Trust anchor lists

Write the RFC 5914 TrustAnchorList a root program publishes: each anchor as a certificate, as a bare TBSCertificate, or as a TrustAnchorInfo carrying the name it is known by and the constraints a relying party applies to paths beneath it. Every anchor is held to the same rules pki.schema.trustanchor.parse holds one to, and the result round-trips through that parser before it is returned.

pki.trustanchor.build

since 0.8.13 stable
pki.trustanchor.build(spec, opts?) -> Buffer | string

Build an RFC 5914 TrustAnchorList, the structure a root program publishes. spec.anchors is a non-empty array, each entry naming exactly one of certificate (pre-encoded Certificate DER), tbsCert (pre-encoded TBSCertificate DER) or taInfo.

A taInfo entry is { pubKey, keyId, taTitle?, certPath?, exts?, taTitleLangTag? }, where pubKey is SubjectPublicKeyInfo DER and keyId the key identifier bytes. certPath carries the constraints: taName (a distinguished name string or an array of relative names), certificate, policySet (an array of policy identifiers), policyFlags ({ inhibitPolicyMapping, requireExplicitPolicy, inhibitAnyPolicy }), nameConstr (pre-encoded NameConstraints DER) and pathLenConstraint.

Every rule the parser enforces is enforced here, so this toolkit does not emit an anchor it would refuse to read: an empty taName, a requireExplicitPolicy with no policySet, a negative pathLenConstraint, and an exts entry naming one of the four extension types RFC 5914 section 3 excludes. The result round-trips through pki.schema.trustanchor.parse before it is returned.

The version is not a field a caller sets: v1 is the ASN.1 DEFAULT and DER omits it, so every v1 anchor has one encoding.

Two refusals are stricter than the module, on the principle that what this writes is what an operator publishes: taTitleLangTag may not be the empty string, which names no language, and exts may not carry one of the four extension types RFC 5914 section 3 excludes, which a reader is told to ignore and which certPath states properly.

Options

- `pem` (boolean) -- return a PEM `TRUST ANCHOR LIST` string instead of DER.

Example

async function example() {
  var pair = await pki.key.generate("Ed25519");
  var der = pki.trustanchor.build({ anchors: [{ taInfo: {
    pubKey: await pki.key.export(pair.publicKey),
    keyId: Buffer.alloc(20, 1),
    taTitle: "Example Root CA",
    certPath: { taName: "CN=Example Root", pathLenConstraint: 2 } } }] });
  pki.schema.trustanchor.parse(der).anchors[0].taInfo.certPath.pathLenConstraint;  // -> 2
}
example();

See also: pki.schema.trustanchor.parse, pki.trust.parseTrustAnchorList

References