@blamejs/pki 0.2.31 → 0.2.32

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.2.32 — 2026-07-16
+
+X.509 certificates now decode the Microsoft Active Directory Certificate Services enrollment extensions, and pki.lint's critical-extension check is aligned with certification-path validation.
+
+### Added
+
+- pki.schema.x509.parse decodes the Microsoft Active Directory Certificate Services enrollment extensions ([MS-WCCE] / [MS-CRTD]): the v2 certificate template (szOID-CERTIFICATE_TEMPLATE -- template OID plus major/minor version), the legacy v1 template name (szOID-ENROLL_CERTTYPE_EXTENSION), the CA version (szOID-CERTSRV_CA_VERSION, surfaced as the raw value and as the CA key index / certificate index split), the previous-CA-certificate hash (szOID-CERTSRV_PREVIOUS_CERT_HASH), and the application policies (szOID-APPLICATION_CERT_POLICIES, decoded as RFC 5280 certificate policies). Each is rendered by pki.inspect and fails closed with a typed error on a malformed shape. The version fields accept the full 32-bit range Active Directory uses, not a signed subset.
+
+### Changed
+
+- pki.lint's unrecognized-critical-extension check now mirrors certification-path validation: it reports a critical extension whose semantics the path validator does not process -- an authority/subject key identifier, a freshest-CRL pointer, an SCT list, a qualified-certificate statement, or a Microsoft enterprise-CA extension -- rather than treating any extension it can merely decode as processed. precertificatePoison, which RFC 6962 requires to be critical, is not reported. A conforming relying party must reject a critical extension it cannot process, so a certificate whose critical enterprise or qualified-certificate constraints this toolkit does not enforce is now surfaced by the linter.
+
 ## v0.2.31 — 2026-07-16
 
 X.509 certificates now decode the RFC 3739 / ETSI EN 319 412-5 qualified-certificate qcStatements extension, and the sigstore verifier gains a low-order EdDSA public-key gate.

package/README.md

@@ -203,7 +203,7 @@ is callable today; nothing below is a stub.
 | `pki.oid` | Two-way OID ↔ name registry — `name`, `byName`, `register`, `toArcs`/`fromArcs`, `toDER`/`fromDER`; seeded with RFC 5280 + NIST PQC arcs |
 | `pki.webcrypto` | A W3C WebCrypto (`SubtleCrypto`) engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2, SHA — **and** post-quantum ML-DSA-44/65/87 and SLH-DSA signatures, plus ML-KEM-512/768/1024 key generation and certificate/PKCS#8 import — the RFC 9935 seed / expandedKey / both private-key CHOICE is validated fail-closed, so an OpenSSL-legacy bare-seed or an internally inconsistent key is rejected with a typed error (KEM encapsulation lands with CMS KEM-decrypt). Zero-dependency, OpenSSL-interoperable |
 | `pki.schema` | The schema family — `parse` detects which PKI format DER / PEM encodes and routes to the right parser, `all` enumerates the registered formats, and the engine + per-format members are grouped here |
-| `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields, with named + partly-decoded extensions — including the RFC 3739 / ETSI EN 319 412-5 qualified-certificate `qcStatements` (EU-qualified declaration, reliance limit, QSCD flag, certificate type, retention, PDS URLs, country of qualification; unknown statements preserved opaque), fail-closed — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields, with named + partly-decoded extensions — including the RFC 3739 / ETSI EN 319 412-5 qualified-certificate `qcStatements` (EU-qualified declaration, reliance limit, QSCD flag, certificate type, retention, PDS URLs, country of qualification; unknown statements preserved opaque) and the Microsoft Active Directory Certificate Services enrollment extensions (certificate template, CA version, previous-CA-certificate hash, application policies), fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.c509` | Parse C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed) |
 | `pki.schema.crl` | Parse DER / PEM X.509 CRLs per RFC 5280 §5 — revoked serials with real-`Date` revocation times, named + partly-decoded extensions, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csr` | Parse DER / PEM PKCS#10 certification requests per RFC 2986 — subject DN, public key, requested attributes, signature, fail-closed — `parse`, `pemDecode`, `pemEncode` |

package/lib/inspect.js

@@ -335,6 +335,19 @@ var EXT_RENDERERS = {
       return label;
     }).join("\n");
   },
+  msCertificateTemplate: function (decoded, inner) {
+    var v = decoded.templateMajorVersion === null ? "" : " v" + decoded.templateMajorVersion + "." + (decoded.templateMinorVersion === null ? 0 : decoded.templateMinorVersion);
+    return inner + "Template: " + (decoded.name || decoded.templateID) + v;
+  },
+  msEnrollCertType: function (decoded, inner) {
+    return inner + "Cert Type: " + _clean(String(decoded));
+  },
+  msCaVersion: function (decoded, inner) {
+    return inner + "CA Version: V" + decoded.caKeyIndex + "." + decoded.certIndex;
+  },
+  msPreviousCertHash: function (decoded, inner) {
+    return inner + _hexColon(Buffer.isBuffer(decoded) ? decoded : Buffer.alloc(0), { upper: true });
+  },
   subjectAltName: _renderAltName,
   issuerAltName: _renderAltName,
   certificatePolicies: function (decoded, inner) {
@@ -422,6 +435,8 @@ var EXT_RENDERERS = {
     return akiLines.length ? akiLines.join("\n") : inner + "keyid:(none)";
   },
 };
+// [MS-WCCE] szOID-APPLICATION_CERT_POLICIES decodes as certificatePolicies, so it renders identically.
+EXT_RENDERERS.msApplicationPolicies = EXT_RENDERERS.certificatePolicies;
 
 // Coverage residual -- the EXT_RENDERERS entry fallbacks are unreachable because each shared
 // decoder (and asn1.read.oid) already narrows the shape before the renderer runs:

package/lib/lint.js

@@ -29,6 +29,7 @@ var guard = require("./guard-all");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
 var pkix = require("./schema-pkix");
+var path = require("./path-validate");
 var C = require("./constants");
 var ipUtils = require("./ip-utils");
 
@@ -237,24 +238,32 @@ function _subjectCNs(cert) {
   return out;
 }
 
-// An extension is "recognized" (RFC 5280 4.2: a consumer MUST reject a critical extension
-// it does NOT recognize / cannot process) when the toolkit has a DECODER for it -- the
-// shared certExtensionDecoders table IS the set of extensions this toolkit processes. This
-// is registry-driven (no curated list to omit a legitimately-critical extension such as
-// policyMappings, which the table decodes) and correctly scoped to EXTENSION OIDs: an
-// algorithm / EKU-purpose OID the name registry happens to resolve is NOT in the decoder
-// table, so a critical extension carrying such an OID is still flagged.
-//
-// The one exception: an extension the table DECODES for display but whose CRITICAL semantics
-// the toolkit does not enforce. qcStatements decodes (for pki.inspect / this linter) yet a
-// critical instance asserts qualified-certificate constraints (a reliance limit, a certificate
-// purpose) no consumer here processes -- path-validate rejects a critical qcStatements as
-// unrecognized-critical for exactly that reason. Structural decodability is not validation
-// processing, so a critical qcStatements is still flagged here, keeping lint consistent with
-// certification-path validation.
-var _DECODE_ONLY_UNPROCESSED_CRITICAL = {};
-_DECODE_ONLY_UNPROCESSED_CRITICAL[oid.byName("qcStatements")] = true;
-function _isUnknownExtension(extOid) { return !EXT_DECODERS[extOid] || _DECODE_ONLY_UNPROCESSED_CRITICAL[extOid] === true; }
+// An extension's CRITICALITY is honoured (RFC 5280 4.2: a consumer MUST reject a critical extension
+// it cannot PROCESS) only when this toolkit actually processes its semantics. That authority is
+// path-validate's PROCESSED_EXTENSIONS (the RFC 5280 sec. 6.1 path-processing set), NOT the decoder
+// table: certExtensionDecoders also DECODES many extensions purely for display (qcStatements, the MS
+// enterprise-CA extensions, the SCT list, the *KeyIdentifiers, freshestCRL, issuerAltName) whose
+// critical semantics are not enforced -- path-validate rejects a critical instance of any of those
+// as unrecognized-critical, so the linter flags them too (structural decodability is not validation
+// processing). The one decode-only extension that is LEGITIMATELY critical is precertificatePoison
+// (RFC 6962 sec. 3.1 REQUIRES it critical), so it is allow-listed. Everything else -- a processed
+// extension, or an unregistered OID (algorithm / EKU-purpose OID the name registry resolves but that
+// is no extension) -- falls out correctly: processed -> recognized, unregistered -> unknown. Driving
+// this off the validator's set (not the decoder table) means a newly-decoded extension is
+// flagged-when-critical automatically until its semantics are actually processed.
+var _CRITICAL_LEGIT = {};
+_CRITICAL_LEGIT[oid.byName("precertificatePoison")] = true;
+// Mirrors path-validate's unrecognizedCriticalExtension. An extension not in PROCESSED_EXTENSIONS is
+// unknown everywhere (precertificatePoison is the one legitimately-critical exception). An extension
+// that IS processed for an intermediate but is unprocessed on the TARGET (policyMappings) is also
+// flagged: path-validate decides target status purely by path position (i === n), so ANY certificate
+// -- a CA included -- can be validated as the final/target certificate, where a critical instance is
+// rejected. A linter has no path context and cannot rule that out, so it flags these regardless of
+// cA-ness (policyMappings is SHOULD-be-non-critical everywhere, so this never mis-flags conformant input).
+function _isUnknownExtension(extOid) {
+  if (path.PROCESSED_EXTENSIONS[extOid] !== true) return _CRITICAL_LEGIT[extOid] !== true;
+  return path.TARGET_UNPROCESSED_IF_CRITICAL[extOid] === true;
+}
 
 // RSA-modulus / EC-curve helpers for the weak-key lint. Each returns null when the key
 // material cannot be read as expected (a malformed RSA modulus, or EC parameters that are

package/lib/oid.js

@@ -95,6 +95,13 @@ var FAMILIES = {
   // ETSI EN 319 412-5 QcType member OIDs (the certificate-purpose types) on the id-etsi-qct arc.
   etsiQcType: { base: [0, 4, 0, 1862, 1, 6], of: { qctEsign: 1, qctEseal: 2, qctWeb: 3 } },
 
+  // [MS-WCCE] AD CS enrollment extensions on the id-microsoft-21 arc (szOID-CERTSRV / szOID-CERTIFICATE_TEMPLATE / szOID-APPLICATION_CERT_POLICIES).
+  msEnrollment: { base: [1, 3, 6, 1, 4, 1, 311, 21], of: {
+    msCaVersion: 1, msPreviousCertHash: 2, msCertificateTemplate: 7, msApplicationPolicies: 10 } },
+
+  // [MS-CRTD] legacy v1 enroll cert-type name on the id-microsoft-20 arc (szOID-ENROLL_CERTTYPE_EXTENSION).
+  msEnrollmentLegacy: { base: [1, 3, 6, 1, 4, 1, 311, 20], of: { msEnrollCertType: 2 } },
+
   // id-aca -- RFC 5755 attribute-certificate attribute types on the id-pkix 10 arc:
   // authenticationInfo sec. 4.4.1 .. group sec. 4.4.4, plus encAttrs sec. 7.1 (the encrypted-
   // attribute wrapper, syntax ContentInfo). { id-aca 5 } is reserved.

package/lib/path-validate.js

@@ -101,6 +101,11 @@ var PROCESSED_EXTENSIONS = {};
  OID.policyMappings, OID.policyConstraints, OID.inhibitAnyPolicy, OID.subjectAltName,
  OID.extKeyUsage, OID.cRLDistributionPoints].
   forEach(function (o) { PROCESSED_EXTENSIONS[o] = true; });
+// Frozen after seeding: this exact object is both consulted by the critical-extension check here and
+// exported (for pki.lint to stay consistent). A caller must not be able to add an OID -- doing so
+// would make an attacker's critical, decoder-less extension pass as "processed" and skip both the
+// unrecognized-critical check and structural validation. Freezing makes any such write a no-op.
+Object.freeze(PROCESSED_EXTENSIONS);
 
 // ---- signature verify bridge (NEW 6) ---------------------------------------
 
@@ -1061,6 +1066,7 @@ function applyPolicyMappings(state, mappings, i) {
 // a terminal CA cert is conforming and is NOT treated as unprocessed here.)
 var TARGET_UNPROCESSED_IF_CRITICAL = {};
 TARGET_UNPROCESSED_IF_CRITICAL[OID.policyMappings] = true;
+Object.freeze(TARGET_UNPROCESSED_IF_CRITICAL);
 
 function unrecognizedCriticalExtension(cert, isTarget) {
   for (var i = 0; i < cert.extensions.length; i++) {
@@ -2023,4 +2029,13 @@ module.exports = {
   crlChecker: crlChecker,
   ocspChecker: ocspChecker,
   verifyOcspResponse: verifyOcspResponse,
+  // The set of extension OIDs whose CRITICAL semantics this validator processes (RFC 5280 sec. 6.1).
+  // Exposed so a linter can distinguish "processed" from "merely decoded" and stay consistent with
+  // the path-validation verdict on a critical extension -- a decoder in certExtensionDecoders is NOT
+  // by itself proof the criticality is honoured. Both sets are frozen so a caller cannot mutate them.
+  PROCESSED_EXTENSIONS: PROCESSED_EXTENSIONS,
+  // Extensions that ARE processed for an intermediate CA but are unprocessed on the target/leaf, so a
+  // critical instance on the target fails closed (RFC 5280 sec. 6.1.5(f)) -- policyMappings is
+  // prepare-next-only and SHOULD-be-non-critical. A linter mirrors this for a leaf certificate.
+  TARGET_UNPROCESSED_IF_CRITICAL: TARGET_UNPROCESSED_IF_CRITICAL,
 };

package/lib/schema-pkix.js

@@ -1031,6 +1031,57 @@ function certExtensionDecoders(ns) {
     return out;
   }
 
+  // [MS-WCCE] szOID-CERTIFICATE_TEMPLATE -- CertificateTemplateOID ::= SEQUENCE {
+  //   templateID OID, templateMajorVersion INTEGER OPTIONAL, templateMinorVersion INTEGER OPTIONAL }.
+  // The two versions are DWORDs (0..2^32-1), NOT uint31 -- a CA key/template revision with bit 31
+  // set is a legal DWORD, so bound to the whole safe-integer range, never guard.range.uint31.
+  function msCertificateTemplate(buf) {
+    var C = ns.prefix + "/bad-ms-certificate-template";
+    var kids = seqChildren(buf, C, "CertificateTemplate");
+    if (!kids.length || kids.length > 3) throw ns.E(C, "CertificateTemplateOID must be a SEQUENCE of a templateID and up to two version INTEGERs");
+    if (kids[0].tagClass !== "universal" || kids[0].tagNumber !== _T.OBJECT_IDENTIFIER) throw ns.E(C, "CertificateTemplateOID templateID must be an OBJECT IDENTIFIER");
+    var id;
+    try { id = asn1.read.oid(kids[0]); } catch (e) { throw ns.E(C, "CertificateTemplateOID templateID must be an OBJECT IDENTIFIER", e); }
+    function ver(i, what) {
+      if (!kids[i]) return null;
+      if (kids[i].tagClass !== "universal" || kids[i].tagNumber !== _T.INTEGER) throw ns.E(C, what + " must be an INTEGER");
+      return guard.range.int(readInt(kids[i], C, what), 0n, 4294967295n, ns.E, C, what);
+    }
+    return { templateID: id, name: ns.oid.name(id) || null, templateMajorVersion: ver(1, "templateMajorVersion"), templateMinorVersion: ver(2, "templateMinorVersion") };
+  }
+
+  // [MS-CRTD] szOID-ENROLL_CERTTYPE_EXTENSION -- the legacy v1 template name as a BARE BMPString.
+  // asn1.read.string accepts any universal string tag, so the explicit BMP_STRING assert is the guard.
+  function msEnrollCertType(buf) {
+    var C = ns.prefix + "/bad-ms-enroll-cert-type";
+    var n = decodeTop(buf, C, "EnrollCertType");
+    if (n.tagClass !== "universal" || n.tagNumber !== _T.BMP_STRING) throw ns.E(C, "the enroll cert-type name must be a BMPString");
+    try { return asn1.read.string(n); } catch (e) { throw ns.E(C, "the enroll cert-type name must be a well-formed BMPString", e); }
+  }
+
+  // [MS-WCCE] szOID-CERTSRV_CA_VERSION -- INTEGER (0..2^32-1) = (caKeyIndex << 16) | certIndex.
+  function msCaVersion(buf) {
+    var C = ns.prefix + "/bad-ms-ca-version";
+    var n = decodeTop(buf, C, "CACertVersion");
+    if (n.tagClass !== "universal" || n.tagNumber !== _T.INTEGER) throw ns.E(C, "CACertVersion must be an INTEGER");
+    var v = guard.range.int(readInt(n, C, "CACertVersion"), 0n, 4294967295n, ns.E, C, "CACertVersion (DWORD)");
+    return { caVersion: v, caKeyIndex: v >>> 16, certIndex: v & 0xffff };
+  }
+
+  // [MS-WCCE] szOID-CERTSRV_PREVIOUS_CERT_HASH -- the SHA-1 thumbprint of the prior CA certificate.
+  // AD CS stamps the Windows certificate THUMBPRINT here, which Windows computes with SHA-1 regardless
+  // of the certificate's signature algorithm, so the OCTET STRING is exactly 20 octets. An empty or
+  // other-length value is malformed renewal metadata and fails closed.
+  function msPreviousCertHash(buf) {
+    var C = ns.prefix + "/bad-ms-previous-cert-hash";
+    var n = decodeTop(buf, C, "CAPrevCertHash");
+    var hash;
+    try { hash = Buffer.concat([asn1.read.octetString(n)]); }
+    catch (e) { throw ns.E(C, "CAPrevCertHash must be an OCTET STRING", e); }
+    if (hash.length !== 20) throw ns.E(C, "CAPrevCertHash must be a 20-octet SHA-1 certificate thumbprint");
+    return hash;
+  }
+
   var byOid = {};
   byOid[O("qcStatements")] = qcStatements;
   byOid[O("basicConstraints")] = basicConstraints;
@@ -1049,6 +1100,11 @@ function certExtensionDecoders(ns) {
   byOid[O("precertificatePoison")] = precertPoison;
   byOid[O("cRLDistributionPoints")] = crlDistributionPoints;
   byOid[O("freshestCRL")] = crlDistributionPoints;
+  byOid[O("msCertificateTemplate")] = msCertificateTemplate;
+  byOid[O("msEnrollCertType")] = msEnrollCertType;
+  byOid[O("msCaVersion")] = msCaVersion;
+  byOid[O("msPreviousCertHash")] = msPreviousCertHash;
+  byOid[O("msApplicationPolicies")] = certificatePolicies;   // [MS-WCCE] = RFC 5280 certificatePolicies, reused not re-implemented
   return { byOid: byOid };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.2.31",
+  "version": "0.2.32",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c89087a8-9dba-4496-9704-cd639f3c4038",
+  "serialNumber": "urn:uuid:c1caa29b-a81a-443d-9296-76988e159993",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-16T21:10:43.618Z",
+    "timestamp": "2026-07-16T23:57:14.646Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.2.31",
+      "bom-ref": "@blamejs/pki@0.2.32",
       "type": "application",
       "name": "pki",
-      "version": "0.2.31",
+      "version": "0.2.32",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.2.31",
+      "purl": "pkg:npm/%40blamejs/pki@0.2.32",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.2.31",
+      "ref": "@blamejs/pki@0.2.32",
       "dependsOn": []
     }
   ]