API index

Every documented primitive, grouped by namespace page — 349 primitives. Generated from the same source comments that build the rest of this site.

Constants

Primitive	Since	Status
`C.TIME.days(n) -> milliseconds`	0.1.0	stable
`C.BYTES.mib(n) -> bytes`	0.1.0	stable

Errors

Primitive	Since	Status
`new PkiError(message, code)`	0.1.0	stable
`pki.errors.defineClass(name, opts?) -> constructor`	0.1.0	stable

ASN.1 / DER

Primitive	Since	Status
`pki.asn1.decode(bytes, opts?) -> node`	0.1.0	stable
`pki.asn1.read.oid(node) -> "1.2.840.113549.1.1.11"`	0.1.15	stable
`pki.asn1.encode(classBits, constructed, tagNumber, content) -> Buffer`	0.1.0	stable
`pki.asn1.build.sequence([ ...tlvBuffers ]) -> Buffer`	0.1.0	stable

CBOR (deterministic)

Primitive	Since	Status
`pki.cbor.decode(bytes, opts?) -> node`	0.1.27	stable
`pki.cbor.read.uint(node) -> 0n`	0.1.27	stable
`pki.cbor.read.nint(node) -> -1n`	0.1.27	stable
`pki.cbor.read.int(node) -> -1n`	0.1.27	stable
`pki.cbor.read.byteString(node) -> Buffer`	0.1.27	stable
`pki.cbor.read.textString(node) -> "text"`	0.1.27	stable
`pki.cbor.read.array(node) -> [node, ...]`	0.1.27	stable
`pki.cbor.read.map(node) -> [[keyNode, valueNode], ...]`	0.1.27	stable
`pki.cbor.read.mapGet(node, key) -> valueNode \| null`	0.2.20	stable
`pki.cbor.read.boolean(node) -> false`	0.1.27	stable
`pki.cbor.read.nullValue(node) -> null`	0.1.27	stable
`pki.cbor.read.undefinedValue(node) -> undefined`	0.1.27	stable
`pki.cbor.read.float(node) -> 1.5`	0.1.27	stable
`pki.cbor.read.biguint(node) -> 18446744073709551616n`	0.1.27	stable
`pki.cbor.read.time(node) -> Date`	0.1.27	stable
`pki.cbor.read.oid(node) -> "2.5.4.3"`	0.1.27	stable

Object Identifiers

Primitive	Since	Status
`pki.oid.name(dotted) -> string \| undefined`	0.1.0	stable
`pki.oid.register(dotted, name) -> void`	0.1.0	stable
`pki.oid.registerFamily(base, members) -> void`	0.1.2	stable
`pki.oid.paramsMustBeAbsent(dotted) -> boolean`	0.1.21	stable

WebCrypto

Primitive	Since	Status
`new pki.webcrypto.CryptoKey(type, extractable, algorithm, usages, handle)`	0.1.0	stable
`await pki.webcrypto.subtle.exportKey(format, key)`	0.1.0	stable
`pki.webcrypto.getRandomValues(typedArray) / pki.webcrypto.subtle`	0.1.0	stable

CMC

Primitive	Since	Status
`pki.cmc.verify(response, sent?) -> Promise<verdict>`	0.4.16	stable
`pki.cmc.build(spec, signer, opts?) -> Promise<Buffer\|string>`	0.4.16	stable
`pki.schema.cmc.parsePkiData(der, caps?) -> parsed`	0.4.16	stable
`pki.schema.cmc.parsePkiResponse(der, caps?) -> parsed`	0.4.16	stable
`pki.schema.cmc.parse(input, caps?) -> parsed`	0.4.16	stable

Possession statements

Primitive	Since	Status
`pki.possession.parse(value) -> { signer, certificate }`	0.8.44	stable
`pki.possession.verifyRequest(request, opts) -> Promise<verdict>`	0.8.44	stable

PKCS#11 URI

Primitive	Since	Status
`pki.pkcs11.parseUri(uri) -> parsed`	0.8.7	stable
`pki.pkcs11.formatUri(record) -> string`	0.8.7	stable

CMS DigestedData

Primitive	Since	Status
`pki.cms.digest(content, opts?) -> Promise<Buffer\|string>`	0.8.1	stable
`pki.cms.verifyDigest(input, opts?) -> Promise<verdict>`	0.8.1	stable

Service identity (RFC 9525)

Primitive	Since	Status
`pki.identity.match(cert, references, opts?) -> verdict`	0.8.8	stable

Certification path validation (RFC 5280 6)

Primitive	Since	Status
`pki.path.validate(path, opts) -> Promise<result>`	0.1.16	stable
`pki.path.crlChecker(crls, opts?) -> RevocationChecker`	0.1.16	stable
`pki.path.ocspChecker(responses) -> RevocationChecker`	0.1.32	stable
`pki.path.verifyOcspResponse(response, cert, issuerCert, time, opts?) -> Promise<{ valid, status, responderAuthorized, signatureValid, matched, nonceMatched, thisUpdate, nextUpdate, revocationReason?, revocationTime?, reason }>`	0.2.22	stable
`pki.path.anchorFromCert(cert) -> { name, publicKey, algorithm, parameters, subjectDer }`		stable
`pki.path.build(leaf, opts) -> Promise<{ valid, path, trustAnchor, result, candidatesConsidered, aiaFetches }>`	0.3.7	stable

Trust-store ingestion

Primitive	Since	Status
`pki.trust.parseCertdata(text) -> { anchors }`	0.2.0	stable
`pki.trust.parseCcadbCsv(text) -> { anchors }`	0.2.0	stable
`pki.trust.anchor(entry, opts?) -> trustAnchor`	0.2.0	stable
`pki.trust.parseTrustAnchorList(input, opts?) -> { anchors }`	0.8.13	stable
`pki.trust.discoversBundles(platform) -> boolean`	0.8.15	stable
`pki.trust.systemAnchors(opts?) -> { anchors, source, path, skipped }`	0.8.15	stable

JOSE (JWS / JWK)

Primitive	Since	Status
`pki.jose.base64url.encode(bytes) -> string`	0.1.25	stable
`pki.jose.base64url.decode(text) -> Buffer`	0.1.25	stable
`pki.jose.parseJson(input) -> value`	0.1.25	stable
`pki.jose.assertPublicJwk(jwk) -> jwk`	0.1.25	stable
`pki.jose.verify(jws, opts) -> Promise<{ header, payload, keySource }>`	0.1.25	stable
`pki.jose.sign(opts) -> Promise<{ protected, payload, signature }>`	0.1.25	stable
`pki.jose.thumbprint(jwk) -> Promise<string>`	0.1.25	stable
`pki.jose.sigAlgs() -> Array<{alg,kty,crv,hash,saltLength}>`	0.5.3	stable

ACME

Primitive	Since	Status
`pki.acme.assertTransition(kind, from, to) -> void`	0.1.25	stable
`pki.acme.validateProblem(obj) -> obj`	0.1.25	stable
`pki.acme.validate(kind, obj) -> obj`	0.1.25	stable
`pki.acme.identify(obj) -> string`	0.1.25	stable
`pki.acme.keyAuthorization(token, accountJwk) -> Promise<string>`	0.1.25	stable
`pki.acme.http01(token, accountJwk) -> Promise<{ path, body }>`	0.1.25	stable
`pki.acme.dns01(token, accountJwk, domain) -> Promise<{ name, value }>`	0.1.25	stable
`pki.acme.tlsAlpn01Extension(token, accountJwk) -> Promise<Buffer>`	0.1.25	stable
`pki.acme.verifyTlsAlpn01(certDer, token, accountJwk, identifier) -> Promise<void>`	0.1.25	stable
`pki.acme.postAsGet(opts) -> Promise<object>`	0.1.25	stable
`pki.acme.newAccount(opts) -> Promise<object>`	0.1.25	stable
`pki.acme.externalAccountBinding(opts) -> Promise<object>`	0.1.25	stable
`pki.acme.newOrder(opts) -> Promise<object>`	0.1.25	stable
`pki.acme.newAuthz(opts) -> flattened JWS`	0.3.29	stable
`pki.acme.finalize(opts) -> Promise<object>`	0.1.25	stable
`pki.acme.challengeResponse(opts) -> Promise<object>`	0.1.25	stable
`pki.acme.deactivate(opts) -> Promise<object>`	0.1.25	stable
`pki.acme.updateAccount(opts) -> Promise<object>`	0.6.4	stable
`pki.acme.revokeCert(opts) -> Promise<object>`	0.1.25	stable
`pki.acme.keyChange(opts) -> Promise<object>`	0.1.25	stable
`pki.acme.ariCertId(certDer) -> string`	0.1.25	stable
`pki.acme.parseAriCertId(certId) -> { keyIdentifier, serial }`	0.1.25	stable
`pki.acme.validateRenewalInfo(obj) -> obj`	0.1.25	stable
`pki.acme.client(directoryUrl, opts) -> client`	0.3.18	stable

HPKE

Primitive	Since	Status
`pki.hpke.setupS(suiteIds, recipientPublicKey, opts?) -> { enc, context, sharedSecret }`	0.2.2	stable
`pki.hpke.setupR(suiteIds, enc, recipientPrivateKey, opts?) -> context`	0.2.2	stable
`pki.hpke.seal(suiteIds, recipientPublicKey, opts, aad, pt) -> { enc, ct }`	0.2.2	stable
`pki.hpke.open(suiteIds, enc, recipientPrivateKey, opts, aad, ct) -> pt`	0.2.2	stable
`pki.hpke.deriveKeyPair(kemId, ikm) -> { publicKey, privateKey }`	0.8.45	stable
`pki.hpke.generateKeyPair(kemId) -> { publicKey, privateKey }`	0.8.45	stable
`pki.hpke.encap(kemId, recipientPublicKey) -> { enc, sharedSecret }`	0.8.45	stable
`pki.hpke.decap(kemId, enc, recipientPrivateKey) -> sharedSecret`	0.8.45	stable

Composite ML-KEM

Primitive	Since	Status
`pki.kem.decapsulate(privateKey, ciphertext) -> Promise<Buffer>`	0.6.6	stable
`pki.kem.encapsulate(publicKey) -> Promise<{ sharedSecret: Buffer, ciphertext: Buffer }>`	0.6.6	stable

Transport

Primitive	Since	Status
`pki.transport.https(defaults?) -> transport`	0.3.16	stable
`pki.transport.peerChain(request, defaults?) -> Promise<channel>`	0.8.32	stable

OCSP

Primitive	Since	Status
`pki.ocsp.buildRequest(query, opts?) -> Buffer \| string`	0.2.22	stable
`pki.ocsp.sign(responseData, responder, opts?) -> Promise<Buffer \| string>`	0.2.22	stable
`pki.ocsp.buildErrorResponse(status) -> Buffer`	0.2.22	stable
`pki.ocsp.verify(response, opts) -> Promise<{ valid, status, responderAuthorized, signatureValid, matched, thisUpdate, nextUpdate, revocationReason?, revocationTime?, nonceMatched?, reason }>`	0.2.22	stable
`pki.ocsp.verifyRequest(request, opts?) -> Promise<{ valid, signed, signatureValid, requestorNamed, signerCert, signerCerts, certs, signerSubject, requestorName, requestList, requestExtensions, version, reason }>`	0.6.0	stable
`pki.ocsp.httpRequest(der, responderUrl, opts?) -> { method, url, headers, body }`	0.8.8	stable
`pki.schema.ocsp.parseRequest(input, caps?) -> ocspRequest`	0.1.11	stable
`pki.schema.ocsp.parseResponse(input, caps?) -> ocspResponse`	0.1.11	stable
`pki.schema.ocsp.pemDecode(text, label?) -> Buffer`	0.1.11	stable
`pki.schema.ocsp.pemEncode(der, label?) -> string`	0.1.23	stable

Schema

Primitive	Since	Status
`pki.schema.all() -> string[]`	0.1.7	stable
`pki.schema.parse(input, caps?) -> parsed`	0.1.7	stable
`pki.schema.detectFormat(input) -> string \| null`	0.3.8	stable
`pki.schema.pem.decodeBundle(text, opts) -> [{ index, offset, label, der }]`	0.8.8	stable
`pki.schema.pem.encodeBundle(objects) -> string`	0.8.8	stable

Schema engine

Primitive	Since	Status
`pki.schema.engine.walk(schema, node, ctx) -> value`	0.1.7	stable
`pki.schema.engine.encode(schema, value, ctx) -> Buffer`	0.1.17	stable
`pki.schema.engine.embeddedDer(schema, bytes, ctx, opts?) -> value`	0.1.18	stable

C509

Primitive	Since	Status
`pki.schema.c509.parse(bytes, caps?) -> { certificateType, serialNumber, serialNumberHex, ... }`	0.2.30	stable
`pki.schema.c509.encode(input[, opts]) -> Buffer`	0.3.4	stable

X.509

Primitive	Since	Status
`pki.schema.x509.pemDecode(text, label?) -> Buffer`	0.1.7	stable
`pki.schema.x509.pemEncode(der, label) -> string`	0.1.7	stable
`pki.schema.x509.parse(input, caps?) -> certificate`	0.1.7	stable
`pki.schema.x509.decodeExtensions(certOrBytes, opts?) -> rows`	0.8.11	stable
`pki.schema.x509.decodeExtension(ext, opts?) -> row`	0.8.11	stable
`pki.x509.sign(spec, issuer, opts?) -> Promise<Buffer\|string>`	0.3.0	stable
`pki.x509.randomSerial() -> BigInt`	0.7.12	stable
`pki.x509.extension(name, value, opts?) -> Buffer`	0.7.33	stable
`pki.x509.parseDn(dn) -> { rdns, dn, bytes }`	0.8.2	stable

PKCS#8

Primitive	Since	Status
`pki.schema.pkcs8.parse(input, caps?) -> privateKey`	0.1.9	stable
`pki.schema.pkcs8.parseEncrypted(input, caps?) -> encrypted`	0.1.9	stable
`pki.schema.pkcs8.pemDecode(text, label?) -> Buffer`	0.1.9	stable
`pki.schema.pkcs8.pemEncode(der, label?) -> string`	0.1.9	stable

PKCS#1

Primitive	Since	Status
`pki.schema.pkcs1.parse(input, opts) -> key`	0.8.8	stable
`pki.schema.pkcs1.parsePublic(input, opts) -> key`	0.8.8	stable
`pki.schema.pkcs1.encode(key) -> Buffer`	0.8.8	stable
`pki.schema.pkcs1.encodePublic(key) -> Buffer`	0.8.8	stable

SEC1

Primitive	Since	Status
`pki.schema.sec1.parse(input, opts) -> key`	0.8.8	stable
`pki.schema.sec1.encode(key) -> Buffer`	0.8.8	stable

TSP

Primitive	Since	Status
`pki.schema.tsp.parseRequest(input, caps?) -> timeStampReq`	0.2.19	stable
`pki.schema.tsp.parseTstInfo(input, caps?) -> tstInfo`	0.1.13	stable
`pki.schema.tsp.parse(input, caps?) -> timeStampResp`	0.1.13	stable
`pki.schema.tsp.parseToken(input, caps?) -> tstInfo`	0.1.13	stable
`pki.schema.tsp.pemDecode(text, label?) -> Buffer`	0.1.13	stable
`pki.schema.tsp.pemEncode(der, label) -> string`	0.1.23	stable
`pki.tsp.sign(messageImprint, tsa, opts) -> Promise<Buffer\|string>`	0.2.15	stable
`pki.tsp.request(messageImprint, opts) -> Buffer\|string`	0.2.19	stable
`pki.tsp.parseRequest(input) -> timeStampReq`	0.2.19	stable
`pki.tsp.response(token, opts) -> Buffer\|string`	0.2.19	stable
`pki.tsp.parseResponse(input) -> timeStampResp`	0.2.19	stable
`pki.tsp.verify(token, data, opts) -> Promise<result>`	0.2.19	stable

Trust anchors

Primitive	Since	Status
`pki.schema.trustanchor.parse(input, caps?) -> trustAnchorList`	0.8.13	stable
`pki.schema.trustanchor.parseInfo(input, caps?) -> trustAnchorInfo`	0.8.13	stable
`pki.schema.trustanchor.pemDecode(text, label?) -> Buffer`	0.8.13	stable
`pki.schema.trustanchor.pemEncode(der, label?) -> string`	0.8.13	stable

S/MIME (ESS)

Primitive	Since	Status
`pki.schema.smime.parseSigningCertificate(der, caps?) -> { certs, policies }`	0.1.22	stable
`pki.schema.smime.parseSigningCertificateV2(der) -> { certs, policies }`	0.1.22	stable
`pki.schema.smime.parseSmimeCapabilities(der, caps?) -> { capabilities }`	0.1.22	stable
`pki.schema.smime.buildSigningCertificateV2(certs, opts?) -> Buffer`	0.8.52	stable
`pki.schema.smime.decodeAttribute(attr) -> { kind, ... }`	0.1.22	stable
`pki.smime.sign(content, signers, opts?) -> Promise<Buffer>`	0.2.25	stable
`pki.smime.verify(message, opts?) -> Promise<{ valid, trusted, signers, form, content, micalg, sender, protectedHeaders, headerProtection }>`	0.2.25	stable
`pki.smime.encrypt(content, recipients, opts?) -> Promise<Buffer>`	0.2.26	stable
`pki.smime.decrypt(message, keyMaterial, opts?) -> Promise<{ content, smimeType, authenticated, recipientType, recipientIndex, contentEncryptionAlgorithm, protectedHeaders, headerProtection }>`	0.2.26	stable
`pki.smime.compress(content, opts?) -> Promise<Buffer>`	0.2.27	stable
`pki.smime.decompress(message, opts?) -> Promise<{ content, contentType, contentTypeName, compressionAlgorithm }>`	0.2.27	stable
`pki.smime.buildCertsOnly(certs, opts?) -> Buffer`	0.6.3	stable

CSR Attributes

Primitive	Since	Status
`pki.schema.csrattrs.parse(der, caps?) -> { items }`	0.1.24	stable

EST

Primitive	Since	Status
`pki.est.transferDecode(body) -> Buffer`	0.1.24	stable
`pki.est.transferEncode(der) -> string`	0.1.24	stable
`pki.est.parseCertsOnly(der) -> { certificates, crls }`	0.1.24	stable
`pki.est.classifyResponse(status, headers, body, opts?) -> verdict`	0.1.24	stable
`pki.est.paths(baseUrl, opts?) -> { cacerts, simpleenroll, ... }`	0.1.24	stable
`pki.est.challengePasswordFromTlsUnique(channelBinding) -> Buffer`	0.6.31	stable
`pki.est.fullcmc(baseUrl, request, opts?) -> Promise<verdict \| { retry, retryAfterSeconds }>`	0.4.16	stable
`pki.est.cacerts(baseUrl, opts?) -> Promise<{ certificates, crls } \| { retry, retryAfterSeconds }>`	0.3.16	stable
`pki.est.simpleenroll(baseUrl, csr \| builder, opts?) -> Promise<{ certificate, chain, certificates } \| { retry, retryAfterSeconds }>`	0.3.16	stable
`pki.est.simplereenroll(baseUrl, csr \| builder, opts?) -> Promise<{ certificate, chain, certificates } \| { retry, retryAfterSeconds }>`	0.3.16	stable
`pki.est.serverkeygen(baseUrl, csr, opts?) -> Promise<{ certificates, privateKey } \| { certificates, encryptedKey } \| { retry, retryAfterSeconds, retryAfterDate }>`	0.3.28	stable
`pki.est.csrattrs(baseUrl, opts?) -> Promise<{ available: true, attrs, plan } \| { available: false, attrs: null }>`	0.3.28	stable

SCEP

Primitive	Since	Status
`pki.scep.build(spec) -> Promise<Buffer>`	0.6.2	stable
`pki.scep.parse(bytes, opts?) -> Promise<verdict>`	0.6.2	stable
`pki.scep.parseCapabilities(text) -> { AES?, "SHA-256"?, POSTPKIOperation?, ... }`	0.6.7	stable
`pki.scep.getCACaps(baseUrl, opts?) -> Promise<capabilities>`	0.6.7	stable
`pki.scep.getCACert(baseUrl, opts?) -> Promise<{ caCertificate, certificates }>`	0.6.7	stable
`pki.scep.getNextCACert(baseUrl, opts) -> Promise<{ certificates }>`	0.6.14	stable
`pki.scep.enroll(baseUrl, opts) -> Promise<{ status, certificate?, certificates?, transactionId }>`	0.6.7	stable
`pki.scep.renew(baseUrl, opts) -> Promise<{ status, certificate?, certificates?, transactionId }>`	0.6.7	stable
`pki.scep.getCert(baseUrl, opts) -> Promise<{ certificate, certificates, transactionId }>`	0.6.17	stable
`pki.scep.getCrl(baseUrl, opts) -> Promise<{ crl, crls, transactionId }>`	0.6.17	stable

Stateful hash-based

Primitive	Since	Status
`pki.shbs.verify(publicKey, message, signature) -> boolean`	0.2.1	stable
`pki.shbs.verifyLms(publicKey, message, signature) -> boolean`	0.2.1	stable

Attribute certificates

Primitive	Since	Status
`pki.attrcert.sign(spec, issuer, opts?) -> Promise<Buffer\|string>`	0.3.2	stable
`pki.attrcert.verify(ac, issuer, opts) -> Promise<{ valid, verified, signatureValid, validityChecked, targetingChecked, revocationChecked, noRevAvail, holderBindingChecked, issuerPathChecked, holder, issuer, attributes, extensions, notBefore, notAfter, serialNumberHex, reason }>`	0.5.15	stable
`pki.schema.attrcert.parse(input, caps?) -> attributeCertificate`	0.1.14	stable
`pki.schema.attrcert.pemDecode(text, label?) -> Buffer`	0.1.14	stable
`pki.schema.attrcert.pemEncode(der, label?) -> string`	0.1.23	stable
`pki.schema.attrcert.decodeExtensions(acOrBytes, opts?) -> rows`	0.8.11	stable
`pki.schema.attrcert.decodeExtension(ext, opts?) -> row`	0.8.11	stable

Certificate management protocol messages

Primitive	Since	Status
`pki.cmp.build(message, opts?) -> Promise<Buffer\|string>`	0.3.5	stable
`pki.cmp.transfer(url, message, opts?) -> Promise<{ response, responseBytes, status, contentType, tls }>`	0.3.19	stable
`pki.cmp.wellKnownUrl(base, opts?) -> string`	0.3.19	stable
`pki.schema.cmp.parse(input, caps?) -> pkiMessage`	0.1.19	stable
`pki.schema.cmp.pemDecode(text, label?) -> Buffer`	0.1.19	stable
`pki.schema.cmp.pemEncode(der, label?) -> string`	0.1.19	stable

CRLs

Primitive	Since	Status
`pki.crl.sign(spec, issuer, opts?) -> Promise<Buffer\|string>`	0.3.9	stable
`pki.crl.verify(crl, issuer) -> Promise<{ valid, issuerMaySign, signatureValid, issuer, code?, reason? }>`	0.3.9	stable
`pki.crl.isRevoked(crl, serialNumber, opts?) -> entry \| null`	0.3.9	stable
`pki.schema.crl.parse(input, caps?) -> crl`	0.1.7	stable
`pki.schema.crl.pemDecode(text, label?) -> Buffer`	0.1.7	stable
`pki.schema.crl.pemEncode(der, label?) -> string`	0.1.23	stable
`pki.schema.crl.decodeExtensions(crlOrBytes, opts?) -> rows`	0.8.11	stable
`pki.schema.crl.decodeExtension(ext, opts) -> row`	0.8.11	stable

Certificate request messages

Primitive	Since	Status
`pki.crmf.build(spec, key?, opts?) -> Promise<Buffer\|string>`	0.3.3	stable
`pki.crmf.buildCertTemplate(template) -> Buffer`	0.3.5	stable
`pki.crmf.verifyPop(messages) -> Promise<{ valid, verified, messages: [{ valid, verified, method, cryptographicallyVerified, certReqId, subject, subjectBound, publicKey, reason }] }>`	0.5.14	stable
`pki.schema.crmf.parse(input, caps?) -> certReqMessages`	0.1.17	stable
`pki.schema.crmf.pemDecode(text, label?) -> Buffer`	0.1.17	stable
`pki.schema.crmf.pemEncode(der, label) -> string`	0.1.23	stable
`pki.schema.crmf.decodeExtensions(messagesOrBytes, opts?) -> rows`	0.8.11	stable
`pki.schema.crmf.decodeExtension(ext, opts?) -> row`	0.8.11	stable

Certification requests

Primitive	Since	Status
`pki.csr.sign(spec, key, opts?) -> Promise<Buffer\|string>`	0.3.1	stable
`pki.csr.verify(request) -> Promise<{ valid, verified, subject, subjectPublicKeyInfo, attributes, certificationRequestInfoBytes }>`	0.5.13	stable
`pki.schema.csr.parse(input, caps?) -> csr`	0.1.8	stable
`pki.schema.csr.pemDecode(text, label?) -> Buffer`	0.1.8	stable
`pki.schema.csr.pemEncode(der, label?) -> string`	0.1.8	stable
`pki.schema.csr.decodeExtensions(csrOrBytes, opts?) -> rows`	0.8.11	stable
`pki.schema.csr.decodeExtension(ext, opts?) -> row`	0.8.11	stable

Keys

Primitive	Since	Status
`pki.key.encrypt(privateKey, password, opts?) -> Promise<Buffer\|string>`	0.3.10	stable
`pki.key.decrypt(encrypted, password, opts?) -> Promise<Buffer\|string>`	0.3.10	stable
`pki.key.export(key, opts?) -> Promise<Buffer\|string>`	0.3.10	stable
`pki.key.import(input, opts?) -> Promise<CryptoKey>`	0.3.10	stable
`pki.key.generate(algorithm, opts?) -> Promise<{ privateKey, publicKey }>`	0.3.10	stable
`pki.key.publicFromPrivate(privateKey, opts?) -> Promise<Buffer\|string>`	0.3.10	stable

PKCS#12

Primitive	Since	Status
`pki.pkcs12.build(spec, opts?) -> Promise<Buffer\|string>`	0.3.11	stable
`pki.pkcs12.verifyMac(pfx, password, opts?) -> Promise<{ valid, macAlgorithm, macAlgorithmName, iterationCount }>`	0.3.11	stable
`pki.pkcs12.open(pfx, password, opts?) -> Promise<OpenResult>`	0.3.12	stable
`pki.schema.pkcs12.parse(input, caps?) -> pfx`	0.1.18	stable
`pki.schema.pkcs12.pemDecode(text, label?) -> Buffer`	0.1.18	stable
`pki.schema.pkcs12.pemEncode(der, label?) -> string`	0.1.18	stable

Primitive	Since	Status
`pki.relatedCert.requestSignedData(spec) -> Buffer`	0.8.42	stable
`pki.relatedCert.certificateHash(certificate, digestAlgorithm?) -> { hashAlgorithm, hashValue }`	0.8.42	stable
`pki.relatedCert.matchesCertificate(relatedCertificate, certificate) -> boolean`	0.8.42	stable
`pki.relatedCert.verifyRequest(requesterCertificate, certificate, opts?) -> Promise<boolean>`	0.8.42	stable

Alternative signatures

Primitive	Since	Status
`pki.altSig.signedData(structure) -> Buffer`	0.8.43	stable
`pki.altSig.subjectAltPublicKey(certificate) -> Buffer`	0.8.43	stable
`pki.altSig.verify(structure, issuerAltPublicKey, opts?) -> Promise<boolean>`	0.8.43	stable

Sigstore

Primitive	Since	Status
`pki.sigstore.pae(payloadType, payloadBytes) -> Buffer`	0.2.3	stable
`pki.sigstore.parseBundle(input) -> bundle`	0.2.3	stable
`pki.sigstore.verifyBundle(bundle, opts) -> Promise<result>`	0.2.3	stable

Inspect

Primitive	Since	Status
`pki.inspect.certificate(input) -> string`	0.2.4	stable
`pki.inspect.crl(input) -> string`	0.3.8	stable
`pki.inspect.csr(input) -> string`	0.3.8	stable
`pki.inspect.cms(input) -> string`	0.3.8	stable
`pki.inspect.pkcs8(input) -> string`	0.8.29	stable
`pki.inspect.pkcs12(input) -> string`	0.8.29	stable
`pki.inspect.crmf(input) -> string`	0.8.29	stable
`pki.inspect.cmp(input) -> string`	0.8.29	stable
`pki.inspect.csrattrs(input) -> string`	0.8.29	stable
`pki.inspect.trustanchor(input) -> string`	0.8.29	stable
`pki.inspect.ocspRequest(input) -> string`	0.8.29	stable
`pki.inspect.ocspResponse(input) -> string`	0.8.29	stable
`pki.inspect.tsp(input) -> string`	0.8.29	stable
`pki.inspect.attrcert(input) -> string`	0.8.29	stable
`pki.inspect.asn1(input, opts?) -> string`	0.8.31	stable
`pki.inspect.any(input) -> string`	0.3.8	stable

Lint

Primitive	Since	Status
`pki.lint.certificate(input, opts?) -> LintReport`	0.2.10	stable
`pki.lint.crl(pem \| der \| parsed, opts?) -> LintReport`	0.7.9	stable
`pki.lint.csr(pem \| der \| parsed, opts?) -> LintReport`	0.8.16	stable
`pki.lint.ocsp(pem \| der \| parsed, opts?) -> LintReport`	0.7.26	stable
`pki.lint.cms(pem \| der \| parsed, opts?) -> LintReport`	0.8.26	stable
`pki.lint.tsp(pem \| der, opts?) -> LintReport`	0.8.26	stable
`pki.lint.attrcert(pem \| der, opts?) -> LintReport`	0.8.26	stable
`pki.lint.rules(profile?, artifact?) -> [{id, severity, source, citation}]`	0.2.10	stable
`pki.lint.profiles() -> [string]`	0.2.10	stable

CT

Primitive	Since	Status
`pki.ct.parseSctList(extValue) -> { scts, unknownScts, all }`	0.1.20	stable
`pki.ct.reconstructSignedData(entry, sct) -> Buffer`	0.1.20	stable
`pki.ct.verifySct(entry, sct, logPublicKey) -> Promise<boolean>`	0.2.12	stable
`pki.ct.encodeSctList(scts) -> Buffer`	0.2.24	stable
`pki.ct.signSct(entry, logKey, opts?) -> Promise<sct>`	0.2.24	stable
`pki.ct.parseLogList(json, opts?) -> { logs, byLogId, version, timestamp }`	0.2.28	stable
`pki.ct.verifySctWithLogList(entry, sct, logList, opts?) -> Promise<{ valid, logId, logIdHex, operator, logState, timestamp }>`	0.2.28	stable
`pki.ct.verifySctList(entry, list, logList, opts?) -> Promise<verdict>`	0.6.1	stable
`pki.ct.x509CertEntry(cert, issuer) -> { entryType, tbsCertificate, issuerKeyHash }`	0.6.1	stable
`pki.ct.verifyLogListSignature(json, signature, publicKey) -> Promise<boolean>`	0.2.29	stable
`pki.ct.sthSignedData(sth) -> Buffer`	0.8.40	stable
`pki.ct.verifySth(sth, logKey) -> Promise<boolean>`	0.8.40	stable
`pki.ct.getSth(opts) -> Promise<{ treeSize, timestamp, rootHash, signature, raw }>`	0.8.40	stable
`pki.ct.getProofByHash(opts) -> Promise<{ leafIndex, auditPath, verified }>`	0.8.40	stable
`pki.ct.getSthConsistency(opts) -> Promise<{ consistency, verified }>`	0.8.40	stable
`pki.ct.getEntries(opts) -> Promise<{ entries, requested, truncated }>`	0.8.40	stable
`pki.ct.getRoots(opts) -> Promise<{ certificates }>`	0.8.40	stable
`pki.ct.addChain(opts) -> Promise<{ sct, verified }>`	0.8.40	stable
`pki.ct.addPreChain(opts) -> Promise<{ sct, verified }>`	0.8.40	stable
`pki.ct.fetchLogList(opts) -> Promise<{ logs, byLogId, version, timestamp, raw, status, contentType, tls }>`	0.3.21	stable

TLS

Primitive	Since	Status
`pki.tls.decompressCertificate(bytes, opts?) -> { algorithm, algorithmName, uncompressedLength, certificateMessage, certificate }`	0.4.3	stable
`pki.tls.parseCertificateMessage(bytes, opts?) -> { certificateRequestContext, entries }`	0.4.3	stable
`pki.tls.compressCertificate(certificateMessage, opts?) -> Buffer`	0.4.3	stable

Merkle

Primitive	Since	Status
`pki.merkle.leafHash(entry) -> Buffer`	0.1.28	stable
`pki.merkle.nodeHash(left, right) -> Buffer`	0.1.28	stable
`pki.merkle.emptyRootHash() -> Buffer`	0.1.28	stable
`pki.merkle.verifyInclusion(opts) -> boolean`	0.1.28	stable
`pki.merkle.verifyConsistency(opts) -> boolean`	0.1.28	stable
`pki.merkle.root(leafHashes) -> Buffer`	0.8.34	stable
`pki.merkle.inclusionProof(opts) -> Buffer[]`	0.8.34	stable
`pki.merkle.consistencyProof(opts) -> Buffer[]`	0.8.34	stable

Tlog

Primitive	Since	Status
`pki.tlog.keyId(keyName, publicKey) -> Buffer`	0.8.33	stable
`pki.tlog.parseNote(input) -> { text, signedBytes, signatures }`	0.8.33	stable
`pki.tlog.verifyNote(input, keys) -> Promise<{ verified, signers, note }>`	0.8.33	stable
`pki.tlog.parseCheckpoint(input) -> { origin, treeSize, rootHash, extensions, note }`	0.8.33	stable
`pki.tlog.verifyCheckpoint(input, keys, opts?) -> Promise<{ verified, signers, checkpoint }>`	0.8.33	stable
`pki.tlog.parseVkey(text) -> { name, keyId, signatureType, publicKey }`	0.8.37	stable
`pki.tlog.tilePath(level, index, width?) -> string`	0.8.33	stable
`pki.tlog.entryBundlePath(index, width?) -> string`	0.8.33	stable
`pki.tlog.checkpointPath() -> string`	0.8.33	stable
`pki.tlog.parseTilePath(path) -> { level, index, width }`	0.8.33	stable
`pki.tlog.parseTile(bytes, opts?) -> Buffer[]`	0.8.33	stable
`pki.tlog.parseEntryBundle(bytes) -> Buffer[]`	0.8.33	stable
`pki.tlog.tileWidth(treeSize, level, index) -> number \| null`	0.8.36	stable
`pki.tlog.inclusionProof(opts) -> Promise<Buffer[]>`	0.8.36	stable

TUF

Primitive	Since	Status
`pki.tuf.canonicalJson(value) -> Buffer`	0.8.41	stable
`pki.tuf.keyId(key) -> string`	0.8.41	stable
`pki.tuf.parseMetadata(input) -> { type, specVersion, version, expires, signed, signatures, signedBytes }`	0.8.41	stable
`pki.tuf.checkExpiry(metadata, now) -> true`	0.8.41	stable
`pki.tuf.verifySignatures(opts) -> Promise<{ verified, keyIds, threshold }>`	0.8.41	stable
`pki.tuf.updateRoot(opts) -> Promise<{ root, version, updated, walked }>`	0.8.41	stable

Trust anchor lists

Primitive	Since	Status
`pki.trustanchor.build(spec, opts?) -> Buffer \| string`	0.8.13	stable

WebAuthn

Primitive	Since	Status
`pki.webauthn.parseCoseKey(bytes) -> object`	0.5.2	stable
`pki.webauthn.parseAttestationObject(bytes) -> { fmt, attStmt, authData, authDataBytes }`	0.2.5	stable
`pki.webauthn.verify(attestationObject, clientDataHash?, opts?) -> Promise<{ valid, attestationVerified, fmt, attestationType, trustPath, anchoredTo, aaguid, credentialId, credentialPublicKey, credentialPublicKeyBytes, signCount, flags, rpIdHash, extensions, bindingChecked, clientData }>`	0.2.5	stable
`pki.webauthn.verifyMetadataBlob(blob, opts) -> Promise<{ no, legalHeader, nextUpdate, stale, allowStale, rollbackChecked, previousNo, entries, byAaguid, byKeyIdentifier, statusPolicy, rejectUnknownStatus }>`	0.4.11	stable
`pki.webauthn.metadataFor(metadata, identifier) -> entry \| null`	0.4.11	stable
`pki.webauthn.metadataAnchors(entry, opts?) -> [certificate]`	0.4.11	stable
`pki.webauthn.parseClientData(bytes, opts?) -> { type, challenge, origin, crossOrigin, topOrigin, checked }`	0.5.0	stable
`pki.webauthn.parseAuthenticatorData(bytes) -> { rpIdHash, flags, signCount, aaguid, credentialId, credentialPublicKey, credentialPublicKeyBytes, extensions }`	0.5.0	stable
`pki.webauthn.verifyAssertion(input) -> Promise<{ valid, signatureVerified, signCount, signCountChecked, flags, rpIdHash, extensions, bindingChecked, clientData }>`	0.5.0	stable

CMS

Primitive	Since	Status
`pki.cms.verify(input, opts?) -> Promise<{ valid, trusted, eContentType, eContent, signers }>`	0.2.14	stable
`pki.cms.sign(content, signers, opts?) -> Promise<Buffer\|string>`	0.2.15	stable
`pki.cms.countersign(cms, signers, opts?) -> Promise<Buffer\|string>`	0.3.13	stable
`pki.cms.encrypt(content, recipients, opts?) -> Promise<Buffer \| string>`	0.2.23	stable
`pki.cms.authenticate(content, recipients, opts?) -> Promise<Buffer \| string>`	0.3.14	stable
`pki.cms.decrypt(input, keyMaterial, opts?) -> Promise<{ content, contentType, contentTypeName, recipientType, recipientIndex, contentEncryptionAlgorithm, authenticated, authenticatedBy, originAuthenticated, originatorInfo }>`	0.2.23	stable
`pki.cms.compress(content, opts?) -> Promise<Buffer \| string>`	0.2.27	stable
`pki.cms.decompress(input, opts?) -> Promise<{ content, contentType, contentTypeName, compressionAlgorithm }>`	0.2.27	stable
`pki.cms.certsOnly(certs, opts?) -> Buffer \| string`	0.6.3	stable
`pki.cms.parseCertsOnly(input, opts?) -> { certificates, crls }`	0.6.3	stable
`pki.cms.isCertsOnly(input) -> boolean`	0.6.3	stable
`pki.schema.cms.parse(input, caps?) -> content`	0.1.10	stable
`pki.schema.cms.pemDecode(text, label?) -> Buffer`	0.1.10	stable
`pki.schema.cms.pemEncode(der, label?) -> string`	0.1.10	stable

pkijs.com — source-driven documentation, generated from the toolkit's own @primitive comment blocks. Zero runtime dependencies.