harperdb/security/certificateVerification/index.d.ts

HarperDB is a distributed database, caching service, streaming broker, and application development platform focused on performance and ease of use.

/**
 * Certificate verification for mTLS authentication
 *
 * This module provides certificate revocation checking for client certificates
 * in mutual TLS (mTLS) connections. Supports both OCSP (Online Certificate
 * Status Protocol) and CRL (Certificate Revocation List) verification methods
 * with automatic method selection.
 *
 * Features:
 * - OCSP verification with caching
 * - CRL verification with caching
 * - CRL-first with OCSP fallback for optimal performance
 * - Background CRL refresh with exponential backoff
 * - Graceful degradation during network outages
 * - Ed25519/Ed448 certificate support
 *
 * Default behavior:
 * - Certificate verification: disabled (must be explicitly enabled)
 * - Verification approach: CRL-first (with OCSP fallback)
 * - CRL timeout: 10 seconds, cache TTL: 24 hours
 * - OCSP timeout: 5 seconds, cache TTL: 1 hour
 * - Failure mode: fail-closed (rejects connections if verification fails)
 */
import type { PeerCertificate, CertificateVerificationResult } from './types.ts';
/**
 * Verify certificate revocation status using OCSP and/or CRL
 * @param peerCertificate - Peer certificate object from TLS connection
 * @param mtlsConfig - The mTLS configuration from the request
 * @returns Promise resolving to verification result
 */
export declare function verifyCertificate(peerCertificate: PeerCertificate, mtlsConfig?: boolean | Record<string, any> | null): Promise<CertificateVerificationResult>;