@credo-ts/core
Version:
<p align="center"> <br /> <img alt="Credo Logo" src="https://github.com/openwallet-foundation/credo-ts/blob/c7886cb8377ceb8ee4efe8d264211e561a75072d/images/credo-logo.png" height="250px" /> </p> <h1 align="center"><b>Credo - Core</b></h1
86 lines • 3.36 kB
text/typescript
import { X509RevocationReason } from "./X509CrlDistributionPoint.mjs";
//#region src/modules/x509/X509ValidationOptions.d.ts
/**
* Revocation checking mode based on Java PKIXRevocationChecker.Option patterns
*/
export declare enum X509RevocationCheckMode {
/**
* Completely disable revocation checking
*/
Disabled = "Disabled",
/**
* Check revocation status but allow validation to succeed if:
* - CRL cannot be obtained due to network error
* This is the RECOMMENDED default for production systems
*/
SoftFail = "SoftFail",
/**
* Require successful revocation check - fail if network unavailable or service errors
* Use with caution in production as network failures will block certificate validation
*/
Require = "Require"
}
export interface X509RevocationCheckOptions {
/**
* Mode for revocation checking
* @default {@link X509RevocationCheckMode.SoftFail}
*
* Note: Currently defaults to 'SoftFail' to provide enhanced security
* without breaking existing functionality in network failure scenarios
*/
mode?: X509RevocationCheckMode;
/**
* Whether to check revocation for all certificates in the chain (except the root).
*
* Defaults to `true`, so every certificate in the chain (the end-entity and any intermediate CAs)
* is checked, as RFC 5280 expects. Set to `false` to only check the end-entity/leaf certificate,
* which is faster but weaker.
*
* @default true
*/
checkFullChain?: boolean;
/**
* Timeout in milliseconds for CRL fetches
* @default 5000
*/
timeoutMs?: number;
/**
* Maximum size in bytes for CRL downloads
* @default 10485760 (10 MB)
*/
maxCrlSizeBytes?: number;
/**
* How long (in seconds) a verified CRL is served from the cache without contacting the
* distribution point. After this period the CRL bytes are fetched again: when unchanged (same
* SHA-256) the cached CRL is reused without re-parsing or re-verifying, otherwise it is fully
* re-verified. Independently of this period, a cached CRL is never served past its own
* `nextUpdate`. When unset in per-call revocation options, the value configured on the X509
* module's `revocationCheck` applies.
*
* @default 3600 (1 hour)
*/
crlCacheExpirySeconds?: number;
/**
* The date/time to use for revocation checking
* Used to verify CRL validity (thisUpdate/nextUpdate) and revocation dates
* @default new Date() (current time)
*/
verificationDate?: Date;
/**
* Specific revocation reasons that must be covered by CRLs
* If a certificate has no reasons specified in its CRL distribution points (a "full" DP),
* it covers all reasons automatically.
*
* If a certificate only has distribution points with specific reasons, this array determines
* which reasons must be covered for the check to be considered complete.
*
* @default The reasons actually published across the certificate's CRL distribution points.
* There is no point requiring coverage of reasons the issuer never published a distribution point
* for, so by default only the reasons present in the certificate's DPs are required.
*
* Set to a subset to only require coverage of specific reasons.
*/
requiredReasons?: X509RevocationReason[];
}
//#endregion
//# sourceMappingURL=X509ValidationOptions.d.mts.map