ParsedCertificate

A fully decoded X.509 certificate.

Built-in extensions (basicConstraints, keyUsage, etc.) are decoded into typed fields automatically.
Supply ParseOptions to also decode custom extensions.

interface ParsedCertificate<TMap extends ExtensionDecoderMap> {
	readonly der: Uint8Array;
	readonly version: number;
	readonly serialNumberHex: string;
	readonly tbsCertificateDer: Uint8Array;
	readonly subjectPublicKeyInfoDer: Uint8Array;
	readonly signatureValue: Uint8Array;
	readonly issuer: ParsedName;
	readonly subject: ParsedName;
	readonly notBefore: Date;
	readonly notAfter: Date;
	readonly signatureAlgorithmOid: string;
	readonly signatureAlgorithmName: string;
	readonly signatureAlgorithmParametersDer?: Uint8Array;
	readonly publicKeyAlgorithmOid: string;
	readonly publicKeyAlgorithmName: string;
	readonly publicKeyAlgorithmParametersDer?: Uint8Array;
	readonly publicKeyParametersOid?: string;
	readonly extensions: readonly ParsedExtension[];
	readonly basicConstraints?: BasicConstraints;
	readonly keyUsage?: ParsedBitFlags<KeyUsage>;
	readonly extendedKeyUsage?: readonly ExtendedKeyUsage[];
	readonly subjectAltNames?: readonly SubjectAltName[];
	readonly nameConstraints?: NameConstraints<ParsedNameConstraintForm>;
	readonly certificatePolicies?: CertificatePolicies;
	readonly policyMappings?: PolicyMappings;
	readonly policyConstraints?: PolicyConstraints;
	readonly inhibitAnyPolicy?: InhibitAnyPolicy;
	readonly authorityInfoAccess?: readonly AuthorityInformationAccess[];
	readonly crlDistributionPoints?: readonly ParsedDistributionPoint[];
	readonly decodedExtensions?: readonly DecodedExtensionValue<unknown>[];
	readonly decodedExtensionMap?: DecodedExtensionMap<TMap>;
	readonly subjectKeyIdentifier?: string;
	readonly authorityKeyIdentifier?: string;
}

Properties

• readonly der: Uint8Array — Complete DER encoding of the certificate (copied from the input).
• readonly version: number — X.509 version number (1, 2, or 3). Almost always 3.
• readonly serialNumberHex: string — Hex-encoded serial number assigned by the issuing CA.
• readonly tbsCertificateDer: Uint8Array — DER encoding of the TBSCertificate, used for signature verification.
• readonly subjectPublicKeyInfoDer: Uint8Array — DER encoding of the SubjectPublicKeyInfo, used for key import.
• readonly signatureValue: Uint8Array — Raw signature bytes (BIT STRING content, padding removed).
• readonly issuer: ParsedName — Distinguished name of the certificate issuer.
• readonly subject: ParsedName — Distinguished name of the certificate subject.
• readonly notBefore: Date — Start of the certificate validity period.
• readonly notAfter: Date — End of the certificate validity period.
• readonly signatureAlgorithmOid: string — OID of the algorithm used to sign this certificate (e.g. "1.2.840.113549.1.1.11" for SHA-256 with RSA).
• readonly signatureAlgorithmName: string — Human-readable signature algorithm name (e.g. "ECDSA with SHA-256").
• readonly signatureAlgorithmParametersDer?: Uint8Array — DER-encoded parameters for the signature algorithm. Absent for algorithms with no parameters.
• readonly publicKeyAlgorithmOid: string — OID of the subject's public key algorithm (e.g. "1.2.840.10045.2.1" for EC).
• readonly publicKeyAlgorithmName: string — Human-readable public key algorithm name (e.g. "EC P-256").
• readonly publicKeyAlgorithmParametersDer?: Uint8Array — DER-encoded parameters for the public key algorithm. Absent when implicit.
• readonly publicKeyParametersOid?: string — OID of the named curve or other key sub-parameter, when present.
• readonly extensions: readonly ParsedExtension[] — All extensions as raw ParsedExtensions, in certificate order.
• readonly basicConstraints?: BasicConstraints — Decoded Basic Constraints (RFC 5280 §4.2.1.9).
• readonly keyUsage?: ParsedBitFlags<KeyUsage> — Decoded Key Usage bit flags (RFC 5280 §4.2.1.3).
• readonly extendedKeyUsage?: readonly ExtendedKeyUsage[] — Decoded Extended Key Usage purposes (RFC 5280 §4.2.1.12).
• readonly subjectAltNames?: readonly SubjectAltName[] — Decoded Subject Alternative Names (RFC 5280 §4.2.1.6).
• readonly nameConstraints?: NameConstraints<ParsedNameConstraintForm> — Decoded Name Constraints (RFC 5280 §4.2.1.10).
• readonly certificatePolicies?: CertificatePolicies — Decoded Certificate Policies (RFC 5280 §4.2.1.4).
• readonly policyMappings?: PolicyMappings — Decoded Policy Mappings (RFC 5280 §4.2.1.5).
• readonly policyConstraints?: PolicyConstraints — Decoded Policy Constraints (RFC 5280 §4.2.1.11).
• readonly inhibitAnyPolicy?: InhibitAnyPolicy — Decoded Inhibit anyPolicy (RFC 5280 §4.2.1.14).
• readonly authorityInfoAccess?: readonly AuthorityInformationAccess[] — Decoded Authority Information Access — OCSP and CA Issuer URIs (RFC 5280 §4.2.2.1).
• readonly crlDistributionPoints?: readonly ParsedDistributionPoint[] — Decoded CRL Distribution Points (RFC 5280 §4.2.1.13).
• readonly decodedExtensions?: readonly DecodedExtensionValue<unknown>[] — Custom-decoded extensions from ParseOptions.decoders.
• readonly decodedExtensionMap?: DecodedExtensionMap<TMap> — Custom-decoded extensions from ParseOptions.decoderMap, keyed by map key.
• readonly subjectKeyIdentifier?: string — Hex-encoded Subject Key Identifier (RFC 5280 §4.2.1.2).
• readonly authorityKeyIdentifier?: string — Hex-encoded Authority Key Identifier (RFC 5280 §4.2.1.1).