getSubjectPublicKeyOrThrow

getSubjectPublicKeyOrThrow

Import the subject public key of a parsed certificate or CSR as a WebCrypto CryptoKey.

The key algorithm — and, for EC keys, the curve — is inferred from the SubjectPublicKeyInfo's own AlgorithmIdentifier (the same resolution importSpkiDerOrThrow applies when no algorithm is given), so callers never map ParsedCertificate.publicKeyAlgorithmOid / ParsedCertificate.publicKeyParametersOid by hand.
RSA keys import with the default pkcs1-v1_5/SHA-256 parameters (a plain rsaEncryption SPKI encodes neither padding scheme nor hash); pass algorithm to choose other RSA parameters or to assert an expected algorithm.

function getSubjectPublicKeyOrThrow<TMap extends ExtensionDecoderMap>(
	parsed: ParsedCertificate<TMap> | ParsedCertificateSigningRequest<TMap>,
	algorithm?: PublicKeyImportInput,
): Promise<CryptoKey>

Parameters

• parsed: ParsedCertificate<TMap> | ParsedCertificateSigningRequest<TMap> — Parsed certificate or CSR whose subject public key to import.
• algorithm?: PublicKeyImportInput — Optional expected algorithm; must match the key contents when given.

Returns — Extractable CryptoKey with verify usage.

Throws

• Error — If the SubjectPublicKeyInfo is malformed, encodes an unsupported algorithm, or doesn't match algorithm

See also

• getSubjectPublicKey for the non-throwing variant

Examples

const parsed = parseCertificatePemOrThrow(pem);
const publicKey = await getSubjectPublicKeyOrThrow(parsed);