VerifyCertificateChainInput

VerifyCertificateChainInput

Input for verifyCertificateChain. Combines path-building, validation, and identity options.

interface VerifyCertificateChainInput extends PolicyValidationInput, InitialNameConstraintsInput {
	readonly distrustedSpkiSha256?: readonly string[];
	readonly policy?: PolicyValidationInput;
	readonly nameConstraints?: InitialNameConstraintsInput;
	readonly leaf: CertificateSource;
	readonly intermediates?: readonly CertificateSource[];
	readonly roots: readonly CertificateSource[];
	readonly trustAnchors?: readonly TrustAnchor[];
	readonly at?: Date;
	readonly maxPathBuildingChecks?: number;
	readonly purpose?: VerifyPurpose;
	readonly serviceIdentity?: ServiceIdentityInput;
	readonly allowSelfSignedLeaf?: boolean;
	readonly rejectOversizedDisplayText?: boolean;
	readonly revocation?: ChainRevocationInput;
}

Properties

• readonly distrustedSpkiSha256?: readonly string``[] — SHA-256 hashes of complete DER SubjectPublicKeyInfo values to distrust. Supply 64 hexadecimal characters per hash (case-insensitive, no separators). Defaults to an empty list. Malformed entries throw RangeError. Applies to every path certificate and bare trust anchor, before revocation. A match returns public_key_distrusted, with the hash in details.actual.
• readonly policy?: PolicyValidationInput — Nested policy validation overrides.
• readonly nameConstraints?: InitialNameConstraintsInput — Nested name constraint overrides.
• readonly leaf: CertificateSource — End-entity certificate to verify.
• readonly intermediates?: readonly CertificateSource[] — Intermediate CA certificates available for path building.
• readonly roots: readonly CertificateSource[] — Trusted root CA certificates.
• readonly trustAnchors?: readonly TrustAnchor[] — Bare trust anchors to try when no root certificate matches.
• readonly at?: Date — Validation time. Defaults to new Date().
• readonly maxPathBuildingChecks?: number — Maximum issuer candidates and trust anchors the path search may try before it stops with path_building_limit_exceeded. Defaults to 100_000.
• readonly purpose?: VerifyPurpose — Leaf purpose constraint to enforce during validation.
• readonly serviceIdentity?: ServiceIdentityInput — DNS/IP/URI/SRV identity to match against the leaf's SAN.
• readonly allowSelfSignedLeaf?: boolean — When true, allows a self-signed leaf. Defaults to false.
• readonly rejectOversizedDisplayText?: boolean — When true, rejects a certificate whose user notice explicitText or noticeRef organization exceeds 200 characters with display_text_oversized. Defaults to false, and the parsed certificate reports such a value as oversizedExplicitText or oversizedOrganization.
• readonly revocation?: ChainRevocationInput — Optional revocation checking.