BuildCandidatePathInput

BuildCandidatePathInput

Input for buildCandidatePath.

interface BuildCandidatePathInput {
	readonly distrustedSpkiSha256?: readonly string[];
	readonly leaf: CertificateSource;
	readonly intermediates?: readonly CertificateSource[];
	readonly roots: readonly CertificateSource[];
	readonly trustAnchors?: readonly TrustAnchor[];
	readonly at?: Date;
	readonly maxPathBuildingChecks?: number;
}

Properties

• readonly distrustedSpkiSha256?: readonly string``[] — SHA-256 hashes of complete DER SubjectPublicKeyInfo values to distrust. Supply 64 hexadecimal characters per hash (case-insensitive, no separators). Defaults to an empty list. Malformed entries throw RangeError. Applies to every path certificate and bare trust anchor, before revocation. A match returns public_key_distrusted, with the hash in details.actual.
• readonly leaf: CertificateSource — End-entity certificate to verify.
• readonly intermediates?: readonly CertificateSource[] — Intermediate CA certificates available for path building. Order does not matter.
• readonly roots: readonly CertificateSource[] — Trusted root CA certificates. At least one root or trust anchor must be supplied.
• readonly trustAnchors?: readonly TrustAnchor[] — Bare trust anchors to try when no root certificate matches.
• readonly at?: Date — Validation time. Defaults to new Date().
• readonly maxPathBuildingChecks?: number — Maximum issuer candidates and trust anchors the path search may try before it stops with path_building_limit_exceeded. Defaults to 100_000.