PolicyValidationInput

PolicyValidationInput

Input for the policy-validation engine.

All fields are optional — omitted values produce the most permissive behavior (accept any policy, allow mappings, allow anyPolicy).

interface PolicyValidationInput {
	readonly initialPolicySet?: readonly string[] | "any";
	readonly requireExplicitPolicy?: boolean;
	readonly inhibitPolicyMapping?: boolean;
	readonly inhibitAnyPolicy?: boolean;
}

Properties

• readonly initialPolicySet?: readonly string``[] | "any" — OIDs the relying party considers acceptable, or 'any' to accept whatever the chain asserts. A list holding the anyPolicy OID (2.5.29.32.0) means 'any'. A list with a malformed OID matches nothing. Unlike RFC 9618 §5.5, which accepts a path whose user-constrained policy set is empty while explicit policy is not required, validation fails when a supplied list is not satisfied, as the application restriction §5.1 allows. Default: 'any'.
• readonly requireExplicitPolicy?: boolean — When true, the chain must assert at least one acceptable policy. Default: false.
• readonly inhibitPolicyMapping?: boolean — When true, policy mappings in CA certificates are ignored. Default: false.
• readonly inhibitAnyPolicy?: boolean — When true, the anyPolicy OID is not treated as matching all policies. Default: false.