate data. It is indep… - [has-name-match](./src/helpers/has-name-match.md) — The `helpers/has-name-match` module exposes a pre-filtering / display helper around the parsed certificate data. It is… - [is-issuer-of](./src/helpers/is-issuer-of.md) — The `helpers/is-issuer-of` module exposes a pre-filtering / display helper around the parsed certificate data. It is in… - [observability](./src/observability/metrics.md) — _(no submodules)_- [metrics](./src/observability/metrics.md) — _(no submodules)_- [pem](./src/pem/pem.md) — _(no submodules)_- [pem](./src/pem/pem.md) — _(no submodules)_- [schemas](./src/schemas/schemas.md) — _(no submodules)_- [schemas](./src/schemas/schemas.md) — _(no submodules)_- [alg-map](./src/signature/alg-map.md) — The `signature/alg-map` module is part of the certificate signature-verify pipeline. Together with the rest of the `sig… - [decode-ecdsa-sig](./src/signature/decode-ecdsa-sig.md) — The `signature/decode-ecdsa-sig` module is part of the certificate signature-verify pipeline. Together with the rest of… - [verify](./src/signature/verify.md) — The `signature/verify` module is part of the certificate signature-verify pipeline. Together with the rest of the `sign… - [trust-anchor](./src/validate/trust-anchor.md) — `validate/trust-anchor` is the core of the certificate path-validation pipeline. `validateChain` walks the certificate… - [validate-chain](./src/validate/validate-chain.md) — `validate/validate-chain` is the core of the certificate path-validation pipeline. `validateChain` walks the certificat… - [build-certs](./src/__fixtures__/build-certs.md) — _(no submodules)_- [decoder](./src/asn1/decoder.md) — Implements `decodeAsn1(bytes, mode)` covering every ASN.1 production used by RFC 5280 Appendix A: primitive scalars (`I… - [encoder](./src/asn1/encoder.md) — Implements `encodeAsn1(node)` producing canonical DER bytes per X.690 paragraph 10 for any `Asn1Node` the decoder accep… - [oid](./src/asn1/oid.md) — Encodes and decodes ASN.1 OBJECT IDENTIFIER bodies per X.690 paragraph 8.19. OIDs in X.509 identify algorithms, extensi… - [strings](./src/asn1/strings.md) — Decodes and encodes the typed ASN.1 string types used inside X.509 Names and SubjectAltName entries: `UTF8String`, `Pri… - [time](./src/asn1/time.md) — Decodes and encodes the two time formats RFC 5280 paragraph 4.1.2.5 permits inside a certificate's `Validity` field: `U… - [name](./src/certificate/name.md) — Decodes RFC 5280 paragraph 4.1.2.4 `Name` (`RDNSequence`) structures into a typed shape carrying both the raw DER bytes… - [parse](./src/certificate/parse.md) — Implements `parseCertificate(bytes)` decoding a DER- or PEM-encoded `Certificate` into a typed `X509Certificate` value… - [errors](./src/errors/error-codes.md) — _(no submodules)_- [error-codes](./src/errors/error-codes.md) — _(no submodules)_- [authority-key-id](./src/extensions/authority-key-id.md) — Decodes the `authority-key-id` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur… - [basic-constraints](./src/extensions/basic-constraints.md) — Decodes the basic-constraints extension into `BasicConstraints { cA: boolean; pathLenConstraint?: number }`. During pat… - [crl-distribution-points](./src/extensions/crl-distribution-points.md) — Decodes the `crl-distribution-points` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is… - [extended-key-usage](./src/extensions/extended-key-usage.md) — Decodes the `extended-key-usage` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is capt… - [key-usage](./src/extensions/key-usage.md) — Decodes the `key-usage` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured from… - [name-constraints](./src/extensions/name-constraints.md) — Decodes the `name-constraints` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur… - [registry](./src/extensions/registry.md) — Decodes the `registry` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured from… - [subject-alt-name](./src/extensions/subject-alt-name.md) — Decodes the `subject-alt-name` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur… - [subject-key-id](./src/extensions/subject-key-id.md) — Decodes the `subject-key-id` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured… - [chains-to](./src/helpers/chains-to.md) — The `helpers/chains-to` module exposes a pre-filtering / display helper around the parsed certificate data. It is indep… - [has-name-match](./src/helpers/has-name-match.md) — The `helpers/has-name-match` module exposes a pre-filtering / display helper around the parsed certificate data. It is… - [is-issuer-of](./src/helpers/is-issuer-of.md) — The `helpers/is-issuer-of` module exposes a pre-filtering / display helper around the parsed certificate data. It is in… - [observability](./src/observability/metrics.md) — _(no submodules)_- [metrics](./src/observability/metrics.md) — _(no submodules)_- [pem](./src/pem/pem.md) — _(no submodules)_- [pem](./src/pem/pem.md) — _(no submodules)_- [schemas](./src/schemas/schemas.md) — _(no submodules)_- [schemas](./src/schemas/schemas.md) — _(no submodules)_- [alg-map](./src/signature/alg-map.md) — The `signature/alg-map` module is part of the certificate signature-verify pipeline. Together with the rest of the `sig… - [decode-ecdsa-sig](./src/signature/decode-ecdsa-sig.md) — The `signature/decode-ecdsa-sig` module is part of the certificate signature-verify pipeline. Together with the rest of… - [verify](./src/signature/verify.md) — The `signature/verify` module is part of the certificate signature-verify pipeline. Together with the rest of the `sign… - [trust-anchor](./src/validate/trust-anchor.md) — `validate/trust-anchor` is the core of the certificate path-validation pipeline. `validateChain` walks the certificate… - [validate-chain](./src/validate/validate-chain.md) — `validate/validate-chain` is the core of the certificate path-validation pipeline. `validateChain` walks the certificat… - [build-certs](./src/__fixtures__/build-certs.md) — _(no submodules)_- [decoder](./src/asn1/decoder.md) — Implements `decodeAsn1(bytes, mode)` covering every ASN.1 production used by RFC 5280 Appendix A: primitive scalars (`I… - [encoder](./src/asn1/encoder.md) — Implements `encodeAsn1(node)` producing canonical DER bytes per X.690 paragraph 10 for any `Asn1Node` the decoder accep… - [oid](./src/asn1/oid.md) — Encodes and decodes ASN.1 OBJECT IDENTIFIER bodies per X.690 paragraph 8.19. OIDs in X.509 identify algorithms, extensi… - [strings](./src/asn1/strings.md) — Decodes and encodes the typed ASN.1 string types used inside X.509 Names and SubjectAltName entries: `UTF8String`, `Pri… - [time](./src/asn1/time.md) — Decodes and encodes the two time formats RFC 5280 paragraph 4.1.2.5 permits inside a certificate's `Validity` field: `U… - [name](./src/certificate/name.md) — Decodes RFC 5280 paragraph 4.1.2.4 `Name` (`RDNSequence`) structures into a typed shape carrying both the raw DER bytes… - [parse](./src/certificate/parse.md) — Implements `parseCertificate(bytes)` decoding a DER- or PEM-encoded `Certificate` into a typed `X509Certificate` value… - [errors](./src/errors/error-codes.md) — _(no submodules)_- [error-codes](./src/errors/error-codes.md) — _(no submodules)_- [authority-key-id](./src/extensions/authority-key-id.md) — Decodes the `authority-key-id` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur… - [basic-constraints](./src/extensions/basic-constraints.md) — Decodes the basic-constraints extension into `BasicConstraints { cA: boolean; pathLenConstraint?: number }`. During pat… - [crl-distribution-points](./src/extensions/crl-distribution-points.md) — Decodes the `crl-distribution-points` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is… - [extended-key-usage](./src/extensions/extended-key-usage.md) — Decodes the `extended-key-usage` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is capt… - [key-usage](./src/extensions/key-usage.md) — Decodes the `key-usage` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured from… - [name-constraints](./src/extensions/name-constraints.md) — Decodes the `name-constraints` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur… - [registry](./src/extensions/registry.md) — Decodes the `registry` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured from… - [subject-alt-name](./src/extensions/subject-alt-name.md) — Decodes the `subject-alt-name` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur… - [subject-key-id](./src/extensions/subject-key-id.md) — Decodes the `subject-key-id` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured… - [chains-to](./src/helpers/chains-to.md) — The `helpers/chains-to` module exposes a pre-filtering / display helper around the parsed certificate data. It is indep… - [has-name-match](./src/helpers/has-name-match.md) — The `helpers/has-name-match` module exposes a pre-filtering / display helper around the parsed certificate data. It is… - [is-issuer-of](./src/helpers/is-issuer-of.md) — The `helpers/is-issuer-of` module exposes a pre-filtering / display helper around the parsed certificate data. It is in… - [observability](./src/observability/metrics.md) — _(no submodules)_- [metrics](./src/observability/metrics.md) — _(no submodules)_- [pem](./src/pem/pem.md) — _(no submodules)_- [pem](./src/pem/pem.md) — _(no submodules)_- [schemas](./src/schemas/schemas.md) — _(no submodules)_- [schemas](./src/schemas/schemas.md) — _(no submodules)_- [alg-map](./src/signature/alg-map.md) — The `signature/alg-map` module is part of the certificate signature-verify pipeline. Together with the rest of the `sig… - [decode-ecdsa-sig](./src/signature/decode-ecdsa-sig.md) — The `signature/decode-ecdsa-sig` module is part of the certificate signature-verify pipeline. Together with the rest of… - [verify](./src/signature/verify.md) — The `signature/verify` module is part of the certificate signature-verify pipeline. Together with the rest of the `sign… - [trust-anchor](./src/validate/trust-anchor.md) — `validate/trust-anchor` is the core of the certificate path-validation pipeline. `validateChain` walks the certificate… - [validate-chain](./src/validate/validate-chain.md) — `validate/validate-chain` is the core of the certificate path-validation pipeline. `validateChain` walks the certificat… - [build-certs](./src/__fixtures__/build-certs.md) — _(no submodules)_- [decoder](./src/asn1/decoder.md) — Implements `decodeAsn1(bytes, mode)` covering every ASN.1 production used by RFC 5280 Appendix A: primitive scalars (`I… - [encoder](./src/asn1/encoder.md) — Implements `encodeAsn1(node)` producing canonical DER bytes per X.690 paragraph 10 for any `Asn1Node` the decoder accep… - [oid](./src/asn1/oid.md) — Encodes and decodes ASN.1 OBJECT IDENTIFIER bodies per X.690 paragraph 8.19. OIDs in X.509 identify algorithms, extensi… - [strings](./src/asn1/strings.md) — Decodes and encodes the typed ASN.1 string types used inside X.509 Names and SubjectAltName entries: `UTF8String`, `Pri… - [time](./src/asn1/time.md) — Decodes and encodes the two time formats RFC 5280 paragraph 4.1.2.5 permits inside a certificate's `Validity` field: `U… - [name](./src/certificate/name.md) — Decodes RFC 5280 paragraph 4.1.2.4 `Name` (`RDNSequence`) structures into a typed shape carrying both the raw DER bytes… - [parse](./src/certificate/parse.md) — Implements `parseCertificate(bytes)` decoding a DER- or PEM-encoded `Certificate` into a typed `X509Certificate` value… - [errors](./src/errors/error-codes.md) — _(no submodules)_ - [error-codes](./src/errors/error-codes.md) — _(no submodules)_- [authority-key-id](./src/extensions/authority-key-id.md) — Decodes the `authority-key-id` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur… - [basic-constraints](./src/extensions/basic-constraints.md) — Decodes the basic-constraints extension into `BasicConstraints { cA: boolean; pathLenConstraint?: number }`. During pat… - [crl-distribution-points](./src/extensions/crl-distribution-points.md) — Decodes the `crl-distribution-points` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is… - [extended-key-usage](./src/extensions/extended-key-usage.md) — Decodes the `extended-key-usage` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is capt… - [key-usage](./src/extensions/key-usage.md) — Decodes the `key-usage` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured from… - [name-constraints](./src/extensions/name-constraints.md) — Decodes the `name-constraints` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur… - [registry](./src/extensions/registry.md) — Decodes the `registry` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured from… - [subject-alt-name](./src/extensions/subject-alt-name.md) — Decodes the `subject-alt-name` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur… - [subject-key-id](./src/extensions/subject-key-id.md) — Decodes the `subject-key-id` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured… - [chains-to](./src/helpers/chains-to.md) — The `helpers/chains-to` module exposes a pre-filtering / display helper around the parsed certificate data. It is indep… - [has-name-match](./src/helpers/has-name-match.md) — The `helpers/has-name-match` module exposes a pre-filtering / display helper around the parsed certificate data. It is… - [is-issuer-of](./src/helpers/is-issuer-of.md) — The `helpers/is-issuer-of` module exposes a pre-filtering / display helper around the parsed certificate data. It is in… - [observability](./src/observability/metrics.md) — _(no submodules)_ - [metrics](./src/observability/metrics.md) — _(no submodules)_- [pem](./src/pem/pem.md) — _(no submodules)_ - [pem](./src/pem/pem.md) — _(no submodules)_- [schemas](./src/schemas/schemas.md) — _(no submodules)_ - [schemas](./src/schemas/schemas.md) — _(no submodules)_- [alg-map](./src/signature/alg-map.md) — The `signature/alg-map` module is part of the certificate signature-verify pipeline. Together with the rest of the `sig… - [decode-ecdsa-sig](./src/signature/decode-ecdsa-sig.md) — The `signature/decode-ecdsa-sig` module is part of the certificate signature-verify pipeline. Together with the rest of… - [verify](./src/signature/verify.md) — The `signature/verify` module is part of the certificate signature-verify pipeline. Together with the rest of the `sign… - [trust-anchor](./src/validate/trust-anchor.md) — `validate/trust-anchor` is the core of the certificate path-validation pipeline. `validateChain` walks the certificate… - [validate-chain](./src/validate/validate-chain.md) — `validate/validate-chain` is the core of the certificate path-validation pipeline. `validateChain` walks the certificat… ## Install ```bash bun add @suaveplan/x509 ``` ## Quick start ```ts import { parseCertificate, validateChain, TrustAnchorStore } from "@suaveplan/x509"; const leaf = parseCertificate(leafDerBytes); const intermediate = parseCertificate(intermediateDerBytes); const root = parseCertificate(rootDerBytes); const result = await validateChain({ leaf, intermediates: [intermediate], trustAnchors: [root], }); console.log(result.trustedPath.length); // 3 ``` ## Modules | Module | Purpose | |---|---| | [`asn1/decoder`](./src/asn1/decoder.md) | TLV decoder for the X.509 ASN.1 subset | | [`asn1/encoder`](./src/asn1/encoder.md) | Canonical DER encoder (round-trip with decoder) | | [`asn1/oid`](./src/asn1/oid.md) | OBJECT IDENTIFIER encode / decode | | [`asn1/strings`](./src/asn1/strings.md) | Typed-string decoders (UTF8 / Printable / IA5 / BMP / Universal / Teletex) | | [`asn1/time`](./src/asn1/time.md) | UTCTime and GeneralizedTime codec | | [`pem/pem`](./src/pem/pem.md) | RFC 7468 PEM framing | | [`certificate/parse`](./src/certificate/parse.md) | RFC 5280 §4.1 Certificate parser | | [`certificate/name`](./src/certificate/name.md) | Name codec + canonical comparison | | [`extensions/basic-constraints`](./src/extensions/basic-constraints.md) | RFC 5280 §4.2.1.9 | | [`extensions/key-usage`](./src/extensions/key-usage.md) | RFC 5280 §4.2.1.3 | | [`extensions/extended-key-usage`](./src/extensions/extended-key-usage.md) | RFC 5280 §4.2.1.12 | | [`extensions/subject-alt-name`](./src/extensions/subject-alt-name.md) | RFC 5280 §4.2.1.6 + §4.2.2.6 | | [`extensions/name-constraints`](./src/extensions/name-constraints.md) | RFC 5280 §4.2.1.10 | | [`extensions/authority-key-id`](./src/extensions/authority-key-id.md) | RFC 5280 §4.2.1.1 | | [`extensions/subject-key-id`](./src/extensions/subject-key-id.md) | RFC 5280 §4.2.1.2 | | [`extensions/crl-distribution-points`](./src/extensions/crl-distribution-points.md) | RFC 5280 §4.2.1.13 (parse only) | | [`extensions/registry`](./src/extensions/registry.md) | OID-keyed dispatch table | | [`signature/alg-map`](./src/signature/alg-map.md) | Signature-algorithm OID lookup | | [`signature/verify`](./src/signature/verify.md) | Signature verify dispatch | | [`signature/decode-ecdsa-sig`](./src/signature/decode-ecdsa-sig.md) | ECDSA-Sig-Value DER decoder | | [`validate/validate-chain`](./src/validate/validate-chain.md) | RFC 5280 §6.1 path-validation algorithm | | [`validate/trust-anchor`](./src/validate/trust-anchor.md) | SKI-indexed trust-anchor store | | [`helpers/has-name-match`](./src/helpers/has-name-match.md) | RFC 6125 host-name match | | [`helpers/chains-to`](./src/helpers/chains-to.md) | SKI/AKI chaining heuristic | | [`helpers/is-issuer-of`](./src/helpers/is-issuer-of.md) | Canonical name equality | | [`errors/error-codes`](./src/errors/error-codes.md) | Typed error registry | | [`observability/metrics`](./src/observability/metrics.md) | OpenTelemetry surface | | [`schemas/schemas`](./src/schemas/schemas.md) | Zod boundary schemas | ## Out of scope - __OCSP__ — interface only (`OcspResponderLike`); implementation in follow-up `@suaveplan/x509-ocsp`. - __CRL fetching__ — distribution-point parsing only; implementation in follow-up `@suaveplan/x509-crl`. - __Certificate issuance / signing__ — follow-up `@suaveplan/x509-ca`. - __Policy mapping / policy constraints__ — decoded as `RawExtension`; critical occurrence triggers `CRITICAL_EXTENSION_UNRECOGNIZED` per RFC 5280 §6.1.4(f). - __PKCS#12 / PKCS#11 / smartcard__ — not in scope.