@credo-ts/core
Version:
<p align="center"> <br /> <img alt="Credo Logo" src="https://github.com/openwallet-foundation/credo-ts/blob/c7886cb8377ceb8ee4efe8d264211e561a75072d/images/credo-logo.png" height="250px" /> </p> <h1 align="center"><b>Credo - Core</b></h1
75 lines (74 loc) • 2.85 kB
JavaScript
import { X509Error } from "../X509Error.mjs";
import "./extensions.mjs";
import "@peculiar/x509";
//#region src/modules/x509/utils/criticalExtensions.ts
/**
* Registry of critical extensions that Credo understands and can validate
* Based on RFC 5280 Section 4.2
*/
const knownCriticalExtensions = [
"2.5.29.19",
"2.5.29.15",
"2.5.29.37",
"2.5.29.17",
"2.5.29.18",
"2.5.29.14",
"2.5.29.35",
"2.5.29.31"
];
/**
* Registry of critical CRL extensions that Credo understands and can process.
* Based on RFC 5280 Section 5.2
*/
const knownCriticalCrlExtensions = ["2.5.29.28", "2.5.29.27"];
/**
* Validates that all critical extensions in a certificate are understood by Credo
* Per RFC 5280 Section 4.2: "A certificate-using system MUST reject the certificate if it encounters
* a critical extension it does not recognize or a critical extension that contains information that it cannot process"
*/
function validateCriticalExtensions(certificate) {
const unknownCriticalExtensions = [];
for (const extension of certificate.extensions) if (extension.critical && !knownCriticalExtensions.includes(extension.type)) unknownCriticalExtensions.push(extension.type);
if (unknownCriticalExtensions.length > 0) return {
isValid: false,
unknownCriticalExtensions,
error: new X509Error(`Certificate contains unknown critical extensions: ${unknownCriticalExtensions.join(", ")}. Per RFC 5280, certificates with unrecognized critical extensions MUST be rejected.`)
};
return {
isValid: true,
unknownCriticalExtensions: []
};
}
/**
* Validates critical extensions for all certificates in a chain
*/
function validateCriticalExtensionsForChain(certificates) {
for (const cert of certificates) {
const result = validateCriticalExtensions(cert);
if (!result.isValid) return {
isValid: false,
error: result.error,
details: `Unknown critical extensions: ${result.unknownCriticalExtensions.join(", ")}`
};
}
return { isValid: true };
}
/**
* Validates a list of critical CRL extension ids against the extensions Credo understands.
* See {@link validateCriticalCrlExtensions}.
*/
function validateCriticalCrlExtensionIds(criticalExtensionIds) {
const unknownCriticalExtensions = criticalExtensionIds.filter((id) => !knownCriticalCrlExtensions.includes(id));
if (unknownCriticalExtensions.length > 0) return {
isValid: false,
unknownCriticalExtensions,
error: new X509Error(`CRL contains unknown critical extensions: ${unknownCriticalExtensions.join(", ")}. Per RFC 5280, a CRL with unrecognized critical extensions MUST NOT be used.`)
};
return {
isValid: true,
unknownCriticalExtensions: []
};
}
//#endregion
export { knownCriticalCrlExtensions, knownCriticalExtensions, validateCriticalCrlExtensionIds, validateCriticalExtensions, validateCriticalExtensionsForChain };
//# sourceMappingURL=criticalExtensions.mjs.map