ValidateOcspResponseInput

ValidateOcspResponseInput

Input for validateOcspResponse.

interface ValidateOcspResponseInput {
	readonly response: string | Uint8Array | ParsedOcspResponse;
	readonly issuerCertificate: OcspCertificateSource;
	readonly request?: OcspRequestSource;
	readonly responderCertificate?: OcspCertificateSource;
	readonly allowChainedResponderCertificate?: boolean;
	readonly trustedOcspResponders?: readonly OcspCertificateSource[];
	readonly responderRevocationPolicy?: OcspResponderRevocationPolicy;
	readonly responderRevocationCrls?: readonly CrlSource[];
	readonly responderRevocationCrlMaxAgeMs?: number;
	readonly responderRevocationUnrecognizedReasonCode?: UnrecognizedReasonCodePolicy;
	readonly at?: Date;
	readonly clockSkewMs?: number;
	readonly profile?: "rfc6960" | "rfc9919";
}

Properties

• readonly response: string | Uint8Array | ParsedOcspResponse — The OCSP response to validate.

• readonly issuerCertificate: OcspCertificateSource — Certificate of the CA that issued the target certificate.

• readonly request?: OcspRequestSource — Original request — enables nonce and request-coverage checks.

• readonly responderCertificate?: OcspCertificateSource — Explicit responder certificate — overrides embedded certificate discovery.

• readonly allowChainedResponderCertificate?: boolean — When true, allows delegated responder chain validation beyond direct issuance.

• readonly trustedOcspResponders?: readonly OcspCertificateSource[] — Explicitly trusted responder certificates for this issuer's scope (RFC 6960 §4.2.2.2 criterion 1 — local responder configuration).

  A response signer matching one of these certificates is accepted without the delegated-responder issuance, chain, EKU, and revocation checks. Signature verification and responder-ID binding are still enforced. Also consulted during responder discovery when the response embeds no matching certificate.

• readonly responderRevocationPolicy?: OcspResponderRevocationPolicy — Revocation policy for delegated responder certificates. Defaults to 'honor-nocheck'.

• readonly responderRevocationCrls?: readonly CrlSource[] — CRLs used as revocation evidence for delegated responder certificates.

• readonly responderRevocationCrlMaxAgeMs?: number — Maximum age of each responderRevocationCrls entry's thisUpdate at at, in milliseconds. An older CRL yields no evidence. Unbounded by default, in which case a CRL without nextUpdate yields no evidence. Throws RangeError when negative or not finite.

• readonly responderRevocationUnrecognizedReasonCode?: UnrecognizedReasonCodePolicy — Treatment of a responderRevocationCrls entry that revokes the responder with an unrecognized CRLReason. See UnrecognizedReasonCodePolicy. 'reject' blocks validation with responder_revocation_unknown, even when another CRL provides good coverage. Defaults to 'revoked'.

• readonly at?: Date — Evaluation time for freshness checks and delegated responder chain validation. Defaults to new Date().

• readonly clockSkewMs?: number — Clock-skew tolerance in milliseconds for thisUpdate/nextUpdate/producedAt, including those of responderRevocationCrls. It also widens responderRevocationCrlMaxAgeMs.

• readonly profile?: "rfc6960" | "rfc9919" — OCSP client profile to enforce. Defaults to 'rfc6960', which accepts a response without nextUpdate (RFC 6960 §4.2.2.1). 'rfc9919' applies the RFC 9919 §5 client rule and fails with next_update_missing when any single response omits nextUpdate.