CheckCertificateRevocationAgainstCrlInput

CheckCertificateRevocationAgainstCrlInput

Input for checkCertificateRevocationAgainstCrl.

interface CheckCertificateRevocationAgainstCrlInput {
	readonly certificate: CrlCertificateSource;
	readonly issuerCertificate: CrlCertificateSource;
	readonly crl: CrlSource;
	readonly deltaCrl?: CrlSource;
	readonly at?: Date;
	readonly clockSkewMs?: number;
	readonly maxAgeMs?: number;
	readonly unrecognizedReasonCode?: UnrecognizedReasonCodePolicy;
}

Properties

• readonly certificate: CrlCertificateSource — Certificate whose revocation status to check.
• readonly issuerCertificate: CrlCertificateSource — Issuer of certificate — also expected signer of the CRL.
• readonly crl: CrlSource — Complete (base) CRL to check against.
• readonly deltaCrl?: CrlSource — Optional delta CRL for more recent revocation information. With a delta CRL, the freshness checks and maxAgeMs apply to the delta CRL alone, whose thisUpdate and nextUpdate the constructed CRL takes (RFC 5280 §5.2.4, §6.3.3(a)(1)(i)). A delta CRL without nextUpdate is never current and fails with stale_crl.
• readonly at?: Date — Evaluation time. Defaults to new Date().
• readonly clockSkewMs?: number — Clock-skew tolerance in milliseconds for freshness checks. It also widens maxAgeMs.
• readonly maxAgeMs?: number — Maximum age of each CRL's thisUpdate in milliseconds. See ValidateCertificateRevocationListInput.maxAgeMs.
• readonly unrecognizedReasonCode?: UnrecognizedReasonCodePolicy — Treatment of a revoked entry whose CRLReason is unrecognized. 'reject' fails the check with reason_code_unrecognized. Defaults to 'revoked'.