@blamejs/pki 0.3.17 → 0.3.19

package/lib/cmp-build.js

@@ -41,6 +41,7 @@ var webcrypto = require("./webcrypto");
 var pbes2 = require("./pbes2");
 var constants = require("./constants");
 var guard = require("./guard-all");
+var httpTransport = require("./http-transport");
 var frameworkError = require("./framework-error");
 
 var CmpError = frameworkError.CmpError;
@@ -632,4 +633,244 @@ function _collectExtraCerts(opts, protCertDer) {
  *     { key: signerKeyPkcs8, cert: signerCertDer });
  *   pki.schema.cmp.parse(der).body.arm;   // "p10cr"
  */
-module.exports = { build: build };
+
+// ---- the thin RFC 9811 HTTP transfer verb: POST a DER PKIMessage over the shared pki.transport ----
+//
+// RFC 9811 defines exactly ONE client operation -- POST a DER PKIMessage, receive a DER PKIMessage -- so
+// every CMP exchange (ir / p10cr / certConf / pollReq / rr / genm ...) rides this single stateless verb;
+// the caller builds+protects the message upstream with pki.cmp.build and hands the finished bytes here,
+// which are POSTed VERBATIM (the protection covers them). No socket is opened by this codec -- the verb
+// composes pki.schema.cmp.parse over pki.transport, exactly as pki.est / pki.acme wire their message layers.
+
+var DEFAULT_TRANSFER_TIMEOUT = constants.TIME.seconds(30);
+var MAX_TRANSFER_TIMEOUT = constants.TIME.seconds(600);
+var PKIXCMP = "application/pkixcmp";
+var PKIXCMP_POLL = "application/pkixcmp-poll";   // the legacy type handled "like application/pkixcmp" (RFC 9811 sec. 4)
+var KNOWN_TRANSFER_OPTS = { transport: 1, tls: 1, headers: 1, timeout: 1, maxResponseBytes: 1 };
+
+// The DER of a caller-supplied PKIMessage: a DER Buffer / Uint8Array re-viewed through guard.bytes.view
+// (sent VERBATIM -- protection covers these exact bytes), a PEM "CMP" string decoded, else a config-time
+// cmp/bad-input before the wire. The re-view fails a DETACHED backing buffer (a transferred / structuredClone'd
+// view reads as zero-length) as cmp/bad-input rather than silently POSTing an empty body in its place.
+function _cmpMessageDer(input) {
+  var der;
+  if (Buffer.isBuffer(input) || input instanceof Uint8Array) der = guard.bytes.view(input, CmpError, "cmp/bad-input", "the CMP message DER");
+  else if (typeof input === "string") {
+    // Normalize a PEM decode failure (no block, wrong armor label, malformed base64) to the stable
+    // cmp/bad-input at this input boundary, rather than leaking the PEM layer's PemError to the caller.
+    try { der = cmp.pemDecode(input); }
+    catch (e) { throw _err("cmp/bad-input", "the CMP message is not a valid PEM CMP block", e); }
+  } else throw _err("cmp/bad-input", "a CMP message must be a DER Buffer/Uint8Array or a PEM CMP string");
+  // Validate the bytes ARE a PKIMessage before the wire (transfer accepts a DER PKIMessage), so malformed
+  // input fails locally as cmp/bad-input rather than crossing the network seam. parse validates only -- the
+  // ORIGINAL der is returned for the verbatim POST (protection covers the exact bytes; nothing re-serialized).
+  try { cmp.parse(der); }
+  catch (e) { throw _err("cmp/bad-input", "the CMP message is not a valid PKIMessage", e); }
+  return der;
+}
+
+// Map opts.tls (operator-facing) to the transport request.tls shape. rejectUnauthorized is NOT here --
+// the transport forces it on unconditionally; the verb never disables server verification.
+function _tlsForTransfer(opts) {
+  var t = opts.tls || {};
+  return { anchors: t.anchors, useSystemStore: t.useSystemStore, cert: t.cert, key: t.key, minVersion: t.minVersion, servername: t.servername, checkServerIdentity: t.checkServerIdentity };
+}
+
+// The response content-type token (before any ;-parameters), lowercased; is it a CMP media type?
+function _ctypeToken(headers) { return String((headers || {})["content-type"] || "").split(";")[0].trim().toLowerCase(); }
+function _isPkixcmp(headers) { var t = _ctypeToken(headers); return t === PKIXCMP || t === PKIXCMP_POLL; }
+
+// Classify the CMP HTTP response (RFC 9811 sec. 3.1/3.2/4). 200 + a pkixcmp body -> parse + resolve;
+// another 2xx -> reject (a request response MUST be 200, sec. 3.1); 3xx -> not followed (sec. 3.1/5);
+// 4xx/5xx WITH a well-formed CMP body -> FORWARD the integrity-protected verdict (sec. 1.2/3.1), else
+// cmp/http-error. The HTTP status is surfaced as DATA, never used to set the transaction verdict (sec. 5).
+// `body` is always a Buffer (the verb normalizes it before the size cap).
+function _classifyCmpResponse(status, headers, body, tls) {
+  var ctype = _ctypeToken(headers);
+  if (status === 200) {
+    if (!_isPkixcmp(headers)) throw _err("cmp/bad-content-type", "a 200 CMP response must be application/pkixcmp (RFC 9811 sec. 3.2), got " + JSON.stringify(ctype || null));
+    if (body.length === 0) throw _err("cmp/empty-response", "a 200 CMP response carried an empty body (RFC 9811 sec. 3.3)");
+    return { response: cmp.parse(body), responseBytes: body, status: 200, contentType: ctype, tls: tls };   // a malformed body surfaces the parser's fail-closed cmp/* verdict
+  }
+  // Below 200, every branch requires a valid HTTP status INTEGER -- a missing / non-numeric / out-of-range
+  // status from an injected transport must not fall through to the forward branch as if it were a 4xx/5xx.
+  var httpStatus = (typeof status === "number" && Number.isSafeInteger(status) && status >= 100 && status <= 599) ? status : null;
+  if (httpStatus !== null && httpStatus >= 300 && httpStatus < 400) throw _err("cmp/redirect-not-followed", "a CMP " + httpStatus + " redirect is not followed (RFC 9811 sec. 3.1, sec. 5); reconfigure the endpoint URL");
+  if (httpStatus !== null && httpStatus >= 400 && httpStatus <= 599) {
+    if (_isPkixcmp(headers) && body.length > 0) {
+      var forwarded;
+      try { forwarded = cmp.parse(body); }
+      catch (e) { throw _err("cmp/http-error", "the CMP server returned HTTP " + httpStatus + " with an undecodable body", e); }
+      // Only a CMP `error` message is a coherent verdict to forward on an HTTP failure. A 4xx/5xx carrying a
+      // non-error arm (a granting `ip`, a `pkiconf`) is contradictory -- the HTTP layer says failure while the
+      // CMP body says success -- so it is NOT accepted as a usable response; the HTTP failure stands.
+      if (forwarded.body.arm !== "error") throw _err("cmp/http-error", "the CMP server returned HTTP " + httpStatus + " with a non-error '" + forwarded.body.arm + "' body; an HTTP failure forwards only a CMP error message (RFC 9811 sec. 1.2/3.1)");
+      return { response: forwarded, responseBytes: body, status: httpStatus, contentType: ctype, tls: tls };
+    }
+    throw _err("cmp/http-error", "the CMP server returned HTTP " + httpStatus + " with no forwardable CMP error body");
+  }
+  // Any other status -- a non-200 2xx, a 1xx informational, or a non-numeric / out-of-range value.
+  throw _err("cmp/unexpected-status", "a CMP response must be HTTP 200 (or a 4xx/5xx carrying a CMP error), not " + JSON.stringify(status) + " (RFC 9811 sec. 3.1)");
+}
+
+function transfer(url, message, opts) {
+  return Promise.resolve().then(function () { return _transfer(url, message, opts); });
+}
+
+function _transfer(url, message, opts) {
+  opts = opts || {};
+  Object.keys(opts).forEach(function (k) { if (!KNOWN_TRANSFER_OPTS[k]) throw _err("cmp/bad-input", "unknown opts field " + JSON.stringify(k)); });
+  var der = _cmpMessageDer(message);   // config gate: before any transport call
+  var parsedUrl;
+  try { parsedUrl = new URL(String(url)); }   // parse only -- NO client scheme gate (the transport owns socket security)
+  catch (e) { throw _err("cmp/bad-url", "the CMP URL did not parse: " + String(url), e); }
+  var transport = opts.transport;
+  if (!transport) {
+    var t = opts.tls || {};
+    var hasAnchors = t.anchors !== undefined && t.anchors !== null && !(Array.isArray(t.anchors) && t.anchors.length === 0);
+    if (!hasAnchors && t.useSystemStore !== true) throw _err("cmp/no-trust-anchors", "no explicit trust anchor and tls.useSystemStore not set to true -- refusing an unpinned server (RFC 9811 sec. 5)");
+    transport = httpTransport.https({ E: _err, errPrefix: "cmp" });
+  }
+  var timeout = guard.limits.cap(opts.timeout, "timeout", DEFAULT_TRANSFER_TIMEOUT, { E: _err, code: "cmp/bad-input", min: 1, max: MAX_TRANSFER_TIMEOUT });
+  var maxResponseBytes = guard.limits.cap(opts.maxResponseBytes, "maxResponseBytes", constants.LIMITS.HTTP_MAX_RESPONSE_BYTES, { E: _err, code: "cmp/bad-input", min: 1, max: constants.LIMITS.HTTP_MAX_RESPONSE_BYTES });
+  // Build the request headers: forward custom opts.headers but STRIP the request-framing headers
+  // (content-length, transfer-encoding) and ANY content-type case variant -- the verb sets the content-type
+  // and the transport computes Content-Length from the exact body, so a caller cannot desync the request
+  // framing (HTTP request smuggling via a short/long content-length) or override the media type through
+  // header-name casing (a "Content-Type" that Object.assign would keep alongside the lowercase one).
+  var headers = {};
+  Object.keys(opts.headers || {}).forEach(function (k) {
+    var lk = k.toLowerCase();
+    if (lk !== "content-length" && lk !== "transfer-encoding" && lk !== "content-type") headers[k] = opts.headers[k];
+  });
+  headers["content-type"] = PKIXCMP;
+  var tls = _tlsForTransfer(opts);
+  return Promise.resolve(transport({ method: "POST", url: parsedUrl.href, headers: headers, body: der, tls: tls, timeout: timeout, maxResponseBytes: maxResponseBytes })).then(function (res) {
+    res = res || {};
+    var h = {};
+    Object.keys(res.headers || {}).forEach(function (k) { h[k.toLowerCase()] = res.headers[k]; });
+    // Normalize the response body to a Buffer preserving its exact bytes: a binary view (Buffer / Uint8Array
+    // from an injected transport) is re-viewed through the byte guard, as the request path does; only a
+    // genuine string body falls back to a UTF-8 encode (the width a real socket already counts) so the size
+    // cap and the parser see the same bytes -- a typed array is not stringified to "48,130,..." garbage.
+    var body = (Buffer.isBuffer(res.body) || res.body instanceof Uint8Array)
+      ? guard.bytes.view(res.body, CmpError, "cmp/bad-response", "the CMP response body")
+      : Buffer.from(String(res.body == null ? "" : res.body), "utf8");
+    if (body.length > maxResponseBytes) throw _err("cmp/response-too-large", "the response body (" + body.length + " bytes) exceeds the " + maxResponseBytes + "-byte cap");
+    return _classifyCmpResponse(res.status, h, body, res.tls || null);
+  });
+}
+
+// A single safe path segment for a well-known URI: no separator, dot-segment, or reserved/space char that
+// would retarget the resource; percent-encoded on the way out. Fails closed (guards never guess a value).
+function _wellKnownSeg(v, name) {
+  var s = String(v);
+  if (s === "" || s === "." || s === ".." || /[/?#\s\\]/.test(s)) throw _err("cmp/bad-url", "the CMP " + name + " must be a single safe path segment (no '/', dot-segment, or reserved char): " + JSON.stringify(s));
+  // encodeURIComponent throws a raw URIError (no .code) on an unpaired UTF-16 surrogate; normalize it to the
+  // helper's cmp/bad-url contract so a malformed-config segment never escapes as an untyped error.
+  try { return encodeURIComponent(s); }
+  catch (e) { throw _err("cmp/bad-url", "the CMP " + name + " is not encodable (e.g. an unpaired surrogate): " + JSON.stringify(s), e); }
+}
+
+var KNOWN_WELLKNOWN_OPTS = { label: 1, operation: 1 };
+
+function wellKnownUrl(base, opts) {
+  opts = opts || {};
+  // Reject an unknown option key (a typo like { lable } / { operaton }), as build/transfer do -- a silently
+  // ignored option would build the DEFAULT endpoint and send the request to a different CA/profile.
+  Object.keys(opts).forEach(function (k) { if (!KNOWN_WELLKNOWN_OPTS[k]) throw _err("cmp/bad-input", "unknown wellKnownUrl option " + JSON.stringify(k) + " (expected label / operation)"); });
+  var u;
+  try { u = new URL(String(base)); }
+  catch (e) { throw _err("cmp/bad-url", "the CMP base URL did not parse: " + String(base), e); }
+  // Require an http(s) authority: a non-HTTP scheme (file:, data:, a custom scheme) has an opaque origin
+  // ("null"), which would build a nonsensical "null/.well-known/cmp". A well-known URI is an HTTP concept
+  // (RFC 8615); https vs http is left to the transport (Build decision 6), but the scheme must be one of them.
+  if (u.protocol !== "https:" && u.protocol !== "http:") throw _err("cmp/bad-url", "the CMP base URL must be http or https (a well-known URI is authority-rooted over HTTP), got " + u.protocol + ": " + JSON.stringify(String(base)));
+  if (u.search || u.hash) throw _err("cmp/bad-url", "the CMP base URL must not carry a query or fragment component (RFC 9811 sec. 3.4)");
+  // A backslash has no place in an http(s) authority: WHATWG rewrites it to a path separator (so
+  // `https://ca.example\tenant` is really the path `/tenant`), but the raw-path regex below excludes only
+  // `/?#` and would swallow it as authority, slipping a supplied path past the check. Reject it outright.
+  if (/\\/.test(String(base))) throw _err("cmp/bad-url", "the CMP base URL must not contain a backslash (WHATWG rewrites it to a path separator): " + JSON.stringify(String(base)));
+  // An RFC 8615 well-known URI is AUTHORITY-ROOTED (/.well-known/...), so a base carrying ANY path is
+  // rejected fail-closed -- an operator whose CMP endpoint sits under a path passes that full operation URL
+  // to transfer() directly. Inspect the RAW path in the source string, NOT url.pathname: WHATWG normalizes
+  // dot-segments (`/tenant/..`, `/%2e`) to "/" before the parse, which would slip a supplied path past a
+  // pathname check and silently target the authority-root profile instead of reporting the misconfiguration.
+  var rawBasePath = String(base).replace(/^[a-z]+:\/\/[^/?#]*/i, "").split(/[?#]/)[0];
+  if (rawBasePath !== "" && rawBasePath !== "/") throw _err("cmp/bad-url", "an RFC 8615 well-known URI is authority-rooted; the CMP base URL must have no path component (pass a full operation URL to transfer instead): " + JSON.stringify(String(base)));
+  var segs = [".well-known", "cmp"];
+  if (opts.label != null) { segs.push("p"); segs.push(_wellKnownSeg(opts.label, "label")); }
+  if (opts.operation != null) segs.push(_wellKnownSeg(opts.operation, "operation"));
+  return u.origin + "/" + segs.join("/");
+}
+
+/**
+ * @primitive  pki.cmp.transfer
+ * @signature  pki.cmp.transfer(url, message, opts?) -> Promise<{ response, responseBytes, status, contentType, tls }>
+ * @since      0.3.19
+ * @status     experimental
+ * @spec       RFC 9811, RFC 9810
+ * @related    pki.cmp.build, pki.cmp.wellKnownUrl, pki.schema.cmp.parse, pki.transport.https
+ *
+ * POST a DER `PKIMessage` to a CMP endpoint and return the parsed response `PKIMessage`, over the shared
+ * `pki.transport`. RFC 9811 transfers every CMP exchange identically -- one HTTP POST of a DER PKIMessage,
+ * one response PKIMessage -- so a single stateless verb carries `ir` / `cr` / `kur` / `p10cr` / `certConf`
+ * / `pollReq` / `rr` / `genm` and their responses; the caller builds and protects the message upstream with
+ * `pki.cmp.build` and hands the finished bytes here. `message` is a DER `Buffer`/`Uint8Array` or a PEM `CMP`
+ * string, sent VERBATIM (the message-layer protection covers these exact bytes -- they are never re-encoded).
+ * The response is classified fail-closed: HTTP 200 carrying an `application/pkixcmp` body is parsed and
+ * resolved; another 2xx is `cmp/unexpected-status` (RFC 9811 requires 200); a 3xx is `cmp/redirect-not-followed`
+ * (never auto-followed, sec. 3.1/5); a 4xx/5xx carrying a well-formed CMP `error` PKIMessage FORWARDS that
+ * integrity-protected verdict (sec. 1.2/3.1) with the HTTP status surfaced as data, while a 4xx/5xx that is
+ * not a CMP `error` message (no body, an undecodable body, or a non-error arm) is `cmp/http-error`.
+ * Protection is SURFACED, not verified -- the client confers no trust; the
+ * caller (or a future `pki.cmp.verify`) checks the response protection using the raw `headerBytes`/`bodyBytes`.
+ * By default the transport is https-only and requires an explicit trust anchor; there is no client scheme
+ * gate, so an operator who injects an http-capable transport reaches the RFC-9811-permitted plain-HTTP path.
+ *
+ * @opts
+ *   - `transport` -- an injectable `transport(request) -> Promise<{status,headers,body}>` (default
+ *     `pki.transport.https`, which fail-closes on a non-https URL and an unpinned server).
+ *   - `tls` -- `{ anchors, useSystemStore, cert, key, minVersion, servername, checkServerIdentity }` for the
+ *     default transport (mutual-TLS `cert`/`key` is common for CMP in addition to message protection).
+ *   - `headers` -- extra request headers. The `content-type: application/pkixcmp` is always set and not
+ *     overridable (any casing), and the request-framing headers (`content-length`, `transfer-encoding`) are
+ *     stripped -- the transport computes Content-Length from the exact body, so a caller cannot desync framing.
+ *   - `timeout` -- ms (default 30s); `maxResponseBytes` -- streaming cap, tightenable downward only.
+ * @example
+ *   var reqDer = await pki.cmp.build(
+ *     { header: { sender: { directoryName: "CN=client" }, recipient: { directoryName: "CN=CA" } },
+ *       body: { p10cr: csrDer } },
+ *     { key: signerKeyPkcs8, cert: signerCertDer });
+ *   var url = pki.cmp.wellKnownUrl("https://ca.example", { operation: "p10cr" });
+ *   var res = await pki.cmp.transfer(url, reqDer, { transport: transport });
+ *   res.response.body.arm;   // "ip" | "cp" | "error"
+ */
+
+/**
+ * @primitive  pki.cmp.wellKnownUrl
+ * @signature  pki.cmp.wellKnownUrl(base, opts?) -> string
+ * @since      0.3.19
+ * @status     experimental
+ * @spec       RFC 9811, RFC 8615
+ * @related    pki.cmp.transfer
+ *
+ * Build an RFC 9811 sec. 3.4 CMP request-URI under the `/.well-known/cmp` prefix (RFC 8615). The four forms:
+ * `<base>/.well-known/cmp`, `.../<operation>`, `.../p/<label>`, and `.../p/<label>/<operation>`. A pure string
+ * builder over an authority-rooted well-known path (RFC 8615) -- https vs http is left to the transport (both
+ * forms are accepted, RFC 9811 sec. 3.4), but the `base` MUST be an http(s) URL. It rejects (`cmp/bad-url`) an
+ * unparseable `base`, a non-http(s) scheme (`file:`/`data:`/a custom scheme has an opaque origin), a `base`
+ * carrying a path / query / fragment (a well-known URI is authority-rooted; a path would capture it), and a
+ * `label`/`operation` that is empty, a dot-segment, or contains a `/` or other reserved char (never silently
+ * retarget the resource). The `operation` label is a caller-supplied string, not validated against a profile
+ * vocabulary (RFC 9483 is out of scope).
+ *
+ * @opts
+ *   - `label` -- an optional CA/RA name inserted as `.../p/<label>` (a single percent-encoded path segment).
+ *   - `operation` -- an optional operation label appended as the final path segment.
+ * @example
+ *   pki.cmp.wellKnownUrl("https://ca.example");                          // "https://ca.example/.well-known/cmp"
+ *   pki.cmp.wellKnownUrl("https://ca.example", { label: "myca", operation: "cr" });
+ *   //                                                                   // ".../.well-known/cmp/p/myca/cr"
+ */
+module.exports = { build: build, transfer: transfer, wellKnownUrl: wellKnownUrl };

package/lib/est.js

@@ -62,6 +62,7 @@ var csr = require("./schema-csr");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var httpTransport = require("./http-transport");
+var retryAfter = require("./http-retry-after");
 
 var EstError = frameworkError.EstError;
 function E(code, message, cause) { return new EstError(code, message, cause); }
@@ -76,50 +77,6 @@ var OID_TEMPLATE = oid.byName("certificationRequestInfoTemplate");
 
 var OPERATIONS = ["cacerts", "simpleenroll", "simplereenroll", "fullcmc", "serverkeygen", "csrattrs"];
 
-// The largest Retry-After delay this classifier will surface as a number: a
-// generous one-year ceiling that keeps the value a safe integer and rejects an
-// overflowing / nonsensical delay-seconds fail-closed rather than returning it.
-var MAX_RETRY_AFTER_SECONDS = constants.TIME.days(365) / constants.TIME.seconds(1);
-
-// The three HTTP-date forms (RFC 7231 sec. 7.1.1.1): IMF-fixdate (the required
-// form), and the obsolete rfc850-date / asctime-date a recipient must still
-// accept. Gating Date.parse on this grammar keeps its permissiveness (an ISO
-// string like "2026-07-10") from passing as a valid Retry-After header.
-var _MONTHS = "Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec".split(" ");
-var _MONTH = "(?:" + _MONTHS.join("|") + ")";
-var HTTP_DATE_FORMS = [
-  new RegExp("^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), \\d{2} " + _MONTH + " \\d{4} \\d{2}:\\d{2}:\\d{2} GMT$"),
-  new RegExp("^(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), \\d{2}-" + _MONTH + "-\\d{2} \\d{2}:\\d{2}:\\d{2} GMT$"),
-  new RegExp("^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) " + _MONTH + " [ \\d]\\d \\d{2}:\\d{2}:\\d{2} \\d{4}$"),
-];
-
-// Parse an HTTP-date to epoch ms, or NaN when its grammar, calendar, or time is
-// invalid. Built from the extracted fields via Date.UTC (never Date.parse): every
-// HTTP-date is UTC -- the asctime form carries no GMT token, so delegating would
-// parse it in LOCAL time -- and the round-trip check rejects an impossible date /
-// time (Date.UTC normalizes Feb 31 -> Mar 2 just as Date.parse would).
-function _httpDateMs(s) {
-  if (!HTTP_DATE_FORMS.some(function (re) { return re.test(s); })) return NaN;
-  var day, monName, year;
-  var asc = /^\w{3} (\w{3}) ([ \d]\d) /.exec(s);                           // asctime: month then day
-  if (asc) { monName = asc[1]; day = parseInt(asc[2], 10); year = parseInt(/(\d{4})$/.exec(s)[1], 10); }
-  else {
-    var dmy = /(\d{2})[ -](\w{3})[ -](\d{2,4})/.exec(s);                   // IMF / rfc850: day month year
-    if (!dmy) return NaN;
-    day = parseInt(dmy[1], 10); monName = dmy[2]; year = parseInt(dmy[3], 10);
-    if (year < 100) year += (year < 70 ? 2000 : 1900);                    // rfc850 two-digit year
-  }
-  var t = /(\d{2}):(\d{2}):(\d{2})/.exec(s);
-  var mon = _MONTHS.indexOf(monName);
-  if (!t || mon < 0) return NaN;
-  var hh = parseInt(t[1], 10), mi = parseInt(t[2], 10), ss = parseInt(t[3], 10);
-  var when = Date.UTC(year, mon, day, hh, mi, ss);
-  var d = new Date(when);
-  if (d.getUTCDate() !== day || d.getUTCMonth() !== mon || d.getUTCFullYear() !== year ||
-      d.getUTCHours() !== hh || d.getUTCMinutes() !== mi || d.getUTCSeconds() !== ss) return NaN;
-  return when;
-}
-
 // ---- the RFC 8951 sec. 3/3.1 transfer codec (CTE-header-blind) -----------
 
 /**
@@ -511,29 +468,11 @@ function classifyResponse(status, headers, body, opts) {
     var ra = h["retry-after"];
     if (ra === undefined || ra === null || String(ra).trim() === "") throw E("est/missing-retry-after", "an HTTP 202 EST response must include Retry-After (RFC 7030 sec. 4.2.3)");
     var raStr = String(ra).trim();
-    // Retry-After is delay-seconds OR an HTTP-date (RFC 7231 sec. 7.1.3). A
-    // delay-seconds becomes retryAfterSeconds directly; an HTTP-date is surfaced
-    // as an absolute retryAfterDate (epoch ms) -- and, when the caller passes its
-    // receipt time as opts.now (epoch ms), also as a bounded retryAfterSeconds.
-    // Neither form -> fail closed rather than a retry verdict with no delay.
-    var out202 = { status: "retry", retryAfter: raStr, retryAfterSeconds: null, retryAfterDate: null };
-    if (/^\d+$/.test(raStr)) {
-      var n = parseInt(raStr, 10);
-      if (!Number.isSafeInteger(n) || n > MAX_RETRY_AFTER_SECONDS) throw E("est/bad-retry-after", "the 202 Retry-After delay is out of the supported range (0.." + MAX_RETRY_AFTER_SECONDS + " seconds)");
-      out202.retryAfterSeconds = n;
-    } else {
-      var when = _httpDateMs(raStr);
-      if (isNaN(when)) throw E("est/bad-retry-after", "a 202 Retry-After must be delay-seconds or a valid HTTP-date (RFC 7231 sec. 7.1.1.1/7.1.3), got " + JSON.stringify(raStr));
-      out202.retryAfterDate = when;
-      if (typeof opts.now === "number" && isFinite(opts.now)) {
-        var d = Math.max(0, Math.round((when - opts.now) / constants.TIME.seconds(1)));
-        // The same one-year ceiling the delay-seconds form enforces (a date far in
-        // the future would otherwise surface a huge numeric delay).
-        if (d > MAX_RETRY_AFTER_SECONDS) throw E("est/bad-retry-after", "the 202 Retry-After date is beyond the supported horizon (" + MAX_RETRY_AFTER_SECONDS + " seconds)");
-        out202.retryAfterSeconds = d;
-      }
-    }
-    return out202;
+    // Retry-After is delay-seconds OR an HTTP-date (RFC 7231 sec. 7.1.3), surfaced (never slept on)
+    // as a bounded retryAfterSeconds and/or an absolute retryAfterDate via the shared parser; neither
+    // form -> fail closed rather than a retry verdict with no delay.
+    var parsed = retryAfter.parse(raStr, { now: opts.now, E: E, code: "est/bad-retry-after" });
+    return { status: "retry", retryAfter: raStr, retryAfterSeconds: parsed.retryAfterSeconds, retryAfterDate: parsed.retryAfterDate };
   }
   if (status === 204 || status === 404) {
     if (op === "csrattrs") return { status: "none-available" };
@@ -792,7 +731,10 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
   function step() {
     return transport({ method: method, url: url.href, headers: headers, body: body, tls: tls, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }).then(function (res) {
       res = res || {};
-      var blen = Buffer.isBuffer(res.body) ? res.body.length : Buffer.byteLength(String(res.body == null ? "" : res.body), "latin1");
+      // Measure an injected string body as UTF-8 -- the byte width the body is decoded/transfer-decoded at,
+      // and what the real socket transport counts -- so a non-ASCII body (multi-byte chars are ~half the
+      // count under latin1) cannot undercount past the DoS cap and reach body handling.
+      var blen = Buffer.isBuffer(res.body) ? res.body.length : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
       if (blen > budgets.maxResponseBytes) throw E("est/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap (RFC 7030 sec. 6)");
       // The transport contract returns lowercased headers, but the injectable seam only promises
       // { status, headers, body }; normalize here so a redirect Location / WWW-Authenticate from an
@@ -885,7 +827,9 @@ function _certsResult(op, res, opts, csrSpki) {
   // Only the RFC-defined success statuses are accepted: a non-standard 2xx (201, 206, ...) that the
   // classifier reports as "unexpected" must NOT have its body decoded and accepted as certificates.
   if (verdict.status !== "ok") throw E("est/http-error", "an EST " + op + " response must be HTTP 200 or 202 (RFC 7030 sec. 4.1.3 / 4.2.3), got " + res.status);
-  var bodyLen = Buffer.isBuffer(res.body) ? res.body.length : Buffer.byteLength(String(res.body == null ? "" : res.body), "latin1");
+  // Measure the body as UTF-8 for parity with the transport cap above (this check only distinguishes empty
+  // from non-empty, where the encoding is immaterial, but the shape is kept uniform so no site undercounts).
+  var bodyLen = Buffer.isBuffer(res.body) ? res.body.length : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
   if (bodyLen === 0) throw E("est/empty-body", "a 200 " + op + " response carried an empty body (RFC 7030 sec. 4.1.3 / 4.2.3)");
   var parsed = parseCertsOnly(transferDecode(res.body));
   if (op === "cacerts") return { certificates: parsed.certificates, crls: parsed.crls };

package/lib/http-retry-after.js

@@ -0,0 +1,101 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- the shared HTTP Retry-After parser (RFC 7231 sec. 7.1.3): a delay-seconds count OR an
+// HTTP-date (sec. 7.1.1.1). The enrollment protocol clients (pki.est now, pki.acme next) all surface a
+// server's Retry-After as a bounded delay -- never sleeping on it in a single-step call -- so the
+// delay-seconds | HTTP-date grammar and the one-year ceiling live in ONE place both compose, error-
+// factory-parameterized so each domain keeps its own typed verdict. A malformed / overflowing value
+// fails closed (the caller's E(code, ...)); the value is never returned unparsed.
+
+var constants = require("./constants");
+
+// The largest delay this parser surfaces as a number: a generous one-year ceiling that keeps the
+// value a safe integer and rejects an overflowing / nonsensical delay-seconds or far-future date.
+var MAX_RETRY_AFTER_SECONDS = constants.TIME.days(365) / constants.TIME.seconds(1);
+
+// The three HTTP-date forms (RFC 7231 sec. 7.1.1.1): IMF-fixdate (the required form), and the obsolete
+// rfc850-date / asctime-date a recipient must still accept. Gating Date.parse on this grammar keeps its
+// permissiveness (an ISO string like "2026-07-10") from passing as a valid Retry-After header.
+var MONTHS = "Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec".split(" ");
+var MONTH = "(?:" + MONTHS.join("|") + ")";
+var HTTP_DATE_FORMS = [
+  new RegExp("^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), \\d{2} " + MONTH + " \\d{4} \\d{2}:\\d{2}:\\d{2} GMT$"),
+  new RegExp("^(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), \\d{2}-" + MONTH + "-\\d{2} \\d{2}:\\d{2}:\\d{2} GMT$"),
+  new RegExp("^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) " + MONTH + " [ \\d]\\d \\d{2}:\\d{2}:\\d{2} \\d{4}$"),
+];
+
+// Expand an obsolete RFC 850 two-digit year: HTTP interprets it RELATIVE TO the receipt year -- the full
+// year with these two digits within [refYear-50, refYear+49] (moved to the past only when it would
+// otherwise be more than 50 years ahead). A fixed cutoff would misdate a year near the century boundary.
+// With no receipt time, fall back to the RFC 6265 fixed rule (< 70 -> 2000s, else 1900s).
+function _rfc850Year(yy, refMs) {
+  if (typeof refMs !== "number" || !isFinite(refMs)) return yy + (yy < 70 ? 2000 : 1900);
+  var refYear = new Date(refMs).getUTCFullYear();
+  var full = Math.floor(refYear / 100) * 100 + yy;
+  // Move to the PREVIOUS century ONLY when the same-century year would be more than 50 years ahead; never
+  // advance a past year to the future (an old two-digit year stays in the past).
+  if (full - refYear > 50) full -= 100;
+  return full;
+}
+
+// Parse an HTTP-date to epoch ms, or NaN when its grammar, calendar, or time is invalid. Built from the
+// extracted fields via Date.UTC (never Date.parse): every HTTP-date is UTC -- the asctime form carries
+// no GMT token, so delegating would parse it in LOCAL time -- and the round-trip check rejects an
+// impossible date / time (Date.UTC normalizes Feb 31 -> Mar 2 just as Date.parse would).
+function httpDateMs(s, refMs) {
+  if (!HTTP_DATE_FORMS.some(function (re) { return re.test(s); })) return NaN;
+  var day, monName, year;
+  var asc = /^\w{3} (\w{3}) ([ \d]\d) /.exec(s);                           // asctime: month then day
+  if (asc) { monName = asc[1]; day = parseInt(asc[2], 10); year = parseInt(/(\d{4})$/.exec(s)[1], 10); }
+  else {
+    var dmy = /(\d{2})[ -](\w{3})[ -](\d{2,4})/.exec(s);                   // IMF / rfc850: day month year
+    if (!dmy) return NaN;
+    day = parseInt(dmy[1], 10); monName = dmy[2]; year = parseInt(dmy[3], 10);
+    if (year < 100) year = _rfc850Year(year, refMs);                       // rfc850 two-digit year
+  }
+  var t = /(\d{2}):(\d{2}):(\d{2})/.exec(s);
+  var mon = MONTHS.indexOf(monName);
+  if (!t || mon < 0) return NaN;
+  var hh = parseInt(t[1], 10), mi = parseInt(t[2], 10), ss = parseInt(t[3], 10);
+  var when = Date.UTC(year, mon, day, hh, mi, ss);
+  var d = new Date(when);
+  if (d.getUTCDate() !== day || d.getUTCMonth() !== mon || d.getUTCFullYear() !== year ||
+      d.getUTCHours() !== hh || d.getUTCMinutes() !== mi || d.getUTCSeconds() !== ss) return NaN;
+  return when;
+}
+
+// parse(value, opts) -> { retryAfterSeconds, retryAfterDate }. A PRESENT Retry-After value (the caller
+// gates absence with its own code) is a delay-seconds integer -> retryAfterSeconds, or an HTTP-date ->
+// retryAfterDate (epoch ms) plus, when opts.now (epoch ms) is given, a bounded retryAfterSeconds. Either
+// form beyond the one-year ceiling, or a value that is neither, fails closed via opts.E(opts.code, ...).
+// Never slept on here -- the value is SURFACED for the caller to decide.
+function parse(value, opts) {
+  opts = opts || {};
+  var raStr = String(value).trim();
+  var out = { retryAfterSeconds: null, retryAfterDate: null };
+  if (/^\d+$/.test(raStr)) {
+    var n = parseInt(raStr, 10);
+    if (!Number.isSafeInteger(n) || n > MAX_RETRY_AFTER_SECONDS) throw _fail(opts, "the Retry-After delay is out of the supported range (0.." + MAX_RETRY_AFTER_SECONDS + " seconds)");
+    out.retryAfterSeconds = n;
+    return out;
+  }
+  var when = httpDateMs(raStr, opts.now);
+  if (isNaN(when)) throw _fail(opts, "a Retry-After must be delay-seconds or a valid HTTP-date (RFC 7231 sec. 7.1.1.1/7.1.3), got " + JSON.stringify(raStr));
+  out.retryAfterDate = when;
+  if (typeof opts.now === "number" && isFinite(opts.now)) {
+    // Round the remaining whole-second delay UP (a sub-second date must not retry before the requested
+    // time), clamping a past date to 0.
+    var d = Math.max(0, Math.ceil((when - opts.now) / constants.TIME.seconds(1)));
+    if (d > MAX_RETRY_AFTER_SECONDS) throw _fail(opts, "the Retry-After date is beyond the supported horizon (" + MAX_RETRY_AFTER_SECONDS + " seconds)");
+    out.retryAfterSeconds = d;
+  }
+  return out;
+}
+
+function _fail(opts, message) {
+  return typeof opts.E === "function" ? opts.E(opts.code, message) : new TypeError(message);
+}
+
+module.exports = { MAX_RETRY_AFTER_SECONDS: MAX_RETRY_AFTER_SECONDS, httpDateMs: httpDateMs, parse: parse };

package/lib/http-transport.js

@@ -178,6 +178,19 @@ function httpsTransport(defaults) {
     var body = request.body;
     if (Buffer.isBuffer(body)) body = guard.bytes.view(body, E, C("bad-input"), "the request body");
 
+    // Frame a body-bearing request with a fixed Content-Length computed from the EXACT body, so it is sent
+    // length-delimited rather than Transfer-Encoding: chunked (node's default when a body is written with no
+    // Content-Length -- which strict enrollment / CMP appliances reject). A caller-supplied content-length
+    // (any case) is dropped: the transport owns request framing and never trusts a possibly-mismatched value.
+    var reqHeaders = Object.assign({}, request.headers || {});
+    if (body != null && body !== "") {
+      // Drop BOTH caller-supplied framing headers before installing the fixed length: node rejects a request
+      // carrying Content-Length AND Transfer-Encoding together (HPE_INVALID_CONTENT_LENGTH), and the transport
+      // owns framing -- it never honors a caller's chunked directive or a mismatched length.
+      Object.keys(reqHeaders).forEach(function (k) { var lk = k.toLowerCase(); if (lk === "content-length" || lk === "transfer-encoding") delete reqHeaders[k]; });
+      reqHeaders["Content-Length"] = Buffer.byteLength(body);
+    }
+
     // URL.hostname keeps the square brackets on an IPv6 literal ([2001:db8::1]); node's `hostname`
     // option and its IP-detection expect the bare address, so strip the brackets once here.
     var host = url.hostname.replace(/^\[(.*)\]$/, "$1");
@@ -186,7 +199,7 @@ function httpsTransport(defaults) {
       hostname: host,
       port: url.port || 443,
       path: url.pathname + url.search,
-      headers: request.headers || {},
+      headers: reqHeaders,
       minVersion: minVersion,
       rejectUnauthorized: true,   // ALWAYS on -- there is no code path that disables server verification
       // Opt out of connection pooling: node's keep-alive agent keys the socket pool on host + TLS

package/lib/ip-utils.js

@@ -56,4 +56,14 @@ function expandIpv6Hex(ip) {
 // Is `s` a syntactically valid IPv4 or IPv6 textual literal?
 function isIpLiteral(s) { return isIPv4(s) || expandIpv6Hex(s) !== null; }
 
-module.exports = { isIPv4: isIPv4, expandIpv6Hex: expandIpv6Hex, isIpLiteral: isIpLiteral, IPV4_RE: IPV4_RE };
+// Pack an IPv4/IPv6 textual literal to its network-order octets -- 4 for IPv4, 16 for IPv6 --
+// or null when `s` is not a valid literal. The binary inverse of the textual forms isIPv4 /
+// expandIpv6Hex validate, so a SAN/GeneralName iPAddress (RFC 5280 sec. 4.2.1.6, always a bare
+// host address of 4 or 16 octets) can be given as a string instead of a pre-packed Buffer.
+function packIpLiteral(s) {
+  if (isIPv4(s)) return Buffer.from(s.split(".").map(Number));   // each octet already range-checked by IPV4_RE
+  var hex = expandIpv6Hex(s);
+  return hex === null ? null : Buffer.from(hex, "hex");
+}
+
+module.exports = { isIPv4: isIPv4, expandIpv6Hex: expandIpv6Hex, isIpLiteral: isIpLiteral, packIpLiteral: packIpLiteral, IPV4_RE: IPV4_RE };

package/lib/pkcs12-build.js

@@ -55,9 +55,14 @@ var DEFAULT_MAC_ITER = 2048;
 var DEFAULT_PBMAC1_ITER = 2048;
 var MAC_SALT_BYTES = 8;
 var MAX_PBMAC1_KEYLEN = 1024;   // an HMAC key beyond a hash block is pointless -- bound the derived length
-// The classic Appendix B KDF is a SYNCHRONOUS JS hash loop (unlike native/async PBKDF2), so its iteration
-// count is capped far lower than the PBKDF2 limit -- a store just under the PBKDF2 cap would block the event
-// loop for seconds. 1e6 is ~500x the OpenSSL default (2048) yet bounds the loop to a fraction of a second.
+// Both MAC paths cap iterations to bound the SYNCHRONOUS derivation that blocks the event loop, but at
+// different counts BECAUSE the per-iteration cost differs by ~5x -- the two ceilings target a comparable
+// ~1-2 second wall-clock budget, not inconsistent DoS budgets. The classic Appendix B KDF is a hand-rolled
+// JS hash loop (a createHash per iteration, ~1.1us each, so 1e6 ~= 1s); PBMAC1 derives via native
+// crypto.pbkdf2Sync (one FFI call, ~0.2us per iteration, so the shared C.LIMITS.PBKDF2_MAX_ITERATIONS of 1e7
+// ~= 2s). The 10x iteration-count gap is thus calibrated to wall clock; additionally the classic count is
+// pkcs12-local (its KDF is bespoke here) while PBMAC1 reuses the toolkit-wide PBKDF2 ceiling. 1e6 is ~500x
+// the OpenSSL default (2048) yet still bounds the loop to ~1 second.
 var CLASSIC_MAC_MAX_ITERATIONS = 1000000;
 
 // The classic App. B.2 KDF (u = hash output bytes, v = compression block bytes) per RFC 7292 App. B.2.
@@ -289,6 +294,8 @@ async function _buildMacData(macOpts, sharedPassword, authSafeDer) {
   if (algorithm === "pbmac1") {
     var prf = PBMAC1_PRF[hash];
     if (!prf) throw _err("pkcs12/unsupported-algorithm", "PBMAC1 requires a SHA-256/384/512 digest (RFC 9579 sec. 5/7 forbids a <= 160-bit digest, e.g. SHA-1)");
+    // Native PBKDF2 (~0.2us/iter) tolerates the toolkit-wide PBKDF2 ceiling where the classic JS-loop KDF
+    // caps ~10x lower; both target a comparable ~1-2s wall clock (see CLASSIC_MAC_MAX_ITERATIONS).
     var iter2 = _assertMacIter(macOpts.iterations == null ? DEFAULT_PBMAC1_ITER : macOpts.iterations, C.LIMITS.PBKDF2_MAX_ITERATIONS);
     var keyLen = macOpts.keyLength != null ? macOpts.keyLength : prf.keyLen;
     if (typeof keyLen !== "number" || !Number.isInteger(keyLen) || keyLen < 20 || keyLen > MAX_PBMAC1_KEYLEN) throw _err("pkcs12/bad-input", "PBMAC1 keyLength must be an integer in [20, " + MAX_PBMAC1_KEYLEN + "] (RFC 9579 sec. 9)");