X509Certificate

[<Interface>]
type X509Certificate =
    abstract member ca: bool
    abstract member fingerprint: string
    abstract member fingerprint256: string
    abstract member fingerprint512: string
    abstract member infoAccess: string option
    abstract member issuer: string
    abstract member issuerCertificate: X509Certificate option
    abstract member keyUsage: string array
    abstract member publicKey: KeyObject
    abstract member raw: NonSharedBuffer
    abstract member serialNumber: string
    abstract member subject: string
    abstract member subjectAltName: string option
    abstract member validFrom: string
    abstract member validFromDate: Date
    abstract member validTo: string
    abstract member validToDate: Date
    abstract member checkEmail (email: string, ?options: Options) : string option
    abstract member checkHost (name: string, ?options: X509CheckOptions) : string option
    abstract member checkIP (ip: string) : string option
    abstract member checkIssued (otherCert: X509Certificate) : bool
    abstract member checkPrivateKey (privateKey: KeyObject) : bool
    abstract member toJSON () : string
    abstract member toLegacyObject () : PeerCertificate
    abstract member toString () : string
    abstract member verify (publicKey: KeyObject) : bool


Assembly	`Xantham.Fable.Node`

Encapsulates an X509 certificate and provides read-only access to its information.

const { X509Certificate } = await import('node:crypto');

const x509 = new X509Certificate('{... pem encoded cert ...}');

console.log(x509.subject);

@since v15.6.0

Declared inside


`CheckEmail`

Properties

abstract member ca: bool

Will be `true` if this is a Certificate Authority (CA) certificate.

@since v15.6.0

abstract member fingerprint: string

The SHA-1 fingerprint of this certificate.

Because SHA-1 is cryptographically broken and because the security of SHA-1 is significantly worse than that of algorithms that are commonly used to sign certificates, consider using x509.fingerprint256 instead.

@since v15.6.0

abstract member fingerprint256: string

The SHA-256 fingerprint of this certificate.

@since v15.6.0

abstract member fingerprint512: string

The SHA-512 fingerprint of this certificate.

Because computing the SHA-256 fingerprint is usually faster and because it is only half the size of the SHA-512 fingerprint, x509.fingerprint256 may be a better choice. While SHA-512 presumably provides a higher level of security in general, the security of SHA-256 matches that of most algorithms that are commonly used to sign certificates.

@since v17.2.0, v16.14.0

abstract member infoAccess: string option

A textual representation of the certificate's authority information access extension.

This is a line feed separated list of access descriptions. Each line begins with the access method and the kind of the access location, followed by a colon and the value associated with the access location.

After the prefix denoting the access method and the kind of the access location, the remainder of each line might be enclosed in quotes to indicate that the value is a JSON string literal. For backward compatibility, Node.js only uses JSON string literals within this property when necessary to avoid ambiguity. Third-party code should be prepared to handle both possible entry formats.

@since v15.6.0

abstract member issuer: string

The issuer identification included in this certificate.

@since v15.6.0

abstract member issuerCertificate: X509Certificate option

The issuer certificate or undefined if the issuer certificate is not available.

@since v15.9.0

abstract member keyUsage: string array

An array detailing the key usages for this certificate.

@since v15.6.0

abstract member publicKey: KeyObject

The public key KeyObject for this certificate.

@since v15.6.0

abstract member raw: NonSharedBuffer

A Buffer containing the DER encoding of this certificate.

@since v15.6.0

abstract member serialNumber: string

The serial number of this certificate.

Serial numbers are assigned by certificate authorities and do not uniquely identify certificates. Consider using x509.fingerprint256 as a unique identifier instead.

@since v15.6.0

abstract member subject: string

The complete subject of this certificate.

@since v15.6.0

abstract member subjectAltName: string option

The subject alternative name specified for this certificate.

This is a comma-separated list of subject alternative names. Each entry begins with a string identifying the kind of the subject alternative name followed by a colon and the value associated with the entry.

Earlier versions of Node.js incorrectly assumed that it is safe to split this property at the two-character sequence ', ' (see CVE-2021-44532). However, both malicious and legitimate certificates can contain subject alternative names that include this sequence when represented as a string.

After the prefix denoting the type of the entry, the remainder of each entry might be enclosed in quotes to indicate that the value is a JSON string literal. For backward compatibility, Node.js only uses JSON string literals within this property when necessary to avoid ambiguity. Third-party code should be prepared to handle both possible entry formats.

@since v15.6.0

abstract member validFrom: string

The date/time from which this certificate is considered valid.

@since v15.6.0

abstract member validFromDate: Date

The date/time from which this certificate is valid, encapsulated in a Date object.

@since v22.10.0

abstract member validTo: string

The date/time until which this certificate is considered valid.

@since v15.6.0

abstract member validToDate: Date

The date/time until which this certificate is valid, encapsulated in a Date object.

@since v22.10.0

Methods

abstract member checkEmail (email: string, ?options: Options) : string option

Checks whether the certificate matches the given email address.

If the 'subject' option is undefined or set to 'default', the certificate subject is only considered if the subject alternative name extension either does not exist or does not contain any email addresses.

If the 'subject' option is set to 'always' and if the subject alternative name extension either does not exist or does not contain a matching email address, the certificate subject is considered.

If the 'subject' option is set to 'never', the certificate subject is never considered, even if the certificate contains no subject alternative names.

@since v15.6.0

Returns. Returns email if the certificate matches, undefined if it does not.

abstract member checkHost (name: string, ?options: X509CheckOptions) : string option

Checks whether the certificate matches the given host name.

If the certificate matches the given host name, the matching subject name is returned. The returned name might be an exact match (e.g., foo.example.com) or it might contain wildcards (e.g., *.example.com). Because host name comparisons are case-insensitive, the returned subject name might also differ from the given name in capitalization.

If the 'subject' option is set to 'always' and if the subject alternative name extension either does not exist or does not contain a matching DNS name, the certificate subject is considered.

If the 'subject' option is set to 'never', the certificate subject is never considered, even if the certificate contains no subject alternative names.

@since v15.6.0

Returns. Returns a subject name that matches name, or undefined if no subject name matches name.

abstract member checkIP (ip: string) : string option

Checks whether the certificate matches the given IP address (IPv4 or IPv6).

Only RFC 5280iPAddress subject alternative names are considered, and they must match the given ip address exactly. Other subject alternative names as well as the subject field of the certificate are ignored.

@since v15.6.0

Returns. Returns ip if the certificate matches, undefined if it does not.

abstract member checkIssued (otherCert: X509Certificate) : bool

Checks whether this certificate was potentially issued by the given otherCert by comparing the certificate metadata.

This is useful for pruning a list of possible issuer certificates which have been selected using a more rudimentary filtering routine, i.e. just based on subject and issuer names.

Finally, to verify that this certificate's signature was produced by a private key corresponding to otherCert's public key use x509.verify(publicKey) with otherCert's public key represented as a KeyObject like so

if (!x509.verify(otherCert.publicKey)) {
throw new Error('otherCert did not issue x509');
}

@since v15.6.0

abstract member checkPrivateKey (privateKey: KeyObject) : bool

Checks whether the public key for this certificate is consistent with the given private key.

@since v15.6.0

Parameter
`privateKey`	A private key.

abstract member toJSON () : string

There is no standard JSON encoding for X509 certificates. ThetoJSON() method returns a string containing the PEM encoded certificate.

@since v15.6.0

abstract member toLegacyObject () : PeerCertificate

Returns information about this certificate using the legacy certificate object encoding.

@since v15.6.0

abstract member toString () : string

Returns the PEM-encoded certificate.

@since v15.6.0

abstract member verify (publicKey: KeyObject) : bool

Verifies that this certificate was signed by the given public key. Does not perform any other validation checks on the certificate.

@since v15.6.0

Parameter
`publicKey`	A public key.