micro509

Stable root import for micro509.
Re-exports the common certificate, parsing, verification, revocation, key, and PKCS workflows from one package entrypoint.

Reach for this module when you want the default workflow-first package surface. Use domain entrypoints such as micro509/x509, micro509/verify, and micro509/revocation when you need exhaustive advanced types.

The root export is organized around common PKI flows:

• create certificates, CSRs, CRLs, OCSP responses, PKCS#7, and PFX artifacts
• parse DER or PEM inputs into typed certificate and request shapes
• verify certificate chains, service identities, CRLs, OCSP, and signed data
• import, export, generate, and encrypt key material with WebCrypto-safe algorithms
• work with the common extension inputs, revocation evidence, and validation results

Advanced PKCS#12 MAC plumbing, signature profile tuning, and other domain-specific helper types stay in their owner domains instead of being headlined here.

Examples

import {
	createSelfSignedCertificate,
	parseCertificatePem,
	unwrap,
	verifyCertificateChain,
} from 'micro509';

const { certificate } = await createSelfSignedCertificate({
	subject: { commonName: 'example.com' },
	algorithm: { kind: 'ecdsa', curve: 'P-256' },
});

const parsed = unwrap(parseCertificatePem(certificate.pem));
// parsed.subject.values.commonName === 'example.com'

const result = await verifyCertificateChain({
	leaf: certificate.pem,
	roots: [certificate.pem],
	allowSelfSignedLeaf: true,
});
// result.ok === true

import {
	generateKeyPair,
	parseCertificateSigningRequestPem,
	createCertificateSigningRequest,
	unwrap,
} from 'micro509';

const keyPair = await generateKeyPair({ kind: 'ecdsa', curve: 'P-256' });
const csr = await createCertificateSigningRequest({
	subject: { commonName: 'example.com' },
	publicKey: keyPair.publicKey,
	signerPrivateKey: keyPair.privateKey,
});

const parsed = unwrap(parseCertificateSigningRequestPem(csr.pem));
// parsed.subject.values.commonName === 'example.com'

Functions

• decryptRsaOaep — Decrypt an RSA-OAEP ciphertext with the matching private key.
• decryptRsaOaepOrThrow — Decrypt an RSA-OAEP ciphertext with the matching private key.
• derivePublicKey — Derive the matching public key from an imported (or generated) private key.
• encryptRsaOaep — Encrypt a small message with an RSA-OAEP public key.
• encryptRsaOaepOrThrow — Encrypt a small message with an RSA-OAEP public key.
• exportBinaryBase64 — Export a key as raw base64 (no PEM headers).
• exportEncryptedPkcs1Pem — Export an RSA private key as legacy Proc-Type: 4,ENCRYPTED PEM (PKCS#1).
• exportEncryptedPkcs8Der — Export a private key as DER-encoded PBES2-encrypted PKCS#8 EncryptedPrivateKeyInfo.
• exportEncryptedPkcs8Pem — Export a private key as PEM-encoded PBES2-encrypted PKCS#8 EncryptedPrivateKeyInfo.
• exportEncryptedSec1Pem — Export an EC private key as legacy Proc-Type: 4,ENCRYPTED PEM (SEC 1).
• exportPkcs1Der — Export an RSA private key as DER-encoded PKCS#1 RSAPrivateKey.
• exportPkcs1Pem — Export an RSA private key as PEM-encoded PKCS#1 RSAPrivateKey.
• exportPkcs8Der — Export a private key as DER-encoded PKCS#8 PrivateKeyInfo.
• exportPkcs8Pem — Export a private key as PEM-encoded PKCS#8 PrivateKeyInfo.
• exportPrivateJwk — Export a private key as a JSON Web Key.
• exportPublicJwk — Export a public key as a JSON Web Key.
• exportSec1Der — Export an EC private key as DER-encoded SEC 1 ECPrivateKey.
• exportSec1Pem — Export an EC private key as PEM-encoded SEC 1 ECPrivateKey.
• exportSpkiDer — Export a public key as DER-encoded SubjectPublicKeyInfo.
• exportSpkiPem — Export a public key as PEM-encoded SubjectPublicKeyInfo.
• generateKeyPair — Generate an asymmetric key pair for signing and verification, or — with
• importEncryptedPkcs1Pem — Import an RSA private key from legacy Proc-Type: 4,ENCRYPTED PEM (PKCS#1).
• importEncryptedPkcs1PemOrThrow — Import an RSA private key from legacy Proc-Type: 4,ENCRYPTED PEM (PKCS#1).
• importEncryptedPkcs8Der — Import a private key from DER-encoded PBES2-encrypted PKCS#8 EncryptedPrivateKeyInfo.
• importEncryptedPkcs8DerOrThrow — Import a private key from DER-encoded PBES2-encrypted PKCS#8 EncryptedPrivateKeyInfo.
• importEncryptedPkcs8Pem — Import a private key from PEM-encoded PBES2-encrypted PKCS#8 EncryptedPrivateKeyInfo.
• importEncryptedPkcs8PemOrThrow — Import a private key from PEM-encoded PBES2-encrypted PKCS#8 EncryptedPrivateKeyInfo.
• importEncryptedSec1Pem — Import an EC private key from legacy Proc-Type: 4,ENCRYPTED PEM (SEC 1).
• importEncryptedSec1PemOrThrow — Import an EC private key from legacy Proc-Type: 4,ENCRYPTED PEM (SEC 1).
• importPkcs1Der — Import an RSA private key from DER-encoded PKCS#1 RSAPrivateKey.
• importPkcs1DerOrThrow — Import an RSA private key from DER-encoded PKCS#1 RSAPrivateKey.
• importPkcs1Pem — Import an RSA private key from PEM-encoded PKCS#1 RSAPrivateKey.
• importPkcs1PemOrThrow — Import an RSA private key from PEM-encoded PKCS#1 RSAPrivateKey.
• importPkcs8Base64 — Import a private key from base64-encoded PKCS#8 PrivateKeyInfo (no PEM headers).
• importPkcs8Base64OrThrow — Import a private key from base64-encoded PKCS#8 PrivateKeyInfo (no PEM headers).
• importPkcs8Der — Import a private key from DER-encoded PKCS#8 PrivateKeyInfo.
• importPkcs8DerOrThrow — Import a private key from DER-encoded PKCS#8 PrivateKeyInfo.
• importPkcs8Pem — Import a private key from PEM-encoded PKCS#8 PrivateKeyInfo.
• importPkcs8PemOrThrow — Import a private key from PEM-encoded PKCS#8 PrivateKeyInfo.
• importPrivateJwk — Import a private signing key from a JSON Web Key.
• importPrivateJwkOrThrow — Import a private signing key from a JSON Web Key.
• importPublicJwk — Import a public verification key from a JSON Web Key.
• importPublicJwkOrThrow — Import a public verification key from a JSON Web Key.
• importSec1Der — Import an EC private key from DER-encoded SEC 1 ECPrivateKey.
• importSec1DerOrThrow — Import an EC private key from DER-encoded SEC 1 ECPrivateKey.
• importSec1Pem — Import an EC private key from PEM-encoded SEC 1 ECPrivateKey.
• importSec1PemOrThrow — Import an EC private key from PEM-encoded SEC 1 ECPrivateKey.
• importSpkiBase64 — Import a public key from base64-encoded SubjectPublicKeyInfo (no PEM headers).
• importSpkiBase64OrThrow — Import a public key from base64-encoded SubjectPublicKeyInfo (no PEM headers).
• importSpkiDer — Import a public key from DER-encoded SubjectPublicKeyInfo.
• importSpkiDerOrThrow — Import a public key from DER-encoded SubjectPublicKeyInfo.
• importSpkiPem — Import a public key from PEM-encoded SubjectPublicKeyInfo.
• importSpkiPemOrThrow — Import a public key from PEM-encoded SubjectPublicKeyInfo.
• inspectEncryptedPkcs8Der — Reads the PBES2 encryption parameters of a DER PKCS#8
• categorizePemBlocks — Groups PEM blocks by label into well-known PKI categories
• categorizePemBlocksOrThrow — Groups PEM blocks by label into well-known PKI categories
• pemDecode — Extracts and base64-decodes the DER content from a PEM string.
• pemDecodeOrThrow — Throwing core for pemDecode: extracts and base64-decodes the
• pemEncode — Wraps DER bytes in a PEM envelope with 64-character base64 lines.
• splitPemBlocks — Finds all BEGIN/END-delimited PEM blocks in a string and returns them
• splitPemBlocksOrThrow — Finds all BEGIN/END-delimited PEM blocks in a string and returns
• createPfx — Builds a PKCS#12/PFX archive containing certificates and/or private keys.
• createPkcs7CertBag — Creates a degenerate PKCS#7 SignedData structure containing only
• createPkcs7SignedData — Creates a PKCS#7/CMS SignedData with one or more signers over content.
• parsePfxDer — Decodes a BER- or DER-encoded PKCS#12/PFX container into its constituent bags.
• parsePfxPem — Decodes a PEM-armored PKCS#12/PFX container. Expects exactly one PKCS12 block.
• parsePkcs7CertBagDer — Parses a DER-encoded PKCS#7 cert bag, returning the contained certificates.
• parsePkcs7CertBagPem — Parses a PEM-armored PKCS#7/CMS cert bag. Expects exactly one PKCS7 or CMS PEM block.
• parsePkcs7SignedDataDer — Decodes a DER-encoded PKCS#7 ContentInfo expecting signedData content type.
• parsePkcs7SignedDataPem — Decodes a PEM-armored PKCS#7/CMS SignedData. Expects exactly one PKCS7 or CMS PEM block.
• verifyPkcs7SignedData — Verifies all signer signatures in a PKCS#7 SignedData structure.
• isResultError — Type guard: was value thrown by unwrap? Narrows to ResultError.
• unwrap — Explicit escape hatch: returns the success value, or throws a ResultError carrying the structured failure.
• unwrapOr — Returns the success value, or fallback when the result is a failure.
• checkCertificateRevocation — Evaluates all provided CRL and OCSP evidence to determine the certificate's
• checkCertificateRevocationAgainstCrl — End-to-end revocation check: validates the CRL (and optional delta CRL),
• checkChainRevocation — Checks revocation status for all certificates in a validated chain.
• createCertificateRevocationList — Signs and encodes an X.509 v2 CRL.
• createOcspRequest — Builds a DER-encoded OCSP request containing one or more CertID entries
• createOcspResponse — Signs and encodes an OCSP BasicResponse with a successful status.
• getCertificateOcspResponderUris — Extracts OCSP responder URIs from the certificate's Authority Information Access extension.
• hasOcspNoCheckExtension — Reports whether a certificate carries the id-pkix-ocsp-nocheck extension
• isCertificateRevoked — Quick serial-number lookup — returns true if the serial appears in the
• parseCertificateRevocationListDer — Decodes a DER-encoded X.509 CRL into a structured ParsedCertificateRevocationList.
• parseCertificateRevocationListDerOrThrow — Throwing core for parseCertificateRevocationListDer.
• parseCertificateRevocationListPem — Decodes a PEM-encoded X.509 CRL (-----BEGIN X509 CRL-----).
• parseCertificateRevocationListPemOrThrow — Decodes a PEM-encoded X.509 CRL (-----BEGIN X509 CRL-----).
• parseOcspRequestDer — Decodes a DER-encoded OCSP request into a structured ParsedOcspRequest.
• parseOcspRequestDerOrThrow — Throwing core for parseOcspRequestDer.
• parseOcspRequestPem — Decodes a PEM-encoded OCSP request (-----BEGIN OCSP REQUEST-----).
• parseOcspRequestPemOrThrow — Decodes a PEM-encoded OCSP request (-----BEGIN OCSP REQUEST-----).
• parseOcspResponseDer — Decodes a DER-encoded OCSP response into a structured ParsedOcspResponse.
• parseOcspResponseDerOrThrow — Throwing core for parseOcspResponseDer.
• parseOcspResponsePem — Decodes a PEM-encoded OCSP response (-----BEGIN OCSP RESPONSE-----).
• parseOcspResponsePemOrThrow — Decodes a PEM-encoded OCSP response (-----BEGIN OCSP RESPONSE-----).
• resolveOcspResponderCandidates — Merges configured OCSP responders with those discovered from the certificate's
• revocationReasonFromCode — Maps an integer CRLReason code to its RevocationReason name, or to
• validateCertificateRevocationList — Full CRL validation: issuer name match, authority key identifier match,
• validateOcspResponse — Full OCSP response validation: response status check, signature verification,
• verifyCertificateRevocationListSignature — Verifies the CRL signature against the issuer certificate's public key.
• verifyOcspResponseSignature — Verifies the OCSP response signature against the given signer certificate.
• buildCandidatePath — Builds a signature-verified path from a leaf certificate to a trusted root.
• checkExtendedKeyUsage — Standalone EKU check against a verified certificate chain.
• isSelfIssuedCertificate — Returns true if the certificate's subject and issuer DNs are semantically equal (RFC 5280 §7.1).
• matchCertificateServiceIdentity — Compares a reference identifier against a certificate's SAN entries.
• matchServiceIdentity — Checks whether a certificate covers the requested service identity.
• trustAnchorFromCertificate — Extracts a TrustAnchor from a parsed certificate, copying the subject, SPKI, and key identifiers.
• validateCandidatePath — Validates a pre-built certificate chain for time, constraints, policy, and
• validateForCa — Validates a certificate chain for CA use:
• validateForCodeSigning — Validates a certificate chain for code signing:
• validateForTlsClient — Validates a certificate chain for TLS client use:
• validateForTlsServer — Validates a certificate chain for TLS server use:
• verifyCertificateChain — All-in-one certificate chain verification: builds a candidate path then
• verifyCertificateSigningRequest — Verifies the self-signature of a PKCS#10 certificate signing request.
• certificateFingerprint — Compute a certificate fingerprint — a hash over the DER encoding.
• certificateMatchesPrivateKey — Check whether a certificate's subject public key belongs to a private key.
• compareDistinguishedNames — RFC 5280 §7.1 semantic equality: same RDN count, each pair matches attribute-by-attribute.
• createCertificate — Create an X.509 certificate signed by input.signerPrivateKey.
• createCertificateSigningRequest — Creates a PKCS#10 Certificate Signing Request signed with the given private key.
• createSelfSignedCertificate — Create a self-signed certificate.
• decodeExtension — Decode a single extension using a custom ExtensionDecoder.
• decodeExtensionMap — Decode all matching extensions using a named ExtensionDecoderMap.
• decodeExtensions — Decode all matching extensions using an array of ExtensionDecoders.
• defineExtensionDecoder — Identity helper that narrows the type of a custom ExtensionDecoder literal.
• defineExtensionDecoderMap — Identity helper that narrows the type of a custom ExtensionDecoderMap literal.
• distinguishedNameToString — Renders a ParsedName as an RFC 4514 distinguished name string, e.g. CN=Example CA,O=Acme,C=US.
• findExtension — Find a raw extension by OID within a parsed extension list.
• getSubjectPublicKey — Import the subject public key of a parsed certificate or CSR as a WebCrypto CryptoKey.
• getSubjectPublicKeyOrThrow — Import the subject public key of a parsed certificate or CSR as a WebCrypto CryptoKey.
• matchCertificatePrivateKey — Check whether a certificate's subject public key belongs to a private key,
• parseCertificateChainPem — Decode a PEM bundle containing one or more certificates.
• parseCertificateChainPemOrThrow — Decode a PEM bundle containing one or more certificates, throwing on malformed input.
• parseCertificateDer — Decode a DER-encoded X.509 certificate into a ParsedCertificate.
• parseCertificateDerOrThrow — Throwing core for parseCertificateDer.
• parseCertificateFromSource — Normalizes a PEM, DER, or already-parsed certificate source into one parsed certificate.
• parseCertificatePem — Decode a PEM-encoded X.509 certificate into a ParsedCertificate.
• parseCertificatePemOrThrow — Decode a PEM-encoded X.509 certificate into a ParsedCertificate.
• parseCertificateSigningRequestDer — Decode a DER-encoded PKCS#10 CSR into a ParsedCertificateSigningRequest.
• parseCertificateSigningRequestDerOrThrow — Decode a DER-encoded PKCS#10 CSR into a ParsedCertificateSigningRequest.
• parseCertificateSigningRequestPem — Decode a PEM-encoded PKCS#10 CSR into a ParsedCertificateSigningRequest.
• parseCertificateSigningRequestPemOrThrow — Decode a PEM-encoded PKCS#10 CSR into a ParsedCertificateSigningRequest.
• parseCertificatesFromSource — Normalizes a PEM bundle or single DER certificate source into parsed certificates.
• parseDistinguishedNameDer — Decodes a bare DER-encoded X.501 Name, as carried in a directoryName GeneralName.
• relativeDistinguishedNameToString — Renders one ParsedRelativeDistinguishedName, joining a multi-valued RDN's attributes with +.
• subjectAltNameLabel — The openssl x509 -text label for a SubjectAltName variant —
• subjectAltNameToString — Renders one SubjectAltName as text.
• subjectPublicKeyInfoFingerprint — Compute the SHA-256 fingerprint of a certificate's complete DER

Types

• DecryptRsaOaepErrorCode — Machine-readable failure reason for decryptRsaOaep.
• DecryptRsaOaepFailure — Structured failure payload for decryptRsaOaep.
• DecryptRsaOaepResult — Success-or-failure result returned by decryptRsaOaep.
• EcKeyAlgorithmInput — ECDSA variant of KeyAlgorithmInput.
• EcNamedCurve — NIST elliptic curve for ECDSA keys.
• Ed25519KeyAlgorithmInput — Ed25519 variant of KeyAlgorithmInput.
• EncryptedPkcs8Options — PBES2 encryption options for the encrypted PKCS#8 export/import functions.
• EncryptRsaOaepErrorCode — Machine-readable failure reason for encryptRsaOaep.
• EncryptRsaOaepFailure — Structured failure payload for encryptRsaOaep.
• EncryptRsaOaepResult — Success-or-failure result returned by encryptRsaOaep.
• ImportEcKeyInput — ECDSA variant of PublicKeyImportInput / PrivateKeyImportInput.
• ImportEd25519KeyInput — Ed25519 variant of PublicKeyImportInput / PrivateKeyImportInput.
• ImportEncryptedKeyErrorCode — Machine-readable failure reason for the importEncrypted* key functions.
• ImportEncryptedKeyFailure — Structured failure payload for encrypted key import.
• ImportEncryptedKeyOptions — Options for the encrypted PKCS#8 import functions.
• ImportEncryptedKeyResult — Success-or-failure result returned by the public importEncrypted* key functions.
• ImportKeyErrorCode — Machine-readable failure reason for the import* key functions.
• ImportKeyFailure — Structured failure payload for key import.
• ImportKeyResult — Success-or-failure result returned by the public import* key functions.
• ImportRsaKeyInput — RSA variant of PublicKeyImportInput / PrivateKeyImportInput.
• KdfLimitOptions — Caller-supplied bound on password-based KDF work.
• KeyAlgorithmInput — Input for generateKeyPair. Selects algorithm family and parameters.
• KeyPairMaterial — Key pair with convenience export helpers. Returned by generateKeyPair.
• LegacyPemEncryptionOptions — Options for OpenSSL-style Proc-Type: 4,ENCRYPTED PEM encryption (PKCS#1/SEC1).
• Pbes2Parameters — Resolved PBES2 algorithm parameters, either parsed from DER or built by encryptPbes2.
• PrivateKeyImportInput — Algorithm descriptor for private key import functions. Same shape as PublicKeyImportInput.
• PublicKeyImportInput — Algorithm descriptor for public key import functions.
• RsaHash — Hash algorithm paired with an RSA key.
• RsaKeyAlgorithmInput — RSA variant of KeyAlgorithmInput.
• RsaOaepOptions — Options shared by encryptRsaOaep and decryptRsaOaep.
• RsaScheme — RSA padding scheme: a signature scheme, or 'oaep' for RSA-OAEP encryption
• RsaSignatureScheme — RSA signature padding scheme.
• CategorizedPemBlocks — PEM blocks grouped by their label into well-known PKI categories.
• CategorizePemBlocksResult — Success-or-failure result from categorizePemBlocks.
• PemBlock — A single decoded PEM block with its label, decoded DER bytes, and original PEM text.
• PemDecodeResult — Success-or-failure result from pemDecode.
• PemErrorCode — Machine-readable failure reason for the PEM decoders.
• PemFailure — Structured failure payload for PEM decoding.
• SplitPemBlocksResult — Success-or-failure result from splitPemBlocks.
• CreatePfxErrorCode — Caller-correctable failure code from createPfx.
• CreatePfxFailure — Error payload for a failed PFX creation.
• CreatePfxInput — Input for createPfx.
• CreatePfxResult — Success-or-failure result from createPfx.
• CreatePkcs7CertBagErrorCode — Caller-correctable failure code from createPkcs7CertBag.
• CreatePkcs7CertBagFailure — Error payload for a failed PKCS#7 certificate bag creation.
• CreatePkcs7CertBagResult — Success-or-failure result from createPkcs7CertBag.
• CreatePkcs7SignedDataErrorCode — Caller-correctable failure codes from createPkcs7SignedData.
• CreatePkcs7SignedDataFailure — Error payload for a failed PKCS#7 SignedData creation.
• CreatePkcs7SignedDataInput — Input for createPkcs7SignedData.
• CreatePkcs7SignedDataResult — Success-or-failure result from createPkcs7SignedData.
• CreatePkcs12MacDataErrorCode — Machine-readable reason createPkcs12MacData rejected its construction input.
• ParsedCertificateChoice — One RFC 5652 §10.2.2 CertificateChoices alternative.
• ParsedPfx — Fully decoded PFX container returned by parsePfxDer / parsePfxPem.
• ParsedPfxAttribute — A single PKCS#12 bag attribute as decoded by parsePfxDer.
• ParsedPfxBag — Discriminated union of SafeBag types decoded from a PFX container.
• ParsedPfxBagAttributes — Decoded bag attributes for a single SafeBag inside a PFX.
• ParsedPkcs7SignedData — Decoded PKCS#7 SignedData content, including certificates and signer info.
• ParsedPkcs7SignerInfo — A single SignerInfo decoded from a PKCS#7 SignedData structure.
• ParsedPkcs7SignerInfoBase — Fields shared by every decoded SignerInfo, regardless of signed-attribute presence.
• ParsedPkcs12MacData — Decoded PKCS#12 MacData block returned by parsePkcs12MacData. type names the
• ParsedSignerIdentifier — RFC 5652 §5.3 `SignerIdentifier ::= CHOICE { issuerAndSerialNumber,
• ParsePfxErrorCode — Error codes returned by parsePfxDer and parsePfxPem.
• ParsePfxFailure — Error payload for a failed PFX parse.
• ParsePfxOptions — Options for parsePfxDer and parsePfxPem.
• ParsePfxResult — Success-or-failure result from parsePfxDer / parsePfxPem.
• ParsePkcs7CertBagResult — Success-or-failure result from parsePkcs7CertBagDer / parsePkcs7CertBagPem.
• ParsePkcs7ErrorCode — Error codes for PKCS#7 parse failures.
• ParsePkcs7Failure — Error payload for a failed PKCS#7 parse.
• ParsePkcs7SignedDataResult — Success-or-failure result from parsePkcs7SignedDataDer / parsePkcs7SignedDataPem.
• ParsePkcs12MacDataErrorCode — Machine-readable failure reason for parsePkcs12MacData.
• ParsePkcs12MacDataFailure — Structured failure payload for MacData parsing.
• ParsePkcs12MacDataOptions — Options for parsePkcs12MacData and parsePkcs12MacDataOrThrow.
• ParsePkcs12MacDataResult — Success-or-failure result from parsePkcs12MacData.
• PfxBagAttributesInput — Optional metadata attached to a certificate or key bag inside a PFX.
• PfxCertificateBagInput — A certificate to embed in a PFX container. Input for createPfx.
• PfxCertificateSource — PEM string or DER bytes for a certificate to include in a PFX bag.
• PfxEncoderErrorCode — Bag attribute input that createPfx refuses by throwing a ResultError.
• PfxEncryptionOptions — PBES2 encryption settings for PFX key-bag protection. Alias of EncryptedPkcs8Options.
• PfxMaterial — DER, PEM, and base64 encodings of a PFX container produced by createPfx.
• PfxPrivateKeyBagInput — A private key to embed in a PFX container. Input for createPfx.
• PfxPrivateKeySource — A WebCrypto private key or raw PKCS#8 DER bytes for a PFX key bag.
• Pkcs7CertBagMaterial — DER, PEM, and base64 encodings of a PKCS#7 certificate bag.
• Pkcs7CertificateSource — PEM text (may contain multiple CERTIFICATE blocks), raw DER bytes, or an already-parsed certificate.
• Pkcs7SignedDataMaterial — DER, PEM, and base64 encodings of a PKCS#7/CMS SignedData structure.
• Pkcs7Signer — A single signer for createPkcs7SignedData.
• Pkcs12MacOptions — Input for createPkcs12MacData. type selects the MAC: 'pkcs12-kdf' (the
• VerifiedPkcs7Signer — A SignerInfo paired with the certificate that verified its signature.
• VerifyPkcs7SignedDataErrorCode — Error codes for verifyPkcs7SignedData failures.
• VerifyPkcs7SignedDataFailure — Error payload for a failed verifyPkcs7SignedData call.
• VerifyPkcs7SignedDataOptions — Options for verifyPkcs7SignedData.
• VerifyPkcs7SignedDataResult — Success-or-failure result from verifyPkcs7SignedData.
• DecodeFailureCode — The codes a parse boundary returns for input it cannot decode: malformed and every DecodeRefusalCode.
• DecodeRefusalCode — One of DECODE_REFUSAL_CODES.
• ErrorResult — Failed result with a flattened code/message/details surface for ergonomic matching.
• IndexedErrorResult — Like ErrorResult but also carries an index into the collection that was being processed.
• IndexedMicro509Error — Like Micro509Error but includes a positional index for collection-processing APIs.
• Micro509Error — Base error shape carried by all failure results in the library.
• Result — Discriminated ok union: either { ok: true; value } or { ok: false; error }.
• ResultError — Exception form of a Micro509Error: a branded Error carrying the structured
• CertificateRevocationListMaterial — Encoded CRL in multiple serialisation formats, returned by createCertificateRevocationList.
• CertificateRevocationStatus — Revocation evaluation result for a single certificate.
• CheckCertificateRevocationAgainstCrlErrorCode — Error codes that checkCertificateRevocationAgainstCrl may return.
• CheckCertificateRevocationAgainstCrlFailure — Failure detail for checkCertificateRevocationAgainstCrl.
• CheckCertificateRevocationAgainstCrlFailureDetails — Structured details attached to a CheckCertificateRevocationAgainstCrlFailure.
• CheckCertificateRevocationAgainstCrlGoodValue — Success value when the certificate is not found in the CRL.
• CheckCertificateRevocationAgainstCrlInput — Input for checkCertificateRevocationAgainstCrl.
• CheckCertificateRevocationAgainstCrlResult — Result of checkCertificateRevocationAgainstCrl.
• CheckCertificateRevocationAgainstCrlRevokedValue — Success value when the certificate is found as revoked in the CRL.
• CheckCertificateRevocationAgainstCrlValue — Discriminated union of good and revoked outcomes.
• CheckCertificateRevocationErrorCode — Error codes that checkCertificateRevocation may surface inside an indeterminate result.
• CheckCertificateRevocationFailureDetails — Diagnostic details attached to an indeterminate revocation result.
• CheckCertificateRevocationInput — Input for checkCertificateRevocation.
• CheckCertificateRevocationResult — Result of checkCertificateRevocation. Always succeeds (ok: true) —
• CheckCertificateRevocationValue — Discriminated union of good, revoked, and indeterminate revocation outcomes.
• CheckChainRevocationInput — Input for checkChainRevocation.
• CheckChainRevocationResult — Result type for checkChainRevocation.
• CheckChainRevocationValue — Detailed revocation check results.
• ConfiguredOcspResponder — A manually-configured OCSP responder endpoint.
• ConfiguredOcspResponderCertificate — PEM or DER bytes of a pre-configured OCSP responder certificate.
• CreateCertificateRevocationListInput — Input for createCertificateRevocationList.
• CreateOcspCertStatusInput — Status to assert for one certificate, mirroring RFC 6960 §4.2.1 CertStatus.
• CreateOcspRequestInput — Input for createOcspRequest.
• CreateOcspRequestItemInput — One certificate whose status to query in an OCSP request.
• CreateOcspResponseInput — Input for createOcspResponse.
• CreateOcspSingleResponseInput — One certificate's status entry for CreateOcspResponseInput.responses.
• CrlApplicabilityFailureReason — Structured reason why a CRL was deemed non-applicable to a given certificate.
• CrlCertificateSource — PEM string, DER bytes, or already-parsed certificate.
• CrlEncoderErrorCode — Machine-readable reason a CRL encoder rejected its construction input.
• CrlSource — PEM string, DER bytes, or already-parsed CRL.
• IssuingDistributionPoint — Input for the Issuing Distribution Point CRL extension (RFC 5280 §5.2.5).
• IssuingDistributionPointBase — Base shape for Issuing Distribution Point (RFC 5280 §5.2.5) — no scope restriction.
• IssuingDistributionPointForAttributeCerts — IDP scoped to attribute certificates only. Mutually exclusive with user / CA scopes.
• IssuingDistributionPointForCaCerts — IDP scoped to CA certificates only. Mutually exclusive with user / attribute scopes.
• IssuingDistributionPointForUserCerts — IDP scoped to end-entity (user) certificates only. Mutually exclusive with CA / attribute scopes.
• OcspCertificateSource — PEM string, DER bytes, or already-parsed certificate.
• OcspCertStatus — RFC 6960 certificate status reported by the responder for a single CertID.
• OcspEncoderErrorCode — Machine-readable reason an OCSP encoder rejected its construction input.
• OcspHashAlgorithm — Hash algorithm used to compute OCSP CertID fields. RFC 9919 §3.1.1 requires SHA-256 for conforming clients; RFC 6960 defines no default.
• OcspRequestMaterial — Encoded OCSP request in multiple serialisation formats, returned by createOcspRequest.
• OcspRequestSource — PEM string, DER bytes, or already-parsed OCSP request.
• OcspResponderCandidate — One candidate OCSP responder resolved by resolveOcspResponderCandidates.
• OcspResponderRevocationPolicy — Revocation policy for delegated OCSP responder certificates (RFC 6960 §4.2.2.2.1).
• OcspResponderSource — Where the OCSP responder URI came from.
• OcspResponseMaterial — Encoded OCSP response in multiple serialisation formats, returned by createOcspResponse.
• OcspResponseSource — OCSP response in any supported format.
• OcspResponseStatus — RFC 6960 overall response status — anything other than 'successful' means the response body is absent or unusable.
• ParseCertificateRevocationListErrorCode — Machine-readable failure reason for the CRL parsers.
• ParseCertificateRevocationListFailure — Structured failure payload for CRL parsing.
• ParseCertificateRevocationListResult — Success-or-failure result from parseCertificateRevocationListDer / parseCertificateRevocationListPem.
• ParsedCertificateRevocationList — Decoded X.509 CRL, returned by parseCertificateRevocationListDer
• ParsedIssuingDistributionPoint — Decoded Issuing Distribution Point CRL extension (RFC 5280 §5.2.5).
• ParsedIssuingDistributionPointBase — Scope-independent fields of a decoded Issuing Distribution Point.
• ParsedIssuingDistributionPointScope — Which certificate kind a CRL is scoped to. RFC 5280 §5.2.5 allows at most one
• ParsedOcspCertId — Decoded OCSP CertID — identifies a certificate by hashed issuer name,
• ParsedOcspCertStatus — RFC 6960 §4.2.1 `CertStatus ::= CHOICE { good [0] NULL, revoked [1] RevokedInfo,
• ParsedOcspRequest — Decoded OCSP request, returned by parseOcspRequestDer / parseOcspRequestPem.
• ParsedOcspResponderId — How the OCSP responder identifies itself — either by distinguished name or
• ParsedOcspResponse — Decoded OCSP response, returned by parseOcspResponseDer / parseOcspResponsePem.
• ParsedOcspSingleResponse — Status of one certificate inside an OCSP BasicResponse.
• ParsedRevocationReason — A decoded CRLReason: a named RevocationReason or an UnrecognizedRevocationReason.
• ParsedRevokedCertificate — A single revoked-certificate entry decoded from a CRL.
• ParseOcspRequestErrorCode — Machine-readable failure reason for the OCSP request parsers.
• ParseOcspRequestFailure — Structured failure payload for OCSP request parsing.
• ParseOcspRequestResult — Success-or-failure result from parseOcspRequestDer / parseOcspRequestPem.
• ParseOcspResponseErrorCode — Machine-readable failure reason for the OCSP response parsers, with the codes of ParseOcspRequestErrorCode.
• ParseOcspResponseFailure — Structured failure payload for OCSP response parsing.
• ParseOcspResponseResult — Success-or-failure result from parseOcspResponseDer / parseOcspResponsePem.
• ResolveOcspResponderCandidatesInput — Input for resolveOcspResponderCandidates.
• RevocationCertificateSource — PEM string, DER bytes, or already-parsed certificate.
• RevocationCheckGoodValue — Certificate is not revoked according to the checked evidence.
• RevocationCheckIndeterminateValue — Revocation status could not be determined from the provided evidence.
• RevocationCheckRevokedValue — Certificate is revoked according to the checked evidence.
• RevocationCrlEvidenceInput — CRL-based revocation evidence for CheckCertificateRevocationInput.evidence.
• RevocationEvidenceInput — Discriminated union of CRL and OCSP evidence inputs.
• RevocationEvidenceKind — Which revocation mechanism produced the evidence.
• RevocationExecutionError — Errors encountered while processing revocation evidence.
• RevocationIndeterminateEvidence — One piece of evidence that failed to produce a definitive revocation answer.
• RevocationIndeterminateReason — See the doc comment above REVOCATION_INDETERMINATE_REASONS.
• RevocationIndeterminateReasonCode — Why a particular piece of evidence could not produce a definitive good/revoked answer.
• RevocationOcspEvidenceInput — OCSP-based revocation evidence for CheckCertificateRevocationInput.evidence.
• RevocationParseError — Revocation evidence that did not parse.
• RevocationPolicy — Revocation checking policy for checkChainRevocation.
• RevocationProcessingError — Revocation evidence that parsed but could not be processed.
• RevocationReason — RFC 5280 §5.3.1 CRLReason code values.
• RevocationSource — Identifies the source of revocation evidence.
• RevocationStatus — Unified revocation outcome across CRL and OCSP evidence.
• RevokedCertificateInput — Single revoked certificate entry for createCertificateRevocationList.
• TrustedOcspResponder — A locally trusted OCSP responder bound to the CA scope it may serve.
• UnrecognizedReasonCodePolicy — Treatment of revocation evidence whose CRLReason is an
• UnrecognizedRevocationReason — A CRLReason code outside the RFC 5280 §5.3.1 enumeration, such as the unused
• ValidateCertificateRevocationListFailure — Failure detail for validateCertificateRevocationList.
• ValidateCertificateRevocationListInput — Input for validateCertificateRevocationList.
• ValidateCertificateRevocationListResult — Result of validateCertificateRevocationList.
• ValidateOcspResponseErrorCode — Failure codes produced by validateOcspResponse.
• ValidateOcspResponseFailure — Failure detail for validateOcspResponse.
• ValidateOcspResponseInput — Input for validateOcspResponse.
• ValidateOcspResponseResult — Result of validateOcspResponse.
• VerifyCertificateRevocationListSignatureFailure — Failure detail when CRL signature verification fails. unsupported and
• VerifyCertificateRevocationListSignatureResult — Result of verifyCertificateRevocationListSignature.
• VerifyOcspResponseSignatureFailure — Failure detail when OCSP response signature verification fails. unsupported
• VerifyOcspResponseSignatureResult — Result of verifyOcspResponseSignature.
• BuildCandidatePathInput — Input for buildCandidatePath.
• BuildCandidatePathResult — Result of buildCandidatePath. On success, contains the CandidatePath.
• CandidatePath — A signature-verified certification path from leaf to root, before constraint validation.
• CertificateSource — PEM string or DER bytes for a certificate. PEM may contain multiple blocks.
• ChainRevocationInput — Input for chain-level revocation checking in verifyCertificateChain.
• ConstrainedPolicy — One policy OID that survives RFC 5280 / RFC 9618 processing.
• CsrSource — PEM string or DER bytes for a certificate signing request.
• DnsServiceIdentityInput — DNS hostname reference identifier.
• EkuCheckFailure — Failure from checkExtendedKeyUsage with the chain index of the certificate that failed.
• EkuCheckPurpose — Extended key usage purpose checked by checkExtendedKeyUsage.
• EkuCheckResult — Result of checkExtendedKeyUsage. Success carries no value; failure identifies the offending certificate.
• InitialNameConstraintsInput — Input for createNameConstraintValidationState.
• IpServiceIdentityInput — IP address reference identifier.
• MatchServiceIdentityErrorCode — Discriminant codes for identity-matching failures.
• MatchServiceIdentityFailure — A failed identity-matching attempt.
• MatchServiceIdentityFailureDetails — Diagnostic context attached to an identity-matching failure.
• MatchServiceIdentityFailureResult — Failure branch of MatchServiceIdentityResult with structured error details.
• MatchServiceIdentityInput — Input for matchServiceIdentity.
• MatchServiceIdentityResult — Result of matching a reference identifier against a certificate's presented identifiers.
• MatchServiceIdentitySuccess — A successful identity match (the certificate covers the requested name).
• PolicyValidationInput — Input for the policy-validation engine.
• PolicyValidationOutcome — Final policy outputs exposed by successful path-validation APIs.
• ServiceIdentityInput — Discriminated union of all supported reference identifier types.
• ServiceIdentityType — The type discriminant values of ServiceIdentityInput.
• SrvServiceIdentityInput — SRV-ID reference identifier (RFC 4985).
• TrustAnchor — Bare trust anchor — subject identity and public key material without a
• UriServiceIdentityInput — URI-ID reference identifier (RFC 9525 §§6.2-6.5). Scheme and host are matched.
• ValidateCandidatePathInput — Input for validateCandidatePath.
• ValidateCandidatePathResult — Result of validateCandidatePath.
• ValidateCandidatePathSuccess — Success payload from validateCandidatePath.
• ValidateForCaInput — Input for validateForCa. Enforces basicConstraints.ca on the leaf.
• ValidateForCodeSigningInput — Input for validateForCodeSigning. Enforces codeSigning EKU.
• ValidateForTlsClientInput — Input for validateForTlsClient. Enforces clientAuth EKU.
• ValidateForTlsServerInput — Input for validateForTlsServer. Enforces serverAuth EKU and optional DNS/IP identity matching.
• VerifiedCertificateChain — Fully verified certificate chain returned on success from verifyCertificateChain.
• VerifyCertificateChainInput — Input for verifyCertificateChain. Combines path-building, validation, and identity options.
• VerifyChainFailure — A chain verification failure with its error code, human message, chain index, and diagnostic details.
• VerifyChainResult — Result of verifyCertificateChain. On success, contains the VerifiedCertificateChain.
• VerifyErrorCode — See the doc comment above VERIFY_ERROR_CODES for the meaning of each code.
• VerifyFailureDetails — Diagnostic context attached to every VerifyChainFailure. All fields are optional; presence depends on the error code.
• VerifyFailureSource — An entry of BuildCandidatePathInput.intermediates or BuildCandidatePathInput.roots.
• VerifyPurpose — High-level purpose applied during path validation to enforce leaf constraints.
• VerifyRequestFailure — Failure from verifyCertificateSigningRequest.
• VerifyRequestResult — Result of verifyCertificateSigningRequest. On success, contains the parsed CSR.
• AuthorityInformationAccess — A single entry in the Authority Information Access extension (RFC 5280 §4.2.2.1).
• AuthorityInformationAccessInput — Builder input for one Authority Information Access entry.
• BasicConstraints — RFC 5280 §4.2.1.9 Basic Constraints.
• CertificateExtensionsInput — Input for createCertificate, createSelfSignedCertificate,
• CertificateFingerprint — The three rendered forms of a certificate fingerprint.
• CertificateFingerprintAlgorithm — Digest algorithms supported by certificateFingerprint.
• CertificateFingerprintSource — A PEM string, raw DER bytes, or an already-parsed certificate.
• CertificateMaterial — Encoded certificate material in common interchange formats.
• CertificatePolicies — RFC 5280 §4.2.1.4 — array of policy OIDs with optional qualifiers.
• CreateCertificateErrorCode — Machine-readable reason a certificate builder rejected its construction input.
• CreateCertificateInput — Input for createCertificate.
• CreateCsrInput — Input for createCertificateSigningRequest.
• CreateSelfSignedCertificateBase — Fields common to both SelfSignedKeySource variants.
• CreateSelfSignedCertificateInput — Input for createSelfSignedCertificate.
• CsrMaterial — DER, PEM, and base64 encodings of a CSR produced by createCertificateSigningRequest.
• DecodedExtensionMap — Inferred result type when decoding extensions via an ExtensionDecoderMap.
• DecodedExtensionValue — A successfully decoded extension value paired with its OID and criticality.
• DisplayTextType — The ASN.1 string types RFC 5280 §4.2.1.4 allows for a DisplayText.
• DistributionPoint — Input for a single CRL Distribution Point (RFC 5280 §4.2.1.13).
• DistributionPointName — Name component of a CRL Distribution Point, mirroring RFC 5280 §4.2.1.13
• ExtendedKeyUsage — Extended Key Usage — either a well-known purpose string or a custom OID.
• ExtensionDecoder — User-supplied decoder for a single extension OID.
• ExtensionDecoderMap — String-keyed map of ExtensionDecoders, used with ParseOptions.decoderMap.
• ExtensionEncoderErrorCode — Machine-readable reason an extension encoder rejected its construction input.
• GeneralName — Alias for SubjectAltName — used where RFC 5280 says "GeneralName".
• GeneralSubtree — A single subtree entry in a Name Constraints permitted/excluded list.
• InhibitAnyPolicy — RFC 5280 §4.2.1.14 Inhibit anyPolicy.
• KeyUsage — RFC 5280 §4.2.1.3 Key Usage bit flag.
• MatchCertificatePrivateKeyErrorCode — Machine-readable failure reason for matchCertificatePrivateKey.
• MatchCertificatePrivateKeyFailure — Structured failure payload for matchCertificatePrivateKey.
• MatchCertificatePrivateKeyFailureResult — Failure branch of MatchCertificatePrivateKeyResult with structured error details.
• MatchCertificatePrivateKeyResult — Result of matchCertificatePrivateKey.
• MatchCertificatePrivateKeySuccess — A successful match: the private key's public half is the certificate's subject public key.
• NameAttribute — Single name attribute within a distinguished name.
• NameConstraintForm — A name form used as a constraint base in namEConstraints.
• NameConstraints — RFC 5280 §4.2.1.10 Name Constraints.
• NameEncoderErrorCode — Machine-readable reason a distinguished-name encoder rejected its construction input.
• NameFieldKey — Union of recognized distinguished-name attribute type shorthand names.
• NameInput — Input for encodeName.
• NameObject — Convenience object form of an X.501 distinguished name.
• OversizedDisplayText — A user notice explicitText or noticeRef organization longer than the 200
• ParseCertificateChainResult — Success-or-failure result from parseCertificateChainPem.
• ParseCertificateErrorCode — Machine-readable failure reason for parseCertificateDer / parseCertificatePem.
• ParseCertificateFailure — Structured failure payload for certificate parsing.
• ParseCertificateResult — Success-or-failure result from parseCertificateDer / parseCertificatePem.
• ParseCertificateSigningRequestErrorCode — Machine-readable failure reason for the CSR parsers, with the codes of ParseCertificateErrorCode.
• ParseCertificateSigningRequestFailure — Structured failure payload for CSR parsing.
• ParseCertificateSigningRequestResult — Success-or-failure result from parseCertificateSigningRequestDer /
• ParsedBitFlags — A decoded BIT STRING flag set.
• ParsedCertificate — A fully decoded X.509 certificate.
• ParsedCertificateSigningRequest — A fully decoded PKCS#10 Certificate Signing Request.
• ParsedDistributionPoint — A decoded DistributionPoint from the CRL Distribution Points extension.
• ParsedDistributionPointName — The name component of a CRL Distribution Point, mirroring RFC 5280 §4.2.1.13
• ParsedExtension — A raw X.509v3 extension before type-specific decoding.
• ParsedName — An X.501 Distinguished Name decoded from an issuer or subject field.
• ParsedNameAttribute — A single decoded name attribute from an X.501 RelativeDistinguishedName.
• ParsedNameConstraintForm — Union of supported and unsupported name constraint forms as produced by parsing.
• ParsedRelativeDistinguishedName — A single RelativeDistinguishedName SET from an X.501 Name.
• ParseOptions — Options for parseCertificateDer, parseCertificatePem,
• PolicyConstraints — RFC 5280 §4.2.1.11 Policy Constraints.
• PolicyInformation — A single certificate policy: an OID plus optional qualifiers.
• PolicyMapping — Maps a policy OID in the issuer's domain to an equivalent OID in the subject's domain.
• PolicyMappings — RFC 5280 §4.2.1.5 — array of issuer-to-subject policy OID pairs.
• PolicyQualifierInfo — Discriminated union of all supported policy qualifier types.
• RelativeDistinguishedNameInput — Input for encodeRelativeDistinguishedName.
• SelfSignedCertificateResult — Result returned by createSelfSignedCertificate.
• SelfSignedKeySource — Where createSelfSignedCertificate gets its key pair.
• SubjectAltName — RFC 5280 §4.2.1.6 Subject Alternative Name / GeneralName.
• SubjectAltNameTextOptions — Options for subjectAltNameToString.
• ValidityInput — Configures the certificate validity window.

Variables

• DECODE_REFUSAL_CODES — Codes a parse boundary returns for input it refuses without calling it
• REVOCATION_INDETERMINATE_REASON_CODES — Every RevocationIndeterminateReasonCode, as a runtime array.
• REVOCATION_INDETERMINATE_REASONS — Granular reasons why revocation status could not be determined.
• VERIFY_ERROR_CODES — Discriminant for every failure a verify operation can produce.