DistributionPointReason = "keyCompromise" | "cACompromise" | "affiliationChanged" | "superseded" | "cessationOfOperation" | "certificateHold" | "privilegeWithdrawn" | "aACompromise"

Defined in: src/x509/extensions.ts:139

Revocation reason flags for CRL Distribution Points and Issuing Distribution Points (RFC 5280 §4.2.1.13, §5.2.5).

KnownAuthorityInfoAccessMethod

KnownAuthorityInfoAccessMethod = "ocsp" | "caIssuers"

Defined in: src/x509/extensions.ts:594

Well-known AIA access methods: OCSP responder or CA issuer certificate.

KnownExtendedKeyUsage

KnownExtendedKeyUsage = "serverAuth" | "clientAuth" | "codeSigning" | "emailProtection" | "timeStamping" | "ocspSigning"

Defined in: src/x509/extensions.ts:624

Well-known Extended Key Usage purpose strings (RFC 5280 §4.2.1.12).

SignatureProfileInput

SignatureProfileInput = { kind?: "auto"; } | { kind: "rsa-pss"; saltLength?: 32 | 48 | 64; }

Defined in: src/internal/crypto/signing.ts:20

Controls how the signature algorithm is chosen.

'auto' (default) infers the algorithm from the key. 'rsa-pss' forces RSA-PSS padding and requires an RSA-PSS private key.

Union Members

Type Literal

{ kind?: "auto"; }

kind?

readonly optional kind?: "auto"

Infer the signature algorithm from the private key.

Type Literal

{ kind: "rsa-pss"; saltLength?: 32 | 48 | 64; }

kind

readonly kind: "rsa-pss"

Force RSA-PSS padding.

saltLength?

readonly optional saltLength?: 32 | 48 | 64

Salt length in bytes. Must match the key's hash digest size.

UnsupportedNameConstraintForm

UnsupportedNameConstraintForm = { type: "otherName"; value: Uint8Array; } | { type: "x400Address"; value: Uint8Array; } | { type: "ediPartyName"; value: Uint8Array; } | { type: "registeredID"; value: string; }

Defined in: src/x509/extensions.ts:466

Name constraint forms parsed from DER but not supported for encoding or validation. Preserved for diagnostic round-tripping.

Union Members

Type Literal

{ type: "otherName"; value: Uint8Array; }

type

readonly type: "otherName"

otherName [0] — raw bytes.

value

readonly value: Uint8Array

Type Literal

{ type: "x400Address"; value: Uint8Array; }

type

readonly type: "x400Address"

x400Address [3] — raw bytes.

value

readonly value: Uint8Array

Type Literal

{ type: "ediPartyName"; value: Uint8Array; }

type

readonly type: "ediPartyName"

ediPartyName [5] — raw bytes.

value

readonly value: Uint8Array

Type Literal

{ type: "registeredID"; value: string; }

type

readonly type: "registeredID"

registeredID [8] — decoded OID string.

value

readonly value: string

Functions

buildCertificateExtensions()

buildCertificateExtensions(subjectPublicKeyInfo, issuerPublicKeyInfo, input, subjectIsEmpty?): Uint8Array<ArrayBufferLike>[]

Defined in: src/x509/extensions.ts:683

Build the v3 extensions block for a certificate.

Automatically adds SKI, AKI (when issuer key is available), and basicConstraints (defaults to { ca: false }). Additional extensions come from the caller's CertificateExtensionsInput.

Parameters

subjectPublicKeyInfo

Uint8Array

DER-encoded SPKI of the subject.

issuerPublicKeyInfo

Uint8Array<ArrayBufferLike> | undefined

DER-encoded SPKI of the issuer, or undefined for self-signed.

input

CertificateExtensionsInput | undefined

Optional extension configuration.

subjectIsEmpty?

boolean = false

Whether the certificate subject DN is empty. When true, the subjectAltName extension is marked critical per RFC 5280 §4.2.1.6.

Returns

Uint8Array<ArrayBufferLike>[]

Array of DER-encoded Extension SEQUENCEs.

buildRequestedExtensions()

buildRequestedExtensions(input): Uint8Array<ArrayBufferLike>[]

Defined in: src/x509/extensions.ts:722

Build the extensions for a CSR's extensionRequest attribute.

Unlike buildCertificateExtensions, SKI/AKI are not auto-generated.

Parameters

input

CertificateExtensionsInput | undefined

Optional extension configuration.

Returns

Uint8Array<ArrayBufferLike>[]

Array of DER-encoded Extension SEQUENCEs.

encodeAuthorityInfoAccess()

encodeAuthorityInfoAccess(entries): Uint8Array

Defined in: src/x509/extensions.ts:940

DER-encode an Authority Information Access SEQUENCE.

Parameters

entries

readonly AuthorityInformationAccess[]

AIA entries (OCSP, caIssuers, or custom) to encode.

Returns

Uint8Array

encodeBasicConstraints()

encodeBasicConstraints(input): Uint8Array

Defined in: src/x509/extensions.ts:872

DER-encode a BasicConstraints value.

Parameters

input

BasicConstraints

CA flag and optional pathLength.

Returns

Uint8Array

DER SEQUENCE suitable for wrapping in an Extension OCTET STRING.

encodeCertificatePolicies()

encodeCertificatePolicies(policies): Uint8Array

Defined in: src/x509/extensions.ts:993

DER-encode a Certificate Policies extension value.

Parameters

policies

CertificatePolicies

Non-empty array of policy information entries.

Returns

Uint8Array

encodeCrlDistributionPoints()

encodeCrlDistributionPoints(points): Uint8Array

Defined in: src/x509/extensions.ts:958

DER-encode a CRL Distribution Points SEQUENCE.

Parameters

points

readonly DistributionPoint[]

Distribution points to encode.

Returns

Uint8Array

encodeExtendedKeyUsage()

encodeExtendedKeyUsage(usages): Uint8Array

Defined in: src/x509/extensions.ts:931

DER-encode an Extended Key Usage SEQUENCE OF OIDs.

Parameters

usages

readonly ExtendedKeyUsage[]

EKU purposes to encode.

Returns

Uint8Array

encodeExtension()

encodeExtension(oid, extnValue, critical?): Uint8Array

Defined in: src/x509/extensions.ts:857

Encode a single X.509 Extension SEQUENCE (OID + optional critical BOOLEAN + OCTET STRING).

Parameters

oid

string

Dotted-decimal extension OID.

extnValue

Uint8Array

DER-encoded extension payload.

critical?

boolean = false

Whether to mark the extension as critical. Default false.

Returns

Uint8Array

encodeInhibitAnyPolicy()

encodeInhibitAnyPolicy(input): Uint8Array

Defined in: src/x509/extensions.ts:1055

DER-encode an Inhibit anyPolicy extension value (single INTEGER).

Parameters

input

InhibitAnyPolicy

The skipCerts threshold.

Returns

Uint8Array

encodeKeyUsage()

encodeKeyUsage(usages): Uint8Array

Defined in: src/x509/extensions.ts:891

DER-encode a Key Usage BIT STRING from an array of KeyUsage flags.

Parameters

usages

readonly KeyUsage[]

Flags to set in the bit string.

Returns

Uint8Array

encodeName()

encodeName(input): Uint8Array

Defined in: src/x509/name.ts:196

DER-encodes an X.509 Name.

Returns a DER SEQUENCE of RelativeDistinguishedNames (RDNs).
Each RDN emitted by this helper contains exactly one name attribute.

Parameters

input

NameInput

Name fields in convenience-object form or caller-ordered attribute form.

Returns

Uint8Array

DER-encoded X.509 Name bytes.

See

RFC 5280 Appendix A.1

NameObject input emits populated fields in the canonical order from NAME_OBJECT_ORDER.
NameAttribute array input preserves caller-supplied ordering, but each entry still becomes its own single-attribute RDN.

Attribute OIDs and ASN.1 string encodings come from NAME_FIELD_DEFINITIONS.
Empty strings and undefined fields are ignored when the input is a NameObject.

Examples

const der = encodeName({ country: 'US', commonName: 'example.com' });

// emits two single-attribute RDNs: C=US, then CN=example.com

const der = encodeName([
	{ type: 'country', value: 'US' },
	{ type: 'commonName', value: 'example.com' },
]);

// preserves caller order: C first, then CN

Throws

If the input produces no attributes, contains an unsupported field key, or uses an invalid country code.

encodeNameConstraints()

encodeNameConstraints(constraints): Uint8Array

Defined in: src/x509/extensions.ts:967

DER-encode a Name Constraints extension value.

Parameters

constraints

NameConstraints

Permitted and/or excluded subtrees.

Returns

Uint8Array

encodePolicyConstraints()

encodePolicyConstraints(constraints): Uint8Array

Defined in: src/x509/extensions.ts:1032

DER-encode a Policy Constraints extension value.

Parameters

constraints

PolicyConstraints

At least one of requireExplicitPolicy or inhibitPolicyMapping must be set.

Returns

Uint8Array

encodePolicyMappings()

encodePolicyMappings(mappings): Uint8Array

Defined in: src/x509/extensions.ts:1005

DER-encode a Policy Mappings extension value.

Parameters

mappings

PolicyMappings

Non-empty array of issuer-to-subject policy pairs. Neither OID may be anyPolicy.

Returns

Uint8Array

encodeRelativeDistinguishedName()

encodeRelativeDistinguishedName(attributes): Uint8Array

Defined in: src/x509/name.ts:236

DER-encodes a single RelativeDistinguishedName (RDN).

Returns a DER SET OF name attributes for one X.509 name segment.
Use this when you need a multi-valued RDN.

Parameters

attributes

RelativeDistinguishedNameInput

Attribute list to encode inside one RDN.

Returns

Uint8Array

DER-encoded RelativeDistinguishedName bytes.

See

RFC 5280 Appendix A.1

Attribute OIDs and ASN.1 string encodings come from NAME_FIELD_DEFINITIONS.

Example

const rdn = encodeRelativeDistinguishedName([
	{ type: 'commonName', value: 'example.com' },
	{ type: 'serialNumber', value: 'device-7' },
]);

// emits one RDN with both attributes in the same SET

Throws

If the attribute list is empty, contains an unsupported field key, or uses an invalid country code.

encodeSubjectAltName()

encodeSubjectAltName(value): Uint8Array

Defined in: src/x509/extensions.ts:900

DER-encode a single SubjectAltName GeneralName element.

Parameters

value

SubjectAltName

The SAN entry to encode.

Returns

Uint8Array

getAuthorityInfoAccessMethodOid()

getAuthorityInfoAccessMethodOid(method): string

Defined in: src/x509/extensions.ts:1238

Resolve an AuthorityInfoAccessMethod to its dotted-decimal OID.

Parameters

method

AuthorityInfoAccessMethod

Well-known string or custom OID object.

Returns

string

getExtendedKeyUsageOid()

getExtendedKeyUsageOid(usage): string

Defined in: src/x509/extensions.ts:1202

Resolve an ExtendedKeyUsage to its dotted-decimal OID.

Parameters

usage

ExtendedKeyUsage

Well-known string or custom OID object.

Returns

string

parseAuthorityInfoAccessMethodOid()

parseAuthorityInfoAccessMethodOid(oid): AuthorityInfoAccessMethod

Defined in: src/x509/extensions.ts:1251

Map a dotted-decimal OID to an AuthorityInfoAccessMethod value.

Returns 'ocsp' or 'caIssuers' for recognized OIDs, or { type: 'oid', value } otherwise.

Parameters

oid

string

Returns

AuthorityInfoAccessMethod

parseExtendedKeyUsageOid()

parseExtendedKeyUsageOid(oid): ExtendedKeyUsage

Defined in: src/x509/extensions.ts:1215

Map a dotted-decimal OID to an ExtendedKeyUsage value.

Returns a well-known string for recognized OIDs, or { type: 'oid', value } otherwise.

Parameters

oid

string

Returns

ExtendedKeyUsage

x509 ​

Interfaces ​

CpsPolicyQualifierInfo ​

Properties ​

type ​

uri ​

CustomAuthorityInfoAccessMethod ​

Properties ​

type ​

value ​

CustomExtendedKeyUsage ​

Properties ​

type ​

value ​

CustomExtension ​

Properties ​

critical? ​

oid ​

value ​

CustomPolicyQualifierInfo ​

Properties ​

oid ​

qualifierDer ​

type ​

IssuingDistributionPointBase ​

Properties ​

distributionPoint? ​

indirectCrl? ​

onlyContainsAttributeCerts? ​

onlyContainsCACerts? ​

onlyContainsUserCerts? ​

onlySomeReasons? ​

IssuingDistributionPointForAttributeCerts ​

Extends ​

Properties ​

distributionPoint? ​

Inherited from ​

indirectCrl? ​

Inherited from ​

onlyContainsAttributeCerts ​

onlyContainsCACerts? ​

Overrides ​

onlyContainsUserCerts? ​

Overrides ​

onlySomeReasons? ​

Inherited from ​

IssuingDistributionPointForCaCerts ​

Extends ​

Properties ​

distributionPoint? ​

Inherited from ​

indirectCrl? ​

Inherited from ​

onlyContainsAttributeCerts? ​

Overrides ​

onlyContainsCACerts ​

onlyContainsUserCerts? ​

Overrides ​

onlySomeReasons? ​

Inherited from ​

IssuingDistributionPointForUserCerts ​

Extends ​

Properties ​

distributionPoint? ​

Inherited from ​

indirectCrl? ​

Inherited from ​

onlyContainsAttributeCerts? ​

Overrides ​

onlyContainsCACerts? ​

Overrides ​

onlyContainsUserCerts ​

onlySomeReasons? ​

Inherited from ​

PolicyNoticeReference ​

Properties ​

noticeNumbers ​

organization ​

UserNoticePolicyQualifierInfo ​

Properties ​

x509

Interfaces

CpsPolicyQualifierInfo

Properties

type

uri

CustomAuthorityInfoAccessMethod

Properties

type

value

CustomExtendedKeyUsage

Properties

type

value

CustomExtension

Properties

critical?

oid

value

CustomPolicyQualifierInfo

Properties

oid

qualifierDer

type

IssuingDistributionPointBase

Properties

distributionPoint?

indirectCrl?

onlyContainsAttributeCerts?

onlyContainsCACerts?

onlyContainsUserCerts?

onlySomeReasons?

IssuingDistributionPointForAttributeCerts

Extends

Properties

distributionPoint?

Inherited from

indirectCrl?

Inherited from

onlyContainsAttributeCerts

onlyContainsCACerts?

Overrides

onlyContainsUserCerts?

Overrides

onlySomeReasons?

Inherited from

IssuingDistributionPointForCaCerts

Extends

Properties

distributionPoint?

Inherited from

indirectCrl?

Inherited from

onlyContainsAttributeCerts?

Overrides

onlyContainsCACerts

onlyContainsUserCerts?

Overrides

onlySomeReasons?

Inherited from

IssuingDistributionPointForUserCerts

Extends

Properties

distributionPoint?

Inherited from

indirectCrl?

Inherited from

onlyContainsAttributeCerts?

Overrides

onlyContainsCACerts?

Overrides

onlyContainsUserCerts

onlySomeReasons?

Inherited from

PolicyNoticeReference

Properties

noticeNumbers

organization

UserNoticePolicyQualifierInfo

Properties