CandidatePath

CandidatePath

A signature-verified certification path from leaf to root, before constraint validation.

interface CandidatePath {
	readonly leaf: ParsedCertificate;
	readonly chain: readonly ParsedCertificate[];
	readonly root: ParsedCertificate;
	readonly anchorCertificateInChain: boolean;
	readonly trustAnchor?: TrustAnchor;
}

Properties

• readonly leaf: ParsedCertificate — Parsed end-entity certificate.
• readonly chain: readonly ParsedCertificate[] — Full chain in leaf-to-root order (includes both leaf and root).
• readonly root: ParsedCertificate — Trusted root that terminates the path.
• readonly anchorCertificateInChain: boolean — true when CandidatePath.root is a trusted root certificate included in CandidatePath.chain; false when a bare trust anchor verified the terminal certificate, which stays a path certificate.
• readonly trustAnchor?: TrustAnchor — Selected bare trust anchor, when the path terminates without a root certificate.