CheckCertificateRevocationInput

CheckCertificateRevocationInput

Input for checkCertificateRevocation.

interface CheckCertificateRevocationInput {
	readonly certificate: RevocationCertificateSource;
	readonly issuerCertificate: RevocationCertificateSource;
	readonly evidence?: readonly RevocationEvidenceInput[];
	readonly at?: Date;
	readonly clockSkewMs?: number;
	readonly crlMaxAgeMs?: number;
	readonly ocspProfile?: ValidateOcspResponseInput["profile"];
	readonly unrecognizedReasonCode?: UnrecognizedReasonCodePolicy;
}

Properties

• readonly certificate: RevocationCertificateSource — Certificate whose revocation status to determine.
• readonly issuerCertificate: RevocationCertificateSource — Issuer of certificate.
• readonly evidence?: readonly RevocationEvidenceInput[] — CRL and/or OCSP evidence to evaluate. Returns indeterminate if empty.
• readonly at?: Date — Evaluation time. Defaults to new Date().
• readonly clockSkewMs?: number — Clock-skew tolerance in milliseconds. It also widens crlMaxAgeMs.
• readonly crlMaxAgeMs?: number — Maximum age of each CRL's thisUpdate in milliseconds. Unbounded by default. See ValidateCertificateRevocationListInput.maxAgeMs.
• readonly ocspProfile?: ValidateOcspResponseInput["profile"] — OCSP client profile for every OCSP evidence entry. See ValidateOcspResponseInput.profile. Defaults to 'rfc6960'.
• readonly unrecognizedReasonCode?: UnrecognizedReasonCodePolicy — Treatment of CRL or OCSP evidence whose CRLReason is unrecognized. See UnrecognizedReasonCodePolicy. 'reject' turns that evidence into reason_code_unrecognized, which also keeps other evidence from settling the status as good. Defaults to 'revoked'.