ValidateCertificateRevocationListInput

ValidateCertificateRevocationListInput

Input for validateCertificateRevocationList.

interface ValidateCertificateRevocationListInput {
	readonly crl: CrlSource;
	readonly issuerCertificate: CrlCertificateSource;
	readonly at?: Date;
	readonly clockSkewMs?: number;
	readonly maxAgeMs?: number;
}

Properties

• readonly crl: CrlSource — The CRL to validate.
• readonly issuerCertificate: CrlCertificateSource — Certificate of the CA that should have signed the CRL.
• readonly at?: Date — Evaluation time for freshness checks. Defaults to new Date().
• readonly clockSkewMs?: number — Tolerance in milliseconds for clock skew when checking thisUpdate and nextUpdate. It also widens maxAgeMs by the same amount.
• readonly maxAgeMs?: number — Maximum age of thisUpdate at at, in milliseconds. A CRL older than this fails with stale_crl even when nextUpdate is absent or later. Unbounded by default, in which case a CRL without nextUpdate fails with stale_crl. RFC 5280 §3.3 leaves the required recency of revocation data to local policy.