RevocationPolicy

RevocationPolicy

Revocation checking policy for checkChainRevocation.

Controls how indeterminate results (missing evidence, expired CRLs) affect the final decision.

interface RevocationPolicy {
	readonly mode?: "soft-fail" | "hard-fail";
	readonly prefer?: "ocsp" | "crl" | "best-available";
	readonly ocspResponderRevocation?: OcspResponderRevocationPolicy;
	readonly crlMaxAgeMs?: number;
	readonly clockSkewMs?: number;
	readonly ocspProfile?: ValidateOcspResponseInput["profile"];
	readonly unrecognizedReasonCode?: UnrecognizedReasonCodePolicy;
}

Properties

• readonly mode?: "soft-fail" | "hard-fail" — How to handle indeterminate status.

  • 'hard-fail': indeterminate certificates cause denial (default)
  • 'soft-fail': indeterminate certificates are allowed — an explicit availability/compatibility choice

  Revocation checking itself is opt-in: no check runs unless evidence is supplied. Once it is, indeterminate status denies by default.

• readonly prefer?: "ocsp" | "crl" | "best-available" — Evidence preference when multiple sources are available.

  Both evidence kinds are always evaluated, and a validated revoked verdict from either source wins regardless of preference (fail-closed). Preference only decides which source's good verdict is reported when both yield one.

  • 'best-available': the source with the fresher evidence — the later thisUpdate on the validated OCSP entry or CRL — is reported; ties favor OCSP (default)
  • 'ocsp': prefer OCSP over CRL
  • 'crl': prefer CRL over OCSP

• readonly ocspResponderRevocation?: OcspResponderRevocationPolicy — Revocation policy for delegated OCSP responder certificates (RFC 6960 §4.2.2.2.1). Supplied CRLs double as responder revocation evidence. Defaults to 'honor-nocheck'.

• readonly crlMaxAgeMs?: number — Maximum age of a CRL's thisUpdate at the evaluation time, in milliseconds. An older CRL yields no evidence even when it carries no nextUpdate. Applies to CRLs for chain certificates, CRL signers and delegated OCSP responders. Unbounded by default, in which case a CRL without nextUpdate yields no evidence. RFC 5280 §3.3 leaves the required recency of revocation data to local policy.

• readonly clockSkewMs?: number — Clock-skew tolerance in milliseconds for CRL and OCSP thisUpdate/ nextUpdate checks. It also widens crlMaxAgeMs by the same amount. Defaults to 0.

• readonly ocspProfile?: ValidateOcspResponseInput["profile"] — OCSP client profile for every OCSP response. See ValidateOcspResponseInput.profile. 'rfc9919' turns a response without nextUpdate into ocsp_next_update_missing. Defaults to 'rfc6960'.

• readonly unrecognizedReasonCode?: UnrecognizedReasonCodePolicy — Treatment of CRL entries and OCSP responses whose CRLReason is unrecognized, including the CRLs for CRL signers and delegated OCSP responders. See UnrecognizedReasonCodePolicy. 'reject' makes that evidence yield crl_reason_code_unrecognized or ocsp_reason_code_unrecognized, which outranks a good verdict from other evidence. Defaults to 'revoked'.