@blamejs/pki 0.3.24 → 0.3.25

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.3.25 — 2026-07-26
+
+pki.path.build can now fetch a missing intermediate over the network -- opt in with `fetchAia` and it discovers the issuer from a certificate's AIA caIssuers URL, so a chain with a gap in the supplied pool still builds.
+
+### Added
+
+- pki.path.build accepts opts.fetchAia: true to discover a missing intermediate from a certificate's AIA caIssuers URL (RFC 5280 sec. 4.2.2.1) over pki.transport, explored as a lazy fallback only after the local candidate pool is exhausted (RFC 4158 sec. 7.2 local-before-remote), so a build the pool can complete never touches the network. The result gains aiaFetches (the count of network GETs). opts.transport injects the transport for offline use; opts.tls carries the TLS trust for the AIA host (distinct from opts.trustAnchors); opts.maxAiaFetches / opts.maxAiaPerCert / opts.aiaTimeout / opts.maxResponseBytes bound the fetch. Off by default -- the default build is byte-identical offline. RFC 5280 sec. 4.2.2.1, RFC 4158 sec. 6.3 / sec. 8.1.
+- pki.inspect renders the authorityInfoAccess extension (RFC 5280 sec. 4.2.2.1) -- the CA Issuers and OCSP access descriptions with their URLs -- instead of a hex dump.
+
+### Changed
+
+- The AIA fetch is fail-closed and SSRF-bounded: an http/ldap/ftp/file/mailto or non-URI caIssuers accessLocation, or an id-ad-ocsp access method, is never fetched (no socket); a destination that is -- or that resolves to -- a private, loopback, or link-local address is refused (the checked address pinned for the connection), so an untrusted certificate cannot drive an authenticated GET to an internal service by IP literal or by hostname; a total fetch budget silently caps fetching (never a throw that denies a buildable path); a per-certificate URL cap (maxAiaPerCert:0 disables per-certificate fetching outright), a build-wide URL dedupe on the normalized URL, a response-size cap, and a per-response certificate-count cap bound the work; no redirect is followed. Every fetch fault -- a transport error, a non-200, an oversize or non-certificate body -- is a silent skip, so an unreachable or hostile AIA endpoint never fails a build that the pool could still complete.
+
 ## v0.3.24 — 2026-07-26
 
 pki.smime.verify / decrypt can now recognize a legacy (RFC 8551) header-protected message -- opt in with `legacyHeaderProtection` and the real headers of an older `message/rfc822`-wrapped message are surfaced, safely separated from the authenticated header set.

package/README.md

@@ -222,7 +222,7 @@ is callable today; nothing below is a stub.
 | `pki.acme` | RFC 8555 / 8737 / 8738 / 9773 ACME — `client(directoryUrl, opts)` is a stateful client that drives a live CA directory over `pki.transport` (inject your own, or the fail-closed default): `newAccount` / `newOrder` / `getOrder` / `getAuthorization` / `getChallenge` / `respondToChallenge` / `finalize` / `pollOrder` / `pollAuthorization` / `downloadCertificate` walk the issuance flow, and `revokeCert` (account-key or certificate-key signed), `keyChange` (account key rotation), `deactivateAccount` / `deactivateAuthorization`, and `renewalInfo` (ARI) round out the lifecycle — https-only for every URL, an explicit trust anchor required, a fresh single-use nonce per request with a bounded badNonce retry, POST-as-GET reads, bounded polling that sleeps on a Retry-After via an injectable sleeper (capped by a poll count and a total-wait budget), and every response body size-capped. Over the message layer it composes: resource-object validators (closed status enums, conditional-required fields, unknown fields ignored), the three §7.1.6 state machines, request builders (newAccount + EAB, newOrder + `replaces`, finalize with CSR identifier-set match and account-key-reuse rejection, challenge responses, deactivation, revokeCert in both key modes, the keyChange nested JWS, POST-as-GET), the http-01 / dns-01 / tls-alpn-01 challenge computations, the dns/ip identifier validators, and the ARI certID (serial sign-padding preserved), fail-closed — `client`, `validate`, `identify`, `assertTransition`, the builders, `keyAuthorization`, `http01`, `dns01`, `tlsAlpn01Extension`, `verifyTlsAlpn01`, `ariCertId` |
 | `pki.schema.smime` | Decode S/MIME ESS signed-attribute values (RFC 5035 / RFC 8551) — `parseSigningCertificate` / `parseSigningCertificateV2` bind a signature to its signing certificate (cert hash, hash algorithm, issuer `GeneralNames` + serial), `parseSmimeCapabilities` decodes the ordered capability list, and `decodeAttribute` OID-dispatches a CMS attribute (enforcing the single-value rule, recognize-and-defer for unknown types). A companion decoder for CMS signed attributes, not an auto-routed format, fail-closed — `parseSigningCertificate`, `parseSigningCertificateV2`, `parseSmimeCapabilities`, `decodeAttribute` |
 | `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` / `encode` / `embeddedDer` plus the schema combinators |
-| `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining across RSA, ECDSA, EdDSA, ML-DSA, SLH-DSA and hybrid composite ML-DSA signatures — a composite is accepted only when **both** its post-quantum and traditional components verify; validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes, and enforces a `pki.trust` anchor's per-purpose distrust-after dates and delegator purposes via `checkPurpose`; `crlChecker` supplies CRL-based revocation — including partitioned/sharded CRLs, whose §6.3.3 Distribution Point ↔ IDP correspondence lets a corresponding full-reason shard establish non-revocation — and `ocspChecker` supplies OCSP-based revocation (RFC 6960 — CertID binding, responder authorization, signature, currency) over the same pluggable hook. `build(leaf, opts)` is the discovering complement (RFC 4158): from a leaf, an untrusted pool of candidate CA certificates, and a trust store, it finds the ordered leaf→anchor path `validate` accepts — name chaining plus the RFC 4158 §3.5 sort hints (AKI/SKI match, anchor-adjacent issuer, CA + keyCertSign, validity), a depth-first search with backtracking so the first path `validate` accepts wins, and a bounded search (chain-length cap, candidate-expansion cap, identity-tuple visited-set) so a cross-certificate cycle or Bridge-CA fan-out terminates deterministically; every accept flows through `validate` and its verdict is cross-checked against `openssl verify`. Pure and re-entrant, fail-closed — `validate`, `build`, `crlChecker`, `ocspChecker` |
+| `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining across RSA, ECDSA, EdDSA, ML-DSA, SLH-DSA and hybrid composite ML-DSA signatures — a composite is accepted only when **both** its post-quantum and traditional components verify; validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes, and enforces a `pki.trust` anchor's per-purpose distrust-after dates and delegator purposes via `checkPurpose`; `crlChecker` supplies CRL-based revocation — including partitioned/sharded CRLs, whose §6.3.3 Distribution Point ↔ IDP correspondence lets a corresponding full-reason shard establish non-revocation — and `ocspChecker` supplies OCSP-based revocation (RFC 6960 — CertID binding, responder authorization, signature, currency) over the same pluggable hook. `build(leaf, opts)` is the discovering complement (RFC 4158): from a leaf, an untrusted pool of candidate CA certificates, and a trust store, it finds the ordered leaf→anchor path `validate` accepts — name chaining plus the RFC 4158 §3.5 sort hints (AKI/SKI match, anchor-adjacent issuer, CA + keyCertSign, validity), a depth-first search with backtracking so the first path `validate` accepts wins, and a bounded search (chain-length cap, candidate-expansion cap, identity-tuple visited-set) so a cross-certificate cycle or Bridge-CA fan-out terminates deterministically; every accept flows through `validate` and its verdict is cross-checked against `openssl verify`. **Opt-in AIA `caIssuers` fetching** (`opts.fetchAia: true`) discovers a *missing* intermediate from a certificate's Authority Information Access URL (RFC 5280 §4.2.2.1) over `pki.transport`, triggered only on a pool miss — SSRF/amplification-bounded (https-only, a total fetch budget that silently caps fetching rather than throwing, a per-cert URL cap, a build-wide URL dedupe, a response-size + certificate-count cap, no redirect following; every fault a silent skip), with the TLS trust (`opts.tls`) kept distinct from the PKI `trustAnchors` and every fetched certificate remaining untrusted pool material that still flows through `validate` (never a trust anchor). Off by default — the default build is byte-identical offline. Pure and re-entrant, fail-closed — `validate`, `build`, `crlChecker`, `ocspChecker` |
 | `pki.x509` | X.509 certificate issuance (RFC 5280 §4) — `sign(spec, issuer, opts)` builds and signs a certificate: a `spec` of subject (a common-name string, an array of RDNs, or raw Name DER), the public key being certified, the validity window, an optional serial, and an optional `extensions` object; an `issuer` that is a key alone (self-signed — issuer equals subject, signed with that key) or a name + public key + key, or an issuing certificate + key (CA-signed). The signature algorithm is resolved from the signing key through the shared registry, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA P-256/384/521, Ed25519, Ed448, ML-DSA-44/65/87, the twelve SLH-DSA sets, and the composite arms all issue without a per-algorithm branch. It encodes basic constraints, key usage, extended key usage, subject and authority key identifiers (the SKI auto-derived by SHA-1 of the subject key), subject alternative names, and certificate policies from the spec — any other extension supplied as pre-encoded DER — derives the version from the field set, and enforces the serial bounds, the UTCTime/GeneralizedTime cutover, the DER default omissions, and the CA cross-field rules; a violation throws a typed `CertificateError`. Returns DER, or a PEM `CERTIFICATE` with `opts.pem`; every arm is independently verified by OpenSSL. Parsing stays at `pki.schema.x509.parse` — `sign` |
 | `pki.csr` | PKCS#10 certification-request issuance (RFC 2986 / RFC 2985) — `sign(spec, key, opts)` builds and signs a `CertificationRequest`: a `spec` of subject (a common-name string, an array of RDNs, or raw Name DER; may be empty), the public key being certified, an optional `extensionRequest` (requested v3 extensions — subject alternative names, key usage, extended key usage, basic constraints, certificate policies, subject key identifier, or an array of pre-encoded Extension DER — that a CA copies into the issued certificate), and an optional `challengePassword`. `key` (or `{ key }`) is the subject's own private key: the request is self-signed to prove possession of the private half of `subjectPublicKey`, and that proof is verified before the request is returned (what `openssl req -verify` checks). The signature algorithm is resolved from the subject key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch. Returns DER, or a PEM `CERTIFICATE REQUEST` with `opts.pem`; malformed input throws a typed `CsrError`. Parsing stays at `pki.schema.csr.parse` — `sign` |
 | `pki.attrcert` | RFC 5755 attribute-certificate issuance — `sign(spec, issuer, opts)` builds and signs an `AttributeCertificate` as an Attribute Authority: a `spec` of `holder` (exactly one of an entity name, a `baseCertificateID` public-key-certificate reference, a `fromCertificate` binding derived from a certificate, or an object digest), the validity window (GeneralizedTime), an optional serial (positive, ≤ 20 octets; randomly generated when omitted), the `attributes` (the privilege syntaxes — role, clearance, group, chargingIdentity, accessIdentity, authenticationInfo — or pre-encoded Attribute DER), and optional `extensions` (auditIdentity, targetInformation, noRevAvail, aaControls, acProxying, authorityKeyIdentifier, or pre-encoded Extension DER, each with its RFC 5755 criticality). An attribute certificate is never self-signed — the `issuer` is the signing AA, supplied as `{ cert, key }` or `{ name, publicKey, key }`. The signature algorithm is resolved from the AA key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch, and the signature is verified under the AA public key before the certificate is returned. Returns DER, or a PEM `ATTRIBUTE CERTIFICATE` with `opts.pem`; malformed input throws a typed `AttrCertError`. Parsing stays at `pki.schema.attrcert.parse` — `sign` |

package/index.js

@@ -154,7 +154,9 @@ module.exports = {
   // drive -- pki.transport.https(defaults) returns a transport(request) -> {status,
   // headers, body}. The toolkit's sole socket choke point: explicit trust anchors,
   // rejectUnauthorized always on, a TLS floor, a streaming response cap, and a timeout.
-  transport: transport,
+  // Curated to the public `https` factory; the module's `isBlockedIp` classifier is an
+  // internal helper pki.path.build reuses (require the module), not a public surface.
+  transport: { https: transport.https },
   // `jose` is the RFC 7515 Flattened JWS + RFC 7638 JWK-thumbprint layer: a strict
   // base64url codec, a bounded duplicate-key-rejecting JSON reader, profiled
   // sign/verify (ACME-outer / EAB-inner / keyChange-inner), and an alg registry

package/lib/constants.js

@@ -223,6 +223,21 @@ var LIMITS = {
   // overridable (opts.maxDepth / opts.maxCandidatesConsidered).
   PATH_BUILD_MAX_DEPTH: 20,
   PATH_BUILD_MAX_CANDIDATES: 1000,
+  // AIA caIssuers network-fetch bounds (pki.path.build with opts.fetchAia). Fetching an issuer over the
+  // network from an untrusted certificate's authorityInfoAccess opens an SSRF / amplification surface (a
+  // hostile mesh where each fetched cert advertises a fresh caIssuers URL). PATH_AIA_MAX_FETCHES is the
+  // TOTAL network GET budget across a whole build() call (a breach throws path/aia-fetch-limit);
+  // PATH_AIA_MAX_PER_CERT caps how many caIssuers URIs are tried for a single certificate (an AIA MAY carry
+  // many). Both are small by default and operator-overridable (opts.maxAiaFetches / opts.maxAiaPerCert).
+  PATH_AIA_MAX_FETCHES: 10,
+  PATH_AIA_MAX_PER_CERT: 3,
+  // A caIssuers response is one certificate or a short chain -- never a 24 MiB bundle. Bounding the AIA
+  // fetch below the general HTTP ceiling (and capping the certificate COUNT a single response contributes)
+  // stops a hostile-but-TLS-trusted AIA endpoint from forcing tens of thousands of certificate parses per
+  // fetch (parse work bounded by COUNT, not only by bytes). Both operator-overridable (opts.maxResponseBytes
+  // tightens downward only; the count cap is a fixed defense).
+  PATH_AIA_MAX_RESPONSE_BYTES: BYTES.mib(1),
+  PATH_AIA_MAX_CERTS_PER_RESPONSE: 16,
   // PKCS#12 container ceilings. A PFX carries lists at three altitudes
   // (ContentInfos per AuthenticatedSafe, SafeBags per SafeContents,
   // attributes per bag) and can chain fresh DER blobs inside OCTET STRINGs,

package/lib/est.js

@@ -56,7 +56,6 @@ var oid = require("./oid");
 var constants = require("./constants");
 var cms = require("./schema-cms");
 var x509 = require("./schema-x509");
-var crl = require("./schema-crl");
 var pkcs8 = require("./schema-pkcs8");
 var csr = require("./schema-csr");
 var frameworkError = require("./framework-error");
@@ -66,8 +65,6 @@ var retryAfter = require("./http-retry-after");
 
 var EstError = frameworkError.EstError;
 function E(code, message, cause) { return new EstError(code, message, cause); }
-
-var ID_DATA = oid.byName("data");
 var ID_SIGNED_DATA = oid.byName("signedData");
 var OID_CHALLENGE_PASSWORD = oid.byName("challengePassword");
 var OID_DECRYPT_KEY_ID = oid.byName("decryptKeyID");
@@ -212,36 +209,9 @@ function splitMultipartMixed(body, contentType) {
  *   r.certificates;   // -> [Buffer, ...] raw, unordered
  */
 function parseCertsOnly(der) {
-  var r;
-  try { r = cms.parse(der); }
-  catch (e) { if (e instanceof EstError) throw e; throw E("est/bad-response", "the EST response did not decode as CMS: " + ((e && e.message) || String(e)), e); }
-  if (r.contentTypeName !== "signedData") throw E("est/not-certs-only", "an EST certs-only response must be a CMS SignedData (RFC 5272 sec. 4.1)");
-  if (r.encapContentInfo.eContentType !== ID_DATA || r.encapContentInfo.eContent !== null) {
-    throw E("est/not-certs-only", "a certs-only Simple PKI Response must carry id-data with no eContent (RFC 5272 sec. 4.1)");
-  }
-  if (r.signerInfos.length !== 0) throw E("est/not-certs-only", "a certs-only Simple PKI Response must have empty signerInfos (RFC 5272 sec. 4.1)");
-  if (!r.certificates || r.certificates.length === 0) throw E("est/no-certificates", "an EST certs-only response must contain at least one certificate (RFC 7030 sec. 4.1.3)");
-  for (var i = 0; i < r.certificates.length; i++) {
-    if (r.certificates[i].tagClass !== "universal") throw E("est/bad-certificate-choice", "EST exchanges plain X.509 certificates; a tagged CertificateChoices alternative is not permitted (RFC 7030)");
-    // A universal-SEQUENCE CertificateChoice must be a well-formed X.509
-    // Certificate, not merely any SEQUENCE. Parse it structurally (still
-    // returning the raw bytes below) so a malformed response fails closed.
-    try { x509.parse(r.certificates[i].bytes); }
-    catch (e) { if (e instanceof EstError) throw e; throw E("est/bad-certificate", "a certs-only response carried a non-certificate in its certificates field (RFC 5272 sec. 4.1)", e); }
-  }
-  var crls = r.crls || [];
-  for (var j = 0; j < crls.length; j++) {
-    // A RevocationInfoChoice is a plain X.509 CertificateList or a [1] otherRevInfo;
-    // EST surfaces CRLs, so reject the tagged alternative and structurally validate
-    // each universal entry as a CertificateList (mirrors the certificate path).
-    if (crls[j].tagClass !== "universal") throw E("est/bad-crl", "an EST response CRL must be a plain X.509 CertificateList, not a tagged otherRevInfo alternative (RFC 5652 sec. 10.2.1)");
-    try { crl.parse(crls[j].bytes); }
-    catch (e) { if (e instanceof EstError) throw e; throw E("est/bad-crl", "a response carried a non-CRL in its crls field", e); }
-  }
-  return {
-    certificates: r.certificates.map(function (c) { return c.bytes; }),
-    crls: crls.map(function (c) { return c.bytes; }),
-  };
+  // The certs-only Simple PKI Response shape is a CMS concern shared with AIA path building; the reader lives
+  // in schema-cms. The "est" prefix keeps the exact est/* codes (est/not-certs-only, est/no-certificates, ...).
+  return cms.parseCertsOnly(der, E, "est");
 }
 
 // Pick the issued certificate from a certs-only response by matching its public

package/lib/http-transport.js

@@ -39,6 +39,7 @@
 var nodeHttps = require("node:https");
 var nodeNet = require("node:net");
 var nodeTls = require("node:tls");
+var nodeDns = require("node:dns");
 var constants = require("./constants");
 var guard = require("./guard-all");
 var frameworkError = require("./framework-error");
@@ -97,11 +98,81 @@ function _systemCa() {
   return out;
 }
 
+// Classify a bare IP string (no brackets) as a private / loopback / link-local / reserved destination an
+// untrusted URL must not reach: RFC 1918 + loopback + this-network + multicast/reserved + 169.254 (cloud
+// metadata) + CGNAT for IPv4, and loopback / unspecified / IPv4-mapped / ULA (fc00::/7) + link-local (fe80::/10)
+// for IPv6. This is the SAME range set the AIA literal pre-check applies (pki.path.build reuses it), enforced
+// here at DNS-RESOLUTION time so a hostname pointing AT an internal address is caught too. A malformed IP fails
+// CLOSED (net.isIP === 0 -> not a v4/v6 arm -> the caller treats a non-IP as un-judgeable, never as public).
+function _isBlockedIp(ip) {
+  var fam = nodeNet.isIP(ip);
+  if (fam === 4) {
+    // net.isIP === 4 guarantees exactly four octets 0..255. Block the COMPLETE IANA special-purpose /
+    // non-global set (RFC 6890) so an untrusted destination can reach ONLY globally-routable public space.
+    var o = ip.split("."), a = +o[0], b = +o[1], c = +o[2];
+    return a === 0 || a === 10 || a === 127 || a >= 224 ||                 // this-network / RFC1918 10/8 / loopback / multicast 224/4 + reserved 240/4 + broadcast
+      (a === 100 && b >= 64 && b <= 127) ||                                 // 100.64/10 CGNAT
+      (a === 169 && b === 254) ||                                           // 169.254/16 link-local (cloud metadata)
+      (a === 172 && b >= 16 && b <= 31) ||                                  // 172.16/12
+      (a === 192 && b === 168) ||                                           // 192.168/16
+      (a === 192 && b === 0 && (c === 0 || c === 2)) ||                      // 192.0.0/24 IETF protocol + 192.0.2/24 TEST-NET-1
+      (a === 192 && b === 88 && c === 99) ||                                 // 192.88.99/24 6to4 relay anycast (deprecated)
+      (a === 198 && (b === 18 || b === 19)) ||                              // 198.18/15 benchmarking
+      (a === 198 && b === 51 && c === 100) ||                               // 198.51.100/24 TEST-NET-2
+      (a === 203 && b === 0 && c === 113);                                   // 203.0.113/24 TEST-NET-3
+  }
+  if (fam === 6) {
+    var l = ip.toLowerCase();
+    if (l.indexOf("::ffff:") === 0) return true;                            // IPv4-mapped -- may embed a private v4; block all (fail-closed)
+    var parts = l.split(":");
+    var h = parseInt(parts[0], 16);                                         // first hextet ("" for a leading "::" -> NaN -> not in 2000::/3 -> blocked)
+    if (!(h >= 0x2000 && h <= 0x3fff)) return true;                         // outside global unicast 2000::/3: loopback/ULA/link-local/site-local/multicast(ff00::/8)/unspecified/unallocated
+    // Within 2000::/3, carve out the non-globally-routable special-purpose sub-ranges (IANA IPv6 Special-Purpose
+    // Address Registry) an attacker could route to an internal service: a first-hextet allow of the whole block
+    // would admit them. The second hextet is 0 when "::" compresses it (parts[1] empty).
+    var h2 = parts[1] ? parseInt(parts[1], 16) : 0;
+    if (h === 0x2002) return true;                                          // 2002::/16 6to4 (embeds an IPv4 that may be private)
+    if (h === 0x2001 && h2 < 0x0200) return true;                           // 2001::/23 IETF protocol assignments (Teredo / benchmarking / ORCHID / AMT / ...)
+    if (h === 0x2001 && h2 === 0x0db8) return true;                         // 2001:db8::/32 documentation (RFC 3849)
+    if (h === 0x3fff && h2 < 0x1000) return true;                           // 3fff::/20 documentation (RFC 9637)
+    return false;
+  }
+  return false;
+}
+
+// A DNS-rebinding-safe SSRF filter, installed as node's `lookup` ONLY when a request opts into
+// blockPrivateAddresses (the AIA fetch of an untrusted-cert URL). node connects to EXACTLY the address this
+// returns -- no second resolution -- so checking the resolved address here PINS it, closing the resolve/connect
+// TOCTOU. Any private / loopback / link-local result fails the lookup, which surfaces as transport/blocked-address.
+function _blockedAddrErr(hostname, address) {
+  var e = new Error("refusing to connect to " + hostname + " -> " + address + " (private / loopback / link-local address blocked)");
+  e.pkiBlockedAddress = true;
+  return e;
+}
+// Built over an injectable resolver (defaults to nodeDns.lookup) so every branch -- a resolve error, the
+// options.all array shape, a blocked result, a permitted result -- is unit-testable without a live DNS.
+function _makeGuardedLookup(lookupFn) {
+  return function guardedLookup(hostname, options, callback) {
+    lookupFn(hostname, options || {}, function (err, address, family) {
+      if (err) return callback(err);
+      if (Array.isArray(address)) {   // options.all -> [{ address, family }, ...]; reject if ANY resolved address is blocked
+        for (var i = 0; i < address.length; i++) if (_isBlockedIp(address[i].address)) return callback(_blockedAddrErr(hostname, address[i].address));
+        return callback(null, address);
+      }
+      if (_isBlockedIp(address)) return callback(_blockedAddrErr(hostname, address));
+      return callback(null, address, family);
+    });
+  };
+}
+var _guardedLookup = _makeGuardedLookup(nodeDns.lookup);
+
 // Classify a node request/TLS error into the transport's fail-closed verdict: a
-// protocol-version mismatch is the TLS floor; a certificate / identity / handshake
-// failure is a server-authentication failure; anything else is a generic transport
-// error. Every arm threads the raw fault as `.cause`, so the diagnostic survives.
+// blocked-address lookup rejection; a protocol-version mismatch is the TLS floor; a
+// certificate / identity / handshake failure is a server-authentication failure;
+// anything else is a generic transport error. Every arm threads the raw fault as
+// `.cause`, so the diagnostic survives.
 function _classifyError(e, C) {
+  if (e && e.pkiBlockedAddress) return C("blocked-address");
   var s = String((e && e.code) || "") + " " + String((e && e.message) || "");
   if (/PROTOCOL_VERSION|UNSUPPORTED_PROTOCOL|VERSION_TOO_LOW|WRONG_VERSION|NO_PROTOCOLS_AVAILABLE|INAPPROPRIATE_FALLBACK/i.test(s)) return C("tls-floor");
   if (/CERT|SELF.?SIGNED|VERIFY|ALTNAME|HOSTNAME|DEPTH_ZERO|LOCAL_ISSUER|HANDSHAKE|\bSSL\b|\bTLS\b/i.test(s)) return C("server-auth-failed");
@@ -114,7 +185,7 @@ function _classifyError(e, C) {
  * @since      0.3.16
  * @status     experimental
  * @spec       RFC 7030, RFC 8996
- * @defends    tls-downgrade (CWE-757), server-impersonation (CWE-297), response-flooding (CWE-770)
+ * @defends    tls-downgrade (CWE-757), server-impersonation (CWE-297), response-flooding (CWE-770), ssrf (CWE-918)
  * @related    pki.est.cacerts, pki.est.simpleenroll
  *
  * Build a fail-closed `node:https` transport: `transport(request) -> Promise<{ status,
@@ -139,6 +210,7 @@ function _classifyError(e, C) {
  *   - `tls.minVersion` -- 'TLSv1.2' (default) or 'TLSv1.3'; never below the floor.
  *   - `tls.servername` / `tls.checkServerIdentity` -- SNI + RFC 6125 identity; may tighten, never disable.
  *   - `timeout` -- ms (default C.TIME.seconds(30)); `maxResponseBytes` -- default LIMITS.HTTP_MAX_RESPONSE_BYTES, tightenable downward only.
+ *   - `blockPrivateAddresses` -- boolean; when true, an IP-literal host OR a hostname resolving to a private / loopback / link-local address is refused (`transport/blocked-address`), and a resolved address is pinned for the connection. For fetching an untrusted-certificate URL (AIA caIssuers); default false.
  * @example
  *   var t = pki.transport.https({ tls: { anchors: [caPem] } });
  *   var res = await t({ method: "GET", url: "https://ca.example/.well-known/est/cacerts" });
@@ -240,11 +312,23 @@ function httpsTransport(defaults) {
         return callerCsi(host, cert2);
       };
     }
+    // SSRF at resolution time: when a request opts in (the AIA fetch of an untrusted-cert URL), install a
+    // lookup that refuses -- and pins -- a private / loopback / link-local resolved address, so a hostname
+    // pointing at an internal service is blocked even though the literal-address check saw only a DNS name.
+    // A STRICT boolean true (a truthy string/object is treated as absent) keeps a malformed config fail-open-free.
+    var blockPrivate = (request.blockPrivateAddresses !== undefined ? request.blockPrivateAddresses : defaults.blockPrivateAddresses) === true;
+    if (blockPrivate) {
+      // Node does NOT invoke a custom `lookup` for an IP-LITERAL host (there is nothing to resolve), so the
+      // resolver alone would let a literal private / loopback / link-local destination through. Reject a blocked
+      // literal here, before installing the resolver -- so the option blocks a literal AND a resolved hostname.
+      if (_isBlockedIp(host)) throw E(C("blocked-address"), "refusing to connect to the private / loopback / link-local address literal " + host);
+      options.lookup = _guardedLookup;
+    }
 
     return { options: options, timeout: timeout, maxBytes: maxBytes, body: body };
   }
 
-  return function transport(request) {
+  var _transportFn = function transport(request) {
     request = request || {};
     var prep;
     try { prep = _prepare(request); }
@@ -318,6 +402,11 @@ function httpsTransport(defaults) {
       } catch (e) { fail(C("transport-error"), "the request could not be initiated: " + ((e && e.message) || String(e)), e); }
     });
   };
+  // Advertise that this transport HONORS the blockPrivateAddresses request flag (it filters and pins a resolved
+  // address). A consumer of an UNTRUSTED URL (pki.path.build's AIA fetch) checks this marker before relying on the
+  // flag for SSRF protection -- an injected transport that does not set it is treated as unguarded (fail-closed).
+  _transportFn.blocksPrivateAddresses = true;
+  return _transportFn;
 }
 
-module.exports = { https: httpsTransport };
+module.exports = { https: httpsTransport, isBlockedIp: _isBlockedIp, _makeGuardedLookup: _makeGuardedLookup, MAX_TIMEOUT: MAX_TIMEOUT };

package/lib/inspect.js

@@ -381,6 +381,26 @@ var EXT_RENDERERS = {
   },
   cRLDistributionPoints: _renderCrlDp,
   freshestCRL: _renderCrlDp,
+  authorityInfoAccess: function (decoded, inner) {
+    // AccessDescription list: <accessMethod> - <accessLocation>. The method resolves to its name (caIssuers /
+    // ocsp); the accessLocation is a GeneralName (a URI in the common case). An unregistered method / an
+    // uncommon accessLocation tag falls back to the raw OID / bracketed tag rather than dropping the entry.
+    var LABEL = { caIssuers: "CA Issuers", ocsp: "OCSP" };
+    return (decoded || []).map(function (ad) {
+      var m = null;
+      try { m = oid.name(ad.accessMethod); } catch (_e) { /* allow:swallow-unverified display best-effort: an unregistered accessMethod OID falls back to the raw dotted OID below (inspection is best-effort, never a verdict) */ }
+      var loc = ad.accessLocation || {}, lv;
+      // The string choices (URI/DNS/email) are IA5String values already control-byte-rejected at decode by the
+      // CVE-2009-2408 guard, so they are safe to emit directly. The iPAddress choice is a RAW 4/16-byte Buffer --
+      // render it through _ipString (never raw), so a byte such as 0x0a cannot inject a line and spoof a field.
+      if (loc.tag === 6) lv = "URI:" + loc.value;
+      else if (loc.tag === 2) lv = "DNS:" + loc.value;
+      else if (loc.tag === 1) lv = "email:" + loc.value;
+      else if (loc.tag === 7) lv = "IP:" + _ipString(loc.value);
+      else lv = typeof loc.value === "string" ? loc.value : "[" + loc.tag + "]";
+      return inner + (LABEL[m] || m || ad.accessMethod) + " - " + lv;
+    }).join("\n");
+  },
   nameConstraints: function (decoded, inner) {
     var ncLines = [];
     ["permittedSubtrees:Permitted", "excludedSubtrees:Excluded"].forEach(function (pair) {

package/lib/path-validate.js

@@ -43,6 +43,9 @@ var crlVerify = require("./crl-verify");
 var guard = require("./guard-all");
 var constants = require("./constants");
 var validator = require("./validator-all");
+var cms = require("./schema-cms");
+var httpTransport = require("./http-transport");
+var net = require("net");
 var compositeSig = require("./composite-sig");
 var edwardsPoint = require("./edwards-point");
 
@@ -78,6 +81,8 @@ var OID = {
   cRLDistributionPoints: oid.byName("cRLDistributionPoints"),
   subjectKeyIdentifier: oid.byName("subjectKeyIdentifier"),
   authorityKeyIdentifier: oid.byName("authorityKeyIdentifier"),
+  authorityInfoAccess: oid.byName("authorityInfoAccess"),
+  caIssuers: oid.byName("caIssuers"),
 };
 
 // The set of extension OIDs the validator PROCESSES -- an unrecognized critical
@@ -2117,6 +2122,14 @@ function identityKey(cert) {
     cert.subjectPublicKeyInfo.bytes.toString("hex");
 }
 
+// A byte-EXACT certificate identity (the signed tbs region + the signature), for deduping certificates fetched
+// over AIA before they enter the shared pool. Unlike identityKey (a subject/SAN/key tuple, deliberately broad for
+// loop pruning), this collapses ONLY true byte-duplicates -- so a mirror URL or a repeating CMS returning the same
+// issuer is added once, but a functionally-different cert sharing a subject+key (e.g. a key rollover) is kept.
+function certDerKey(cert) {
+  return cert.tbsBytes.toString("base64") + "|" + (cert.signatureValue && cert.signatureValue.bytes ? cert.signatureValue.bytes.toString("base64") : "");
+}
+
 function childAkiKeyId(cert) {
   var d = softDecode(cert, OID.authorityKeyIdentifier);
   return (d && d.value && d.value.keyIdentifier) ? d.value.keyIdentifier : null;
@@ -2147,9 +2160,140 @@ function scoreCandidate(cand, childAki, anchors, time) {
   return score;
 }
 
+// Sort scored issuer candidates by descending priority and push each non-looping one onto the DFS stack as a
+// child frame (the chain grows leaf-ward by PREPENDING the issuer). Shared by the static-pool expansion and the
+// AIA-fallback expansion so both enforce the SAME total-work counter (sec. 3.5 breadth cap), loop pruning
+// (the identity visited-set), and priority order. `scored` is [{cand, score}]; returns the number of candidates
+// ticked so the caller can advance its `considered` tally.
+function _pushCandidates(frame, scored, stack, counter) {
+  scored.sort(function (a, b) { return a.score - b.score; });   // ascending -> push lowest first so the highest is popped first
+  var n = 0;
+  for (var ci = 0; ci < scored.length; ci++) {
+    counter.tick();          // breadth / total-work cap -> throws path/build-limit
+    n += 1;
+    var cand = scored[ci].cand, candKey = identityKey(cand);
+    if (frame.keys.has(candKey)) continue;   // the (subject, SAN, key) tuple is already on this branch -> a loop, prune
+    var childKeys = new Set(frame.keys);
+    childKeys.add(candKey);
+    stack.push({ chain: [cand].concat(frame.chain), hop: frame.hop + 1, keys: childKeys });
+  }
+  return n;
+}
+
+// ---- AIA caIssuers network fetching (RFC 5280 sec. 4.2.2.1, opt-in over pki.transport) --------------------
+// Discover a MISSING intermediate by GETting the caIssuers accessLocation of the certificate being chained
+// past, feeding the fetched cert(s) into the SAME candidate search. SSRF / amplification bounded: https-only,
+// NO private / loopback / link-local destination -- an IP LITERAL is refused by the pre-check, and a DNS NAME
+// that RESOLVES to such an address is refused (and the address pinned) by the transport's blockPrivateAddresses
+// filter set on every AIA request, so an untrusted cert cannot drive an authenticated GET to an internal service
+// / cloud metadata by literal OR by hostname; a
+// total fetch budget (a SILENT cap -- stop fetching, never a throw that aborts a buildable path), a per-cert URL
+// cap over DISTINCT normalized URLs, a build-wide URL dedupe (fragment-free), a response size + certificate-count
+// cap, no redirect following. Every fetch fault is a SKIP (the DFS continues over the pool). A fetched cert is UNTRUSTED pool
+// material -- when validate is on (the default) it flows through validate() like any candidate and is NEVER a
+// trust anchor; in pure-builder mode (opts.validate:false) it is returned unvalidated, exactly like a static candidate.
+
+// SSRF guard (literal pre-check): is a URL host a private / loopback / link-local / reserved IP LITERAL? An AIA
+// URL comes from an UNTRUSTED certificate, so a literal address into RFC 1918 / loopback / the 169.254 cloud-
+// metadata range must not be fetched (with enterprise TLS trust it would be an authenticated GET to an internal
+// service). This is a fast pre-filter that avoids even opening a socket for an obvious literal; a DNS NAME is
+// judged at RESOLUTION time by the transport's blockPrivateAddresses filter (set on the AIA request below), which
+// also pins the checked address. The IP classification is shared with the transport (one range set, no drift).
+function _isBlockedAiaHost(host) {
+  if (host.charAt(0) === "[" && host.charAt(host.length - 1) === "]") host = host.slice(1, -1);   // an IPv6 literal: URL.hostname keeps the [brackets]
+  if (net.isIP(host) === 0) return false;   // a DNS name -> not judged here; the transport's resolution-time filter blocks a private resolution
+  return httpTransport.isBlockedIp(host);   // an IP literal -> the shared private/loopback/link-local classifier
+}
+
+// Parse an AIA response body as a single DER certificate (RFC 2585) OR a certs-only CMS bundle (RFC 5272).
+// The media type is only an ordering HINT (RFC 5280 sec. 4.2.2.1: "should not depend solely on the ... media
+// type") -- both structures are attempted, the wire decides. Returns raw certificate DER Buffers; throws
+// (caught upstream as a skip) if the body is neither.
+function _aiaParseBody(body, contentType, maxCerts) {
+  var certsFirst = String(contentType || "").toLowerCase().indexOf("pkcs7") >= 0;   // HINT: order the attempts only
+  var order = certsFirst ? ["certs", "cert"] : ["cert", "certs"];
+  for (var i = 0; i < order.length; i++) {
+    try {
+      if (order[i] === "cert") { x509.parse(body); return [Buffer.from(body)]; }
+      return cms.parseCertsOnly(body, E, "path", maxCerts).certificates;   // maxCerts bounds the parse of an untrusted bundle
+    } catch (_e) { /* structure-sniff: try the other form */ }
+  }
+  throw E("path/aia-bad-body", "an AIA response body is neither a DER certificate nor a certs-only CMS");
+}
+
+// Fetch ONE caIssuers URL over the injected/default transport; returns the parsed candidate certs, or throws
+// (the caller collapses any throw to a skip). Only a 200 with a non-empty, in-cap body is a cert source (M12).
+async function _aiaFetchOne(uri, aia) {
+  // blockPrivateAddresses: the real transport refuses -- and pins -- a hostname that RESOLVES to a private /
+  // loopback / link-local address (the literal pre-check only catches an IP literal). An injected test transport
+  // ignores the flag; the DFS treats a blocked-address transport error as a silent skip like any fetch fault.
+  var res = await aia.transport({ method: "GET", url: uri, tls: aia.tls, timeout: aia.timeout, maxResponseBytes: aia.maxResponseBytes, blockPrivateAddresses: true });
+  res = res || {};
+  if (res.status !== 200) throw E("path/aia-status", "an AIA fetch returned HTTP " + res.status + " (only 200 is a cert source; no redirect following)");
+  var body = Buffer.isBuffer(res.body) ? res.body : Buffer.from(res.body == null ? "" : String(res.body), "latin1");
+  if (body.length === 0) throw E("path/aia-empty", "an AIA fetch returned an empty body");
+  // Belt for an INJECTED transport that ignores maxResponseBytes (the real transport streaming-aborts at the cap).
+  if (body.length > aia.maxResponseBytes) throw E("path/aia-too-large", "an AIA response exceeds the " + aia.maxResponseBytes + "-byte cap");
+  var headers = {};
+  Object.keys(res.headers || {}).forEach(function (k) { headers[k.toLowerCase()] = res.headers[k]; });
+  return _aiaParseBody(body, headers["content-type"], aia.maxCertsPerResponse);
+}
+
+// Discover issuer candidates for `current` from its AIA caIssuers URLs. Returns parsed candidate certs (coerced
+// like any pool cert). Bounded + fail-closed; ticks aia.fetchCounter (the total-budget throw) and mutates
+// aia.fetchedUrls (build-wide dedupe). A cert with no AIA, a malformed AIA, or no fetchable https caIssuers
+// URI simply yields no candidates (RFC 5280 sec. 4.2.2.1 AIA is advisory / non-critical).
+async function _fetchAiaIssuers(current, aia) {
+  var d = softDecode(current, OID.authorityInfoAccess);   // no / malformed AIA -> no fetch
+  if (!d || !d.value) return [];
+  // Collect DISTINCT, normalized, fetchable https URLs, deduping BEFORE the per-cert cap so a flood of duplicate
+  // (or fragment-variant) entries can never crowd out a usable later URL.
+  var uris = [];
+  var seenThisCert = new Set();
+  for (var i = 0; i < d.value.length; i++) {
+    var ad = d.value[i];
+    if (ad.accessMethod !== OID.caIssuers) continue;      // ONLY id-ad-caIssuers, never id-ad-ocsp
+    if (!ad.accessLocation || ad.accessLocation.tag !== 6) continue;   // ONLY a uniformResourceIdentifier [6]
+    // Parse the URI ONCE: the NORMALIZED href is both the dedupe key AND the exact URL handed to the transport.
+    var u;
+    try { u = new URL(ad.accessLocation.value); }
+    catch (_e) { continue; }                              // an unparseable URI -> skip (catch on its own line so the swallow gate can trace it)
+    if (u.protocol !== "https:") continue;                // https-only: no socket for http/ldap/ftp/file/mailto
+    if (_isBlockedAiaHost(u.hostname)) continue;          // SSRF: never fetch a private / loopback / link-local IP literal
+    // A DNS-NAME host's private RESOLUTION can only be blocked by a transport that filters the resolved address;
+    // with an UNGUARDED transport (an injected fn that does not vouch blocksPrivateAddresses) fail closed -- fetch
+    // IP literals only (already validated above), never a hostname whose resolved address we cannot verify.
+    if (net.isIP(u.hostname.replace(/^\[(.*)\]$/, "$1")) === 0 && !aia.transportGuardsAddresses) continue;
+    u.hash = "";                                          // the fragment is never sent on the wire -> not part of the request/dedupe identity
+    if (aia.fetchedUrls.has(u.href) || seenThisCert.has(u.href)) continue;   // dedupe (build-wide OR same-cert) on the normalized URL
+    if (seenThisCert.size >= aia.maxPerCert) break;       // per-cert DISTINCT-url cap, checked BEFORE appending so maxAiaPerCert:0 collects nothing (no fetch at all)
+    seenThisCert.add(u.href);
+    uris.push(u.href);
+  }
+  var out = [];
+  for (var k = 0; k < uris.length; k++) {
+    if (aia.fetchedUrls.has(uris[k])) continue;   // a same-cert normalization-equal duplicate
+    if (aia.fetches >= aia.maxFetches) break;     // total budget reached -> STOP fetching (a SILENT cap, never a throw that denies a buildable path)
+    aia.fetchedUrls.add(uris[k]);                 // mark BEFORE the fetch -> fetched at most once, even on failure
+    aia.fetches += 1;
+    var certs;
+    try { certs = await _aiaFetchOne(uris[k], aia); }
+    catch (_e2) { continue; }   // any fetch / parse fault is a skip; the DFS continues over the pool + other URLs
+    // Each response is already capped to maxCertsPerResponse by parseCertsOnly (per RESPONSE), so an earlier
+    // URL's bundle never consumes a later URL's allowance -- coerce every returned cert.
+    for (var c = 0; c < certs.length; c++) {
+      var parsed;
+      try { parsed = coerceCert(certs[c]); }
+      catch (_e3) { /* allow:swallow-unverified verified-unreachable: every cert here already passed the IDENTICAL x509.parse in _aiaParseBody (single-DER validates `body`; certs-only validates each via parseCertsOnly), so coerceCert re-parsing the same bytes cannot throw -- the guard stays as defence-in-depth */ continue; }
+      out.push(parsed);
+    }
+  }
+  return out;
+}
+
 /**
  * @primitive  pki.path.build
- * @signature  pki.path.build(leaf, opts) -> Promise<{ valid, path, trustAnchor, result, candidatesConsidered }>
+ * @signature  pki.path.build(leaf, opts) -> Promise<{ valid, path, trustAnchor, result, candidatesConsidered, aiaFetches }>
  * @since       0.3.7
  * @status      experimental
  * @spec        RFC 4158, RFC 5280
@@ -2176,8 +2320,16 @@ function scoreCandidate(cand, childAki, anchors, time) {
  * `validate` consumes (anchor-proximal first, leaf last, the anchor excluded). Fail-closed: bad
  * options throw `path/bad-input`; no chain to any anchor throws `path/no-path`; chains that
  * assemble but none validate return `{ valid:false }` with the best failing `validate` result;
- * the search bound throws `path/build-limit`. AIA caIssuers fetching is out of scope -- `build` is
- * offline (zero network); supply fetched issuers in `opts.candidates`.
+ * the search bound throws `path/build-limit`. By default `build` is OFFLINE (zero network) -- supply
+ * intermediates in `opts.candidates`. Set `opts.fetchAia: true` to opt in to fetching a MISSING intermediate
+ * from a certificate's Authority Information Access `caIssuers` URL (RFC 5280 sec. 4.2.2.1) over
+ * `pki.transport`: the fetch triggers only on a pool miss, every fetched certificate is UNTRUSTED pool material
+ * that still flows through `validate` when validation is on (never a trust anchor), and the whole surface is
+ * SSRF/amplification bounded -- https-only, a total fetch budget (a SILENT cap, never a throw that denies a
+ * buildable path), a per-cert URL cap, a build-wide URL dedupe, a response size + certificate-count cap, and no
+ * redirect following; every fetch fault is a silent skip. `aiaFetches` reports how many network GETs the build
+ * performed (`0` when `fetchAia` is off). NOTE: with `opts.validate:false` (pure-builder mode) a fetched cert is
+ * returned unvalidated, identical to a static candidate -- the "flows through validate" guarantee needs validation on.
  *
  * @opts  candidates             The untrusted candidate CA pool (array of DER/PEM/parsed certs; alias `intermediates`).
  * @opts  trustAnchors           The trust store (non-empty array of `{ name, publicKey, algorithm }` tuples or self-signed root certificates).
@@ -2185,6 +2337,13 @@ function scoreCandidate(cand, childAki, anchors, time) {
  * @opts  maxDepth               Chain-length depth cap (default `C.LIMITS.PATH_BUILD_MAX_DEPTH`).
  * @opts  maxCandidatesConsidered  Total-work cap on candidate expansions (default `C.LIMITS.PATH_BUILD_MAX_CANDIDATES`).
  * @opts  validate               `false` returns the ordered path without validating (pure-builder mode; default `true`).
+ * @opts  fetchAia               `true` opts in to AIA caIssuers network fetching of a missing intermediate (default `false` -- fully offline). Off unless set; when set, a fetch runs only on a pool miss for a non-anchor-adjacent cert, and (with validation on) every fetched cert still flows through `validate`.
+ * @opts  transport              The injectable transport seam (`fn(request) -> Promise<{ status, headers, body }>`); tests drive the fetch offline. With none, the default `pki.transport.https` is used, which fails closed unless `opts.tls` carries trust. SSRF: for a caIssuers URL with a DNS hostname, a custom transport is used ONLY if it declares `fn.blocksPrivateAddresses = true` -- vouching it refuses (and pins) a resolved private / loopback / link-local / special-use address, as the default transport does. Without that marker a DNS-name AIA URL is fail-closed (skipped) and only an IP-literal URL (validated up front) is fetched; set the marker on your transport when it filters resolved addresses.
+ * @opts  tls                    The TLS trust for the AIA HTTPS host (`{ anchors, useSystemStore, ... }`) -- DISTINCT from `opts.trustAnchors` (the PKI trust store the path validates against). The default transport refuses an unpinned server.
+ * @opts  maxAiaFetches          Total AIA network GET budget across the whole build (default `C.LIMITS.PATH_AIA_MAX_FETCHES`); on reaching it the builder stops fetching (a silent cap), never a throw -- a fetch bound never denies a path the pool could build.
+ * @opts  maxAiaPerCert          Cap on caIssuers URLs tried per certificate (default `C.LIMITS.PATH_AIA_MAX_PER_CERT`).
+ * @opts  aiaTimeout             Per-fetch timeout in ms, forwarded to the transport.
+ * @opts  maxResponseBytes       Per-fetch response size cap, forwarded to the transport (tightenable downward only).
  * @opts  (validate options)     Every `pki.path.validate` option (`requiredEku`, `revocationChecker`, `checkPurpose`, the initial policy inputs, ...) is forwarded unchanged.
  * @example
  *   var result = await pki.path.build(pemString, {
@@ -2212,6 +2371,11 @@ async function build(leaf, opts) {
   var pool;
   try { pool = poolInput.map(coerceCert); }
   catch (e) { throw E("path/bad-input", "build: a candidate certificate did not parse", e); }
+  // Byte-exact identities of every cert already in the shared pool, so an AIA-fetched duplicate (a mirror URL or a
+  // repeating CMS returning the same issuer) is appended AT MOST ONCE -- it otherwise inflates the pool, charging
+  // the candidate budget and the ceiling for each copy before the issuer is ever evaluated.
+  var poolDerKeys = new Set();
+  for (var pdk = 0; pdk < pool.length; pdk++) poolDerKeys.add(certDerKey(pool[pdk]));
 
   if (!Array.isArray(opts.trustAnchors) || opts.trustAnchors.length === 0) throw E("path/bad-input", "build: opts.trustAnchors must be a non-empty array of anchor tuples or root certificates");
   var anchors = opts.trustAnchors.map(toAnchor);
@@ -2235,10 +2399,55 @@ async function build(leaf, opts) {
   var maxConsidered = guard.limits.cap(opts.maxCandidatesConsidered, "build: opts.maxCandidatesConsidered", poolCeiling, { E: E, code: "path/bad-input", min: 1 });
   var doValidate = opts.validate !== false;
 
+  // AIA caIssuers fetching is OFF unless opts.fetchAia === true -- the default build is byte-identical to
+  // today's offline search (no transport constructed, no socket, no new path executed). When on, opts.transport
+  // is the injectable seam (tests drive it offline); with no injected transport the default https transport
+  // fails closed unless opts.tls carries an anchor / useSystemStore. opts.tls is the TLS trust for the AIA
+  // HTTPS host -- DISTINCT from opts.trustAnchors (the PKI trust store the built path validates against).
+  var aiaCtx = null;
+  if (opts.fetchAia === true) {
+    // Validate the AIA-specific options at CONFIG time (a caller typo is a path/bad-input throw, tier 1), not
+    // lazily inside the fetch where a bad transport / timeout would be caught as an ordinary fetch fault and
+    // silently degrade to path/no-path. A non-function transport can never be called; an injected transport gets
+    // a validated timeout (it may not cap the value itself).
+    if (opts.transport !== undefined && typeof opts.transport !== "function") {
+      throw E("path/bad-input", "build: opts.transport must be a transport function (request) -> Promise<{ status, headers, body }>");
+    }
+    // Validate aiaTimeout against the SAME bounds the built-in transport enforces (integer, 1..MAX_TIMEOUT) at
+    // CONFIG time, so a non-integer / over-ceiling value is a path/bad-input throw here rather than a transport
+    // rejection swallowed later as a fetch fault. guard.limits.cap is the exact primitive the transport applies.
+    if (opts.aiaTimeout !== undefined) {
+      guard.limits.cap(opts.aiaTimeout, "build: opts.aiaTimeout", 1, { E: E, code: "path/bad-input", min: 1, max: httpTransport.MAX_TIMEOUT });
+    }
+    var aiaTransport = opts.transport || httpTransport.https({ E: E, errPrefix: "path" });
+    aiaCtx = {
+      transport: aiaTransport,
+      // SSRF for a DNS-name AIA host needs resolution-time address filtering + pinning, which only a transport
+      // that ADVERTISES the capability performs (the built-in, or an injected one that sets blocksPrivateAddresses
+      // to vouch it filters). An injected fn(request) that ignores the flag is treated as UNGUARDED: a DNS-name AIA
+      // URL is then fail-closed (skipped) and only an IP literal (validated by the literal pre-check) is fetched.
+      transportGuardsAddresses: aiaTransport.blocksPrivateAddresses === true,
+      tls: opts.tls || {},
+      timeout: opts.aiaTimeout,               // validated above; the transport applies its own default + cap
+      // Default the AIA response cap BELOW the general HTTP ceiling (a caIssuers response is small); tighten
+      // downward only, never above HTTP_MAX_RESPONSE_BYTES.
+      maxResponseBytes: guard.limits.cap(opts.maxResponseBytes, "build: opts.maxResponseBytes", constants.LIMITS.PATH_AIA_MAX_RESPONSE_BYTES, { E: E, code: "path/bad-input", min: 1, max: constants.LIMITS.PATH_AIA_MAX_RESPONSE_BYTES }),
+      maxPerCert: guard.limits.cap(opts.maxAiaPerCert, "build: opts.maxAiaPerCert", constants.LIMITS.PATH_AIA_MAX_PER_CERT, { E: E, code: "path/bad-input", min: 0 }),
+      maxCertsPerResponse: constants.LIMITS.PATH_AIA_MAX_CERTS_PER_RESPONSE,
+      // The total fetch budget is a SILENT cap (stop initiating fetches when reached), NOT a throw: a bound on
+      // an ADVISORY fetch must never abort a build that the static pool could still complete. maxFetches may be
+      // 0 (fetchAia:true but no network -- identical to offline).
+      maxFetches: guard.limits.cap(opts.maxAiaFetches, "build: opts.maxAiaFetches", constants.LIMITS.PATH_AIA_MAX_FETCHES, { E: E, code: "path/bad-input", min: 0 }),
+      fetchedUrls: new Set(),
+      fetches: 0,
+    };
+  }
+
   // The build-specific options are consumed here; every remaining validate
   // option is forwarded unchanged to the interleaved validate call. Object.keys
   // enumerates only own enumerable properties, so no prototype-pollution belt.
-  var BUILD_ONLY_OPT = { candidates: 1, intermediates: 1, trustAnchors: 1, maxDepth: 1, maxCandidatesConsidered: 1, validate: 1 };
+  var BUILD_ONLY_OPT = { candidates: 1, intermediates: 1, trustAnchors: 1, maxDepth: 1, maxCandidatesConsidered: 1, validate: 1,
+    fetchAia: 1, transport: 1, tls: 1, maxAiaFetches: 1, maxAiaPerCert: 1, aiaTimeout: 1, maxResponseBytes: 1 };
   var forwarded = {};
   Object.keys(opts).forEach(function (k) { if (!BUILD_ONLY_OPT[k]) forwarded[k] = opts[k]; });
   function validateOpts(anchor) {
@@ -2266,7 +2475,61 @@ async function build(leaf, opts) {
   // Caps are enforced before every expansion; a candidate whose (subject, SAN,
   // public key) tuple is already on the chain is a loop and is pruned.
   var stack = [{ chain: [leafCert], hop: 0, keys: new Set([identityKey(leafCert)]) }];
-  while (stack.length && !success) {
+  // AIA fetch frames are DEFERRED into this queue and drained ONLY when `stack` is empty -- i.e. once the ENTIRE
+  // local (static-pool) search has failed. This enforces RFC 4158 sec. 7.2 "local before remote" GLOBALLY across
+  // the whole search, not per-branch: a build the static pool can complete never issues a network request, and a
+  // higher-priority local dead-end can never fetch ahead of a still-unexplored lower-priority static sibling.
+  // Drained DEEPEST-first, and among equal depth EARLIEST-deferred (= highest DFS priority) first: the actual
+  // dead end (a missing deeper hop) is fetched before an ancestor whose issuer the pool ALREADY supplies (so a
+  // scarce budget is never spent re-retrieving a locally-resolved hop), and a higher-scoring sibling's AIA is
+  // tried before a lower-scoring one (a plain LIFO pop would reverse sibling priority and let a stale low-priority
+  // branch's dead URL waste a tight budget before the preferred branch).
+  var deferredAia = [];
+  var deferSeq = 0;   // monotonic deferral order (DFS priority): the drain tie-breaks same-depth frames by it
+  while (!success) {
+    if (!stack.length) {
+      // The local search is drained. Begin / continue the fetch phase: pick a deferred frame with PENDING WORK --
+      // one that has NOT yet fetched, OR whose poolMark trails the shared pool (a SIBLING branch fetched a cert
+      // SINCE this frame last ran, which may complete it). A drained frame is NOT discarded: a later sibling's
+      // fetch can add the very issuer an earlier, already-run branch needed, so every frame stays eligible for
+      // pool growth until it has fetched AND seen the whole pool. Among eligible frames pick the deepest, then the
+      // earliest-deferred (highest DFS priority). No eligible frame -> the whole search is exhausted.
+      var _bi = -1;
+      for (var _di = 0; _di < deferredAia.length; _di++) {
+        var _f = deferredAia[_di];
+        if (_f.fetched && _f.poolMark >= pool.length) continue;   // nothing left to fetch or to re-expand against
+        if (_bi === -1) { _bi = _di; continue; }
+        var _bf = deferredAia[_bi];
+        if (_f.hop > _bf.hop || (_f.hop === _bf.hop && _f.seq < _bf.seq)) _bi = _di;
+      }
+      if (_bi === -1) break;   // no deferred frame can make further progress
+      var fb = deferredAia[_bi];   // NOT removed: it stays eligible for certs a later sibling fetch adds
+      var fbCur = fb.chain[0];
+      if (!fb.fetched && aiaCtx && aiaCtx.fetches < aiaCtx.maxFetches) {
+        var fetched = await _fetchAiaIssuers(fbCur, aiaCtx);   // append newly-fetched issuer(s) to the SHARED pool
+        for (var fj = 0; fj < fetched.length; fj++) {
+          var fdk = certDerKey(fetched[fj]);
+          if (poolDerKeys.has(fdk)) continue;                  // a byte-duplicate (mirror URL / repeating CMS) -> add once, never re-charge the budget/ceiling
+          poolDerKeys.add(fdk);
+          if (pool.length < poolCeiling) pool.push(fetched[fj]);
+        }
+      }
+      fb.fetched = true;   // the fetch attempt is done (or budget-skipped); the frame stays eligible for FUTURE pool growth
+      // Re-expand fb against every pool cert added SINCE it last ran -- its OWN just-fetched certs AND any a SIBLING
+      // branch fetched into the shared pool. The pool-index mark skips certs fb already scored (no redundant work);
+      // advancing it means fb re-scores only certs added even later. This runs even when the budget is exhausted, so
+      // a budget-capped frame still benefits from a sibling fetch.
+      var fbAki = childAkiKeyId(fbCur);
+      var fbScored = [];
+      for (var pj = fb.poolMark; pj < pool.length; pj++) {
+        if (nameMatchSoft(pool[pj].subject.rdns, fbCur.issuer.rdns)) {
+          fbScored.push({ cand: pool[pj], score: scoreCandidate(pool[pj], fbAki, anchors, opts.time) });
+        }
+      }
+      fb.poolMark = pool.length;
+      considered += _pushCandidates(fb, fbScored, stack, counter);
+      continue;
+    }
     var frame = stack.pop();
     var current = frame.chain[0];
 
@@ -2290,28 +2553,32 @@ async function build(leaf, opts) {
         scored.push({ cand: pool[pi], score: scoreCandidate(pool[pi], childAki, anchors, opts.time) });
       }
     }
-    // Ascending sort -> push lowest priority first so the highest is on top.
-    scored.sort(function (a, bb) { return a.score - bb.score; });
-    for (var ci = 0; ci < scored.length; ci++) {
-      counter.tick();          // breadth / total-work cap -> throws path/build-limit
-      considered += 1;
-      var cand = scored[ci].cand;
-      var candKey = identityKey(cand);
-      if (frame.keys.has(candKey)) continue;   // the (subject,SAN,key) tuple is already on this branch -> a loop, prune
-      var childKeys = new Set(frame.keys);
-      childKeys.add(candKey);
-      stack.push({ chain: [cand].concat(frame.chain), hop: frame.hop + 1, keys: childKeys });
+    // Opt-in AIA caIssuers fetch as a FALLBACK: DEFER it (drained above only after the ENTIRE local search is
+    // exhausted, RFC 4158 sec. 7.2 "local before remote") rather than pushing it onto the stack, so it can never
+    // run ahead of an unexplored local sibling -- a build the static pool can complete never fetches. It is gated
+    // on `success` being unset (guaranteed by the continue above), NOT on the issuer name failing to match an
+    // anchor: an issuer DN that matches an anchor whose KEY did not validate this chain (a CA key rollover -- the
+    // real same-DN, different-key intermediate is missing and reachable only via AIA) still needs the fetch.
+    if (aiaCtx && frame.hop < maxDepth && aiaCtx.fetches < aiaCtx.maxFetches) {
+      // poolMark: the shared-pool length now, so the drain re-expands this frame only against certs added LATER
+      // (its own fetch + any sibling branch's fetch), never re-scoring the static pool it expands against below.
+      // seq: the deferral order, so the drain can tie-break same-depth frames by DFS priority (earliest first).
+      // fetched: false until this frame's own AIA fetch runs; it then stays eligible for later sibling pool growth.
+      deferredAia.push({ chain: frame.chain, hop: frame.hop, keys: frame.keys, poolMark: pool.length, seq: deferSeq, fetched: false });
+      deferSeq += 1;
     }
+    considered += _pushCandidates(frame, scored, stack, counter);
   }
 
+  var aiaFetches = aiaCtx ? aiaCtx.fetches : 0;   // the count of AIA caIssuers network GETs this build performed (0 when opts.fetchAia is off)
   if (success) {
-    if (doValidate) return { valid: true, path: success.path, trustAnchor: success.trustAnchor, result: success.result, candidatesConsidered: considered };
-    return { path: success.path, trustAnchor: success.trustAnchor, candidatesConsidered: considered };
+    if (doValidate) return { valid: true, path: success.path, trustAnchor: success.trustAnchor, result: success.result, candidatesConsidered: considered, aiaFetches: aiaFetches };
+    return { path: success.path, trustAnchor: success.trustAnchor, candidatesConsidered: considered, aiaFetches: aiaFetches };
   }
   if (anyChainAssembled) {
     // Chains reached an anchor but none validated -> the soft verdict carrying
     // the best failing validate result (parity with validate; never a throw).
-    return { valid: false, path: bestFail.path, trustAnchor: bestFail.trustAnchor, result: bestFail.result, candidatesConsidered: considered };
+    return { valid: false, path: bestFail.path, trustAnchor: bestFail.trustAnchor, result: bestFail.result, candidatesConsidered: considered, aiaFetches: aiaFetches };
   }
   // No chain to any configured anchor could even be assembled -- a permanent
   // structural verdict (name/key chaining dead-ended before the trust store).

package/lib/schema-cms.js

@@ -49,6 +49,8 @@ var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var oid = require("./oid");
 var frameworkError = require("./framework-error");
+var schemaX509 = require("./schema-x509");
+var schemaCrl = require("./schema-crl");
 
 var CmsError = frameworkError.CmsError;
 var PemError = frameworkError.PemError;
@@ -1225,11 +1227,54 @@ function assertAttachedCiphertext(eci, E, code, label) {
   return eci;
 }
 
+// The "certs-only" Simple PKI Response (RFC 5272 sec. 4.1): a degenerate SignedData carrying certificates (and
+// optionally CRLs) but NO signed content -- id-data with no eContent and EMPTY signerInfos. It is how RFC 7030
+// EST returns a CA chain (/cacerts) and how an RFC 5280 sec. 4.2.2.1 AIA caIssuers URL may serve issuers
+// (application/pkcs7-mime). Returns { certificates: [raw DER], crls: [raw DER] } -- the RAW bytes only; the
+// caller validates each cert/CRL for its own purpose (EST re-parses; path building runs each through validate).
+// Shared so the EST client and the path builder decode an identical shape; the caller passes its typed-error
+// factory `E(code, msg, cause)` and domain `prefix` so a fault surfaces the caller's own `prefix/*` code.
+// `maxCerts` (optional) caps how many certificates / CRLs are validated + returned, BEFORE the per-element
+// X.509 / CRL parse -- so an untrusted source (an AIA caIssuers URL) cannot force tens of thousands of parses
+// with one in-cap-bytes bundle; the EST client passes no cap (a /cacerts chain is small and fully returned).
+function parseCertsOnly(der, E, prefix, maxCerts) {
+  var r;
+  try { r = parse(der); }
+  catch (e) { throw E(prefix + "/bad-response", "a certs-only response did not decode as CMS: " + ((e && e.message) || String(e)), e); }
+  if (r.contentTypeName !== "signedData") throw E(prefix + "/not-certs-only", "a certs-only response must be a CMS SignedData (RFC 5272 sec. 4.1)");
+  if (r.encapContentInfo.eContentType !== OID_DATA || r.encapContentInfo.eContent !== null) {
+    throw E(prefix + "/not-certs-only", "a certs-only Simple PKI Response must carry id-data with no eContent (RFC 5272 sec. 4.1)");
+  }
+  if (r.signerInfos.length !== 0) throw E(prefix + "/not-certs-only", "a certs-only Simple PKI Response must have empty signerInfos (RFC 5272 sec. 4.1)");
+  if (!r.certificates || r.certificates.length === 0) throw E(prefix + "/no-certificates", "a certs-only response must contain at least one certificate (RFC 5272 sec. 4.1)");
+  // Cap BEFORE the per-certificate X.509 parse: bound parse work by count, not only by the decoded byte size.
+  var certs = (maxCerts != null && r.certificates.length > maxCerts) ? r.certificates.slice(0, maxCerts) : r.certificates;
+  for (var i = 0; i < certs.length; i++) {
+    // A universal-SEQUENCE CertificateChoice must be a well-formed X.509 Certificate, not merely any SEQUENCE;
+    // a tagged CertificateChoices alternative (attribute cert / other) is not a plain certificate.
+    if (certs[i].tagClass !== "universal") throw E(prefix + "/bad-certificate-choice", "a certs-only response exchanges plain X.509 certificates; a tagged CertificateChoices alternative is not permitted (RFC 5272)");
+    try { schemaX509.parse(certs[i].bytes); }
+    catch (e) { throw E(prefix + "/bad-certificate", "a certs-only response carried a non-certificate in its certificates field (RFC 5272 sec. 4.1)", e); }
+  }
+  var allCrls = r.crls || [];
+  var crls = (maxCerts != null && allCrls.length > maxCerts) ? allCrls.slice(0, maxCerts) : allCrls;
+  for (var j = 0; j < crls.length; j++) {
+    if (crls[j].tagClass !== "universal") throw E(prefix + "/bad-crl", "a certs-only response CRL must be a plain X.509 CertificateList, not a tagged otherRevInfo alternative (RFC 5652 sec. 10.2.1)");
+    try { schemaCrl.parse(crls[j].bytes); }
+    catch (e) { throw E(prefix + "/bad-crl", "a certs-only response carried a non-CRL in its crls field", e); }
+  }
+  return {
+    certificates: certs.map(function (c) { return c.bytes; }),
+    crls: crls.map(function (c) { return c.bytes; }),
+  };
+}
+
 module.exports = {
   parse: parse,
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matches: matches,
+  parseCertsOnly: parseCertsOnly,
   walkEnvelopedData: walkEnvelopedData,
   walkSignedData: walkSignedData,
   walkEncryptedData: walkEncryptedData,

package/lib/schema-pkix.js

@@ -809,6 +809,30 @@ function certExtensionDecoders(ns) {
     return schema.walk(generalNames(ns, { decodeValue: true, code: C }), n, ns).result;
   }
 
+  // authorityInfoAccess ::= AuthorityInfoAccessSyntax ::= SEQUENCE SIZE(1..MAX) OF AccessDescription
+  // (RFC 5280 sec. 4.2.2.1); AccessDescription ::= SEQUENCE { accessMethod OBJECT IDENTIFIER, accessLocation
+  // GeneralName }. Surfaces [{ accessMethod: <dotted OID>, accessLocation: { tag, value } }] in wire order --
+  // accessLocation is the shared generalName leaf (its context tag number + decoded value, so a control-byte
+  // URI is rejected by the CVE-2009-2408 guard). BOTH accessMethods surface (id-ad-caIssuers AND id-ad-ocsp):
+  // a consumer filters by accessMethod (caIssuers for issuer fetching, ocsp for responder discovery). An empty
+  // SEQUENCE violates SIZE(1..MAX) and is malformed. A composed decoder + registry row, not a hand-roll.
+  function authorityInfoAccess(buf) {
+    var C = ns.prefix + "/bad-extension-value";
+    var descs = seqChildren(buf, C, "AuthorityInfoAccessSyntax");
+    if (descs.length < 1) throw ns.E(C, "AuthorityInfoAccessSyntax must contain at least one AccessDescription (RFC 5280 sec. 4.2.2.1, SIZE(1..MAX))");
+    var GN = generalName(ns, { decodeValue: true, code: C });
+    return descs.map(function (d) {
+      if (d.tagClass !== "universal" || d.tagNumber !== _T.SEQUENCE || !d.children || d.children.length !== 2) {
+        throw ns.E(C, "AccessDescription must be a SEQUENCE { accessMethod, accessLocation } (RFC 5280 sec. 4.2.2.1)");
+      }
+      var method;
+      try { method = asn1.read.oid(d.children[0]); }
+      catch (e) { throw ns.E(C, "AccessDescription accessMethod must be an OBJECT IDENTIFIER", e); }
+      var loc = schema.walk(GN, d.children[1], ns);   // a decode leaf returns its value directly (no .result wrapper)
+      return { accessMethod: method, accessLocation: { tag: loc.tagNumber, value: loc.value } };
+    });
+  }
+
   // extKeyUsage ::= SEQUENCE SIZE(1..MAX) OF KeyPurposeId (OID)
   function extKeyUsage(buf) {
     var C = ns.prefix + "/bad-extension-value";
@@ -1105,6 +1129,7 @@ function certExtensionDecoders(ns) {
   byOid[O("precertificatePoison")] = precertPoison;
   byOid[O("cRLDistributionPoints")] = crlDistributionPoints;
   byOid[O("freshestCRL")] = crlDistributionPoints;
+  byOid[O("authorityInfoAccess")] = authorityInfoAccess;
   byOid[O("msCertificateTemplate")] = msCertificateTemplate;
   byOid[O("msEnrollCertType")] = msEnrollCertType;
   byOid[O("msCaVersion")] = msCaVersion;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.3.24",
+  "version": "0.3.25",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:342eb0a5-bbfa-46f5-9b51-912a21d97f53",
+  "serialNumber": "urn:uuid:5e29cae0-edec-47f9-be9b-305be03dd73c",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-26T21:06:05.598Z",
+    "timestamp": "2026-07-27T02:30:05.287Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.3.24",
+      "bom-ref": "@blamejs/pki@0.3.25",
       "type": "application",
       "name": "pki",
-      "version": "0.3.24",
+      "version": "0.3.25",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.3.24",
+      "purl": "pkg:npm/%40blamejs/pki@0.3.25",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.3.24",
+      "ref": "@blamejs/pki@0.3.25",
       "dependsOn": []
     }
   ]