`verifyPkcs7SignedData`

Verifies all signer signatures in a PKCS#7 SignedData structure.

Accepts PEM text, raw DER, or an already-parsed ParsedPkcs7SignedData. For each signer, locates the matching certificate in the embedded set and verifies the signature (including signed-attribute digest checks per RFC 5652 Section 5.4).

For a detached SignedData (absent eContent), pass the externally-held content via options.content; without it, verification fails with the typed detached_content_required code. When the SignedData embeds its own content, that embedded content is verified and options.content is ignored.

function verifyPkcs7SignedData(
	input: string | Uint8Array | ParsedPkcs7SignedData,
	options: VerifyPkcs7SignedDataOptions,
): Promise<VerifyPkcs7SignedDataResult>

Parameters

input: string | Uint8Array | ParsedPkcs7SignedData
options: VerifyPkcs7SignedDataOptions

Examples

import { verifyPkcs7SignedData } from 'micro509';

const result = await verifyPkcs7SignedData(pkcs7Pem);
if (result.ok) {
  for (const { signerInfo, certificate } of result.signers) {
    console.log(signerInfo.digestAlgorithmOid, certificate.subject);
  }
}

// Detached signature: supply the content externally
const detached = await verifyPkcs7SignedData(cmsBlob, { content: signedBytes });

verifyPkcs7SignedData ​