@blamejs/core 0.6.37 → 0.6.59

package/lib/mtls-engine-default.js

@@ -424,10 +424,50 @@ function algorithmEnvelope() {
   };
 }
 
+// Generate a signed X.509 CRL (RFC 5280) covering every revoked
+// serial number. The vendored peculiar/x509 library exposes
+// X509CrlGenerator.create which builds the TBSCertList, populates
+// the entries, and signs with the CA private key — same signature
+// algorithm the CA itself was issued under (auto-detected via
+// _selectAlgorithm + cached on first issuance).
+async function generateCrl(opts) {
+  opts = opts || {};
+  if (!opts.caCertPem || !opts.caKeyPem) {
+    throw new MtlsEngineError("mtls-engine/missing-arg",
+      "generateCrl requires { caCertPem, caKeyPem, revocations, thisUpdate, nextUpdate }");
+  }
+  var revocations = Array.isArray(opts.revocations) ? opts.revocations : [];
+  var alg = await _selectAlgorithm();
+  CA_KEY_ALG = alg.keyAlg; CA_SIG_ALG = alg.sigAlg;
+
+  var caKey  = await _importPemPrivateKey(opts.caKeyPem, CA_KEY_ALG, ["sign"]);
+  var caCert = _parseCertPem(opts.caCertPem);
+
+  // X509CrlEntry expects { serialNumber: hex, revocationDate, reason }.
+  var entries = revocations.map(function (r) {
+    return {
+      serialNumber:    r.serialNumber,
+      revocationDate:  new Date(r.revokedAt || Date.now()),
+      reason:          (typeof r.reasonCode === "number") ? r.reasonCode : 0,
+    };
+  });
+
+  var crl = await x509.X509CrlGenerator.create({
+    issuer:           caCert.subject,
+    thisUpdate:       opts.thisUpdate || new Date(),
+    nextUpdate:       opts.nextUpdate,
+    entries:          entries,
+    signingAlgorithm: CA_SIG_ALG,
+    signingKey:       caKey,
+  });
+  return crl.toString("pem");
+}
+
 module.exports = {
   generateCa:         generateCa,
   signClientCert:     signClientCert,
   packageP12:         packageP12,
+  generateCrl:        generateCrl,
   algorithmEnvelope:  algorithmEnvelope,
   MtlsEngineError:    MtlsEngineError,
 };