@credo-ts/core
Version:
<p align="center"> <br /> <img alt="Credo Logo" src="https://github.com/openwallet-foundation/credo-ts/blob/c7886cb8377ceb8ee4efe8d264211e561a75072d/images/credo-logo.png" height="250px" /> </p> <h1 align="center"><b>Credo - Core</b></h1
85 lines • 5.21 kB
text/typescript
import { X509Certificate } from "./X509Certificate.mjs";
import { X509CertificateRevocationList } from "./X509CertificateRevocationList.mjs";
import { X509CreateCertificateOptions, X509CreateCertificateRevocationListOptions, X509CreateCertificateSigningRequestOptions, X509GetLeafCertificateOptions, X509ParseCertificateOptions, X509ParseCertificateSigningRequestOptions, X509ValidateCertificateChainOptions } from "./X509ServiceOptions.mjs";
import { CertificateSigningRequest } from "./CertificateSigningRequest.mjs";
import { AgentContext } from "../../agent/context/AgentContext.mjs";
import "../../agent/index.mjs";
//#region src/modules/x509/X509Service.d.ts
export declare class X509Service {
/**
*
* Validate a chain of X.509 certificates according to RFC 5280
*
* This function requires a list of base64 encoded certificates and, optionally, a certificate that should be found in the chain.
* If no certificate is provided, it will just assume the leaf certificate
*
* The leaf certificate should be the 0th index and the root the last
*
* The Issuer of the certificate is found with the following algorithm:
* - Check if there is an AuthorityKeyIdentifierExtension
* - Go through all the other certificates and see if the SubjectKeyIdentifier is equal to the AuthorityKeyIdentifier
* - If they are equal, the certificate signature is verified and returned as the issuer
*
* Validation checks performed:
* - Chain validation (structure, signatures, validity, trust anchor)
* - Basic constraints are valid for CA certificates
* - Key usage of issuing CA certificates includes `keyCertSign` (when the extension is present)
* - Path length constraints are satisfied
* - All critical extensions are understood and valid
* - Certificates have not been revoked (CRL) - if enabled
*
* Limitations (RFC 5280 features not enforced here):
* - Revocation is checked via CRL only; OCSP is not supported.
* - Name Constraints (§4.2.1.10), Policy Constraints (§4.2.1.11), and Certificate Policies
* (§4.2.1.4) are not enforced. A certificate carrying one of these as a *critical* extension is
* rejected (unrecognized critical extension); a non-critical occurrence is ignored.
* - Extended Key Usage is parsed but not enforced.
* - Key Usage is only enforced when the extension is present (it is optional; absent means
* unrestricted).
* - Subject/Issuer Alternative Names only surface the URI and DNS GeneralName forms.
*/
static validateCertificateChain(agentContext: AgentContext, { certificateChain, certificate, verificationDate, trustedCertificates, allowNonRootTrustedCertificate }: X509ValidateCertificateChainOptions): Promise<X509Certificate[]>;
/**
*
* Parses a base64-encoded X.509 certificate into a {@link X509Certificate}
*
*/
static parseCertificate(_agentContext: AgentContext, { encodedCertificate }: X509ParseCertificateOptions): X509Certificate;
static getLeafCertificate(_agentContext: AgentContext, { certificateChain }: X509GetLeafCertificateOptions): X509Certificate;
static createCertificate(agentContext: AgentContext, options: X509CreateCertificateOptions): Promise<X509Certificate>;
static createCertificateSigningRequest(agentContext: AgentContext, options: X509CreateCertificateSigningRequestOptions): Promise<CertificateSigningRequest>;
/**
* Creates and signs a X.509 Certificate Revocation List (CRL).
*
* Supported CRL extensions: CRL Number (§5.2.3), Delta CRL Indicator (§5.2.4), Authority Key
* Identifier (§5.2.1) and Issuing Distribution Point (§5.2.5), plus the per-entry
* `certificateIssuer` extension (§5.3.3) for indirect CRLs. Other CRL extensions are not produced.
*
* Note: issuer/subject names built from a structured object only support the `CN`, `C`, `OU` and
* `ST` distinguished-name attributes; pass a raw DN string to use any other attribute.
*/
static createCertificateRevocationList(agentContext: AgentContext, options: X509CreateCertificateRevocationListOptions): Promise<X509CertificateRevocationList>;
static parseCertificateSigningRequest({ encodedCertificateSigningRequest }: X509ParseCertificateSigningRequestOptions): CertificateSigningRequest;
/**
* Validates path length constraints for a certificate chain
* Per RFC 5280 Section 4.2.1.9
*/
private static validatePathLengthConstraints;
/**
* Validates basic constraints for CA certificates in the chain
* Per RFC 5280 Section 4.2.1.9
*/
private static validateBasicConstraintsForChain;
/**
* Validates the Key Usage extension of the issuing CA certificates in the chain.
* Per RFC 5280 §4.2.1.3 / §6.1.4(n): a certificate used to sign other certificates MUST, when it
* asserts a Key Usage extension, include the `keyCertSign` bit.
*
* Key Usage is optional in a certificate; when the extension is absent, all usages are permitted
* and no constraint is enforced. Only the issuing certificates (every certificate except the leaf)
* are checked.
*/
private static validateKeyUsageForChain;
}
//#endregion
//# sourceMappingURL=X509Service.d.mts.map