206 lines
29 KiB
Markdown
206 lines
29 KiB
Markdown
# @suaveplan/x509 - RFC 5280 X.509 v3 certificate parser and certification-path validator. Universal: pure TypeScript over Uint8Array/DataView; signature verify delegated to @suaveplan/crypto-rsa and @suaveplan/crypto-curve.
|
|
|
|
## Summary
|
|
|
|
RFC 5280 X.509 v3 certificate parser and certification-path validator. Universal (zero browser, Node, or React deps). Pure TypeScript over `Uint8Array` / `DataView`; signature verify delegated to `@suaveplan/crypto-rsa` (RSA-PKCS1v1.5, RSA-PSS) and `@suaveplan/crypto-curve` (ECDSA-P{256,384,521}, Ed25519).
|
|
|
|
<!-- begin:auto-docs -->
|
|
## Documentation tree
|
|
|
|
- [__fixtures__](./src/__fixtures__/build-certs.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
|
|
- [build-certs](./src/__fixtures__/build-certs.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
|
|
- [decoder](./src/asn1/decoder.md) — Implements `decodeAsn1(bytes, mode)` covering every ASN.1 production used by RFC 5280 Appendix A: primitive scalars (`I…
|
|
- [encoder](./src/asn1/encoder.md) — Implements `encodeAsn1(node)` producing canonical DER bytes per X.690 paragraph 10 for any `Asn1Node` the decoder accep…
|
|
- [oid](./src/asn1/oid.md) — Encodes and decodes ASN.1 OBJECT IDENTIFIER bodies per X.690 paragraph 8.19. OIDs in X.509 identify algorithms, extensi…
|
|
- [strings](./src/asn1/strings.md) — Decodes and encodes the typed ASN.1 string types used inside X.509 Names and SubjectAltName entries: `UTF8String`, `Pri…
|
|
- [time](./src/asn1/time.md) — Decodes and encodes the two time formats RFC 5280 paragraph 4.1.2.5 permits inside a certificate's `Validity` field: `U…
|
|
- [name](./src/certificate/name.md) — Decodes RFC 5280 paragraph 4.1.2.4 `Name` (`RDNSequence`) structures into a typed shape carrying both the raw DER bytes…
|
|
- [parse](./src/certificate/parse.md) — Implements `parseCertificate(bytes)` decoding a DER- or PEM-encoded `Certificate` into a typed `X509Certificate` value…
|
|
- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
|
|
- [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
|
|
- [authority-key-id](./src/extensions/authority-key-id.md) — Decodes the `authority-key-id` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur…
|
|
- [basic-constraints](./src/extensions/basic-constraints.md) — Decodes the basic-constraints extension into `BasicConstraints { cA: boolean; pathLenConstraint?: number }`. During pat…
|
|
- [crl-distribution-points](./src/extensions/crl-distribution-points.md) — Decodes the `crl-distribution-points` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is…
|
|
- [extended-key-usage](./src/extensions/extended-key-usage.md) — Decodes the `extended-key-usage` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is capt…
|
|
- [key-usage](./src/extensions/key-usage.md) — Decodes the `key-usage` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured from…
|
|
- [name-constraints](./src/extensions/name-constraints.md) — Decodes the `name-constraints` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur…
|
|
- [registry](./src/extensions/registry.md) — Decodes the `registry` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured from…
|
|
- [subject-alt-name](./src/extensions/subject-alt-name.md) — Decodes the `subject-alt-name` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur…
|
|
- [subject-key-id](./src/extensions/subject-key-id.md) — Decodes the `subject-key-id` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured…
|
|
- [chains-to](./src/helpers/chains-to.md) — The `helpers/chains-to` module exposes a pre-filtering / display helper around the parsed certificate data. It is indep…
|
|
- [has-name-match](./src/helpers/has-name-match.md) — The `helpers/has-name-match` module exposes a pre-filtering / display helper around the parsed certificate data. It is…
|
|
- [is-issuer-of](./src/helpers/is-issuer-of.md) — The `helpers/is-issuer-of` module exposes a pre-filtering / display helper around the parsed certificate data. It is in…
|
|
- [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
|
|
- [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
|
|
- [pem](./src/pem/pem.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
|
|
- [pem](./src/pem/pem.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
|
|
- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
|
|
- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
|
|
- [alg-map](./src/signature/alg-map.md) — The `signature/alg-map` module is part of the certificate signature-verify pipeline. Together with the rest of the `sig…
|
|
- [decode-ecdsa-sig](./src/signature/decode-ecdsa-sig.md) — The `signature/decode-ecdsa-sig` module is part of the certificate signature-verify pipeline. Together with the rest of…
|
|
- [verify](./src/signature/verify.md) — The `signature/verify` module is part of the certificate signature-verify pipeline. Together with the rest of the `sign…
|
|
- [trust-anchor](./src/validate/trust-anchor.md) — `validate/trust-anchor` is the core of the certificate path-validation pipeline. `validateChain` walks the certificate…
|
|
- [validate-chain](./src/validate/validate-chain.md) — `validate/validate-chain` is the core of the certificate path-validation pipeline. `validateChain` walks the certificat…
|
|
<!-- end:auto-docs --> - [build-certs](./src/__fixtures__/build-certs.md) — <!-- begin:auto-docs --> _(no submodules)_- [decoder](./src/asn1/decoder.md) — Implements `decodeAsn1(bytes, mode)` covering every ASN.1 production used by RFC 5280 Appendix A: primitive scalars (`I…
|
|
- [encoder](./src/asn1/encoder.md) — Implements `encodeAsn1(node)` producing canonical DER bytes per X.690 paragraph 10 for any `Asn1Node` the decoder accep…
|
|
- [oid](./src/asn1/oid.md) — Encodes and decodes ASN.1 OBJECT IDENTIFIER bodies per X.690 paragraph 8.19. OIDs in X.509 identify algorithms, extensi…
|
|
- [strings](./src/asn1/strings.md) — Decodes and encodes the typed ASN.1 string types used inside X.509 Names and SubjectAltName entries: `UTF8String`, `Pri…
|
|
- [time](./src/asn1/time.md) — Decodes and encodes the two time formats RFC 5280 paragraph 4.1.2.5 permits inside a certificate's `Validity` field: `U…
|
|
- [name](./src/certificate/name.md) — Decodes RFC 5280 paragraph 4.1.2.4 `Name` (`RDNSequence`) structures into a typed shape carrying both the raw DER bytes…
|
|
- [parse](./src/certificate/parse.md) — Implements `parseCertificate(bytes)` decoding a DER- or PEM-encoded `Certificate` into a typed `X509Certificate` value…
|
|
- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [authority-key-id](./src/extensions/authority-key-id.md) — Decodes the `authority-key-id` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur…
|
|
- [basic-constraints](./src/extensions/basic-constraints.md) — Decodes the basic-constraints extension into `BasicConstraints { cA: boolean; pathLenConstraint?: number }`. During pat…
|
|
- [crl-distribution-points](./src/extensions/crl-distribution-points.md) — Decodes the `crl-distribution-points` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is…
|
|
- [extended-key-usage](./src/extensions/extended-key-usage.md) — Decodes the `extended-key-usage` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is capt…
|
|
- [key-usage](./src/extensions/key-usage.md) — Decodes the `key-usage` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured from…
|
|
- [name-constraints](./src/extensions/name-constraints.md) — Decodes the `name-constraints` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur…
|
|
- [registry](./src/extensions/registry.md) — Decodes the `registry` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured from…
|
|
- [subject-alt-name](./src/extensions/subject-alt-name.md) — Decodes the `subject-alt-name` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur…
|
|
- [subject-key-id](./src/extensions/subject-key-id.md) — Decodes the `subject-key-id` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured…
|
|
- [chains-to](./src/helpers/chains-to.md) — The `helpers/chains-to` module exposes a pre-filtering / display helper around the parsed certificate data. It is indep…
|
|
- [has-name-match](./src/helpers/has-name-match.md) — The `helpers/has-name-match` module exposes a pre-filtering / display helper around the parsed certificate data. It is…
|
|
- [is-issuer-of](./src/helpers/is-issuer-of.md) — The `helpers/is-issuer-of` module exposes a pre-filtering / display helper around the parsed certificate data. It is in…
|
|
- [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [pem](./src/pem/pem.md) — <!-- begin:auto-docs --> _(no submodules)_- [pem](./src/pem/pem.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [alg-map](./src/signature/alg-map.md) — The `signature/alg-map` module is part of the certificate signature-verify pipeline. Together with the rest of the `sig…
|
|
- [decode-ecdsa-sig](./src/signature/decode-ecdsa-sig.md) — The `signature/decode-ecdsa-sig` module is part of the certificate signature-verify pipeline. Together with the rest of…
|
|
- [verify](./src/signature/verify.md) — The `signature/verify` module is part of the certificate signature-verify pipeline. Together with the rest of the `sign…
|
|
- [trust-anchor](./src/validate/trust-anchor.md) — `validate/trust-anchor` is the core of the certificate path-validation pipeline. `validateChain` walks the certificate…
|
|
- [validate-chain](./src/validate/validate-chain.md) — `validate/validate-chain` is the core of the certificate path-validation pipeline. `validateChain` walks the certificat…
|
|
- [build-certs](./src/__fixtures__/build-certs.md) — <!-- begin:auto-docs --> _(no submodules)_- [decoder](./src/asn1/decoder.md) — Implements `decodeAsn1(bytes, mode)` covering every ASN.1 production used by RFC 5280 Appendix A: primitive scalars (`I…
|
|
- [encoder](./src/asn1/encoder.md) — Implements `encodeAsn1(node)` producing canonical DER bytes per X.690 paragraph 10 for any `Asn1Node` the decoder accep…
|
|
- [oid](./src/asn1/oid.md) — Encodes and decodes ASN.1 OBJECT IDENTIFIER bodies per X.690 paragraph 8.19. OIDs in X.509 identify algorithms, extensi…
|
|
- [strings](./src/asn1/strings.md) — Decodes and encodes the typed ASN.1 string types used inside X.509 Names and SubjectAltName entries: `UTF8String`, `Pri…
|
|
- [time](./src/asn1/time.md) — Decodes and encodes the two time formats RFC 5280 paragraph 4.1.2.5 permits inside a certificate's `Validity` field: `U…
|
|
- [name](./src/certificate/name.md) — Decodes RFC 5280 paragraph 4.1.2.4 `Name` (`RDNSequence`) structures into a typed shape carrying both the raw DER bytes…
|
|
- [parse](./src/certificate/parse.md) — Implements `parseCertificate(bytes)` decoding a DER- or PEM-encoded `Certificate` into a typed `X509Certificate` value…
|
|
- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [authority-key-id](./src/extensions/authority-key-id.md) — Decodes the `authority-key-id` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur…
|
|
- [basic-constraints](./src/extensions/basic-constraints.md) — Decodes the basic-constraints extension into `BasicConstraints { cA: boolean; pathLenConstraint?: number }`. During pat…
|
|
- [crl-distribution-points](./src/extensions/crl-distribution-points.md) — Decodes the `crl-distribution-points` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is…
|
|
- [extended-key-usage](./src/extensions/extended-key-usage.md) — Decodes the `extended-key-usage` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is capt…
|
|
- [key-usage](./src/extensions/key-usage.md) — Decodes the `key-usage` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured from…
|
|
- [name-constraints](./src/extensions/name-constraints.md) — Decodes the `name-constraints` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur…
|
|
- [registry](./src/extensions/registry.md) — Decodes the `registry` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured from…
|
|
- [subject-alt-name](./src/extensions/subject-alt-name.md) — Decodes the `subject-alt-name` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur…
|
|
- [subject-key-id](./src/extensions/subject-key-id.md) — Decodes the `subject-key-id` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured…
|
|
- [chains-to](./src/helpers/chains-to.md) — The `helpers/chains-to` module exposes a pre-filtering / display helper around the parsed certificate data. It is indep…
|
|
- [has-name-match](./src/helpers/has-name-match.md) — The `helpers/has-name-match` module exposes a pre-filtering / display helper around the parsed certificate data. It is…
|
|
- [is-issuer-of](./src/helpers/is-issuer-of.md) — The `helpers/is-issuer-of` module exposes a pre-filtering / display helper around the parsed certificate data. It is in…
|
|
- [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [pem](./src/pem/pem.md) — <!-- begin:auto-docs --> _(no submodules)_- [pem](./src/pem/pem.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [alg-map](./src/signature/alg-map.md) — The `signature/alg-map` module is part of the certificate signature-verify pipeline. Together with the rest of the `sig…
|
|
- [decode-ecdsa-sig](./src/signature/decode-ecdsa-sig.md) — The `signature/decode-ecdsa-sig` module is part of the certificate signature-verify pipeline. Together with the rest of…
|
|
- [verify](./src/signature/verify.md) — The `signature/verify` module is part of the certificate signature-verify pipeline. Together with the rest of the `sign…
|
|
- [trust-anchor](./src/validate/trust-anchor.md) — `validate/trust-anchor` is the core of the certificate path-validation pipeline. `validateChain` walks the certificate…
|
|
- [validate-chain](./src/validate/validate-chain.md) — `validate/validate-chain` is the core of the certificate path-validation pipeline. `validateChain` walks the certificat…
|
|
- [build-certs](./src/__fixtures__/build-certs.md) — <!-- begin:auto-docs --> _(no submodules)_- [decoder](./src/asn1/decoder.md) — Implements `decodeAsn1(bytes, mode)` covering every ASN.1 production used by RFC 5280 Appendix A: primitive scalars (`I…
|
|
- [encoder](./src/asn1/encoder.md) — Implements `encodeAsn1(node)` producing canonical DER bytes per X.690 paragraph 10 for any `Asn1Node` the decoder accep…
|
|
- [oid](./src/asn1/oid.md) — Encodes and decodes ASN.1 OBJECT IDENTIFIER bodies per X.690 paragraph 8.19. OIDs in X.509 identify algorithms, extensi…
|
|
- [strings](./src/asn1/strings.md) — Decodes and encodes the typed ASN.1 string types used inside X.509 Names and SubjectAltName entries: `UTF8String`, `Pri…
|
|
- [time](./src/asn1/time.md) — Decodes and encodes the two time formats RFC 5280 paragraph 4.1.2.5 permits inside a certificate's `Validity` field: `U…
|
|
- [name](./src/certificate/name.md) — Decodes RFC 5280 paragraph 4.1.2.4 `Name` (`RDNSequence`) structures into a typed shape carrying both the raw DER bytes…
|
|
- [parse](./src/certificate/parse.md) — Implements `parseCertificate(bytes)` decoding a DER- or PEM-encoded `Certificate` into a typed `X509Certificate` value…
|
|
- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [authority-key-id](./src/extensions/authority-key-id.md) — Decodes the `authority-key-id` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur…
|
|
- [basic-constraints](./src/extensions/basic-constraints.md) — Decodes the basic-constraints extension into `BasicConstraints { cA: boolean; pathLenConstraint?: number }`. During pat…
|
|
- [crl-distribution-points](./src/extensions/crl-distribution-points.md) — Decodes the `crl-distribution-points` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is…
|
|
- [extended-key-usage](./src/extensions/extended-key-usage.md) — Decodes the `extended-key-usage` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is capt…
|
|
- [key-usage](./src/extensions/key-usage.md) — Decodes the `key-usage` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured from…
|
|
- [name-constraints](./src/extensions/name-constraints.md) — Decodes the `name-constraints` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur…
|
|
- [registry](./src/extensions/registry.md) — Decodes the `registry` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured from…
|
|
- [subject-alt-name](./src/extensions/subject-alt-name.md) — Decodes the `subject-alt-name` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur…
|
|
- [subject-key-id](./src/extensions/subject-key-id.md) — Decodes the `subject-key-id` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured…
|
|
- [chains-to](./src/helpers/chains-to.md) — The `helpers/chains-to` module exposes a pre-filtering / display helper around the parsed certificate data. It is indep…
|
|
- [has-name-match](./src/helpers/has-name-match.md) — The `helpers/has-name-match` module exposes a pre-filtering / display helper around the parsed certificate data. It is…
|
|
- [is-issuer-of](./src/helpers/is-issuer-of.md) — The `helpers/is-issuer-of` module exposes a pre-filtering / display helper around the parsed certificate data. It is in…
|
|
- [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [pem](./src/pem/pem.md) — <!-- begin:auto-docs --> _(no submodules)_- [pem](./src/pem/pem.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [alg-map](./src/signature/alg-map.md) — The `signature/alg-map` module is part of the certificate signature-verify pipeline. Together with the rest of the `sig…
|
|
- [decode-ecdsa-sig](./src/signature/decode-ecdsa-sig.md) — The `signature/decode-ecdsa-sig` module is part of the certificate signature-verify pipeline. Together with the rest of…
|
|
- [verify](./src/signature/verify.md) — The `signature/verify` module is part of the certificate signature-verify pipeline. Together with the rest of the `sign…
|
|
- [trust-anchor](./src/validate/trust-anchor.md) — `validate/trust-anchor` is the core of the certificate path-validation pipeline. `validateChain` walks the certificate…
|
|
- [validate-chain](./src/validate/validate-chain.md) — `validate/validate-chain` is the core of the certificate path-validation pipeline. `validateChain` walks the certificat…
|
|
- [build-certs](./src/__fixtures__/build-certs.md) — <!-- begin:auto-docs --> _(no submodules)_- [decoder](./src/asn1/decoder.md) — Implements `decodeAsn1(bytes, mode)` covering every ASN.1 production used by RFC 5280 Appendix A: primitive scalars (`I…
|
|
- [encoder](./src/asn1/encoder.md) — Implements `encodeAsn1(node)` producing canonical DER bytes per X.690 paragraph 10 for any `Asn1Node` the decoder accep…
|
|
- [oid](./src/asn1/oid.md) — Encodes and decodes ASN.1 OBJECT IDENTIFIER bodies per X.690 paragraph 8.19. OIDs in X.509 identify algorithms, extensi…
|
|
- [strings](./src/asn1/strings.md) — Decodes and encodes the typed ASN.1 string types used inside X.509 Names and SubjectAltName entries: `UTF8String`, `Pri…
|
|
- [time](./src/asn1/time.md) — Decodes and encodes the two time formats RFC 5280 paragraph 4.1.2.5 permits inside a certificate's `Validity` field: `U…
|
|
- [name](./src/certificate/name.md) — Decodes RFC 5280 paragraph 4.1.2.4 `Name` (`RDNSequence`) structures into a typed shape carrying both the raw DER bytes…
|
|
- [parse](./src/certificate/parse.md) — Implements `parseCertificate(bytes)` decoding a DER- or PEM-encoded `Certificate` into a typed `X509Certificate` value…
|
|
- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_ - [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [authority-key-id](./src/extensions/authority-key-id.md) — Decodes the `authority-key-id` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur…
|
|
- [basic-constraints](./src/extensions/basic-constraints.md) — Decodes the basic-constraints extension into `BasicConstraints { cA: boolean; pathLenConstraint?: number }`. During pat…
|
|
- [crl-distribution-points](./src/extensions/crl-distribution-points.md) — Decodes the `crl-distribution-points` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is…
|
|
- [extended-key-usage](./src/extensions/extended-key-usage.md) — Decodes the `extended-key-usage` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is capt…
|
|
- [key-usage](./src/extensions/key-usage.md) — Decodes the `key-usage` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured from…
|
|
- [name-constraints](./src/extensions/name-constraints.md) — Decodes the `name-constraints` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur…
|
|
- [registry](./src/extensions/registry.md) — Decodes the `registry` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured from…
|
|
- [subject-alt-name](./src/extensions/subject-alt-name.md) — Decodes the `subject-alt-name` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captur…
|
|
- [subject-key-id](./src/extensions/subject-key-id.md) — Decodes the `subject-key-id` extension per RFC 5280 paragraph 4.2. Every public field in the resulting type is captured…
|
|
- [chains-to](./src/helpers/chains-to.md) — The `helpers/chains-to` module exposes a pre-filtering / display helper around the parsed certificate data. It is indep…
|
|
- [has-name-match](./src/helpers/has-name-match.md) — The `helpers/has-name-match` module exposes a pre-filtering / display helper around the parsed certificate data. It is…
|
|
- [is-issuer-of](./src/helpers/is-issuer-of.md) — The `helpers/is-issuer-of` module exposes a pre-filtering / display helper around the parsed certificate data. It is in…
|
|
- [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_ - [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [pem](./src/pem/pem.md) — <!-- begin:auto-docs --> _(no submodules)_ - [pem](./src/pem/pem.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_ - [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [alg-map](./src/signature/alg-map.md) — The `signature/alg-map` module is part of the certificate signature-verify pipeline. Together with the rest of the `sig…
|
|
- [decode-ecdsa-sig](./src/signature/decode-ecdsa-sig.md) — The `signature/decode-ecdsa-sig` module is part of the certificate signature-verify pipeline. Together with the rest of…
|
|
- [verify](./src/signature/verify.md) — The `signature/verify` module is part of the certificate signature-verify pipeline. Together with the rest of the `sign…
|
|
- [trust-anchor](./src/validate/trust-anchor.md) — `validate/trust-anchor` is the core of the certificate path-validation pipeline. `validateChain` walks the certificate…
|
|
- [validate-chain](./src/validate/validate-chain.md) — `validate/validate-chain` is the core of the certificate path-validation pipeline. `validateChain` walks the certificat…
|
|
|
|
## Install
|
|
|
|
```bash
|
|
bun add @suaveplan/x509
|
|
```
|
|
|
|
## Quick start
|
|
|
|
```ts
|
|
import { parseCertificate, validateChain, TrustAnchorStore } from "@suaveplan/x509";
|
|
|
|
const leaf = parseCertificate(leafDerBytes);
|
|
const intermediate = parseCertificate(intermediateDerBytes);
|
|
const root = parseCertificate(rootDerBytes);
|
|
|
|
const result = await validateChain({
|
|
leaf,
|
|
intermediates: [intermediate],
|
|
trustAnchors: [root],
|
|
});
|
|
|
|
console.log(result.trustedPath.length); // 3
|
|
```
|
|
|
|
## Modules
|
|
|
|
| Module | Purpose |
|
|
|---|---|
|
|
| [`asn1/decoder`](./src/asn1/decoder.md) | TLV decoder for the X.509 ASN.1 subset |
|
|
| [`asn1/encoder`](./src/asn1/encoder.md) | Canonical DER encoder (round-trip with decoder) |
|
|
| [`asn1/oid`](./src/asn1/oid.md) | OBJECT IDENTIFIER encode / decode |
|
|
| [`asn1/strings`](./src/asn1/strings.md) | Typed-string decoders (UTF8 / Printable / IA5 / BMP / Universal / Teletex) |
|
|
| [`asn1/time`](./src/asn1/time.md) | UTCTime and GeneralizedTime codec |
|
|
| [`pem/pem`](./src/pem/pem.md) | RFC 7468 PEM framing |
|
|
| [`certificate/parse`](./src/certificate/parse.md) | RFC 5280 §4.1 Certificate parser |
|
|
| [`certificate/name`](./src/certificate/name.md) | Name codec + canonical comparison |
|
|
| [`extensions/basic-constraints`](./src/extensions/basic-constraints.md) | RFC 5280 §4.2.1.9 |
|
|
| [`extensions/key-usage`](./src/extensions/key-usage.md) | RFC 5280 §4.2.1.3 |
|
|
| [`extensions/extended-key-usage`](./src/extensions/extended-key-usage.md) | RFC 5280 §4.2.1.12 |
|
|
| [`extensions/subject-alt-name`](./src/extensions/subject-alt-name.md) | RFC 5280 §4.2.1.6 + §4.2.2.6 |
|
|
| [`extensions/name-constraints`](./src/extensions/name-constraints.md) | RFC 5280 §4.2.1.10 |
|
|
| [`extensions/authority-key-id`](./src/extensions/authority-key-id.md) | RFC 5280 §4.2.1.1 |
|
|
| [`extensions/subject-key-id`](./src/extensions/subject-key-id.md) | RFC 5280 §4.2.1.2 |
|
|
| [`extensions/crl-distribution-points`](./src/extensions/crl-distribution-points.md) | RFC 5280 §4.2.1.13 (parse only) |
|
|
| [`extensions/registry`](./src/extensions/registry.md) | OID-keyed dispatch table |
|
|
| [`signature/alg-map`](./src/signature/alg-map.md) | Signature-algorithm OID lookup |
|
|
| [`signature/verify`](./src/signature/verify.md) | Signature verify dispatch |
|
|
| [`signature/decode-ecdsa-sig`](./src/signature/decode-ecdsa-sig.md) | ECDSA-Sig-Value DER decoder |
|
|
| [`validate/validate-chain`](./src/validate/validate-chain.md) | RFC 5280 §6.1 path-validation algorithm |
|
|
| [`validate/trust-anchor`](./src/validate/trust-anchor.md) | SKI-indexed trust-anchor store |
|
|
| [`helpers/has-name-match`](./src/helpers/has-name-match.md) | RFC 6125 host-name match |
|
|
| [`helpers/chains-to`](./src/helpers/chains-to.md) | SKI/AKI chaining heuristic |
|
|
| [`helpers/is-issuer-of`](./src/helpers/is-issuer-of.md) | Canonical name equality |
|
|
| [`errors/error-codes`](./src/errors/error-codes.md) | Typed error registry |
|
|
| [`observability/metrics`](./src/observability/metrics.md) | OpenTelemetry surface |
|
|
| [`schemas/schemas`](./src/schemas/schemas.md) | Zod boundary schemas |
|
|
|
|
## Out of scope
|
|
|
|
- __OCSP__ — interface only (`OcspResponderLike`); implementation in follow-up `@suaveplan/x509-ocsp`.
|
|
- __CRL fetching__ — distribution-point parsing only; implementation in follow-up `@suaveplan/x509-crl`.
|
|
- __Certificate issuance / signing__ — follow-up `@suaveplan/x509-ca`.
|
|
- __Policy mapping / policy constraints__ — decoded as `RawExtension`; critical occurrence triggers `CRITICAL_EXTENSION_UNRECOGNIZED` per RFC 5280 §6.1.4(f).
|
|
- __PKCS#12 / PKCS#11 / smartcard__ — not in scope.
|
|
|