CertificateExtensionsInput

CertificateExtensionsInput

Input for createCertificate, createSelfSignedCertificate, and createCertificateSigningRequest.

Every field is optional. Omitted extensions are not encoded. Built-in extensions (SKI, AKI, basicConstraints defaults) are handled automatically by the builder.

interface CertificateExtensionsInput {
	readonly subjectAltNames?: readonly SubjectAltName[];
	readonly keyUsage?: readonly KeyUsage[];
	readonly basicConstraints?: BasicConstraints;
	readonly extendedKeyUsage?: readonly ExtendedKeyUsage[];
	readonly nameConstraints?: NameConstraints;
	readonly certificatePolicies?: CertificatePolicies;
	readonly policyMappings?: PolicyMappings;
	readonly policyConstraints?: PolicyConstraints;
	readonly inhibitAnyPolicy?: InhibitAnyPolicy;
	readonly authorityInfoAccess?: readonly AuthorityInformationAccessInput[];
	readonly crlDistributionPoints?: readonly DistributionPoint[];
	readonly noRevAvail?: boolean;
	readonly customExtensions?: readonly CustomExtension[];
}

Properties

• readonly subjectAltNames?: readonly SubjectAltName[] — Subject Alternative Names (dns, ip, email, uri, srv, directoryName).
• readonly keyUsage?: readonly KeyUsage[] — Key Usage flags (digitalSignature, keyCertSign, etc.).
• readonly basicConstraints?: BasicConstraints — Basic Constraints (CA flag + optional pathLength). Defaults to { ca: false } for certs.
• readonly extendedKeyUsage?: readonly ExtendedKeyUsage[] — Extended Key Usage purposes (serverAuth, clientAuth, etc.).
• readonly nameConstraints?: NameConstraints — Name Constraints — permitted and/or excluded subtrees.
• readonly certificatePolicies?: CertificatePolicies — Certificate Policies with optional qualifiers.
• readonly policyMappings?: PolicyMappings — Policy Mappings between issuer and subject policy domains.
• readonly policyConstraints?: PolicyConstraints — Policy Constraints (requireExplicitPolicy / inhibitPolicyMapping thresholds).
• readonly inhibitAnyPolicy?: InhibitAnyPolicy — Inhibit anyPolicy skip-certs threshold.
• readonly authorityInfoAccess?: readonly AuthorityInformationAccessInput[] — Authority Information Access — OCSP responder and CA issuer locations.
• readonly crlDistributionPoints?: readonly DistributionPoint[] — CRL Distribution Points — where to check revocation status.
• readonly noRevAvail?: boolean — Emit No Revocation Available (RFC 9608 §2): the CA publishes no revocation information for this certificate. A certificate carrying it cannot be a CA and cannot point at a CRL or an OCSP responder (RFC 9608 §3).
• readonly customExtensions?: readonly CustomExtension[] — Arbitrary extensions not covered by the built-in fields.