TrustAnchor

Bare trust anchor — subject identity and public key material without a full certificate. Used when the root CA certificate is unavailable but its key is known. Build from a certificate with trustAnchorFromCertificate.

interface TrustAnchor {
	readonly subject: ParsedName;
	readonly subjectPublicKeyInfoDer: Uint8Array;
	readonly publicKeyAlgorithmOid: string;
	readonly publicKeyParametersOid?: string;
	readonly subjectKeyIdentifier?: string;
}

Properties

• readonly subject: ParsedName — Parsed subject distinguished name. Used for semantic issuer matching (RFC 5280 §7.1).
• readonly subjectPublicKeyInfoDer: Uint8Array — DER-encoded SubjectPublicKeyInfo used to verify signatures from this anchor.
• readonly publicKeyAlgorithmOid: string — OID of the public key algorithm (e.g. 1.2.840.10045.2.1 for EC).
• readonly publicKeyParametersOid?: string — OID of the key parameters, when algorithm-specific (e.g. named curve OID for EC).
• readonly subjectKeyIdentifier?: string — Hex-encoded subject key identifier for AKI matching.