RevocationPolicy

Revocation checking policy for checkChainRevocation.

Controls how indeterminate results (missing evidence, expired CRLs) affect the final decision.

interface RevocationPolicy {
	readonly mode?: soft-fail | hard-fail;
	readonly prefer?: ocsp | crl | best-available;
	readonly ocspResponderRevocation?: OcspResponderRevocationPolicy;
}

Properties

• readonly mode?: soft-fail | hard-fail — How to handle indeterminate status.

  • 'hard-fail': indeterminate certificates cause denial (default)
  • 'soft-fail': indeterminate certificates are allowed — an explicit availability/compatibility choice

  Revocation checking itself is opt-in: no check runs unless evidence is supplied. Once it is, indeterminate status denies by default.

• readonly prefer?: ocsp | crl | best-available — Evidence preference when multiple sources are available.

  Both evidence kinds are always evaluated, and a validated revoked verdict from either source wins regardless of preference (fail-closed). Preference only decides which source's good verdict is reported when both yield one.

  • 'best-available': the source with the fresher evidence — the later thisUpdate on the validated OCSP entry or CRL — is reported; ties favor OCSP (default)
  • 'ocsp': prefer OCSP over CRL
  • 'crl': prefer CRL over OCSP

• readonly ocspResponderRevocation?: OcspResponderRevocationPolicy — Revocation policy for delegated OCSP responder certificates (RFC 6960 §4.2.2.2.1). Supplied CRLs double as responder revocation evidence. Defaults to 'honor-nocheck'.