@blamejs/pki 0.3.2 → 0.3.3

package/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.3.3 — 2026-07-17
+
+pki.crmf.build issues RFC 4211 certificate request messages -- a CertReqMessages with a signature proof of possession, over every algorithm the toolkit supports.
+
+### Added
+
+- pki.crmf.build(spec, key, opts) builds and DER-encodes an RFC 4211 CertReqMessages -- a CertTemplate of the requested certificate fields plus a POPOSigningKey proof of possession signed with the requester's key (or a raVerified proof, opted into without a key) -- and returns DER, or a PEM block with opts.pem. The signing algorithm is resolved from the requested public key: RSA PKCS#1 v1.5 / PSS, ECDSA, EdDSA, ML-DSA, SLH-DSA, or a composite arm. Requested v3 extensions, registration controls, and regInfo ride in the message; pass an array of specs for a batch. Certificate-request-message parsing remains pki.schema.crmf.parse.
+- pki.asn1.build.implicit(tag, tlv) retags an encoded universal TLV as a context-class IMPLICIT [tag], preserving the source's primitive/constructed bit and content -- the single home for the IMPLICIT tag replacement the CertTemplate and other context-tagged structures compose.
+
 ## v0.3.2 — 2026-07-17
 
 pki.attrcert.sign issues RFC 5755 attribute certificates -- an Attribute Authority binds a holder to privilege attributes and signs with any algorithm the toolkit supports.

package/README.md

@@ -225,6 +225,7 @@ is callable today; nothing below is a stub.
 | `pki.x509` | X.509 certificate issuance (RFC 5280 §4) — `sign(spec, issuer, opts)` builds and signs a certificate: a `spec` of subject (a common-name string, an array of RDNs, or raw Name DER), the public key being certified, the validity window, an optional serial, and an optional `extensions` object; an `issuer` that is a key alone (self-signed — issuer equals subject, signed with that key) or a name + public key + key, or an issuing certificate + key (CA-signed). The signature algorithm is resolved from the signing key through the shared registry, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA P-256/384/521, Ed25519, Ed448, ML-DSA-44/65/87, the twelve SLH-DSA sets, and the composite arms all issue without a per-algorithm branch. It encodes basic constraints, key usage, extended key usage, subject and authority key identifiers (the SKI auto-derived by SHA-1 of the subject key), subject alternative names, and certificate policies from the spec — any other extension supplied as pre-encoded DER — derives the version from the field set, and enforces the serial bounds, the UTCTime/GeneralizedTime cutover, the DER default omissions, and the CA cross-field rules; a violation throws a typed `CertificateError`. Returns DER, or a PEM `CERTIFICATE` with `opts.pem`; every arm is independently verified by OpenSSL. Parsing stays at `pki.schema.x509.parse` — `sign` |
 | `pki.csr` | PKCS#10 certification-request issuance (RFC 2986 / RFC 2985) — `sign(spec, key, opts)` builds and signs a `CertificationRequest`: a `spec` of subject (a common-name string, an array of RDNs, or raw Name DER; may be empty), the public key being certified, an optional `extensionRequest` (requested v3 extensions — subject alternative names, key usage, extended key usage, basic constraints, certificate policies, subject key identifier, or an array of pre-encoded Extension DER — that a CA copies into the issued certificate), and an optional `challengePassword`. `key` (or `{ key }`) is the subject's own private key: the request is self-signed to prove possession of the private half of `subjectPublicKey`, and that proof is verified before the request is returned (what `openssl req -verify` checks). The signature algorithm is resolved from the subject key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch. Returns DER, or a PEM `CERTIFICATE REQUEST` with `opts.pem`; malformed input throws a typed `CsrError`. Parsing stays at `pki.schema.csr.parse` — `sign` |
 | `pki.attrcert` | RFC 5755 attribute-certificate issuance — `sign(spec, issuer, opts)` builds and signs an `AttributeCertificate` as an Attribute Authority: a `spec` of `holder` (exactly one of an entity name, a `baseCertificateID` public-key-certificate reference, a `fromCertificate` binding derived from a certificate, or an object digest), the validity window (GeneralizedTime), an optional serial (positive, ≤ 20 octets; randomly generated when omitted), the `attributes` (the privilege syntaxes — role, clearance, group, chargingIdentity, accessIdentity, authenticationInfo — or pre-encoded Attribute DER), and optional `extensions` (auditIdentity, targetInformation, noRevAvail, aaControls, acProxying, authorityKeyIdentifier, or pre-encoded Extension DER, each with its RFC 5755 criticality). An attribute certificate is never self-signed — the `issuer` is the signing AA, supplied as `{ cert, key }` or `{ name, publicKey, key }`. The signature algorithm is resolved from the AA key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch, and the signature is verified under the AA public key before the certificate is returned. Returns DER, or a PEM `ATTRIBUTE CERTIFICATE` with `opts.pem`; malformed input throws a typed `AttrCertError`. Parsing stays at `pki.schema.attrcert.parse` — `sign` |
+| `pki.crmf` | RFC 4211 certificate-request-message issuance — `build(spec, key, opts)` assembles a `CertReqMessages`: a `spec` of `certReqId` (default 0; the RFC 9483 `-1` sentinel allowed), a `certTemplate` of the requested certificate fields (`subject`, `publicKey` — the SPKI DER of the key being certified — `validity`, requested `extensions`, an optional `version` 2), optional `controls` and `regInfo` (regToken / authenticator / utf8Pairs / oldCertID / protocolEncrKey, or pre-encoded `AttributeTypeAndValue` DER), and an optional `pop` selector. `key` (or `{ key }`) is the requester's private key — the message carries a `POPOSigningKey` proof of possession signed with the private half of `certTemplate.publicKey` (verified before the message is returned), exactly as a PKCS#10 CSR proves possession; a complete template signs the `CertRequest`, an incomplete one signs a `POPOSigningKeyInput`. The signature algorithm is resolved from the requested public key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch. `key` is optional for a `raVerified` proof. Pass an array of specs for a batch; the CA-assigned template fields are never emitted. Returns DER, or a PEM block with `opts.pem`; malformed input throws a typed `CrmfError`. Parsing stays at `pki.schema.crmf.parse` — `build` |
 | `pki.cms` | RFC 5652 §5 CMS SignedData signing + signature verification — `sign(content, signers, opts)` produces a SignedData (attached or detached, one or many signers, RSA / RSASSA-PSS / ECDSA / EdDSA, the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814), and composite ML-DSA (pairing ML-DSA with a traditional RSA / ECDSA / EdDSA — accepted only when **both** components verify — draft-ietf-lamps-cms-composite-sigs)); it builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: when signed attributes are present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate; it does not chain that certificate to a trust anchor — that is the caller's step through `pki.path.validate`. **Content encryption** (RFC 5652/5083/5084/9629): `encrypt(content, recipients, opts)` produces an EnvelopedData, AuthEnvelopedData (AES-GCM, the authenticated default), or EncryptedData — recipients auto-dispatch off the certificate key to key-transport (RSAES-OAEP; v1.5 never emitted), key-agreement (ephemeral-static ECDH over P-256/384/521 with the X9.63 KDF, and X25519/X448 with HKDF), symmetric key-wrap, password (PBKDF2 + RFC 3211 PWRI-KEK), or the post-quantum ML-KEM KEMRecipientInfo (RFC 9629/9936) — one fresh content key wrapped for every recipient. `decrypt(input, keyMaterial, opts)` recovers the content through the matching arm and returns it with an `authenticated` flag; every secret-dependent failure collapses to one uniform `cms/decrypt-failed` verdict (Bleichenbacher / EFAIL / password-oracle freedom), and PKCS#1 v1.5 is decrypt-only under the RFC 3218 implicit-rejection countermeasure. **Compression** (RFC 3274): `compress(content, opts)` / `decompress(input, opts)` produce and consume a CompressedData (ZLIB, version 0, id-alg-zlibCompress); decompress bounds the uncompressed output at 16 MiB and stops before it is materialized, so a decompression bomb fails closed as `cms/decompress-too-large` — a size transform with no integrity/confidentiality (RFC 8551 §2.4.5). Fail-closed with typed `cms/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress` |
 | `pki.smime` | RFC 8551 S/MIME message assembly, verification, encryption, and compression over the CMS layer — `sign(content, signers, opts)` wraps a MIME entity as a signed S/MIME message in either form: `multipart/signed` (clear-signed — the content stays readable in any MUA, a detached CMS SignedData rides alongside as `application/pkcs7-signature` with a matching `micalg`) or `application/pkcs7-mime; smime-type=signed-data` (opaque — the whole entity is a base64 CMS SignedData). The signed bytes are the entity's RFC 8551 §3.1.1 canonical form (CRLF line endings); `verify(message, opts)` unwraps both forms and recomputes over the same canonicalizer, so a transport that re-wraps line endings still verifies and a tampered part fails. `encrypt(content, recipients, opts)` envelopes a MIME entity as an opaque `application/pkcs7-mime` message and `decrypt(message, keyMaterial, opts)` opens one — `smime-type=authEnveloped-data` (AES-GCM, confidentiality and integrity, the default) or `smime-type=enveloped-data` (AES-CBC, confidentiality only, so `decrypt` reports `authenticated: false`, the §3.3 no-integrity caveat); the `smime-type` is derived from the CMS body, not the header, and decryption is fail-closed and oracle-free. The crypto is entirely `pki.cms.sign` / `verify` / `encrypt` / `decrypt` — any RSA / RSASSA-PSS / ECDSA / EdDSA / ML-DSA / SLH-DSA signer and any RSA-OAEP / ECDH / X25519 / X448 / AES-KW / PBKDF2 / ML-KEM recipient carries through (algorithm-agnostic). Like `cms.verify`, `verify` returns the per-signer cryptographic verdict plus the recovered content; chaining a signer to a trust anchor is the caller's `pki.path.validate` step. `compress(content, opts)` / `decompress(message, opts)` add the opaque `application/pkcs7-mime; smime-type=compressed-data; name=smime.p7z` frame (RFC 8551 §3.6, RFC 3274) — a size transform with no integrity/confidentiality (§2.4.5), decompress bounded against a bomb; the recovered content, which may itself be signed or enveloped, is returned for the caller to re-verify. Bidirectionally interoperable with `openssl smime` / `openssl cms`. Fail-closed with typed `smime/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress` |
 | `pki.tsp` | RFC 3161 Time-Stamp Protocol — `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData (over `pki.cms.sign`) whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` (with optional accuracy / nonce / ordering), plus the RFC 3161 §2.4.2 signing-certificate attribute binding the token to the TSA certificate (SHA-2 imprints, any `pki.cms.sign` TSA key). `request` / `parseRequest` build and parse the TimeStampReq a client sends (imprint, requested policy, nonce, certReq), `response` / `parseResponse` the TimeStampResp a TSA returns — a granted status wrapping a token, or a rejection with PKIStatus and failure info, the §2.4.2 status↔token coupling enforced in both directions. `verify(token, data, opts)` verifies a token fail-closed: the CMS signature over the exact signed bytes, the message imprint recomputed from the data, the TSTInfo content type, the ESSCertID(V2) binding to the TSA certificate, the §2.3 critical timeStamping-only extendedKeyUsage, the request nonce when used, and — with a trust anchor supplied — full certification-path validation of the TSA certificate at the token's `genTime`, returning `{ valid, genTime, serialNumber, tstInfo, … }` — `sign`, `request`, `parseRequest`, `response`, `parseResponse`, `verify` |

package/index.js

@@ -43,6 +43,7 @@ var ocsp      = require("./lib/ocsp");
 var x509      = require("./lib/x509-sign");
 var csr       = require("./lib/csr-sign");
 var attrcert  = require("./lib/attrcert-sign");
+var crmf      = require("./lib/crmf-sign");
 var merkle    = require("./lib/merkle");
 var shbs      = require("./lib/shbs");
 var hpke      = require("./lib/hpke");
@@ -98,6 +99,10 @@ module.exports = {
   // builds and signs an AttributeCertificate binding a Holder to privilege attributes as an
   // Attribute Authority (never self-signed). Parsing lives at pki.schema.attrcert.parse.
   attrcert:  attrcert,
+  // `crmf` is the RFC 4211 certificate-request-message producing side -- pki.crmf.build
+  // assembles a CertReqMessages (a CertTemplate + a signature proof of possession) for a CMP
+  // or EST enrollment. Parsing lives at pki.schema.crmf.parse.
+  crmf:      crmf,
   // `merkle` is the RFC 6962 / RFC 9162 Merkle-tree proof-verification core --
   // pki.merkle.leafHash / nodeHash / emptyRootHash build the domain-separated
   // (0x00 leaf / 0x01 node) SHA-256 tree hashes; pki.merkle.verifyInclusion and

package/lib/asn1-der.js

@@ -989,6 +989,15 @@ var build = {
   explicit: function (tagNumber, inner) { return encodeTLV(CLASS_CONTEXT, true, tagNumber, _asBuffer(inner, "build.explicit")); },
   contextPrimitive:   function (tagNumber, content) { return encodeTLV(CLASS_CONTEXT, false, tagNumber, _asBuffer(content, "build.contextPrimitive")); },
   contextConstructed: function (tagNumber, content) { return encodeTLV(CLASS_CONTEXT, true, tagNumber, _asBuffer(content, "build.contextConstructed")); },
+  // IMPLICIT [tag] retag of an already-encoded UNIVERSAL TLV: replace the source's tag with a context-class
+  // [tag] identifier, PRESERVING the source's primitive/constructed bit and content octets (X.680 sec. 30.6).
+  // A single home for the tag replacement so no format module re-inlines the P/C-bit handling (a decode of
+  // the source validates it is exactly one well-formed TLV; its content is the trailing `length` octets).
+  implicit: function (tagNumber, tlv) {
+    var buf = _asBuffer(tlv, "build.implicit");
+    var node = decode(buf);
+    return encodeTLV(CLASS_CONTEXT, node.constructed, tagNumber, buf.slice(buf.length - node.length));
+  },
   raw:      function (buf) { return _asBuffer(buf, "build.raw"); },
 };
 

package/lib/crmf-sign.js

@@ -0,0 +1,275 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+
+/**
+ * @module     pki.crmf
+ * @nav        Signing
+ * @title      Certificate request messages
+ * @intro The RFC 4211 certificate-request-message producing side. `pki.crmf.build` assembles a
+ *   `CertReqMessages` -- one or more `CertReqMsg`, each a `CertRequest` (a `CertTemplate` of the requested
+ *   certificate fields plus optional controls) paired with a proof of possession. The common proof is a
+ *   `POPOSigningKey` signature over the `CertRequest`, made with the private half of the key being
+ *   certified (the requester proves possession, exactly as a PKCS#10 CSR does). The message drops into a
+ *   CMP (RFC 9810) or EST enrollment body. Parsing lives at `pki.schema.crmf.parse`.
+ * @spec RFC 4211
+ * @card Build a CRMF CertReqMessages with a signature proof of possession.
+ */
+//
+// RFC 4211 App. B / RFC 5912 sec. 10 are DEFINITIONS IMPLICIT TAGS: a CertTemplate [0]..[9] field tag
+// REPLACES the base universal tag (built via asn1.build.implicit, preserving the primitive/constructed
+// bit); the shipped parser encodes issuer [3] / subject [5] Name IMPLICITLY (the dominant CMP/EST wire
+// form), so the builder does too. The two EXPLICIT exceptions are the OptionalValidity notBefore [0] /
+// notAfter [1] Time (a genuine UTCTime/GeneralizedTime CHOICE). The signature scheme resolves from the
+// requested publicKey through the shared sign-scheme registry; the Name / extension / SPKI encoders and
+// the post-sign self-check are the shared lib/pki-build primitives, bound to the crmf namespace.
+
+var asn1 = require("./asn1-der");
+var oid = require("./oid");
+var crmf = require("./schema-crmf");
+var signScheme = require("./sign-scheme");
+var pkix = require("./schema-pkix");
+var pkiBuild = require("./pki-build");
+var frameworkError = require("./framework-error");
+
+var CrmfError = frameworkError.CrmfError;
+var b = asn1.build;
+function _err(code, message, cause) { return new CrmfError(code, message, cause); }
+function _signE(kind, message, cause) { return new CrmfError("crmf/" + kind, message, cause); }
+function O(n) { return oid.byName(n); }
+
+var NS = pkix.makeNS("crmf", CrmfError, oid);
+var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
+var _b = pkiBuild.makeBuilder({
+  ErrorClass: CrmfError, prefix: "crmf", O: O, NS: NS,
+  NAME_SCHEMA: pkix.name(NS), SPKI_SCHEMA: pkix.spki(NS), EXT_DECODERS: EXT_DECODERS,
+});
+
+var KNOWN_SPEC_KEYS = { certReqId: 1, certTemplate: 1, controls: 1, regInfo: 1, pop: 1 };
+var KNOWN_TEMPLATE_KEYS = { version: 1, subject: 1, publicKey: 1, validity: 1, extensions: 1, issuer: 1 };
+// The controls (RFC 4211 sec. 6) and regInfo (sec. 7) are DISJOINT AttributeTypeAndValue namespaces --
+// regToken/authenticator/oldCertID/protocolEncrKey are controls; utf8Pairs is regInfo -- so the object
+// form validates each key against its own field's registry (a control name is not a valid regInfo, and
+// vice versa). The key name equals the registered OID name; complex values (pkiPublicationInfo, certReq)
+// ride the pre-encoded escape hatch. Each entry is the value encoder for that OID.
+function _ctlUtf8(v) { return b.utf8(String(v)); }
+function _ctlSpki(v) { var k = _b.reqDer(v, "protocolEncrKey (an SPKI DER)"); _b.assertValidSpki(k, "protocolEncrKey"); return b.raw(k); }
+var CONTROL_VALUE = { regToken: _ctlUtf8, authenticator: _ctlUtf8, oldCertID: function (v) { return _encodeCertId(v); }, protocolEncrKey: _ctlSpki };
+var REGINFO_VALUE = { utf8Pairs: _ctlUtf8 };
+
+// ---- CertTemplate + POP structural encoders (byte-exact inverses of schema-crmf.js) ----
+
+// OptionalValidity [4] IMPLICIT SEQUENCE { notBefore [0] EXPLICIT Time, notAfter [1] EXPLICIT Time } --
+// at least one present (RFC 4211 sec. 5). Time is a CHOICE so [0]/[1] are EXPLICIT.
+function _encodeOptionalValidity(validity) {
+  if (!validity || typeof validity !== "object" || Buffer.isBuffer(validity)) throw _err("crmf/bad-validity", "validity must be an object { notBefore?, notAfter? }");
+  var nb = validity.notBefore, na = validity.notAfter;
+  if (nb == null && na == null) throw _err("crmf/bad-validity", "validity must contain notBefore or notAfter (RFC 4211 sec. 5)");
+  var parts = [];
+  // timeDer validates each instant (guard.time.assertValid throws on an Invalid Date) BEFORE the
+  // inverted-window comparison, so getTime() below cannot be NaN.
+  if (nb != null) parts.push(b.explicit(0, _b.timeDer(nb, "validity notBefore")));
+  if (na != null) parts.push(b.explicit(1, _b.timeDer(na, "validity notAfter")));
+  // allow:nan-date-comparison-unguarded -- both instants passed timeDer's guard.time.assertValid above.
+  if (nb != null && na != null && nb.getTime() > na.getTime()) throw _err("crmf/bad-validity", "notBefore must not be after notAfter");
+  return b.implicit(4, b.sequence(parts));
+}
+// CertTemplate ::= SEQUENCE { [0..9] all IMPLICIT OPTIONAL }. A REQUEST omits serialNumber [1] / signingAlg
+// [2] / issuerUID [7] / subjectUID [8] (CA-assigned or deprecated, RFC 4211 sec. 5) -- the builder never
+// emits them. Fields are emitted in ascending tag order.
+function _encodeCertTemplate(tpl) {
+  if (!tpl || typeof tpl !== "object" || Buffer.isBuffer(tpl)) throw _err("crmf/bad-cert-template", "certTemplate must be an object");
+  Object.keys(tpl).forEach(function (k) { if (!KNOWN_TEMPLATE_KEYS[k]) throw _err("crmf/bad-input", "unknown certTemplate field " + JSON.stringify(k)); });
+  var fields = [];
+  if (tpl.version != null) {
+    if (tpl.version !== 2) throw _err("crmf/bad-version", "certTemplate version MUST be 2 (v3) if supplied (RFC 4211 sec. 5)");
+    fields.push(b.implicit(0, b.integer(2n)));                                  // version [0]
+  }
+  // issuer [3] / subject [5] are EXPLICIT: Name is a CHOICE, and X.680 sec. 31.2.7 forces a context tag on
+  // a CHOICE to EXPLICIT even under the module's IMPLICIT TAGS default (the [3]/[5] wraps the RDNSequence
+  // SEQUENCE, it does not replace its tag). The parser accepts both forms; this is the conformant one.
+  if (tpl.issuer != null) fields.push(b.explicit(3, _b.encodeName(tpl.issuer)));    // issuer [3] EXPLICIT
+  if (tpl.validity != null) fields.push(_encodeOptionalValidity(tpl.validity));     // validity [4] IMPLICIT
+  if (tpl.subject != null) fields.push(b.explicit(5, _b.encodeName(tpl.subject)));  // subject [5] EXPLICIT
+  var spki = null;
+  if (tpl.publicKey != null) {
+    spki = _b.reqDer(tpl.publicKey, "certTemplate.publicKey (the SPKI DER of the requested key)");
+    _b.assertValidSpki(spki, "certTemplate.publicKey");
+    fields.push(b.implicit(6, spki));                                             // publicKey [6]
+  }
+  if (tpl.extensions != null) fields.push(b.implicit(9, _b.requestedExtensions(tpl.extensions, spki)));   // extensions [9]
+  return { der: b.sequence(fields), spki: spki, complete: tpl.subject != null && tpl.publicKey != null };
+}
+
+// Controls / regInfo ::= SEQUENCE SIZE(1..MAX) OF AttributeTypeAndValue { type OID, value ANY }. Object
+// form maps recognized names to typed value encoders; any other (or a pre-encoded AttributeTypeAndValue
+// DER array) rides the escape hatch, shape-validated.
+function _buildAttrTypeAndValues(spec, code, label, valueMap) {
+  if (Array.isArray(spec)) {
+    if (!spec.length) throw _err(code, label + " must carry at least one entry");
+    var seenA = {};
+    return b.sequence(spec.map(function (e, i) {
+      var der = _b.reqDer(e, label + " [" + i + "]");
+      var n;
+      try { n = asn1.decode(der); } catch (err) { throw _err("crmf/bad-input", "pre-encoded " + label + " [" + i + "] is not valid DER", err); }
+      if (n.tagNumber !== asn1.TAGS.SEQUENCE || n.tagClass !== "universal" || !n.children || n.children.length !== 2) throw _err("crmf/bad-input", "pre-encoded " + label + " [" + i + "] must be a SEQUENCE { type OID, value }");
+      var t;
+      try { t = asn1.read.oid(n.children[0]); } catch (err) { throw _err("crmf/bad-input", "pre-encoded " + label + " [" + i + "] type is not an OBJECT IDENTIFIER", err); }
+      if (seenA[t]) throw _err(code, "duplicate " + label + " type " + (oid.name(t) || t));
+      seenA[t] = true;
+      return b.raw(der);
+    }));
+  }
+  if (!spec || typeof spec !== "object") throw _err("crmf/bad-input", label + " must be an object or an array of pre-encoded AttributeTypeAndValue DER");
+  var out = [], seen = {};
+  Object.keys(spec).forEach(function (k) {
+    var enc = valueMap[k];
+    if (!enc) throw _err("crmf/bad-input", "unknown " + label + " " + JSON.stringify(k) + "; pass a pre-encoded AttributeTypeAndValue DER via the array form for a " + label + " entry outside " + Object.keys(valueMap).join("/"));
+    var typeOid = O(k);
+    if (seen[typeOid]) throw _err(code, "duplicate " + label + " type " + k);
+    seen[typeOid] = true;
+    out.push(b.sequence([b.oid(typeOid), enc(spec[k])]));
+  });
+  if (!out.length) throw _err(code, label + " must carry at least one entry");
+  return b.sequence(out);
+}
+// certReqId is a signed INTEGER, value UNCONSTRAINED (the RFC 9483 -1 sentinel and 0 are both legal). A
+// number must be a safe integer (a fractional or > 2^53 number loses precision through BigInt); a BigInt
+// or a decimal / 0x-hex string carries an arbitrary value.
+function _certReqId(v) {
+  if (v == null) return 0n;
+  if (typeof v === "bigint") return v;
+  if (typeof v === "number") { if (!Number.isSafeInteger(v)) throw _err("crmf/bad-input", "certReqId number must be a safe integer (pass a BigInt or a string for a larger value)"); return BigInt(v); }
+  if (typeof v === "string") { try { return BigInt(v); } catch (e) { throw _err("crmf/bad-input", "certReqId string must be a decimal or 0x-hex integer", e); } }
+  throw _err("crmf/bad-input", "certReqId must be a BigInt, a safe integer, or a string");
+}
+// CertId ::= SEQUENCE { issuer GeneralName, serialNumber INTEGER } (RFC 4211 sec. 6.4, oldCertID value).
+function _encodeCertId(id) {
+  if (!id || typeof id !== "object" || id.issuer == null || id.serialNumber == null) throw _err("crmf/bad-input", "oldCertID must be { issuer: GeneralName, serialNumber }");
+  return b.sequence([_b.encodeGeneralName(id.issuer), _b.serialInteger(id.serialNumber)]);
+}
+
+// ProofOfPossession. The signature arm (the default when a key is given): when the template carries BOTH
+// subject and publicKey (complete), sign the CertRequest DER and OMIT poposkInput; otherwise build a
+// POPOSigningKeyInput (authInfo sender [0] GeneralName + the requested publicKey), sign its SEQUENCE, and
+// carry it as poposkInput [0] (RFC 4211 sec. 4.1). raVerified is emitted only on an explicit opt-in.
+function _buildProofOfPossession(pop, certReqDer, template, signingKey, opts) {
+  if (pop != null && (typeof pop !== "object" || Buffer.isBuffer(pop))) throw _err("crmf/bad-input", "spec.pop must be an object (e.g. { type: 'signature' } or { type: 'raVerified', raVerified: true })");
+  var mode = (pop && pop.type) || (signingKey != null ? "signature" : null);
+  if (mode == null) return null;   // no POP requested and no key -> omit popo (an RA supplies it out of band)
+  if (mode === "raVerified") {
+    if (!(pop && pop.raVerified === true)) throw _err("crmf/bad-popo", "raVerified must be explicitly opted into (pop: { type: 'raVerified', raVerified: true }) -- a requester does not normally assert it (RFC 4211 sec. 4)");
+    return b.implicit(0, b.nullValue());   // raVerified [0] IMPLICIT NULL
+  }
+  if (mode !== "signature") throw _err("crmf/bad-popo", "unsupported proof-of-possession type " + JSON.stringify(mode) + " (supported: 'signature', 'raVerified')");
+  if (signingKey == null) throw _err("crmf/bad-input", "a signature proof of possession requires the requester's private key");
+  if (template.spki == null) throw _err("crmf/bad-input", "a signature proof of possession requires certTemplate.publicKey");
+  var scheme = signScheme.resolveSignScheme(_b.certLikeFromSpki(template.spki), { combinedRsaSig: true, pss: opts.pss, digestAlgorithm: opts.digestAlgorithm }, true, _signE);
+  var signedRegion, poposkInputField = null;
+  if (template.complete) {
+    signedRegion = certReqDer;   // sec. 4.1: complete template -> sign the CertRequest, poposkInput omitted
+  } else {
+    // POPOSigningKeyInput ::= SEQUENCE { authInfo CHOICE { sender [0] GeneralName, publicKeyMAC }, publicKey }.
+    var sender = pop && pop.sender;
+    if (sender == null) throw _err("crmf/bad-popo", "an incomplete template (missing subject or publicKey) requires pop.sender (a GeneralName) for the POPOSigningKeyInput authInfo (RFC 4211 sec. 4.1)");
+    var poposkSeq = b.sequence([b.explicit(0, _b.encodeGeneralName(sender)), b.raw(template.spki)]);
+    signedRegion = poposkSeq;
+    poposkInputField = b.implicit(0, poposkSeq);   // poposkInput [0] IMPLICIT POPOSigningKeyInput
+  }
+  return signScheme.signOverTbs(scheme, signingKey, signedRegion, _signE).then(function (sig) {
+    return Promise.resolve(_b.assertSignatureVerifies(signedRegion, sig, template.spki, scheme)).then(function () {
+      var popoChildren = [];
+      if (poposkInputField) popoChildren.push(poposkInputField);
+      popoChildren.push(scheme.sigAlgId);
+      popoChildren.push(b.bitString(sig, 0));
+      return b.implicit(1, b.sequence(popoChildren));   // signature [1] IMPLICIT POPOSigningKey
+    });
+  }, function (e) {
+    if (e instanceof CrmfError) throw e;
+    throw _err("crmf/bad-input", "signing the proof of possession failed -- the key does not match the requested public key or is invalid", e);
+  });
+}
+
+/**
+ * @primitive pki.crmf.build
+ * @signature pki.crmf.build(spec, key?, opts?) -> Promise<Buffer|string>
+ * @since 0.3.3
+ * @status experimental
+ * @spec RFC 4211
+ * @defends forged-certificate-request (CWE-347)
+ * @related pki.schema.crmf.parse, pki.csr.sign
+ *
+ * Build and DER-encode an RFC 4211 `CertReqMessages`. `spec` describes one certificate request message (or
+ * pass `spec.messages` -- an array of specs -- for a batch): `certReqId` (an integer, default 0; the RFC
+ * 9483 `-1` sentinel is allowed), `certTemplate` (the requested certificate fields -- `subject`, `publicKey`
+ * (the SPKI DER of the key being certified), `validity` ({ notBefore, notAfter } Dates), `extensions` (an
+ * object of subjectAltName / keyUsage / extendedKeyUsage / basicConstraints / certificatePolicies /
+ * subjectKeyIdentifier, or pre-encoded Extension DER), and an optional `version` (2)), optional `controls`
+ * and `regInfo` (an object of regToken / authenticator / utf8Pairs / oldCertID / protocolEncrKey, or
+ * pre-encoded AttributeTypeAndValue DER), and an optional `pop` selector. `key` (or `{ key }`) is the
+ * REQUESTER's private key -- the private half of `certTemplate.publicKey`; the message carries a
+ * `POPOSigningKey` proof of possession signed with it (verified before the message is returned), exactly
+ * as a PKCS#10 CSR proves possession. The signature algorithm is resolved from the requested public key
+ * (RSA PKCS#1 v1.5 / PSS, ECDSA, EdDSA, ML-DSA, SLH-DSA, or a composite arm). `key` is optional -- omit it
+ * for a `raVerified` proof (opt in with `pop: { type: 'raVerified', raVerified: true }`). Returns DER, or a
+ * PEM block with `opts.pem` (the label is required). Malformed input throws a typed `CrmfError`.
+ * Certificate-request-message parsing is `pki.schema.crmf.parse`.
+ *
+ * @opts
+ *   - `pem` (string) -- return a PEM block with this label instead of DER (e.g. "CERTIFICATE REQUEST MESSAGE").
+ *   - `pss` (boolean) -- sign an RSA key with RSASSA-PSS rather than PKCS#1 v1.5.
+ *   - `digestAlgorithm` (string) -- override the message digest where the algorithm permits a choice.
+ * @example
+ *   var msg = await pki.crmf.build(
+ *     { certReqId: 0, certTemplate: { subject: "device-42", publicKey: signerSpki } },
+ *     { key: signerKeyPkcs8 });
+ *   pki.schema.crmf.parse(msg).messages[0].certReq.certTemplate.subject.dn;   // "CN=device-42"
+ */
+function build(spec, key, opts) {
+  return Promise.resolve().then(function () { return _build(spec, key, opts); });
+}
+
+function _buildCertReqMsg(spec, key, opts) {
+  if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("crmf/bad-input", "each certificate-request-message spec must be an object");
+  Object.keys(spec).forEach(function (k) { if (!KNOWN_SPEC_KEYS[k]) throw _err("crmf/bad-input", "unknown spec field " + JSON.stringify(k)); });
+  if (spec.certTemplate == null) throw _err("crmf/bad-input", "spec.certTemplate is required");
+
+  var signingKey = (key && typeof key === "object" && !Buffer.isBuffer(key) && !(key instanceof Uint8Array) && key.type == null && "key" in key) ? key.key : key;
+  var template = _encodeCertTemplate(spec.certTemplate);
+  var certReqChildren = [b.integer(_certReqId(spec.certReqId)), template.der];
+  if (spec.controls != null) certReqChildren.push(_buildAttrTypeAndValues(spec.controls, "crmf/bad-controls", "controls", CONTROL_VALUE));
+  var certReqDer = b.sequence(certReqChildren);
+
+  return Promise.resolve(_buildProofOfPossession(spec.pop, certReqDer, template, signingKey, opts)).then(function (popoDer) {
+    var msgChildren = [certReqDer];
+    if (popoDer) msgChildren.push(popoDer);
+    if (spec.regInfo != null) msgChildren.push(_buildAttrTypeAndValues(spec.regInfo, "crmf/bad-reg-info", "regInfo", REGINFO_VALUE));
+    return b.sequence(msgChildren);   // CertReqMsg
+  });
+}
+
+function _build(spec, key, opts) {
+  opts = opts || {};
+  if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("crmf/bad-input", "the certificate-request-message spec must be an object");
+  var specs;
+  if (spec.messages != null) {
+    // Batch form: the envelope carries ONLY `messages` -- reject a stray field so a request spec written at
+    // the wrong nesting level (e.g. certTemplate alongside messages) is not silently dropped.
+    if (!Array.isArray(spec.messages)) throw _err("crmf/bad-input", "spec.messages must be an array of certificate-request-message specs");
+    Object.keys(spec).forEach(function (k) { if (k !== "messages") throw _err("crmf/bad-input", "unknown batch-envelope field " + JSON.stringify(k) + " -- a batch spec carries only 'messages'"); });
+    specs = spec.messages;
+  } else {
+    specs = [spec];
+  }
+  if (!specs.length) throw _err("crmf/bad-input", "at least one certificate request message is required (RFC 4211 sec. 3)");
+  return Promise.all(specs.map(function (s) { return _buildCertReqMsg(s, key, opts); })).then(function (msgs) {
+    var der = b.sequence(msgs);   // CertReqMessages ::= SEQUENCE SIZE(1..MAX) OF CertReqMsg
+    if (opts.pem != null) {
+      if (typeof opts.pem !== "string" || !opts.pem) throw _err("crmf/bad-input", "opts.pem must be a non-empty PEM label string");
+      return crmf.pemEncode(der, opts.pem);
+    }
+    return der;
+  });
+}
+
+module.exports = { build: build };

package/lib/csr-sign.js

@@ -42,12 +42,6 @@ var _b = pkiBuild.makeBuilder({
   NAME_SCHEMA: pkix.name(NS), SPKI_SCHEMA: pkix.spki(NS), EXT_DECODERS: EXT_DECODERS,
 });
 
-// The requested-extension object keys (a CSR REQUESTS extensions; it does NOT enforce issuance policy,
-// so there are no CA cross-field gates and no authorityKeyIdentifier auto-derivation).
-var KNOWN_REQ_EXT_KEYS = {
-  subjectAltName: 1, keyUsage: 1, keyUsageCritical: 1, extendedKeyUsage: 1, extendedKeyUsageCritical: 1,
-  basicConstraints: 1, certificatePolicies: 1, certificatePoliciesCritical: 1, subjectKeyIdentifier: 1,
-};
 // challengePassword DirectoryString charset (PrintableString set); anything else uses UTF8String.
 var PRINTABLE_RE = /^[A-Za-z0-9 '()+,\-./:=?]*$/;
 
@@ -57,43 +51,9 @@ function _implicitSetOf0(members) {
   return b.contextConstructed(0, Buffer.concat(members.slice().sort(Buffer.compare)));
 }
 
-// The requested v3 Extensions (a bare SEQUENCE OF Extension, RFC 2985 sec. 5.4.2) from the object form,
-// or an array of pre-encoded Extension DER. Reuses the shared extension-value encoders; no CA gates.
-function _buildRequestedExtensions(extSpec, subjectSpki) {
-  if (Array.isArray(extSpec)) {
-    if (!extSpec.length) throw _err("csr/bad-input", "extensionRequest must carry at least one extension");
-    var seen = {};
-    return b.sequence(extSpec.map(function (e, i) {
-      var der = _b.reqDer(e, "extension");
-      _b.assertValidExtension(der, i);
-      var n = asn1.decode(der);
-      var extnId = asn1.read.oid(n.children[0]);
-      if (seen[extnId]) throw _err("csr/bad-input", "duplicate extension " + extnId + " in extensionRequest (RFC 5280 sec. 4.2)");
-      seen[extnId] = true;
-      // Fully validate a RECOGNIZED extension via its real RFC 5280 sec. 4.2.1 value decoder (a malformed
-      // value fails closed with the decoder's typed code); an unrecognized extension stays opaque.
-      var dec = EXT_DECODERS[extnId];
-      if (dec) {
-        try { dec(asn1.read.octetString(n.children[n.children.length - 1])); }
-        catch (err) { if (err instanceof CsrError) throw err; throw _err("csr/bad-input", "pre-encoded " + (oid.name(extnId) || extnId) + " extension value is malformed", err); }
-      }
-      return b.raw(der);
-    }));
-  }
-  if (!extSpec || typeof extSpec !== "object") throw _err("csr/bad-input", "extensionRequest must be an object or an array of pre-encoded Extension DER");
-  Object.keys(extSpec).forEach(function (k) {
-    if (!KNOWN_REQ_EXT_KEYS[k]) throw _err("csr/bad-input", "unknown extensionRequest extension " + JSON.stringify(k) + "; pass a pre-encoded Extension DER via the array form for a custom extension");
-  });
-  var out = [];
-  if (extSpec.subjectKeyIdentifier != null) out.push(_b.ext(O("subjectKeyIdentifier"), false, _b.extSki(_b.skiKeyId(extSpec.subjectKeyIdentifier, subjectSpki))));
-  if (extSpec.keyUsage != null) out.push(_b.ext(O("keyUsage"), extSpec.keyUsageCritical !== false, _b.extKeyUsage(extSpec.keyUsage)));
-  if (extSpec.extendedKeyUsage != null) out.push(_b.ext(O("extKeyUsage"), !!extSpec.extendedKeyUsageCritical, _b.extExtKeyUsage(extSpec.extendedKeyUsage)));
-  if (extSpec.basicConstraints != null) { _b.validateBcSpec(extSpec.basicConstraints); out.push(_b.ext(O("basicConstraints"), extSpec.basicConstraints.critical !== false, _b.extBasicConstraints(extSpec.basicConstraints))); }
-  if (extSpec.subjectAltName != null) out.push(_b.ext(O("subjectAltName"), false, _b.extSan(extSpec.subjectAltName)));
-  if (extSpec.certificatePolicies != null) out.push(_b.ext(O("certificatePolicies"), !!extSpec.certificatePoliciesCritical, _b.extCertPolicies(extSpec.certificatePolicies)));
-  if (!out.length) throw _err("csr/bad-input", "extensionRequest must request at least one extension");
-  return b.sequence(out);
-}
+// The requested v3 Extensions (a bare SEQUENCE OF Extension, RFC 2985 sec. 5.4.2) -- the shared builder
+// primitive (a CSR REQUESTS extensions; no CA gates), object form or a pre-encoded Extension DER array.
+function _buildRequestedExtensions(extSpec, subjectSpki) { return _b.requestedExtensions(extSpec, subjectSpki); }
 
 // challengePassword ::= DirectoryString bounded 1..255 (RFC 2985 sec. 5.4.1). PrintableString when the
 // value is in that charset, else UTF8String; never a Teletex/BMP/Universal string for a new value.

package/lib/pki-build.js

@@ -13,6 +13,8 @@
 var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
 var compositeSig = require("./composite-sig");
+var guard = require("./guard-all");
+var oid = require("./oid");
 var nodeCrypto = require("crypto");
 
 var b = asn1.build;
@@ -31,6 +33,17 @@ function makeBuilder(ctx) {
   var NAME_SCHEMA = ctx.NAME_SCHEMA, SPKI_SCHEMA = ctx.SPKI_SCHEMA;
   function E(kind, message, cause) { return new ErrorClass(ctx.prefix + "/" + kind, message, cause); }
   function code(kind) { return ctx.prefix + "/" + kind; }
+  // A full-code error factory (guard.* helpers invoke E as `E(fullCode, msg)`, not `E(kind, msg)`).
+  function rawErr(fullCode, message, cause) { return new ErrorClass(fullCode, message, cause); }
+
+  // RFC 5280 sec. 4.1.2.5 -- UTCTime for 1950..2049, GeneralizedTime otherwise (UTCTime's two-digit year
+  // only represents that window). The shared cutover so a certificate / CRMF / any validity encoder cannot
+  // drift on the boundary. `which` labels the instant in a validation error.
+  function timeDer(date, which) {
+    guard.time.assertValid(date, rawErr, code("bad-input"), which);
+    var y = date.getUTCFullYear();
+    return (y >= 1950 && y <= 2049) ? b.utcTime(date) : b.generalizedTime(date);
+  }
 
   // ---- distinguished name encoding (RFC 5280 sec. 4.1.2.4) ----
   // countryName is a PrintableString SIZE(2), emailAddress an IA5String; every other new-name attribute
@@ -226,6 +239,55 @@ function makeBuilder(ctx) {
     var last = n.children[n.children.length - 1];
     if (last.tagNumber !== asn1.TAGS.OCTET_STRING || last.tagClass !== "universal") throw E("bad-input", "pre-encoded extension [" + idx + "] extnValue must be an OCTET STRING");
   }
+  // The requested v3 Extensions (a bare SEQUENCE OF Extension) from an object of the recognized keys, or
+  // an array of pre-encoded Extension DER (shape- + recognized-value-validated). Shared by every enrollment
+  // request that carries requested extensions (a PKCS#10 extensionRequest attribute, a CRMF CertTemplate
+  // extensions [9]); a request REQUESTS extensions, so there are no CA cross-field gates. `spki` feeds the
+  // subjectKeyIdentifier auto-derive.
+  var REQ_EXT_KEYS = {
+    subjectAltName: 1, keyUsage: 1, keyUsageCritical: 1, extendedKeyUsage: 1, extendedKeyUsageCritical: 1,
+    basicConstraints: 1, certificatePolicies: 1, certificatePoliciesCritical: 1, subjectKeyIdentifier: 1,
+  };
+  function requestedExtensions(extSpec, spki) {
+    var EXT_DECODERS = ctx.EXT_DECODERS;
+    if (Array.isArray(extSpec)) {
+      if (!extSpec.length) throw E("bad-input", "the requested extensions list must carry at least one extension");
+      var seen = {};
+      return b.sequence(extSpec.map(function (e, i) {
+        var der = reqDer(e, "extension");
+        assertValidExtension(der, i);
+        var n = asn1.decode(der);
+        var extnId = asn1.read.oid(n.children[0]);
+        if (seen[extnId]) throw E("bad-input", "duplicate requested extension " + extnId + " (RFC 5280 sec. 4.2)");
+        seen[extnId] = true;
+        var dec = EXT_DECODERS && EXT_DECODERS[extnId];
+        if (dec) {
+          try { dec(asn1.read.octetString(n.children[n.children.length - 1])); }
+          catch (err) { if (err instanceof ErrorClass) throw err; throw E("bad-input", "pre-encoded " + (oid.name(extnId) || extnId) + " extension value is malformed", err); }
+        }
+        return b.raw(der);
+      }));
+    }
+    if (!extSpec || typeof extSpec !== "object") throw E("bad-input", "requested extensions must be an object or an array of pre-encoded Extension DER");
+    Object.keys(extSpec).forEach(function (k) {
+      if (!REQ_EXT_KEYS[k]) throw E("bad-input", "unknown requested extension " + JSON.stringify(k) + "; pass a pre-encoded Extension DER via the array form for a custom extension");
+    });
+    var out = [];
+    if (extSpec.subjectKeyIdentifier != null) {
+      // Auto-deriving the SKI (subjectKeyIdentifier: true) hashes the subject public key, so it needs one;
+      // reject the request when no public key is available (supply a Buffer key id instead).
+      if (extSpec.subjectKeyIdentifier === true && spki == null) throw E("bad-input", "subjectKeyIdentifier auto-derive (true) requires the public key -- supply a Buffer key id, or include the public key");
+      out.push(ext(O("subjectKeyIdentifier"), false, extSki(skiKeyId(extSpec.subjectKeyIdentifier, spki))));
+    }
+    if (extSpec.keyUsage != null) out.push(ext(O("keyUsage"), extSpec.keyUsageCritical !== false, extKeyUsage(extSpec.keyUsage)));
+    if (extSpec.extendedKeyUsage != null) out.push(ext(O("extKeyUsage"), !!extSpec.extendedKeyUsageCritical, extExtKeyUsage(extSpec.extendedKeyUsage)));
+    if (extSpec.basicConstraints != null) { validateBcSpec(extSpec.basicConstraints); out.push(ext(O("basicConstraints"), extSpec.basicConstraints.critical !== false, extBasicConstraints(extSpec.basicConstraints))); }
+    if (extSpec.subjectAltName != null) out.push(ext(O("subjectAltName"), false, extSan(extSpec.subjectAltName)));
+    if (extSpec.certificatePolicies != null) out.push(ext(O("certificatePolicies"), !!extSpec.certificatePoliciesCritical, extCertPolicies(extSpec.certificatePolicies)));
+    if (!out.length) throw E("bad-input", "the requested extensions object must request at least one extension");
+    return b.sequence(out);
+  }
+
   // A positive, non-zero INTEGER of at most 20 content octets (RFC 5280 sec. 4.1.2.2 / RFC 5755 sec.
   // 4.2.5 -- the identical serial rule for a certificate and an attribute certificate). A random 20-octet
   // positive serial is generated when none is supplied. Accepts a BigInt, a safe integer, a decimal /
@@ -287,7 +349,8 @@ function makeBuilder(ctx) {
   return {
     E: E, code: code, KU_BIT: KU_BIT,
     encodeName: encodeName, isEmptyName: isEmptyName, encodeGeneralName: encodeGeneralName,
-    encodeGeneralNames: encodeGeneralNames, serialInteger: serialInteger,
+    encodeGeneralNames: encodeGeneralNames, serialInteger: serialInteger, timeDer: timeDer,
+    requestedExtensions: requestedExtensions,
     extKeyUsage: extKeyUsage, extExtKeyUsage: extExtKeyUsage, validateBcSpec: validateBcSpec,
     extBasicConstraints: extBasicConstraints, pathLen: pathLen, extSki: extSki, extAki: extAki,
     extSan: extSan, extCertPolicies: extCertPolicies, ext: ext,

package/lib/x509-sign.js

@@ -165,14 +165,9 @@ function _buildExtensions(extSpec, ctx) {
 
 // ---- serial + validity + key plumbing --------------------------------------
 
-// RFC 5280 sec. 4.1.2.5 -- UTCTime for 1950..2049, GeneralizedTime otherwise. UTCTime's two-digit year
-// only represents 1950..2049 (sec. 4.1.2.5.1), so a pre-1950 date MUST use GeneralizedTime (the same
-// arm as a date from 2050 on); using UTCTime for a pre-1950 year would be unrepresentable.
-function _timeDer(date, which) {
-  guard.time.assertValid(date, _err, "x509/bad-input", "certificate " + which);
-  var y = date.getUTCFullYear();
-  return (y >= 1950 && y <= 2049) ? b.utcTime(date) : b.generalizedTime(date);
-}
+// RFC 5280 sec. 4.1.2.5 UTCTime/GeneralizedTime cutover -- the shared builder primitive (pki-build), a
+// thin wrapper here so the certificate validity label reads "certificate notBefore/notAfter".
+function _timeDer(date, which) { return _b.timeDer(date, "certificate " + which); }
 // A supplied issuer certificate MUST be a CA that may sign certificates: basicConstraints present AND
 // critical AND cA=TRUE (RFC 5280 sec. 4.2.1.9), and -- when a keyUsage extension is present -- the
 // keyCertSign bit (sec. 4.2.1.3). Refuse a non-CA issuer rather than mint a certificate that will not

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3787cd37-e9d0-465d-bed3-0f6822edb52c",
+  "serialNumber": "urn:uuid:e238289a-30dc-45fc-b08a-4cc7a4f0a503",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-17T08:27:56.310Z",
+    "timestamp": "2026-07-17T09:21:09.414Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.3.2",
+      "bom-ref": "@blamejs/pki@0.3.3",
       "type": "application",
       "name": "pki",
-      "version": "0.3.2",
+      "version": "0.3.3",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.3.2",
+      "purl": "pkg:npm/%40blamejs/pki@0.3.3",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.3.2",
+      "ref": "@blamejs/pki@0.3.3",
       "dependsOn": []
     }
   ]