micro509/x509

Create and inspect certificates, CSRs, names, and extensions.

Read existing material with parseCertificatePem. Issue a certificate with createCertificate, or generate a key and certificate together with createSelfSignedCertificate.

DER/PEM parsing, encoding, extension decoding, and text rendering return synchronously. Certificate/CSR creation and WebCrypto-backed hashing and key operations return promises and must be awaited.

Functions

• createCertificate — Create an X.509 certificate signed by input.signerPrivateKey.
• createSelfSignedCertificate — Create a self-signed certificate.
• createCertificateSigningRequest — Creates a PKCS#10 Certificate Signing Request signed with the given private key.
• allOnesMaskForIpAddress — Returns an all-ones (0xff) mask of the appropriate length for the
• buildCertificateExtensions — Build the v3 extensions block for a certificate.
• buildRequestedExtensions — Build the extensions for a CSR's extensionRequest attribute.
• subjectKeyIdentifier — Computes a key identifier from a DER SubjectPublicKeyInfo using method (1)
• decodeIpAddress — Converts raw IP address bytes back to a human-readable string.\
• encodeAuthorityInfoAccess — DER-encode an Authority Information Access SEQUENCE.
• encodeBasicConstraints — DER-encode a BasicConstraints value.
• encodeCertificatePolicies — DER-encode a Certificate Policies extension value.
• encodeCrlDistributionPoints — DER-encode a CRL Distribution Points SEQUENCE.
• encodeExtendedKeyUsage — DER-encode an Extended Key Usage SEQUENCE OF OIDs.
• encodeExtension — Encode a single X.509 Extension SEQUENCE (OID + optional critical BOOLEAN + OCTET STRING).
• encodeInhibitAnyPolicy — DER-encode an Inhibit anyPolicy extension value (single INTEGER).
• encodeKeyUsage — DER-encode a Key Usage BIT STRING from an array of KeyUsage flags.
• encodeNameConstraints — DER-encode a Name Constraints extension value.
• encodePolicyConstraints — DER-encode a Policy Constraints extension value.
• encodePolicyMappings — DER-encode a Policy Mappings extension value.
• encodeSubjectAltName — DER-encode a single SubjectAltName GeneralName element.
• getAuthorityInfoAccessMethodOid — Resolve an AuthorityInfoAccessMethod to its dotted-decimal OID.
• getExtendedKeyUsageOid — Resolve an ExtendedKeyUsage to its dotted-decimal OID.
• normalizeIpAddress — Normalizes an IP address string for comparison.\
• parseAuthorityInfoAccessMethodOid — Map a dotted-decimal OID to an AuthorityInfoAccessMethod value.
• parseExtendedKeyUsageOid — Map a dotted-decimal OID to an ExtendedKeyUsage value.
• parseIpAddressToBytes — Parses an IPv4 or IPv6 address string into raw bytes.\
• certificateFingerprint — Compute a certificate fingerprint — a hash over the DER encoding.
• subjectPublicKeyInfoFingerprint — Compute the SHA-256 fingerprint of a certificate's complete DER
• canonicalDnKey — Produces a deterministic string key for a parsed DN, suitable as a Map key.
• compareDistinguishedNames — RFC 5280 §7.1 semantic equality: same RDN count, each pair matches attribute-by-attribute.
• encodeName — DER-encodes an X.509 Name.
• encodeRelativeDistinguishedName — DER-encodes a single RelativeDistinguishedName (RDN).
• isWithinDirectoryNameSubtree — True when subject equals or is subordinate to constraint (RDN prefix match).
• distinguishedNameToString — Renders a ParsedName as an RFC 4514 distinguished name string, e.g. CN=Example CA,O=Acme,C=US.
• relativeDistinguishedNameToString — Renders one ParsedRelativeDistinguishedName, joining a multi-valued RDN's attributes with +.
• subjectAltNameLabel — The openssl x509 -text label for a SubjectAltName variant —
• subjectAltNameToString — Renders one SubjectAltName as text.
• certificateMatchesPrivateKey — Check whether a certificate's subject public key belongs to a private key.
• decodeExtension — Decode a single extension using a custom ExtensionDecoder.
• decodeExtensionMap — Decode all matching extensions using a named ExtensionDecoderMap.
• decodeExtensions — Decode all matching extensions using an array of ExtensionDecoders.
• defineExtensionDecoder — Identity helper that narrows the type of a custom ExtensionDecoder literal.
• defineExtensionDecoderMap — Identity helper that narrows the type of a custom ExtensionDecoderMap literal.
• findExtension — Find a raw extension by OID within a parsed extension list.
• getSubjectPublicKey — Import the subject public key of a parsed certificate or CSR as a WebCrypto CryptoKey.
• getSubjectPublicKeyOrThrow — Import the subject public key of a parsed certificate or CSR as a WebCrypto CryptoKey.
• matchCertificatePrivateKey — Check whether a certificate's subject public key belongs to a private key,
• decodeAuthorityInfoAccess — Decodes the Authority Information Access extension value.
• decodeAuthorityKeyIdentifier — Decodes the Authority Key Identifier extension, returning the keyIdentifier hex or undefined.
• decodeBasicConstraints — Decodes the Basic Constraints extension value DER.
• parseCertificateChainPem — Decode a PEM bundle containing one or more certificates.
• parseCertificateChainPemOrThrow — Decode a PEM bundle containing one or more certificates, throwing on malformed input.
• parseCertificateDer — Decode a DER-encoded X.509 certificate into a ParsedCertificate.
• parseCertificateDerOrThrow — Throwing core for parseCertificateDer.
• parseCertificateFromSource — Normalizes a PEM, DER, or already-parsed certificate source into one parsed certificate.
• parseCertificatePem — Decode a PEM-encoded X.509 certificate into a ParsedCertificate.
• parseCertificatePemOrThrow — Decode a PEM-encoded X.509 certificate into a ParsedCertificate.
• decodeCertificatePolicies — Decodes the Certificate Policies extension value.
• parseCertificateSigningRequestDer — Decode a DER-encoded PKCS#10 CSR into a ParsedCertificateSigningRequest.
• parseCertificateSigningRequestDerOrThrow — Decode a DER-encoded PKCS#10 CSR into a ParsedCertificateSigningRequest.
• parseCertificateSigningRequestPem — Decode a PEM-encoded PKCS#10 CSR into a ParsedCertificateSigningRequest.
• parseCertificateSigningRequestPemOrThrow — Decode a PEM-encoded PKCS#10 CSR into a ParsedCertificateSigningRequest.
• parseCertificatesFromSource — Normalizes a PEM bundle or single DER certificate source into parsed certificates.
• decodeCrlDistributionPoints — Decodes the CRL Distribution Points extension value.
• parseDistinguishedNameDer — Decodes a bare DER-encoded X.501 Name, as carried in a directoryName GeneralName.
• decodeExtendedKeyUsage — Decodes the Extended Key Usage SEQUENCE OF OIDs.
• decodeInhibitAnyPolicy — Decodes the Inhibit anyPolicy extension (single INTEGER).
• decodeKeyUsage — Decodes the Key Usage BIT STRING extension value.
• decodeNameConstraints — Decodes the Name Constraints extension value.
• decodePolicyConstraints — Decodes the Policy Constraints extension value.
• decodePolicyMappings — Decodes the Policy Mappings extension value.
• decodeSubjectAltNames — Decodes a subjectAltName or issuerAltName SEQUENCE OF GeneralName.

Types

• CertificateMaterial — Encoded certificate material in common interchange formats.
• CreateCertificateErrorCode — Machine-readable reason a certificate builder rejected its construction input.
• CreateCertificateInput — Input for createCertificate.
• CreateSelfSignedCertificateBase — Fields common to both SelfSignedKeySource variants.
• CreateSelfSignedCertificateInput — Input for createSelfSignedCertificate.
• SelfSignedCertificateResult — Result returned by createSelfSignedCertificate.
• SelfSignedKeySource — Where createSelfSignedCertificate gets its key pair.
• SignatureProfileInput — Controls how the signature algorithm is chosen.
• ValidityInput — Configures the certificate validity window.
• CreateCsrInput — Input for createCertificateSigningRequest.
• CsrMaterial — DER, PEM, and base64 encodings of a CSR produced by createCertificateSigningRequest.
• AuthorityInfoAccessMethod — AIA access method — either a well-known string or a custom OID.
• AuthorityInformationAccess — A single entry in the Authority Information Access extension (RFC 5280 §4.2.2.1).
• AuthorityInformationAccessInput — Builder input for one Authority Information Access entry.
• BasicConstraints — RFC 5280 §4.2.1.9 Basic Constraints.
• CertificateExtensionsInput — Input for createCertificate, createSelfSignedCertificate,
• CertificatePolicies — RFC 5280 §4.2.1.4 — array of policy OIDs with optional qualifiers.
• CpsPolicyQualifierInfo — CPS (Certification Practice Statement) URI policy qualifier.
• CustomAuthorityInfoAccessMethod — AIA access method identified by a custom OID not in the well-known set.
• CustomExtendedKeyUsage — Extended Key Usage purpose identified by a custom OID.
• CustomExtension — An extension not covered by the typed fields in CertificateExtensionsInput.
• CustomPolicyQualifierInfo — Opaque policy qualifier identified by a custom OID, carried as raw DER.
• DisplayTextType — The ASN.1 string types RFC 5280 §4.2.1.4 allows for a DisplayText.
• DistributionPoint — Input for a single CRL Distribution Point (RFC 5280 §4.2.1.13).
• DistributionPointName — Name component of a CRL Distribution Point, mirroring RFC 5280 §4.2.1.13
• DistributionPointReason — Revocation reason flags for CRL Distribution Points and Issuing Distribution Points
• ExtendedKeyUsage — Extended Key Usage — either a well-known purpose string or a custom OID.
• ExtensionEncoderErrorCode — Machine-readable reason an extension encoder rejected its construction input.
• GeneralName — Alias for SubjectAltName — used where RFC 5280 says "GeneralName".
• GeneralSubtree — A single subtree entry in a Name Constraints permitted/excluded list.
• InhibitAnyPolicy — RFC 5280 §4.2.1.14 Inhibit anyPolicy.
• KeyUsage — RFC 5280 §4.2.1.3 Key Usage bit flag.
• KnownAuthorityInfoAccessMethod — Well-known AIA access methods: OCSP responder or CA issuer certificate.
• KnownExtendedKeyUsage — Well-known Extended Key Usage purpose strings (RFC 5280 §4.2.1.12).
• NameConstraintForm — A name form used as a constraint base in namEConstraints.
• NameConstraints — RFC 5280 §4.2.1.10 Name Constraints.
• OversizedDisplayText — A user notice explicitText or noticeRef organization longer than the 200
• ParsedNameConstraintForm — Union of supported and unsupported name constraint forms as produced by parsing.
• PolicyConstraints — RFC 5280 §4.2.1.11 Policy Constraints.
• PolicyInformation — A single certificate policy: an OID plus optional qualifiers.
• PolicyMapping — Maps a policy OID in the issuer's domain to an equivalent OID in the subject's domain.
• PolicyMappings — RFC 5280 §4.2.1.5 — array of issuer-to-subject policy OID pairs.
• PolicyNoticeReference — Reference to a numbered notice within an organization's practice statement.
• PolicyQualifierInfo — Discriminated union of all supported policy qualifier types.
• SubjectAltName — RFC 5280 §4.2.1.6 Subject Alternative Name / GeneralName.
• UnsupportedNameConstraintForm — Name constraint forms parsed from DER but not supported for encoding or
• UserNoticePolicyQualifierInfo — UserNotice policy qualifier — human-readable notice text and/or a notice reference.
• CertificateFingerprint — The three rendered forms of a certificate fingerprint.
• CertificateFingerprintAlgorithm — Digest algorithms supported by certificateFingerprint.
• CertificateFingerprintSource — A PEM string, raw DER bytes, or an already-parsed certificate.
• NameAttribute — Single name attribute within a distinguished name.
• NameEncoderErrorCode — Machine-readable reason a distinguished-name encoder rejected its construction input.
• NameFieldKey — Union of recognized distinguished-name attribute type shorthand names.
• NameInput — Input for encodeName.
• NameObject — Convenience object form of an X.501 distinguished name.
• RelativeDistinguishedNameInput — Input for encodeRelativeDistinguishedName.
• SubjectAltNameTextOptions — Options for subjectAltNameToString.
• DecodedExtensionMap — Inferred result type when decoding extensions via an ExtensionDecoderMap.
• DecodedExtensionValue — A successfully decoded extension value paired with its OID and criticality.
• ExtensionDecoder — User-supplied decoder for a single extension OID.
• ExtensionDecoderMap — String-keyed map of ExtensionDecoders, used with ParseOptions.decoderMap.
• MatchCertificatePrivateKeyErrorCode — Machine-readable failure reason for matchCertificatePrivateKey.
• MatchCertificatePrivateKeyFailure — Structured failure payload for matchCertificatePrivateKey.
• MatchCertificatePrivateKeyFailureResult — Failure branch of MatchCertificatePrivateKeyResult with structured error details.
• MatchCertificatePrivateKeyResult — Result of matchCertificatePrivateKey.
• MatchCertificatePrivateKeySuccess — A successful match: the private key's public half is the certificate's subject public key.
• ParseCertificateChainResult — Success-or-failure result from parseCertificateChainPem.
• ParseCertificateErrorCode — Machine-readable failure reason for parseCertificateDer / parseCertificatePem.
• ParseCertificateFailure — Structured failure payload for certificate parsing.
• ParseCertificateResult — Success-or-failure result from parseCertificateDer / parseCertificatePem.
• ParseCertificateSigningRequestErrorCode — Machine-readable failure reason for the CSR parsers, with the codes of ParseCertificateErrorCode.
• ParseCertificateSigningRequestFailure — Structured failure payload for CSR parsing.
• ParseCertificateSigningRequestResult — Success-or-failure result from parseCertificateSigningRequestDer /
• ParsedBitFlags — A decoded BIT STRING flag set.
• ParsedCertificate — A fully decoded X.509 certificate.
• ParsedCertificateSigningRequest — A fully decoded PKCS#10 Certificate Signing Request.
• ParsedDistributionPoint — A decoded DistributionPoint from the CRL Distribution Points extension.
• ParsedDistributionPointName — The name component of a CRL Distribution Point, mirroring RFC 5280 §4.2.1.13
• ParsedExtension — A raw X.509v3 extension before type-specific decoding.
• ParsedName — An X.501 Distinguished Name decoded from an issuer or subject field.
• ParsedNameAttribute — A single decoded name attribute from an X.501 RelativeDistinguishedName.
• ParsedRelativeDistinguishedName — A single RelativeDistinguishedName SET from an X.501 Name.
• ParseOptions — Options for parseCertificateDer, parseCertificatePem,