ValidateForTlsServerInput

Input for validateForTlsServer. Enforces serverAuth EKU and optional DNS/IP identity matching.

interface ValidateForTlsServerInput extends BuildCandidatePathInput, PolicyValidationInput, InitialNameConstraintsInput {
	readonly policy?: PolicyValidationInput;
	readonly nameConstraints?: InitialNameConstraintsInput;
	readonly leaf: CertificateSource;
	readonly intermediates?: readonly CertificateSource[];
	readonly roots: readonly CertificateSource[];
	readonly trustAnchors?: readonly TrustAnchor[];
	readonly at?: Date;
	readonly serviceIdentity?: ServiceIdentityInput;
}

Properties

• readonly policy?: PolicyValidationInput — Nested policy validation overrides.
• readonly nameConstraints?: InitialNameConstraintsInput — Nested name constraint overrides.
• readonly leaf: CertificateSource — End-entity certificate to verify.
• readonly intermediates?: readonly CertificateSource[] — Intermediate CA certificates.
• readonly roots: readonly CertificateSource[] — Trusted root CA certificates.
• readonly trustAnchors?: readonly TrustAnchor[] — Bare trust anchors.
• readonly at?: Date — Validation time. Defaults to new Date().
• readonly serviceIdentity?: ServiceIdentityInput — DNS/IP identity to match against the leaf's SAN.