CreateCertificateInput

CreateCertificateInput

Input for createCertificate.

interface CreateCertificateInput {
	readonly issuer: NameInput;
	readonly subject: NameInput;
	readonly publicKey: CryptoKey;
	readonly signerPrivateKey: CryptoKey;
	readonly issuerCertificate?: string | Uint8Array | ParsedCertificate;
	readonly validity?: ValidityInput;
	readonly serialNumber?: Uint8Array;
	readonly extensions?: CertificateExtensionsInput;
	readonly signature?: SignatureProfileInput;
}

Properties

• readonly issuer: NameInput — Issuer distinguished name.

• readonly subject: NameInput — Subject distinguished name.

• readonly publicKey: CryptoKey — Subject public key to encode into the certificate.

• readonly signerPrivateKey: CryptoKey — Private key used to sign the certificate.

• readonly issuerCertificate?: string | Uint8Array | ParsedCertificate — Certificate of the issuer. Its subject key identifier becomes the authority key identifier (RFC 5280 §4.2.1.1, §4.2.1.2). An issuer certificate without one yields a key identifier derived from its public key. Omit it to leave the authority key identifier out.

• readonly validity?: ValidityInput — Validity window configuration.

• readonly serialNumber?: Uint8Array — DER integer bytes for the certificate serial number.

  RFC 5280 §4.1.2.2 requires a positive value of at most 20 octets. When omitted, a random positive 16-byte serial number is generated.

• readonly extensions?: CertificateExtensionsInput — X.509 extensions to encode into the certificate.

• readonly signature?: SignatureProfileInput — Signature algorithm override.

  When omitted, the library selects a compatible profile from the signing key.