buildCertificateExtensions

buildCertificateExtensions

Build the v3 extensions block for a certificate.

Automatically adds SKI, AKI (when a key identifier is given), and basicConstraints (defaults to { ca: false }). Additional extensions come from the caller's CertificateExtensionsInput.

function buildCertificateExtensions(
	subjectPublicKeyInfo: Uint8Array,
	authorityKeyIdentifier: Uint8Array | undefined,
	input: CertificateExtensionsInput | undefined,
	subjectIsEmpty: boolean,
): Uint8Array[]

Parameters

• subjectPublicKeyInfo: Uint8Array — DER-encoded SPKI of the subject.
• authorityKeyIdentifier: Uint8Array | undefined — Key identifier for the AKI, or undefined to omit it.
• input: CertificateExtensionsInput | undefined — Optional extension configuration.
• subjectIsEmpty: boolean — Whether the certificate subject DN is empty. When true, a subjectAltName extension is required and marked critical per RFC 5280 §4.2.1.6.

Returns — Array of DER-encoded Extension SEQUENCEs.