micro509/verify

Validate certificate chains, application purposes, and service identities.

Start with verifyCertificateChain and supply your trusted roots. Use matchCertificateServiceIdentity for identity matching alone, or verifyCertificateSigningRequest to check a CSR signature.

Functions

• matchCertificateServiceIdentity — Compares a reference identifier against a certificate's SAN entries.
• matchServiceIdentity — Checks whether a certificate covers the requested service identity.
• buildCandidatePath — Builds a signature-verified path from a leaf certificate to a trusted root.
• checkExtendedKeyUsage — Standalone EKU check against a verified certificate chain.
• isSelfIssuedCertificate — Returns true if the certificate's subject and issuer DNs are semantically equal (RFC 5280 §7.1).
• trustAnchorFromCertificate — Extracts a TrustAnchor from a parsed certificate, copying the subject, SPKI, and key identifiers.
• validateCandidatePath — Validates a pre-built certificate chain for time, constraints, policy, and
• validateForCa — Validates a certificate chain for CA use:
• validateForCodeSigning — Validates a certificate chain for code signing:
• validateForTlsClient — Validates a certificate chain for TLS client use:
• validateForTlsServer — Validates a certificate chain for TLS server use:
• verifyCertificateChain — All-in-one certificate chain verification: builds a candidate path then
• verifyCertificateSigningRequest — Verifies the self-signature of a PKCS#10 certificate signing request.

Types

• DnsServiceIdentityInput — DNS hostname reference identifier.
• IpServiceIdentityInput — IP address reference identifier.
• MatchServiceIdentityErrorCode — Discriminant codes for identity-matching failures.
• MatchServiceIdentityFailure — A failed identity-matching attempt.
• MatchServiceIdentityFailureDetails — Diagnostic context attached to an identity-matching failure.
• MatchServiceIdentityFailureResult — Failure branch of MatchServiceIdentityResult with structured error details.
• MatchServiceIdentityInput — Input for matchServiceIdentity.
• MatchServiceIdentityResult — Result of matching a reference identifier against a certificate's presented identifiers.
• MatchServiceIdentitySuccess — A successful identity match (the certificate covers the requested name).
• ServiceIdentityInput — Discriminated union of all supported reference identifier types.
• ServiceIdentityType — The type discriminant values of ServiceIdentityInput.
• SrvServiceIdentityInput — SRV-ID reference identifier (RFC 4985).
• UriServiceIdentityInput — URI-ID reference identifier (RFC 9525 §§6.2-6.5). Scheme and host are matched.
• InitialNameConstraintsInput — Input for createNameConstraintValidationState.
• ConstrainedPolicy — One policy OID that survives RFC 5280 / RFC 9618 processing.
• PolicyValidationInput — Input for the policy-validation engine.
• PolicyValidationOutcome — Final policy outputs exposed by successful path-validation APIs.
• BuildCandidatePathInput — Input for buildCandidatePath.
• BuildCandidatePathResult — Result of buildCandidatePath. On success, contains the CandidatePath.
• CandidatePath — A signature-verified certification path from leaf to root, before constraint validation.
• CertificateSource — PEM string or DER bytes for a certificate. PEM may contain multiple blocks.
• ChainRevocationInput — Input for chain-level revocation checking in verifyCertificateChain.
• CsrSource — PEM string or DER bytes for a certificate signing request.
• EkuCheckFailure — Failure from checkExtendedKeyUsage with the chain index of the certificate that failed.
• EkuCheckPurpose — Extended key usage purpose checked by checkExtendedKeyUsage.
• EkuCheckResult — Result of checkExtendedKeyUsage. Success carries no value; failure identifies the offending certificate.
• TrustAnchor — Bare trust anchor — subject identity and public key material without a
• ValidateCandidatePathInput — Input for validateCandidatePath.
• ValidateCandidatePathResult — Result of validateCandidatePath.
• ValidateCandidatePathSuccess — Success payload from validateCandidatePath.
• ValidateForCaInput — Input for validateForCa. Enforces basicConstraints.ca on the leaf.
• ValidateForCodeSigningInput — Input for validateForCodeSigning. Enforces codeSigning EKU.
• ValidateForTlsClientInput — Input for validateForTlsClient. Enforces clientAuth EKU.
• ValidateForTlsServerInput — Input for validateForTlsServer. Enforces serverAuth EKU and optional DNS/IP identity matching.
• VerifiedCertificateChain — Fully verified certificate chain returned on success from verifyCertificateChain.
• VerifyCertificateChainInput — Input for verifyCertificateChain. Combines path-building, validation, and identity options.
• VerifyChainFailure — A chain verification failure with its error code, human message, chain index, and diagnostic details.
• VerifyChainResult — Result of verifyCertificateChain. On success, contains the VerifiedCertificateChain.
• VerifyErrorCode — See the doc comment above VERIFY_ERROR_CODES for the meaning of each code.
• VerifyFailureDetails — Diagnostic context attached to every VerifyChainFailure. All fields are optional; presence depends on the error code.
• VerifyFailureSource — An entry of BuildCandidatePathInput.intermediates or BuildCandidatePathInput.roots.
• VerifyPurpose — High-level purpose applied during path validation to enforce leaf constraints.
• VerifyRequestFailure — Failure from verifyCertificateSigningRequest.
• VerifyRequestResult — Result of verifyCertificateSigningRequest. On success, contains the parsed CSR.

Variables

• VERIFY_ERROR_CODES — Discriminant for every failure a verify operation can produce.