Lint

The certificate LINTING engine -- the zlint / pkilint of JavaScript. It walks an ALREADY-PARSED certificate (from pki.schema.x509.parse, whose extension values it decodes with the shared RFC 5280 decoders) and emits graded, advisory FINDINGS: each with a stable id, a severity (fatal > error > warn > notice > pass), a source, a spec-clause citation, and a human message. It ships the RFC 5280 certificate profile plus a representative CA/Browser Forum TLS Baseline Requirements subset.

Unlike every other toolkit entry, the lint DATA path NEVER throws. A linter surveys a corpus that includes malformed members, so pki.lint.certificate(hostileBytes) returns a report whose worst finding is a fatal id lint/unparseable (carrying the inner PkiError.code) rather than raising. The SOLE throw path is CONFIG-time misuse -- an unknown profile, an out-of-range severity threshold, or a wrong-type input -- which raises a typed LintError. This deliberate inversion of the toolkit's fail-closed-throw posture is what lets an operator lint a whole directory without a try/catch per file.

pki.lint.certificate

since 0.2.10 experimental
pki.lint.certificate(input, opts?) -> LintReport

Lint a certificate against the RFC 5280 profile plus a representative CABF TLS BR subset. input is a PEM string, a DER Buffer, or an already-parsed pki.schema.x509 object. Returns a LintReport { findings: [{id, severity, source, citation, message, context?}], counts, worst, ran }.

The DATA path never throws: hostile bytes produce a single fatal finding lint/unparseable rather than raising. The ONLY throw path is config-time misuse (opts.profile unknown, opts.severity out of range, or a wrong-type input) -- a typed LintError.

Options

severity  Suppress findings below this floor (default `"notice"`). `counts` and
                 `worst` always reflect the complete, unfiltered result.

Example

var report = pki.lint.certificate(pemString);
report.worst;                              // "notice" | "error" | ...
report.findings.map(function (f) { return f.id; });

See also: pki.schema.x509.parse, pki.inspect.certificate, pki.path.validate

References

  • spec RFC 5280
  • spec CA/Browser Forum TLS BR

pki.lint.rules

since 0.2.10 experimental
pki.lint.rules(profile?) -> [{id, severity, source, citation}]

Enumerate the rule registry (all rules, or one profile's). Each entry exposes its stable id, severity, source, and spec-clause citation for documentation and corpus tooling.

Example

pki.lint.rules("rfc5280").length;   // -> a positive count

References

  • spec RFC 5280
  • spec CA/Browser Forum TLS BR

pki.lint.profiles

since 0.2.10 experimental
pki.lint.profiles() -> [string]

List the known lint-profile names.

Example

pki.lint.profiles();   // -> ["rfc5280", "rfc9935", "cabf-tls"]

References

  • spec RFC 5280
  • spec CA/Browser Forum TLS BR