Inspect: render any PKI structure as readable text

Human-readable inspection of a parsed certificate: the pure-JS equivalent of openssl x509 -text. certificate(input) ingests a PEM string, a DER Buffer, or an already-parsed certificate and returns a familiar OpenSSL-style report: version, serial, signature algorithm, the issuer and subject distinguished names, the validity window, the public-key details (curve or modulus size plus the raw point/modulus), every decoded extension with its critical flag, and the signature. It renders purely from the toolkit's own strict parser and two-way OID registry, with no OpenSSL dependency and no drift-prone second naming table, so it names extension and algorithm OIDs an OpenSSL build shows only as raw bytes. The format is stable and OpenSSL-*familiar*, never byte-identical to any one OpenSSL version (those disagree across releases). Rendering is best-effort: a malformed extension falls back to a hex dump and does not throw.

pki.inspect.certificate

since 0.2.4 stable
pki.inspect.certificate(input) -> string

Render a certificate as a human-readable, OpenSSL-familiar text report. input is a PEM string, a DER Buffer, or a pki.schema.x509.parse result. A value that is none of those throws inspect/bad-input; a malformed certificate throws inspect/bad-certificate; but a malformed individual extension is rendered as a hex dump and does not fail the whole report. Pure, with no OpenSSL dependency.

Example

async function example() {
  var pair = await pki.key.generate("Ed25519");
  var der = await pki.x509.sign({ subject: "example.com", subjectPublicKey: await pki.key.export(pair.publicKey),
    notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") },
    { key: await pki.key.export(pair.privateKey) });
  var cert = pki.schema.x509.parse(der);
  pki.inspect.certificate(cert).split("\n")[0]; // "Certificate:"
}
example();

See also: pki.schema.x509.parse

References

pki.inspect.crl

since 0.3.8 stable
pki.inspect.crl(input) -> string

Render a certificate revocation list as an openssl crl -text-familiar text report: issuer, Last/Next Update, the CRL extensions, each revoked entry (serial, revocation date, entry extensions), and the signature. input is a PEM string, a DER Buffer, or a pki.schema.crl.parse result; a non-CRL throws inspect/bad-crl, a wrong-type input inspect/bad-input. A malformed individual extension renders as hex and does not fail the report.

Example

async function example() {
  var pair = await pki.key.generate("Ed25519");
  var key = await pki.key.export(pair.privateKey);
  var caCert = await pki.x509.sign({ subject: "Issuing CA", subjectPublicKey: await pki.key.export(pair.publicKey),
    notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z"),
    extensions: { basicConstraints: { cA: true }, keyUsage: ["cRLSign"] } }, { key: key });
  var crlDer = await pki.crl.sign({ thisUpdate: new Date("2026-01-01T00:00:00Z"), crlNumber: 1n, revoked: [] },
    { cert: caCert, key: key });
  pki.inspect.crl(crlDer).split("\n")[0]; // "Certificate Revocation List (CRL):"
}
example();

See also: pki.schema.crl.parse, pki.inspect.certificate

References

pki.inspect.csr

since 0.3.8 stable
pki.inspect.csr(input) -> string

Render a PKCS#10 certification request as an openssl req -text-familiar text report: subject, the subject public key, the requested extensions and other attributes, and the signature. input is a PEM string, a DER Buffer, or a pki.schema.csr.parse result; a non-CSR throws inspect/bad-csr, a wrong-type input inspect/bad-input. Best-effort like certificate.

Example

async function example() {
  var pair = await pki.key.generate("Ed25519");
  var csrDer = await pki.csr.sign({ subject: "req.example", subjectPublicKey: await pki.key.export(pair.publicKey) },
    { key: await pki.key.export(pair.privateKey) });
  pki.inspect.csr(csrDer).split("\n")[0]; // "Certificate Request:"
}
example();

See also: pki.schema.csr.parse, pki.inspect.certificate

References

pki.inspect.cms

since 0.3.8 stable
pki.inspect.cms(input) -> string

Render a CMS message as an openssl cms -cmsout -print-familiar text report. A SignedData shows the content type, digest algorithms, encapsulated content, embedded certificates/CRLs, and each SignerInfo (signer identifier, algorithms, signed/unsigned attributes, signature); a non-SignedData ContentInfo renders a stable top-field summary. input is a PEM string, a DER Buffer, or a pki.schema.cms.parse result; a non-CMS throws inspect/bad-cms. Best-effort.

Example

async function example() {
  var pair = await pki.key.generate("Ed25519");
  var key = await pki.key.export(pair.privateKey);
  var cert = await pki.x509.sign({ subject: "Signer", subjectPublicKey: await pki.key.export(pair.publicKey),
    notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
  var cmsDer = await pki.cms.sign(Buffer.from("hello"), { cert: cert, key: key });
  pki.inspect.cms(cmsDer).split("\n")[0]; // "CMS ContentInfo:"
}
example();

See also: pki.schema.cms.parse, pki.inspect.certificate

References

pki.inspect.any

since 0.3.8 stable
pki.inspect.any(input) -> string

Detect which PKI format input (a PEM string or DER Buffer) encodes and render it with the matching report, the inspect analogue of pki.schema.parse. Routes a certificate / CRL / CSR / CMS to certificate / crl / csr / cms; a detected but out-of-scope format (OCSP, TSP, PKCS#8/#12, CRMF, CMP, ...) throws inspect/unsupported-format naming it, and an unrecognized input inspect/bad-input.

Example

async function example() {
  var pair = await pki.key.generate("Ed25519");
  var der = await pki.x509.sign({ subject: "example.com", subjectPublicKey: await pki.key.export(pair.publicKey),
    notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") },
    { key: await pki.key.export(pair.privateKey) });
  pki.inspect.any(der);  // routes to the right report by detected format
}
example();

See also: pki.schema.detectFormat, pki.inspect.certificate

References