micro509/pkcs

PKCS container APIs: PFX/PKCS#12 and PKCS#7/CMS.

Package keys and certificates with createPfx, then read them with parsePfxDer. Use createPkcs7SignedData and verifyPkcs7SignedData for signed content.

Functions

• createPfx — Builds a PKCS#12/PFX archive containing certificates and/or private keys.
• parsePfxDer — Decodes a BER- or DER-encoded PKCS#12/PFX container into its constituent bags.
• parsePfxPem — Decodes a PEM-armored PKCS#12/PFX container. Expects exactly one PKCS12 block.
• createPkcs7CertBag — Creates a degenerate PKCS#7 SignedData structure containing only
• createPkcs7SignedData — Creates a PKCS#7/CMS SignedData with one or more signers over content.
• parsePkcs7CertBagDer — Parses a DER-encoded PKCS#7 cert bag, returning the contained certificates.
• parsePkcs7CertBagPem — Parses a PEM-armored PKCS#7/CMS cert bag. Expects exactly one PKCS7 or CMS PEM block.
• parsePkcs7SignedDataDer — Decodes a DER-encoded PKCS#7 ContentInfo expecting signedData content type.
• parsePkcs7SignedDataPem — Decodes a PEM-armored PKCS#7/CMS SignedData. Expects exactly one PKCS7 or CMS PEM block.
• verifyPkcs7SignedData — Verifies all signer signatures in a PKCS#7 SignedData structure.
• createPkcs12MacData — Computes a PKCS#12 MAC over the AuthenticatedSafe and returns the DER-encoded MacData
• parsePkcs12MacData — Decodes a DER-encoded MacData block. When password is provided, verifies
• parsePkcs12MacDataOrThrow — Throwing core for parsePkcs12MacData. When password is

Types

• CreatePfxErrorCode — Caller-correctable failure code from createPfx.
• CreatePfxFailure — Error payload for a failed PFX creation.
• CreatePfxInput — Input for createPfx.
• CreatePfxResult — Success-or-failure result from createPfx.
• KdfLimitOptions — Caller-supplied bound on password-based KDF work.
• ParsedPfx — Fully decoded PFX container returned by parsePfxDer / parsePfxPem.
• ParsedPfxAttribute — A single PKCS#12 bag attribute as decoded by parsePfxDer.
• ParsedPfxBag — Discriminated union of SafeBag types decoded from a PFX container.
• ParsedPfxBagAttributes — Decoded bag attributes for a single SafeBag inside a PFX.
• ParsePfxErrorCode — Error codes returned by parsePfxDer and parsePfxPem.
• ParsePfxFailure — Error payload for a failed PFX parse.
• ParsePfxOptions — Options for parsePfxDer and parsePfxPem.
• ParsePfxResult — Success-or-failure result from parsePfxDer / parsePfxPem.
• PfxBagAttributesInput — Optional metadata attached to a certificate or key bag inside a PFX.
• PfxCertificateBagInput — A certificate to embed in a PFX container. Input for createPfx.
• PfxCertificateSource — PEM string or DER bytes for a certificate to include in a PFX bag.
• PfxEncoderErrorCode — Bag attribute input that createPfx refuses by throwing a ResultError.
• PfxEncryptionOptions — PBES2 encryption settings for PFX key-bag protection. Alias of EncryptedPkcs8Options.
• PfxMaterial — DER, PEM, and base64 encodings of a PFX container produced by createPfx.
• PfxPrivateKeyBagInput — A private key to embed in a PFX container. Input for createPfx.
• PfxPrivateKeySource — A WebCrypto private key or raw PKCS#8 DER bytes for a PFX key bag.
• CreatePkcs7CertBagErrorCode — Caller-correctable failure code from createPkcs7CertBag.
• CreatePkcs7CertBagFailure — Error payload for a failed PKCS#7 certificate bag creation.
• CreatePkcs7CertBagResult — Success-or-failure result from createPkcs7CertBag.
• CreatePkcs7SignedDataErrorCode — Caller-correctable failure codes from createPkcs7SignedData.
• CreatePkcs7SignedDataFailure — Error payload for a failed PKCS#7 SignedData creation.
• CreatePkcs7SignedDataInput — Input for createPkcs7SignedData.
• CreatePkcs7SignedDataResult — Success-or-failure result from createPkcs7SignedData.
• ParsedCertificateChoice — One RFC 5652 §10.2.2 CertificateChoices alternative.
• ParsedPkcs7SignedData — Decoded PKCS#7 SignedData content, including certificates and signer info.
• ParsedPkcs7SignerInfo — A single SignerInfo decoded from a PKCS#7 SignedData structure.
• ParsedPkcs7SignerInfoBase — Fields shared by every decoded SignerInfo, regardless of signed-attribute presence.
• ParsedSignerIdentifier — RFC 5652 §5.3 `SignerIdentifier ::= CHOICE { issuerAndSerialNumber,
• ParsePkcs7CertBagResult — Success-or-failure result from parsePkcs7CertBagDer / parsePkcs7CertBagPem.
• ParsePkcs7ErrorCode — Error codes for PKCS#7 parse failures.
• ParsePkcs7Failure — Error payload for a failed PKCS#7 parse.
• ParsePkcs7SignedDataResult — Success-or-failure result from parsePkcs7SignedDataDer / parsePkcs7SignedDataPem.
• Pkcs7CertBagMaterial — DER, PEM, and base64 encodings of a PKCS#7 certificate bag.
• Pkcs7CertificateSource — PEM text (may contain multiple CERTIFICATE blocks), raw DER bytes, or an already-parsed certificate.
• Pkcs7SignedDataMaterial — DER, PEM, and base64 encodings of a PKCS#7/CMS SignedData structure.
• Pkcs7Signer — A single signer for createPkcs7SignedData.
• VerifiedPkcs7Signer — A SignerInfo paired with the certificate that verified its signature.
• VerifyPkcs7SignedDataErrorCode — Error codes for verifyPkcs7SignedData failures.
• VerifyPkcs7SignedDataFailure — Error payload for a failed verifyPkcs7SignedData call.
• VerifyPkcs7SignedDataOptions — Options for verifyPkcs7SignedData.
• VerifyPkcs7SignedDataResult — Success-or-failure result from verifyPkcs7SignedData.
• CreatePkcs12MacDataErrorCode — Machine-readable reason createPkcs12MacData rejected its construction input.
• ParsedPkcs12MacData — Decoded PKCS#12 MacData block returned by parsePkcs12MacData. type names the
• ParsePkcs12MacDataErrorCode — Machine-readable failure reason for parsePkcs12MacData.
• ParsePkcs12MacDataFailure — Structured failure payload for MacData parsing.
• ParsePkcs12MacDataOptions — Options for parsePkcs12MacData and parsePkcs12MacDataOrThrow.
• ParsePkcs12MacDataResult — Success-or-failure result from parsePkcs12MacData.
• Pkcs12MacOptions — Input for createPkcs12MacData. type selects the MAC: 'pkcs12-kdf' (the