micro509/revocation

Create and validate CRLs and OCSP responses, then check certificate status.

Use checkCertificateRevocation with evidence your application supplies. Create evidence with createCertificateRevocationList or createOcspResponse. Network retrieval belongs to the caller.

Functions

• checkChainRevocation — Checks revocation status for all certificates in a validated chain.
• checkCertificateRevocationAgainstCrl — End-to-end revocation check: validates the CRL (and optional delta CRL),
• createCertificateRevocationList — Signs and encodes an X.509 v2 CRL.
• isCertificateRevoked — Quick serial-number lookup — returns true if the serial appears in the
• parseCertificateRevocationListDer — Decodes a DER-encoded X.509 CRL into a structured ParsedCertificateRevocationList.
• parseCertificateRevocationListDerOrThrow — Throwing core for parseCertificateRevocationListDer.
• parseCertificateRevocationListPem — Decodes a PEM-encoded X.509 CRL (-----BEGIN X509 CRL-----).
• parseCertificateRevocationListPemOrThrow — Decodes a PEM-encoded X.509 CRL (-----BEGIN X509 CRL-----).
• revocationReasonFromCode — Maps an integer CRLReason code to its RevocationReason name, or to
• validateCertificateRevocationList — Full CRL validation: issuer name match, authority key identifier match,
• verifyCertificateRevocationListSignature — Verifies the CRL signature against the issuer certificate's public key.
• createOcspRequest — Builds a DER-encoded OCSP request containing one or more CertID entries
• createOcspResponse — Signs and encodes an OCSP BasicResponse with a successful status.
• hasOcspNoCheckExtension — Reports whether a certificate carries the id-pkix-ocsp-nocheck extension
• parseOcspRequestDer — Decodes a DER-encoded OCSP request into a structured ParsedOcspRequest.
• parseOcspRequestDerOrThrow — Throwing core for parseOcspRequestDer.
• parseOcspRequestPem — Decodes a PEM-encoded OCSP request (-----BEGIN OCSP REQUEST-----).
• parseOcspRequestPemOrThrow — Decodes a PEM-encoded OCSP request (-----BEGIN OCSP REQUEST-----).
• parseOcspResponseDer — Decodes a DER-encoded OCSP response into a structured ParsedOcspResponse.
• parseOcspResponseDerOrThrow — Throwing core for parseOcspResponseDer.
• parseOcspResponsePem — Decodes a PEM-encoded OCSP response (-----BEGIN OCSP RESPONSE-----).
• parseOcspResponsePemOrThrow — Decodes a PEM-encoded OCSP response (-----BEGIN OCSP RESPONSE-----).
• validateOcspResponse — Full OCSP response validation: response status check, signature verification,
• verifyOcspResponseSignature — Verifies the OCSP response signature against the given signer certificate.
• checkCertificateRevocation — Evaluates all provided CRL and OCSP evidence to determine the certificate's
• getCertificateOcspResponderUris — Extracts OCSP responder URIs from the certificate's Authority Information Access extension.
• resolveOcspResponderCandidates — Merges configured OCSP responders with those discovered from the certificate's

Types

• CertificateRevocationStatus — Revocation evaluation result for a single certificate.
• CheckChainRevocationInput — Input for checkChainRevocation.
• CheckChainRevocationResult — Result type for checkChainRevocation.
• CheckChainRevocationValue — Detailed revocation check results.
• OcspResponseSource — OCSP response in any supported format.
• RevocationExecutionError — Errors encountered while processing revocation evidence.
• RevocationIndeterminateReason — See the doc comment above REVOCATION_INDETERMINATE_REASONS.
• RevocationParseError — Revocation evidence that did not parse.
• RevocationPolicy — Revocation checking policy for checkChainRevocation.
• RevocationProcessingError — Revocation evidence that parsed but could not be processed.
• RevocationSource — Identifies the source of revocation evidence.
• TrustedOcspResponder — A locally trusted OCSP responder bound to the CA scope it may serve.
• CertificateRevocationListMaterial — Encoded CRL in multiple serialisation formats, returned by createCertificateRevocationList.
• CheckCertificateRevocationAgainstCrlErrorCode — Error codes that checkCertificateRevocationAgainstCrl may return.
• CheckCertificateRevocationAgainstCrlFailure — Failure detail for checkCertificateRevocationAgainstCrl.
• CheckCertificateRevocationAgainstCrlFailureDetails — Structured details attached to a CheckCertificateRevocationAgainstCrlFailure.
• CheckCertificateRevocationAgainstCrlGoodValue — Success value when the certificate is not found in the CRL.
• CheckCertificateRevocationAgainstCrlInput — Input for checkCertificateRevocationAgainstCrl.
• CheckCertificateRevocationAgainstCrlResult — Result of checkCertificateRevocationAgainstCrl.
• CheckCertificateRevocationAgainstCrlRevokedValue — Success value when the certificate is found as revoked in the CRL.
• CheckCertificateRevocationAgainstCrlValue — Discriminated union of good and revoked outcomes.
• CreateCertificateRevocationListInput — Input for createCertificateRevocationList.
• CrlApplicabilityFailureReason — Structured reason why a CRL was deemed non-applicable to a given certificate.
• CrlCertificateSource — PEM string, DER bytes, or already-parsed certificate.
• CrlEncoderErrorCode — Machine-readable reason a CRL encoder rejected its construction input.
• CrlSource — PEM string, DER bytes, or already-parsed CRL.
• ParseCertificateRevocationListErrorCode — Machine-readable failure reason for the CRL parsers.
• ParseCertificateRevocationListFailure — Structured failure payload for CRL parsing.
• ParseCertificateRevocationListResult — Success-or-failure result from parseCertificateRevocationListDer / parseCertificateRevocationListPem.
• ParsedCertificateRevocationList — Decoded X.509 CRL, returned by parseCertificateRevocationListDer
• ParsedRevocationReason — A decoded CRLReason: a named RevocationReason or an UnrecognizedRevocationReason.
• ParsedRevokedCertificate — A single revoked-certificate entry decoded from a CRL.
• RevocationReason — RFC 5280 §5.3.1 CRLReason code values.
• RevokedCertificateInput — Single revoked certificate entry for createCertificateRevocationList.
• UnrecognizedReasonCodePolicy — Treatment of revocation evidence whose CRLReason is an
• UnrecognizedRevocationReason — A CRLReason code outside the RFC 5280 §5.3.1 enumeration, such as the unused
• ValidateCertificateRevocationListFailure — Failure detail for validateCertificateRevocationList.
• ValidateCertificateRevocationListInput — Input for validateCertificateRevocationList.
• ValidateCertificateRevocationListResult — Result of validateCertificateRevocationList.
• VerifyCertificateRevocationListSignatureFailure — Failure detail when CRL signature verification fails. unsupported and
• VerifyCertificateRevocationListSignatureResult — Result of verifyCertificateRevocationListSignature.
• CreateOcspCertStatusInput — Status to assert for one certificate, mirroring RFC 6960 §4.2.1 CertStatus.
• CreateOcspRequestInput — Input for createOcspRequest.
• CreateOcspRequestItemInput — One certificate whose status to query in an OCSP request.
• CreateOcspResponseInput — Input for createOcspResponse.
• CreateOcspSingleResponseInput — One certificate's status entry for CreateOcspResponseInput.responses.
• OcspCertificateSource — PEM string, DER bytes, or already-parsed certificate.
• OcspCertStatus — RFC 6960 certificate status reported by the responder for a single CertID.
• OcspEncoderErrorCode — Machine-readable reason an OCSP encoder rejected its construction input.
• OcspHashAlgorithm — Hash algorithm used to compute OCSP CertID fields. RFC 9919 §3.1.1 requires SHA-256 for conforming clients; RFC 6960 defines no default.
• OcspRequestMaterial — Encoded OCSP request in multiple serialisation formats, returned by createOcspRequest.
• OcspRequestSource — PEM string, DER bytes, or already-parsed OCSP request.
• OcspResponderRevocationPolicy — Revocation policy for delegated OCSP responder certificates (RFC 6960 §4.2.2.2.1).
• OcspResponseMaterial — Encoded OCSP response in multiple serialisation formats, returned by createOcspResponse.
• OcspResponseStatus — RFC 6960 overall response status — anything other than 'successful' means the response body is absent or unusable.
• ParsedOcspCertId — Decoded OCSP CertID — identifies a certificate by hashed issuer name,
• ParsedOcspCertStatus — RFC 6960 §4.2.1 `CertStatus ::= CHOICE { good [0] NULL, revoked [1] RevokedInfo,
• ParsedOcspRequest — Decoded OCSP request, returned by parseOcspRequestDer / parseOcspRequestPem.
• ParsedOcspResponderId — How the OCSP responder identifies itself — either by distinguished name or
• ParsedOcspResponse — Decoded OCSP response, returned by parseOcspResponseDer / parseOcspResponsePem.
• ParsedOcspSingleResponse — Status of one certificate inside an OCSP BasicResponse.
• ParseOcspRequestErrorCode — Machine-readable failure reason for the OCSP request parsers.
• ParseOcspRequestFailure — Structured failure payload for OCSP request parsing.
• ParseOcspRequestResult — Success-or-failure result from parseOcspRequestDer / parseOcspRequestPem.
• ParseOcspResponseErrorCode — Machine-readable failure reason for the OCSP response parsers, with the codes of ParseOcspRequestErrorCode.
• ParseOcspResponseFailure — Structured failure payload for OCSP response parsing.
• ParseOcspResponseResult — Success-or-failure result from parseOcspResponseDer / parseOcspResponsePem.
• ValidateOcspResponseErrorCode — Failure codes produced by validateOcspResponse.
• ValidateOcspResponseFailure — Failure detail for validateOcspResponse.
• ValidateOcspResponseInput — Input for validateOcspResponse.
• ValidateOcspResponseResult — Result of validateOcspResponse.
• VerifyOcspResponseSignatureFailure — Failure detail when OCSP response signature verification fails. unsupported
• VerifyOcspResponseSignatureResult — Result of verifyOcspResponseSignature.
• CheckCertificateRevocationErrorCode — Error codes that checkCertificateRevocation may surface inside an indeterminate result.
• CheckCertificateRevocationFailureDetails — Diagnostic details attached to an indeterminate revocation result.
• CheckCertificateRevocationInput — Input for checkCertificateRevocation.
• CheckCertificateRevocationResult — Result of checkCertificateRevocation. Always succeeds (ok: true) —
• CheckCertificateRevocationValue — Discriminated union of good, revoked, and indeterminate revocation outcomes.
• ConfiguredOcspResponder — A manually-configured OCSP responder endpoint.
• ConfiguredOcspResponderCertificate — PEM or DER bytes of a pre-configured OCSP responder certificate.
• OcspResponderCandidate — One candidate OCSP responder resolved by resolveOcspResponderCandidates.
• OcspResponderSource — Where the OCSP responder URI came from.
• ResolveOcspResponderCandidatesInput — Input for resolveOcspResponderCandidates.
• RevocationCertificateSource — PEM string, DER bytes, or already-parsed certificate.
• RevocationCheckGoodValue — Certificate is not revoked according to the checked evidence.
• RevocationCheckIndeterminateValue — Revocation status could not be determined from the provided evidence.
• RevocationCheckRevokedValue — Certificate is revoked according to the checked evidence.
• RevocationCrlEvidenceInput — CRL-based revocation evidence for CheckCertificateRevocationInput.evidence.
• RevocationEvidenceInput — Discriminated union of CRL and OCSP evidence inputs.
• RevocationEvidenceKind — Which revocation mechanism produced the evidence.
• RevocationIndeterminateEvidence — One piece of evidence that failed to produce a definitive revocation answer.
• RevocationIndeterminateReasonCode — Why a particular piece of evidence could not produce a definitive good/revoked answer.
• RevocationOcspEvidenceInput — OCSP-based revocation evidence for CheckCertificateRevocationInput.evidence.
• RevocationStatus — Unified revocation outcome across CRL and OCSP evidence.
• IssuingDistributionPoint — Input for the Issuing Distribution Point CRL extension (RFC 5280 §5.2.5).
• IssuingDistributionPointBase — Base shape for Issuing Distribution Point (RFC 5280 §5.2.5) — no scope restriction.
• IssuingDistributionPointForAttributeCerts — IDP scoped to attribute certificates only. Mutually exclusive with user / CA scopes.
• IssuingDistributionPointForCaCerts — IDP scoped to CA certificates only. Mutually exclusive with user / attribute scopes.
• IssuingDistributionPointForUserCerts — IDP scoped to end-entity (user) certificates only. Mutually exclusive with CA / attribute scopes.
• ParsedIssuingDistributionPoint — Decoded Issuing Distribution Point CRL extension (RFC 5280 §5.2.5).
• ParsedIssuingDistributionPointBase — Scope-independent fields of a decoded Issuing Distribution Point.
• ParsedIssuingDistributionPointScope — Which certificate kind a CRL is scoped to. RFC 5280 §5.2.5 allows at most one

Variables

• REVOCATION_INDETERMINATE_REASONS — Granular reasons why revocation status could not be determined.
• REVOCATION_INDETERMINATE_REASON_CODES — Every RevocationIndeterminateReasonCode, as a runtime array.