@blamejs/pki 0.3.0 → 0.3.2

package/lib/x509-sign.js

@@ -21,16 +21,15 @@
 // cms/tsp/ocsp producing pattern); the strict schema-x509 decoder round-trips it, and that round-trip
 // -- plus OpenSSL interop -- is the divergence guard.
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
 var signScheme = require("./sign-scheme");
-var compositeSig = require("./composite-sig");
 var guard = require("./guard-all");
 var frameworkError = require("./framework-error");
 var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
+var pkiBuild = require("./pki-build");
 
 var CertificateError = frameworkError.CertificateError;
 // The x509 schema namespace + Name parser -- the SAME RDNSequence parser pki.schema.x509.parse uses, so
@@ -59,189 +58,25 @@ var KNOWN_EXT_KEYS = {
   certificatePolicies: 1, certificatePoliciesCritical: 1,
 };
 
-// KeyUsage named-bit positions (RFC 5280 sec. 4.2.1.3); contentCommitment is the RFC 5280 rename of
-// the X.509 nonRepudiation bit (1).
-var KU_BIT = {
-  digitalSignature: 0, nonRepudiation: 1, contentCommitment: 1, keyEncipherment: 2,
-  dataEncipherment: 3, keyAgreement: 4, keyCertSign: 5, cRLSign: 6, encipherOnly: 7, decipherOnly: 8,
-};
+// The shared PKIX producing primitives (lib/pki-build.js), bound to the x509 namespace so they keep the
+// frozen x509/* codes. Thin local aliases let the x509 call sites read unchanged. csr-sign binds the same
+// builder to its own namespace (Hard rule #5 -- one encode definition, no per-format hand-roll).
+var _b = pkiBuild.makeBuilder({ ErrorClass: CertificateError, prefix: "x509", O: O, NS: NS, NAME_SCHEMA: NAME_SCHEMA, SPKI_SCHEMA: SPKI_SCHEMA, EXT_DECODERS: EXT_DECODERS });
+var _encodeName = _b.encodeName, _isEmptyName = _b.isEmptyName, _reqDer = _b.reqDer,
+  _assertValidSpki = _b.assertValidSpki, _assertValidExtension = _b.assertValidExtension,
+  _certLikeFromSpki = _b.certLikeFromSpki, _assertCertVerifies = _b.assertSignatureVerifies,
+  _ext = _b.ext, _extBasicConstraints = _b.extBasicConstraints, _validateBcSpec = _b.validateBcSpec,
+  _extKeyUsage = _b.extKeyUsage, _extExtKeyUsage = _b.extExtKeyUsage, _extSki = _b.extSki,
+  _extAki = _b.extAki, _extSan = _b.extSan, _extCertPolicies = _b.extCertPolicies,
+  _skiKeyId = _b.skiKeyId, _spkiKeyId = _b.spkiKeyId, _serialInteger = _b.serialInteger;
 
-// ---- distinguished name encoding (RFC 5280 sec. 4.1.2.4) -------------------
+// ---- issuer-side extension helpers (subjectKeyIdentifier lookup + authorityKeyIdentifier) ----
 
-// countryName is a PrintableString, emailAddress an IA5String; every other new-certificate attribute
-// is a UTF8String (Teletex/BMP/Universal are backward-compat only and never emitted).
-function _atvString(attrName, value) {
-  if (attrName === "countryName") {
-    // countryName is a PrintableString SIZE(2) -- the two-letter ISO 3166 alpha-2 code (RFC 5280 /
-    // X.520). Reject any other length at config-time.
-    if (String(value).length !== 2) throw _err("x509/bad-name", "countryName must be a two-letter ISO 3166 code (PrintableString SIZE(2))");
-    return b.printable(value);
-  }
-  if (attrName === "emailAddress") return b.ia5(value);
-  return b.utf8(value);
-}
-function _encodeAtv(attrName, value) {
-  if (value == null || value === "") throw _err("x509/bad-name", "the " + attrName + " attribute value must be a non-empty string");
-  var typeOid;
-  try { typeOid = O(attrName); }
-  catch (e) { throw _err("x509/bad-name", "unknown distinguished-name attribute " + JSON.stringify(attrName), e); }
-  var valueTlv;
-  try { valueTlv = _atvString(attrName, value); }
-  catch (e) { if (e instanceof CertificateError) throw e; throw _err("x509/bad-name", "the " + attrName + " value has characters invalid for its string type", e); }
-  return b.sequence([b.oid(typeOid), valueTlv]);
-}
-function _encodeRdn(rdnSpec) {
-  if (!rdnSpec || typeof rdnSpec !== "object" || Buffer.isBuffer(rdnSpec)) throw _err("x509/bad-name", "each RDN must be an object of { attributeName: value }");
-  var keys = Object.keys(rdnSpec);
-  if (!keys.length) throw _err("x509/bad-name", "an RDN must carry at least one attribute");
-  // build.set DER-sorts the AttributeTypeAndValue members (X.690 SET-OF ordering) for a multi-valued RDN.
-  return b.set(keys.map(function (k) { return _encodeAtv(k, rdnSpec[k]); }));
-}
-// A DN spec -> RDNSequence DER. A string is shorthand for a single commonName RDN; a Buffer is raw
-// pre-encoded Name DER (the escape hatch). An empty array yields an empty RDNSequence (a subject MAY
-// be empty with a critical SAN; the issuer non-empty rule is enforced by the caller).
-function _encodeName(spec) {
-  if (Buffer.isBuffer(spec)) { _assertValidNameDer(spec); return spec; }
-  if (typeof spec === "string") spec = [{ commonName: spec }];
-  if (!Array.isArray(spec)) throw _err("x509/bad-name", "a name must be a string, an array of RDNs, or raw Name DER");
-  return b.sequence(spec.map(_encodeRdn));
-}
-// A raw Name DER is embedded verbatim, so validate it is a well-formed RDNSequence -- a SEQUENCE OF
-// RelativeDistinguishedName, each a non-empty SET OF AttributeTypeAndValue{ type OID, value } -- before
-// it is embedded. An empty RDNSequence is permitted (an empty subject; the issuer non-empty rule is
-// enforced separately). asn1.decode already rejects trailing bytes.
-function _assertValidNameDer(der) {
-  var node;
-  try { node = asn1.decode(der); }
-  catch (e) { throw _err("x509/bad-name", "the raw Name DER is not valid DER", e); }
-  // Full validation: walk the raw Name through the exact RDNSequence parser the certificate parser
-  // uses (the SET-OF structure, the AttributeTypeAndValue arity, the DirectoryString value types),
-  // not a partial hand-rolled shape check -- so an embedded raw Name is exactly what parses back.
-  try { schema.walk(NAME_SCHEMA, node, NS); }
-  catch (e) {
-    if (e instanceof CertificateError || (e && e.name === "Asn1Error")) throw e;
-    throw _err("x509/bad-name", "the raw Name DER is not a well-formed distinguished name", e);
-  }
-}
-function _isEmptyName(nameDer) { return asn1.decode(nameDer).children.length === 0; }
-
-// ---- GeneralName encoding (RFC 5280 sec. 4.2.1.6) --------------------------
-
-function _ia5Content(s) {
-  s = String(s);
-  for (var i = 0; i < s.length; i++) {
-    if (s.charCodeAt(i) > 0x7F) throw _err("x509/bad-input", "value requires 7-bit ASCII (IA5String): " + JSON.stringify(s));
-  }
-  return Buffer.from(s, "latin1");
-}
-function _encodeGeneralName(entry) {
-  if (!entry || typeof entry !== "object" || Buffer.isBuffer(entry)) throw _err("x509/bad-input", "a GeneralName must be an object with exactly one name form");
-  var keys = Object.keys(entry);
-  if (keys.length !== 1) throw _err("x509/bad-input", "a GeneralName entry must have exactly one form, got " + keys.length);
-  var k = keys[0], v = entry[k];
-  if (v == null || v === "") throw _err("x509/bad-input", "an empty GeneralName value is not permitted (RFC 5280 sec. 4.2.1.6)");
-  switch (k) {
-    // IMPLICIT [1]/[2]/[6] IA5String -- context-primitive over the raw ASCII content.
-    case "rfc822Name": return b.contextPrimitive(1, _ia5Content(v));
-    case "dNSName": return b.contextPrimitive(2, _ia5Content(v));
-    case "uniformResourceIdentifier": case "uri": return b.contextPrimitive(6, _ia5Content(v));
-    // IMPLICIT [7] OCTET STRING -- 4 octets (IPv4) or 16 (IPv6).
-    case "iPAddress":
-      if (!Buffer.isBuffer(v) || (v.length !== 4 && v.length !== 16)) throw _err("x509/bad-input", "iPAddress must be a 4- or 16-octet Buffer");
-      return b.contextPrimitive(7, v);
-    // [4] Name -- Name is a CHOICE, so the context tag is necessarily EXPLICIT.
-    case "directoryName": return b.explicit(4, _encodeName(v));
-    default: throw _err("x509/bad-input", "unsupported GeneralName form " + JSON.stringify(k) + " (supported: rfc822Name, dNSName, uniformResourceIdentifier, iPAddress, directoryName)");
-  }
-}
-
-// ---- extension-value encoders (the inverse of certExtensionDecoders) -------
-
-function _extKeyUsage(names) {
-  if (!Array.isArray(names) || !names.length) throw _err("x509/bad-input", "keyUsage must assert at least one bit (RFC 5280 sec. 4.2.1.3)");
-  var positions = names.map(function (n) {
-    var pos = KU_BIT[n];
-    if (pos == null) throw _err("x509/bad-input", "unknown keyUsage bit " + JSON.stringify(n));
-    return pos;
-  });
-  return b.namedBitString(positions);   // minimal NamedBitList DER (X.690 sec. 11.2.2)
-}
-function _extExtKeyUsage(names) {
-  if (!Array.isArray(names) || !names.length) throw _err("x509/bad-input", "extendedKeyUsage must list at least one KeyPurposeId");
-  return b.sequence(names.map(function (n) {
-    var purposeOid;
-    try { purposeOid = O(n); }
-    catch (e) { throw _err("x509/bad-input", "unknown extendedKeyUsage purpose " + JSON.stringify(n), e); }
-    return b.oid(purposeOid);
-  }));
-}
-// Validate a basicConstraints spec object before it drives the coherence checks + encoding: cA must be
-// an explicit boolean (a truthy non-true value like 1 or "true" would silently encode as a non-CA),
-// pathLen a non-negative integer, and only cA/pathLen/critical are recognized.
-function _validateBcSpec(bc) {
-  if (bc.cA != null && typeof bc.cA !== "boolean") throw _err("x509/bad-input", "basicConstraints cA must be a boolean");
-  if (bc.critical != null && typeof bc.critical !== "boolean") throw _err("x509/bad-input", "basicConstraints critical must be a boolean");
-  if (bc.pathLen != null) _pathLen(bc.pathLen);
-  Object.keys(bc).forEach(function (k) {
-    if (k !== "cA" && k !== "pathLen" && k !== "critical") throw _err("x509/bad-input", "unknown basicConstraints field " + JSON.stringify(k));
-  });
-}
-function _extBasicConstraints(spec) {
-  var children = [];
-  if (spec.cA === true) children.push(b.boolean(true));   // cA=FALSE omitted (DER DEFAULT)
-  if (spec.pathLen != null) children.push(b.integer(_pathLen(spec.pathLen)));
-  return b.sequence(children);
-}
-function _pathLen(v) {
-  if (typeof v !== "number" || !isFinite(v) || v < 0 || (v | 0) !== v) throw _err("x509/bad-input", "basicConstraints pathLenConstraint must be a non-negative integer");
-  return BigInt(v);
-}
-function _extSki(keyid) { return b.octetString(keyid); }
-function _extAki(keyid) { return b.sequence([b.contextPrimitive(0, keyid)]); }   // keyIdentifier [0] IMPLICIT OCTET STRING
-function _extSan(entries) {
-  if (!Array.isArray(entries) || !entries.length) throw _err("x509/bad-input", "subjectAltName must carry at least one GeneralName");
-  return b.sequence(entries.map(_encodeGeneralName));
-}
-function _extCertPolicies(names) {
-  if (!Array.isArray(names) || !names.length) throw _err("x509/bad-input", "certificatePolicies must list at least one policy OID");
-  var seen = {};
-  return b.sequence(names.map(function (n) {
-    var pOid;
-    try { pOid = O(n); }
-    catch (e) { throw _err("x509/bad-input", "unknown certificate policy " + JSON.stringify(n), e); }
-    if (seen[pOid]) throw _err("x509/bad-input", "duplicate certificate policy " + JSON.stringify(n) + " (RFC 5280 sec. 4.2.1.4)");
-    seen[pOid] = true;
-    return b.sequence([b.oid(pOid)]);   // PolicyInformation ::= SEQUENCE { policyIdentifier OID }
-  }));
-}
-// Wrap an encoded extension value in Extension ::= SEQUENCE { extnID, critical?, extnValue }. A
-// FALSE critical bit is omitted (DER DEFAULT), so the boolean appears only when the extension is critical.
-function _ext(oidStr, critical, valueDer) {
-  var children = [b.oid(oidStr)];
-  if (critical) children.push(b.boolean(true));
-  children.push(b.octetString(valueDer));
-  return b.sequence(children);
-}
-
-// The SHA-1 subjectKeyIdentifier (RFC 5280 sec. 4.2.1.2 method 1): the hash of the subjectPublicKey
-// BIT STRING CONTENT (past the unused-bits octet), NOT the whole SPKI or the whole BIT STRING TLV.
-function _spkiKeyId(spkiDer) {
-  var keyBytes = asn1.read.bitString(asn1.decode(spkiDer).children[1]).bytes;
-  // nosemgrep: pki-weak-hash-md5-sha1 -- RFC 5280 sec. 4.2.1.2 method 1 DEFINES the subjectKeyIdentifier
-  // as the SHA-1 of the subjectPublicKey; this is a key identifier, not a signature or a
-  // collision-resistance use, and the algorithm is fixed by the standard.
-  return nodeCrypto.createHash("sha1").update(keyBytes).digest();
-}
 function _skiValueOf(caCert) {
   var ext = (caCert.extensions || []).filter(function (e) { return e.oid === OID_SKI; })[0];
   if (ext) { try { return asn1.read.octetString(asn1.decode(ext.value)); } catch (_e) { /* fall through to re-derive from the issuer SPKI */ } }
   return null;
 }
-function _skiKeyId(val, spkiDer) {
-  if (Buffer.isBuffer(val)) return val;
-  if (val === true) return _spkiKeyId(spkiDer);
-  throw _err("x509/bad-input", "subjectKeyIdentifier must be true (auto-derive) or a Buffer key id");
-}
 function _akiKeyId(val, ctx) {
   if (Buffer.isBuffer(val)) return val;
   if (val === true) {
@@ -330,25 +165,6 @@ function _buildExtensions(extSpec, ctx) {
 
 // ---- serial + validity + key plumbing --------------------------------------
 
-// RFC 5280 sec. 4.1.2.2 -- a positive, non-zero INTEGER of at most 20 content octets. A random
-// 20-octet positive serial is generated when none is supplied.
-function _serialInteger(serial) {
-  var v;
-  if (serial == null) {
-    var rnd = nodeCrypto.randomBytes(20);
-    rnd[0] &= 0x7f;                      // keep the top bit clear so the magnitude stays <= 20 octets and positive
-    if (rnd[0] === 0) rnd[0] = 0x01;     // never all-zero leading -> non-zero and no redundant sign octet
-    v = BigInt("0x" + rnd.toString("hex"));
-  } else if (typeof serial === "bigint") { v = serial; }
-  else if (typeof serial === "number") { if (!Number.isInteger(serial)) throw _err("x509/bad-serial", "serialNumber must be an integer"); v = BigInt(serial); }
-  else if (typeof serial === "string") { try { v = BigInt(serial); } catch (e) { throw _err("x509/bad-serial", "serialNumber string must be a decimal or 0x-hex integer", e); } }
-  else if (Buffer.isBuffer(serial)) { v = serial.length ? BigInt("0x" + serial.toString("hex")) : 0n; }
-  else { throw _err("x509/bad-serial", "serialNumber must be a BigInt, integer, hex string, or Buffer"); }
-  if (v <= 0n) throw _err("x509/bad-serial", "serialNumber must be a positive integer (RFC 5280 sec. 4.1.2.2)");
-  var tlv = b.integer(v);
-  if (asn1.decode(tlv).content.length > 20) throw _err("x509/bad-serial", "serialNumber must not exceed 20 octets (RFC 5280 sec. 4.1.2.2)");
-  return tlv;
-}
 // RFC 5280 sec. 4.1.2.5 -- UTCTime for 1950..2049, GeneralizedTime otherwise. UTCTime's two-digit year
 // only represents 1950..2049 (sec. 4.1.2.5.1), so a pre-1950 date MUST use GeneralizedTime (the same
 // arm as a date from 2050 on); using UTCTime for a pre-1950 year would be unrepresentable.
@@ -357,65 +173,6 @@ function _timeDer(date, which) {
   var y = date.getUTCFullYear();
   return (y >= 1950 && y <= 2049) ? b.utcTime(date) : b.generalizedTime(date);
 }
-function _reqDer(v, what) {
-  if (Buffer.isBuffer(v)) return v;
-  if (v instanceof Uint8Array) return Buffer.from(v);
-  throw _err("x509/bad-input", what + " must be a DER Buffer");
-}
-// A well-formed SubjectPublicKeyInfo is a SEQUENCE { algorithm AlgorithmIdentifier, subjectPublicKey
-// BIT STRING }. The subject key is embedded verbatim (b.raw), so reject a malformed one AT ISSUANCE
-// rather than emitting a certificate that fails to parse. (asn1.decode already rejects trailing bytes.)
-function _assertValidSpki(spkiDer, what) {
-  var node;
-  try { node = asn1.decode(spkiDer); }
-  catch (e) { throw _err("x509/bad-input", what + " is not valid DER", e); }
-  // Full validation: run it through the SAME SubjectPublicKeyInfo parser pki.schema.x509.parse uses
-  // (the AlgorithmIdentifier + the subjectPublicKey BIT STRING), not a partial hand-rolled shape check.
-  try { schema.walk(SPKI_SCHEMA, node, NS); }
-  catch (e) {
-    if (e instanceof CertificateError || (e && e.name === "Asn1Error")) throw e;
-    throw _err("x509/bad-input", what + " is not a well-formed SubjectPublicKeyInfo", e);
-  }
-}
-// A well-formed Extension is a SEQUENCE { extnID OID, critical BOOLEAN OPTIONAL, extnValue OCTET
-// STRING }. A pre-encoded (array-form) extension is embedded verbatim, so validate its shape here.
-function _assertValidExtension(der, idx) {
-  var n;
-  try { n = asn1.decode(der); }
-  catch (e) { throw _err("x509/bad-input", "pre-encoded extension [" + idx + "] is not valid DER", e); }
-  if (n.tagNumber !== asn1.TAGS.SEQUENCE || n.tagClass !== "universal" || !n.children || n.children.length < 2 || n.children.length > 3) throw _err("x509/bad-input", "pre-encoded extension [" + idx + "] must be an Extension SEQUENCE { extnID, critical?, extnValue }");
-  try { asn1.read.oid(n.children[0]); }
-  catch (e) { throw _err("x509/bad-input", "pre-encoded extension [" + idx + "] extnID is not an OBJECT IDENTIFIER", e); }
-  if (n.children.length === 3) {
-    var crit;
-    try { crit = asn1.read.boolean(n.children[1]); }
-    catch (e) { throw _err("x509/bad-input", "pre-encoded extension [" + idx + "] critical must be a BOOLEAN", e); }
-    // DER DEFAULT: a FALSE criticality MUST be omitted, so an explicitly-encoded critical=FALSE is
-    // non-canonical (RFC 5280 sec. 4.2 / X.690 sec. 11.5).
-    if (crit !== true) throw _err("x509/bad-input", "pre-encoded extension [" + idx + "] critical=FALSE must be omitted (DER DEFAULT)");
-  }
-  var last = n.children[n.children.length - 1];
-  if (last.tagNumber !== asn1.TAGS.OCTET_STRING || last.tagClass !== "universal") throw _err("x509/bad-input", "pre-encoded extension [" + idx + "] extnValue must be an OCTET STRING");
-}
-// Synthesize the parsed-cert shape resolveSignScheme reads (it only needs subjectPublicKeyInfo.algorithm)
-// from a raw SPKI DER: { algorithm: { oid, parameters } }. `parameters` is the raw params TLV (or undefined).
-function _certLikeFromSpki(spkiDer) {
-  var spki = asn1.decode(spkiDer);
-  if (!spki.children || !spki.children.length) throw _err("x509/bad-input", "the signing key SPKI is not a SubjectPublicKeyInfo");
-  var alg = spki.children[0];
-  var keyOid;
-  try { keyOid = asn1.read.oid(alg.children[0]); }
-  catch (e) { throw _err("x509/bad-input", "the signing key SPKI algorithm is not an OID", e); }
-  return { subjectPublicKeyInfo: { algorithm: { oid: keyOid, parameters: alg.children.length > 1 ? alg.children[1].bytes : undefined } } };
-}
-// The raw subject Name TLV of a parsed CA certificate (byte-identical, so the child issuer chains to
-// the CA subject exactly). The subject follows the optional version [0], serial, signature, issuer,
-// and validity in the tbsCertificate.
-function _caSubjectBytes(caCert) {
-  var tbs = asn1.decode(caCert.tbsBytes);
-  var hasVersion = tbs.children[0].tagClass === "context" && tbs.children[0].tagNumber === 0;
-  return tbs.children[(hasVersion ? 1 : 0) + 4].bytes;   // [version?] serial(0) sig(1) issuer(2) validity(3) SUBJECT(4)
-}
 // A supplied issuer certificate MUST be a CA that may sign certificates: basicConstraints present AND
 // critical AND cA=TRUE (RFC 5280 sec. 4.2.1.9), and -- when a keyUsage extension is present -- the
 // keyCertSign bit (sec. 4.2.1.3). Refuse a non-CA issuer rather than mint a certificate that will not
@@ -455,33 +212,6 @@ function _issuedCaInfo(extSpec) {
   }
   return { cA: false, pathLen: null };
 }
-// Confirm the produced signature verifies under the ISSUER public key, so a signing key that does not
-// correspond to it cannot silently yield a certificate that fails to chain. Verifying the actual
-// signature is key-type-agnostic -- it holds for a PKCS#8 key, a WebCrypto CryptoKey, or any signer --
-// where deriving-and-comparing the public key cannot (a non-extractable CryptoKey has no exportable
-// public half). A composite {mldsa, trad} arm is the caller's to pair and is skipped here.
-function _assertCertVerifies(tbsDer, sig, issuerSpki, scheme) {
-  if (scheme.composite) {
-    // Verify BOTH composite component signatures against the composite public key.
-    return compositeSig.compositeVerify(issuerSpki, sig, tbsDer, scheme.composite, CertificateError, "x509/unsupported-algorithm", "x509/bad-input").then(function (r) {
-      if (!r.ok) throw _err("x509/bad-input", "the composite signing key does not correspond to the issuer public key -- the certificate would not chain");
-    });
-  }
-  var pub;
-  try { pub = nodeCrypto.createPublicKey({ key: issuerSpki, format: "der", type: "spki" }); }
-  catch (e) { throw _err("x509/bad-input", "the issuer public key could not be imported for the chain self-check", e); }
-  var s = scheme.sign, ok;
-  try {
-    if (s.name === "ECDSA") ok = nodeCrypto.verify(scheme.digest, tbsDer, { key: pub, dsaEncoding: "der" }, sig);
-    else if (s.name === "RSA-PSS") ok = nodeCrypto.verify(scheme.digest, tbsDer, { key: pub, padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: s.saltLength }, sig);
-    else if (s.name === "RSASSA-PKCS1-v1_5") ok = nodeCrypto.verify(scheme.digest, tbsDer, pub, sig);
-    // allow:eddsa-verify-without-loworder-gate -- this is a self-check that OUR just-produced signature
-    // verifies under the issuer key the caller controls, not a security verify of an untrusted EdDSA
-    // signature, so the low-order-point gate (a forged-signature defense) does not apply.
-    else ok = nodeCrypto.verify(null, tbsDer, pub, sig);   // Ed25519 / Ed448 / ML-DSA / SLH-DSA
-  } catch (e) { throw _err("x509/bad-input", "the chain self-check could not run against the issuer public key", e); }
-  if (!ok) throw _err("x509/bad-input", "the signing key does not correspond to the issuer public key -- the certificate would not chain");
-}
 // Does the extensions spec carry a subjectAltName that will be emitted critical? The object form forces
 // SAN critical when the subject is empty (so any subjectAltName qualifies); the pre-encoded array form
 // is decoded to look for an Extension whose extnID is subjectAltName with a TRUE critical flag.
@@ -558,7 +288,7 @@ function _sign(spec, issuer, opts) {
     issuerCert = (Buffer.isBuffer(issuer.cert) || typeof issuer.cert === "string") ? x509.parse(issuer.cert) : issuer.cert;
     if (!issuerCert || !issuerCert.tbsBytes) throw _err("x509/bad-input", "issuer.cert must be a certificate DER/PEM or a parsed certificate");
     issuerPathLen = _assertIssuerIsCa(issuerCert);
-    issuerDer = _caSubjectBytes(issuerCert);
+    issuerDer = pkiBuild.tbsNameField(issuerCert, "subject");
     issuerSpki = issuerCert.subjectPublicKeyInfo.bytes;
   } else {
     issuerDer = _encodeName(issuer.name == null ? [] : issuer.name);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:6f299c9a-151b-4a48-9580-bc19e1ab66b0",
+  "serialNumber": "urn:uuid:3787cd37-e9d0-465d-bed3-0f6822edb52c",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-17T06:00:11.553Z",
+    "timestamp": "2026-07-17T08:27:56.310Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.3.0",
+      "bom-ref": "@blamejs/pki@0.3.2",
       "type": "application",
       "name": "pki",
-      "version": "0.3.0",
+      "version": "0.3.2",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.3.0",
+      "purl": "pkg:npm/%40blamejs/pki@0.3.2",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.3.0",
+      "ref": "@blamejs/pki@0.3.2",
       "dependsOn": []
     }
   ]