@blamejs/pki 0.3.24 → 0.3.26

package/lib/path-validate.js

@@ -40,9 +40,13 @@ var crl = require("./schema-crl");
 var ocsp = require("./schema-ocsp");
 var ocspVerify = require("./ocsp-verify");
 var crlVerify = require("./crl-verify");
+var cmpVerify = require("./cmp-verify");
 var guard = require("./guard-all");
 var constants = require("./constants");
 var validator = require("./validator-all");
+var cms = require("./schema-cms");
+var httpTransport = require("./http-transport");
+var net = require("net");
 var compositeSig = require("./composite-sig");
 var edwardsPoint = require("./edwards-point");
 
@@ -78,6 +82,8 @@ var OID = {
   cRLDistributionPoints: oid.byName("cRLDistributionPoints"),
   subjectKeyIdentifier: oid.byName("subjectKeyIdentifier"),
   authorityKeyIdentifier: oid.byName("authorityKeyIdentifier"),
+  authorityInfoAccess: oid.byName("authorityInfoAccess"),
+  caIssuers: oid.byName("caIssuers"),
 };
 
 // The set of extension OIDs the validator PROCESSES -- an unrecognized critical
@@ -1875,6 +1881,13 @@ var ocspCore = ocspVerify.makeOcspVerify({
   dnEqual: dnEqual,
 });
 
+// Inject this validator's signature engine + full path build/validate into the internal cmp-verify seam,
+// so pki.cmp.verify routes incoming CMP signature protection through the SAME engine (never a second, weaker
+// CMP verifier; never build's self-check, which skips the EdDSA low-order-point gate) and chains an
+// out-of-path signer certificate through the FULL RFC 5280 sec. 6.1 path validation -- without exposing any
+// of it on the public pki.path surface (index.js exports the whole path-validate module).
+cmpVerify.setEngine({ verifyWithSpki: _verifyWithSpki, build: build, validate: validate });
+
 /**
  * @primitive  pki.path.ocspChecker
  * @signature  pki.path.ocspChecker(responses) -> RevocationChecker
@@ -2117,6 +2130,14 @@ function identityKey(cert) {
     cert.subjectPublicKeyInfo.bytes.toString("hex");
 }
 
+// A byte-EXACT certificate identity (the signed tbs region + the signature), for deduping certificates fetched
+// over AIA before they enter the shared pool. Unlike identityKey (a subject/SAN/key tuple, deliberately broad for
+// loop pruning), this collapses ONLY true byte-duplicates -- so a mirror URL or a repeating CMS returning the same
+// issuer is added once, but a functionally-different cert sharing a subject+key (e.g. a key rollover) is kept.
+function certDerKey(cert) {
+  return cert.tbsBytes.toString("base64") + "|" + (cert.signatureValue && cert.signatureValue.bytes ? cert.signatureValue.bytes.toString("base64") : "");
+}
+
 function childAkiKeyId(cert) {
   var d = softDecode(cert, OID.authorityKeyIdentifier);
   return (d && d.value && d.value.keyIdentifier) ? d.value.keyIdentifier : null;
@@ -2147,9 +2168,140 @@ function scoreCandidate(cand, childAki, anchors, time) {
   return score;
 }
 
+// Sort scored issuer candidates by descending priority and push each non-looping one onto the DFS stack as a
+// child frame (the chain grows leaf-ward by PREPENDING the issuer). Shared by the static-pool expansion and the
+// AIA-fallback expansion so both enforce the SAME total-work counter (sec. 3.5 breadth cap), loop pruning
+// (the identity visited-set), and priority order. `scored` is [{cand, score}]; returns the number of candidates
+// ticked so the caller can advance its `considered` tally.
+function _pushCandidates(frame, scored, stack, counter) {
+  scored.sort(function (a, b) { return a.score - b.score; });   // ascending -> push lowest first so the highest is popped first
+  var n = 0;
+  for (var ci = 0; ci < scored.length; ci++) {
+    counter.tick();          // breadth / total-work cap -> throws path/build-limit
+    n += 1;
+    var cand = scored[ci].cand, candKey = identityKey(cand);
+    if (frame.keys.has(candKey)) continue;   // the (subject, SAN, key) tuple is already on this branch -> a loop, prune
+    var childKeys = new Set(frame.keys);
+    childKeys.add(candKey);
+    stack.push({ chain: [cand].concat(frame.chain), hop: frame.hop + 1, keys: childKeys });
+  }
+  return n;
+}
+
+// ---- AIA caIssuers network fetching (RFC 5280 sec. 4.2.2.1, opt-in over pki.transport) --------------------
+// Discover a MISSING intermediate by GETting the caIssuers accessLocation of the certificate being chained
+// past, feeding the fetched cert(s) into the SAME candidate search. SSRF / amplification bounded: https-only,
+// NO private / loopback / link-local destination -- an IP LITERAL is refused by the pre-check, and a DNS NAME
+// that RESOLVES to such an address is refused (and the address pinned) by the transport's blockPrivateAddresses
+// filter set on every AIA request, so an untrusted cert cannot drive an authenticated GET to an internal service
+// / cloud metadata by literal OR by hostname; a
+// total fetch budget (a SILENT cap -- stop fetching, never a throw that aborts a buildable path), a per-cert URL
+// cap over DISTINCT normalized URLs, a build-wide URL dedupe (fragment-free), a response size + certificate-count
+// cap, no redirect following. Every fetch fault is a SKIP (the DFS continues over the pool). A fetched cert is UNTRUSTED pool
+// material -- when validate is on (the default) it flows through validate() like any candidate and is NEVER a
+// trust anchor; in pure-builder mode (opts.validate:false) it is returned unvalidated, exactly like a static candidate.
+
+// SSRF guard (literal pre-check): is a URL host a private / loopback / link-local / reserved IP LITERAL? An AIA
+// URL comes from an UNTRUSTED certificate, so a literal address into RFC 1918 / loopback / the 169.254 cloud-
+// metadata range must not be fetched (with enterprise TLS trust it would be an authenticated GET to an internal
+// service). This is a fast pre-filter that avoids even opening a socket for an obvious literal; a DNS NAME is
+// judged at RESOLUTION time by the transport's blockPrivateAddresses filter (set on the AIA request below), which
+// also pins the checked address. The IP classification is shared with the transport (one range set, no drift).
+function _isBlockedAiaHost(host) {
+  if (host.charAt(0) === "[" && host.charAt(host.length - 1) === "]") host = host.slice(1, -1);   // an IPv6 literal: URL.hostname keeps the [brackets]
+  if (net.isIP(host) === 0) return false;   // a DNS name -> not judged here; the transport's resolution-time filter blocks a private resolution
+  return httpTransport.isBlockedIp(host);   // an IP literal -> the shared private/loopback/link-local classifier
+}
+
+// Parse an AIA response body as a single DER certificate (RFC 2585) OR a certs-only CMS bundle (RFC 5272).
+// The media type is only an ordering HINT (RFC 5280 sec. 4.2.2.1: "should not depend solely on the ... media
+// type") -- both structures are attempted, the wire decides. Returns raw certificate DER Buffers; throws
+// (caught upstream as a skip) if the body is neither.
+function _aiaParseBody(body, contentType, maxCerts) {
+  var certsFirst = String(contentType || "").toLowerCase().indexOf("pkcs7") >= 0;   // HINT: order the attempts only
+  var order = certsFirst ? ["certs", "cert"] : ["cert", "certs"];
+  for (var i = 0; i < order.length; i++) {
+    try {
+      if (order[i] === "cert") { x509.parse(body); return [Buffer.from(body)]; }
+      return cms.parseCertsOnly(body, E, "path", maxCerts).certificates;   // maxCerts bounds the parse of an untrusted bundle
+    } catch (_e) { /* structure-sniff: try the other form */ }
+  }
+  throw E("path/aia-bad-body", "an AIA response body is neither a DER certificate nor a certs-only CMS");
+}
+
+// Fetch ONE caIssuers URL over the injected/default transport; returns the parsed candidate certs, or throws
+// (the caller collapses any throw to a skip). Only a 200 with a non-empty, in-cap body is a cert source (M12).
+async function _aiaFetchOne(uri, aia) {
+  // blockPrivateAddresses: the real transport refuses -- and pins -- a hostname that RESOLVES to a private /
+  // loopback / link-local address (the literal pre-check only catches an IP literal). An injected test transport
+  // ignores the flag; the DFS treats a blocked-address transport error as a silent skip like any fetch fault.
+  var res = await aia.transport({ method: "GET", url: uri, tls: aia.tls, timeout: aia.timeout, maxResponseBytes: aia.maxResponseBytes, blockPrivateAddresses: true });
+  res = res || {};
+  if (res.status !== 200) throw E("path/aia-status", "an AIA fetch returned HTTP " + res.status + " (only 200 is a cert source; no redirect following)");
+  var body = Buffer.isBuffer(res.body) ? res.body : Buffer.from(res.body == null ? "" : String(res.body), "latin1");
+  if (body.length === 0) throw E("path/aia-empty", "an AIA fetch returned an empty body");
+  // Belt for an INJECTED transport that ignores maxResponseBytes (the real transport streaming-aborts at the cap).
+  if (body.length > aia.maxResponseBytes) throw E("path/aia-too-large", "an AIA response exceeds the " + aia.maxResponseBytes + "-byte cap");
+  var headers = {};
+  Object.keys(res.headers || {}).forEach(function (k) { headers[k.toLowerCase()] = res.headers[k]; });
+  return _aiaParseBody(body, headers["content-type"], aia.maxCertsPerResponse);
+}
+
+// Discover issuer candidates for `current` from its AIA caIssuers URLs. Returns parsed candidate certs (coerced
+// like any pool cert). Bounded + fail-closed; ticks aia.fetchCounter (the total-budget throw) and mutates
+// aia.fetchedUrls (build-wide dedupe). A cert with no AIA, a malformed AIA, or no fetchable https caIssuers
+// URI simply yields no candidates (RFC 5280 sec. 4.2.2.1 AIA is advisory / non-critical).
+async function _fetchAiaIssuers(current, aia) {
+  var d = softDecode(current, OID.authorityInfoAccess);   // no / malformed AIA -> no fetch
+  if (!d || !d.value) return [];
+  // Collect DISTINCT, normalized, fetchable https URLs, deduping BEFORE the per-cert cap so a flood of duplicate
+  // (or fragment-variant) entries can never crowd out a usable later URL.
+  var uris = [];
+  var seenThisCert = new Set();
+  for (var i = 0; i < d.value.length; i++) {
+    var ad = d.value[i];
+    if (ad.accessMethod !== OID.caIssuers) continue;      // ONLY id-ad-caIssuers, never id-ad-ocsp
+    if (!ad.accessLocation || ad.accessLocation.tag !== 6) continue;   // ONLY a uniformResourceIdentifier [6]
+    // Parse the URI ONCE: the NORMALIZED href is both the dedupe key AND the exact URL handed to the transport.
+    var u;
+    try { u = new URL(ad.accessLocation.value); }
+    catch (_e) { continue; }                              // an unparseable URI -> skip (catch on its own line so the swallow gate can trace it)
+    if (u.protocol !== "https:") continue;                // https-only: no socket for http/ldap/ftp/file/mailto
+    if (_isBlockedAiaHost(u.hostname)) continue;          // SSRF: never fetch a private / loopback / link-local IP literal
+    // A DNS-NAME host's private RESOLUTION can only be blocked by a transport that filters the resolved address;
+    // with an UNGUARDED transport (an injected fn that does not vouch blocksPrivateAddresses) fail closed -- fetch
+    // IP literals only (already validated above), never a hostname whose resolved address we cannot verify.
+    if (net.isIP(u.hostname.replace(/^\[(.*)\]$/, "$1")) === 0 && !aia.transportGuardsAddresses) continue;
+    u.hash = "";                                          // the fragment is never sent on the wire -> not part of the request/dedupe identity
+    if (aia.fetchedUrls.has(u.href) || seenThisCert.has(u.href)) continue;   // dedupe (build-wide OR same-cert) on the normalized URL
+    if (seenThisCert.size >= aia.maxPerCert) break;       // per-cert DISTINCT-url cap, checked BEFORE appending so maxAiaPerCert:0 collects nothing (no fetch at all)
+    seenThisCert.add(u.href);
+    uris.push(u.href);
+  }
+  var out = [];
+  for (var k = 0; k < uris.length; k++) {
+    if (aia.fetchedUrls.has(uris[k])) continue;   // a same-cert normalization-equal duplicate
+    if (aia.fetches >= aia.maxFetches) break;     // total budget reached -> STOP fetching (a SILENT cap, never a throw that denies a buildable path)
+    aia.fetchedUrls.add(uris[k]);                 // mark BEFORE the fetch -> fetched at most once, even on failure
+    aia.fetches += 1;
+    var certs;
+    try { certs = await _aiaFetchOne(uris[k], aia); }
+    catch (_e2) { continue; }   // any fetch / parse fault is a skip; the DFS continues over the pool + other URLs
+    // Each response is already capped to maxCertsPerResponse by parseCertsOnly (per RESPONSE), so an earlier
+    // URL's bundle never consumes a later URL's allowance -- coerce every returned cert.
+    for (var c = 0; c < certs.length; c++) {
+      var parsed;
+      try { parsed = coerceCert(certs[c]); }
+      catch (_e3) { /* allow:swallow-unverified verified-unreachable: every cert here already passed the IDENTICAL x509.parse in _aiaParseBody (single-DER validates `body`; certs-only validates each via parseCertsOnly), so coerceCert re-parsing the same bytes cannot throw -- the guard stays as defence-in-depth */ continue; }
+      out.push(parsed);
+    }
+  }
+  return out;
+}
+
 /**
  * @primitive  pki.path.build
- * @signature  pki.path.build(leaf, opts) -> Promise<{ valid, path, trustAnchor, result, candidatesConsidered }>
+ * @signature  pki.path.build(leaf, opts) -> Promise<{ valid, path, trustAnchor, result, candidatesConsidered, aiaFetches }>
  * @since       0.3.7
  * @status      experimental
  * @spec        RFC 4158, RFC 5280
@@ -2176,8 +2328,16 @@ function scoreCandidate(cand, childAki, anchors, time) {
  * `validate` consumes (anchor-proximal first, leaf last, the anchor excluded). Fail-closed: bad
  * options throw `path/bad-input`; no chain to any anchor throws `path/no-path`; chains that
  * assemble but none validate return `{ valid:false }` with the best failing `validate` result;
- * the search bound throws `path/build-limit`. AIA caIssuers fetching is out of scope -- `build` is
- * offline (zero network); supply fetched issuers in `opts.candidates`.
+ * the search bound throws `path/build-limit`. By default `build` is OFFLINE (zero network) -- supply
+ * intermediates in `opts.candidates`. Set `opts.fetchAia: true` to opt in to fetching a MISSING intermediate
+ * from a certificate's Authority Information Access `caIssuers` URL (RFC 5280 sec. 4.2.2.1) over
+ * `pki.transport`: the fetch triggers only on a pool miss, every fetched certificate is UNTRUSTED pool material
+ * that still flows through `validate` when validation is on (never a trust anchor), and the whole surface is
+ * SSRF/amplification bounded -- https-only, a total fetch budget (a SILENT cap, never a throw that denies a
+ * buildable path), a per-cert URL cap, a build-wide URL dedupe, a response size + certificate-count cap, and no
+ * redirect following; every fetch fault is a silent skip. `aiaFetches` reports how many network GETs the build
+ * performed (`0` when `fetchAia` is off). NOTE: with `opts.validate:false` (pure-builder mode) a fetched cert is
+ * returned unvalidated, identical to a static candidate -- the "flows through validate" guarantee needs validation on.
  *
  * @opts  candidates             The untrusted candidate CA pool (array of DER/PEM/parsed certs; alias `intermediates`).
  * @opts  trustAnchors           The trust store (non-empty array of `{ name, publicKey, algorithm }` tuples or self-signed root certificates).
@@ -2185,6 +2345,13 @@ function scoreCandidate(cand, childAki, anchors, time) {
  * @opts  maxDepth               Chain-length depth cap (default `C.LIMITS.PATH_BUILD_MAX_DEPTH`).
  * @opts  maxCandidatesConsidered  Total-work cap on candidate expansions (default `C.LIMITS.PATH_BUILD_MAX_CANDIDATES`).
  * @opts  validate               `false` returns the ordered path without validating (pure-builder mode; default `true`).
+ * @opts  fetchAia               `true` opts in to AIA caIssuers network fetching of a missing intermediate (default `false` -- fully offline). Off unless set; when set, a fetch runs only on a pool miss for a non-anchor-adjacent cert, and (with validation on) every fetched cert still flows through `validate`.
+ * @opts  transport              The injectable transport seam (`fn(request) -> Promise<{ status, headers, body }>`); tests drive the fetch offline. With none, the default `pki.transport.https` is used, which fails closed unless `opts.tls` carries trust. SSRF: for a caIssuers URL with a DNS hostname, a custom transport is used ONLY if it declares `fn.blocksPrivateAddresses = true` -- vouching it refuses (and pins) a resolved private / loopback / link-local / special-use address, as the default transport does. Without that marker a DNS-name AIA URL is fail-closed (skipped) and only an IP-literal URL (validated up front) is fetched; set the marker on your transport when it filters resolved addresses.
+ * @opts  tls                    The TLS trust for the AIA HTTPS host (`{ anchors, useSystemStore, ... }`) -- DISTINCT from `opts.trustAnchors` (the PKI trust store the path validates against). The default transport refuses an unpinned server.
+ * @opts  maxAiaFetches          Total AIA network GET budget across the whole build (default `C.LIMITS.PATH_AIA_MAX_FETCHES`); on reaching it the builder stops fetching (a silent cap), never a throw -- a fetch bound never denies a path the pool could build.
+ * @opts  maxAiaPerCert          Cap on caIssuers URLs tried per certificate (default `C.LIMITS.PATH_AIA_MAX_PER_CERT`).
+ * @opts  aiaTimeout             Per-fetch timeout in ms, forwarded to the transport.
+ * @opts  maxResponseBytes       Per-fetch response size cap, forwarded to the transport (tightenable downward only).
  * @opts  (validate options)     Every `pki.path.validate` option (`requiredEku`, `revocationChecker`, `checkPurpose`, the initial policy inputs, ...) is forwarded unchanged.
  * @example
  *   var result = await pki.path.build(pemString, {
@@ -2212,6 +2379,11 @@ async function build(leaf, opts) {
   var pool;
   try { pool = poolInput.map(coerceCert); }
   catch (e) { throw E("path/bad-input", "build: a candidate certificate did not parse", e); }
+  // Byte-exact identities of every cert already in the shared pool, so an AIA-fetched duplicate (a mirror URL or a
+  // repeating CMS returning the same issuer) is appended AT MOST ONCE -- it otherwise inflates the pool, charging
+  // the candidate budget and the ceiling for each copy before the issuer is ever evaluated.
+  var poolDerKeys = new Set();
+  for (var pdk = 0; pdk < pool.length; pdk++) poolDerKeys.add(certDerKey(pool[pdk]));
 
   if (!Array.isArray(opts.trustAnchors) || opts.trustAnchors.length === 0) throw E("path/bad-input", "build: opts.trustAnchors must be a non-empty array of anchor tuples or root certificates");
   var anchors = opts.trustAnchors.map(toAnchor);
@@ -2235,10 +2407,55 @@ async function build(leaf, opts) {
   var maxConsidered = guard.limits.cap(opts.maxCandidatesConsidered, "build: opts.maxCandidatesConsidered", poolCeiling, { E: E, code: "path/bad-input", min: 1 });
   var doValidate = opts.validate !== false;
 
+  // AIA caIssuers fetching is OFF unless opts.fetchAia === true -- the default build is byte-identical to
+  // today's offline search (no transport constructed, no socket, no new path executed). When on, opts.transport
+  // is the injectable seam (tests drive it offline); with no injected transport the default https transport
+  // fails closed unless opts.tls carries an anchor / useSystemStore. opts.tls is the TLS trust for the AIA
+  // HTTPS host -- DISTINCT from opts.trustAnchors (the PKI trust store the built path validates against).
+  var aiaCtx = null;
+  if (opts.fetchAia === true) {
+    // Validate the AIA-specific options at CONFIG time (a caller typo is a path/bad-input throw, tier 1), not
+    // lazily inside the fetch where a bad transport / timeout would be caught as an ordinary fetch fault and
+    // silently degrade to path/no-path. A non-function transport can never be called; an injected transport gets
+    // a validated timeout (it may not cap the value itself).
+    if (opts.transport !== undefined && typeof opts.transport !== "function") {
+      throw E("path/bad-input", "build: opts.transport must be a transport function (request) -> Promise<{ status, headers, body }>");
+    }
+    // Validate aiaTimeout against the SAME bounds the built-in transport enforces (integer, 1..MAX_TIMEOUT) at
+    // CONFIG time, so a non-integer / over-ceiling value is a path/bad-input throw here rather than a transport
+    // rejection swallowed later as a fetch fault. guard.limits.cap is the exact primitive the transport applies.
+    if (opts.aiaTimeout !== undefined) {
+      guard.limits.cap(opts.aiaTimeout, "build: opts.aiaTimeout", 1, { E: E, code: "path/bad-input", min: 1, max: httpTransport.MAX_TIMEOUT });
+    }
+    var aiaTransport = opts.transport || httpTransport.https({ E: E, errPrefix: "path" });
+    aiaCtx = {
+      transport: aiaTransport,
+      // SSRF for a DNS-name AIA host needs resolution-time address filtering + pinning, which only a transport
+      // that ADVERTISES the capability performs (the built-in, or an injected one that sets blocksPrivateAddresses
+      // to vouch it filters). An injected fn(request) that ignores the flag is treated as UNGUARDED: a DNS-name AIA
+      // URL is then fail-closed (skipped) and only an IP literal (validated by the literal pre-check) is fetched.
+      transportGuardsAddresses: aiaTransport.blocksPrivateAddresses === true,
+      tls: opts.tls || {},
+      timeout: opts.aiaTimeout,               // validated above; the transport applies its own default + cap
+      // Default the AIA response cap BELOW the general HTTP ceiling (a caIssuers response is small); tighten
+      // downward only, never above HTTP_MAX_RESPONSE_BYTES.
+      maxResponseBytes: guard.limits.cap(opts.maxResponseBytes, "build: opts.maxResponseBytes", constants.LIMITS.PATH_AIA_MAX_RESPONSE_BYTES, { E: E, code: "path/bad-input", min: 1, max: constants.LIMITS.PATH_AIA_MAX_RESPONSE_BYTES }),
+      maxPerCert: guard.limits.cap(opts.maxAiaPerCert, "build: opts.maxAiaPerCert", constants.LIMITS.PATH_AIA_MAX_PER_CERT, { E: E, code: "path/bad-input", min: 0 }),
+      maxCertsPerResponse: constants.LIMITS.PATH_AIA_MAX_CERTS_PER_RESPONSE,
+      // The total fetch budget is a SILENT cap (stop initiating fetches when reached), NOT a throw: a bound on
+      // an ADVISORY fetch must never abort a build that the static pool could still complete. maxFetches may be
+      // 0 (fetchAia:true but no network -- identical to offline).
+      maxFetches: guard.limits.cap(opts.maxAiaFetches, "build: opts.maxAiaFetches", constants.LIMITS.PATH_AIA_MAX_FETCHES, { E: E, code: "path/bad-input", min: 0 }),
+      fetchedUrls: new Set(),
+      fetches: 0,
+    };
+  }
+
   // The build-specific options are consumed here; every remaining validate
   // option is forwarded unchanged to the interleaved validate call. Object.keys
   // enumerates only own enumerable properties, so no prototype-pollution belt.
-  var BUILD_ONLY_OPT = { candidates: 1, intermediates: 1, trustAnchors: 1, maxDepth: 1, maxCandidatesConsidered: 1, validate: 1 };
+  var BUILD_ONLY_OPT = { candidates: 1, intermediates: 1, trustAnchors: 1, maxDepth: 1, maxCandidatesConsidered: 1, validate: 1,
+    fetchAia: 1, transport: 1, tls: 1, maxAiaFetches: 1, maxAiaPerCert: 1, aiaTimeout: 1, maxResponseBytes: 1 };
   var forwarded = {};
   Object.keys(opts).forEach(function (k) { if (!BUILD_ONLY_OPT[k]) forwarded[k] = opts[k]; });
   function validateOpts(anchor) {
@@ -2266,7 +2483,61 @@ async function build(leaf, opts) {
   // Caps are enforced before every expansion; a candidate whose (subject, SAN,
   // public key) tuple is already on the chain is a loop and is pruned.
   var stack = [{ chain: [leafCert], hop: 0, keys: new Set([identityKey(leafCert)]) }];
-  while (stack.length && !success) {
+  // AIA fetch frames are DEFERRED into this queue and drained ONLY when `stack` is empty -- i.e. once the ENTIRE
+  // local (static-pool) search has failed. This enforces RFC 4158 sec. 7.2 "local before remote" GLOBALLY across
+  // the whole search, not per-branch: a build the static pool can complete never issues a network request, and a
+  // higher-priority local dead-end can never fetch ahead of a still-unexplored lower-priority static sibling.
+  // Drained DEEPEST-first, and among equal depth EARLIEST-deferred (= highest DFS priority) first: the actual
+  // dead end (a missing deeper hop) is fetched before an ancestor whose issuer the pool ALREADY supplies (so a
+  // scarce budget is never spent re-retrieving a locally-resolved hop), and a higher-scoring sibling's AIA is
+  // tried before a lower-scoring one (a plain LIFO pop would reverse sibling priority and let a stale low-priority
+  // branch's dead URL waste a tight budget before the preferred branch).
+  var deferredAia = [];
+  var deferSeq = 0;   // monotonic deferral order (DFS priority): the drain tie-breaks same-depth frames by it
+  while (!success) {
+    if (!stack.length) {
+      // The local search is drained. Begin / continue the fetch phase: pick a deferred frame with PENDING WORK --
+      // one that has NOT yet fetched, OR whose poolMark trails the shared pool (a SIBLING branch fetched a cert
+      // SINCE this frame last ran, which may complete it). A drained frame is NOT discarded: a later sibling's
+      // fetch can add the very issuer an earlier, already-run branch needed, so every frame stays eligible for
+      // pool growth until it has fetched AND seen the whole pool. Among eligible frames pick the deepest, then the
+      // earliest-deferred (highest DFS priority). No eligible frame -> the whole search is exhausted.
+      var _bi = -1;
+      for (var _di = 0; _di < deferredAia.length; _di++) {
+        var _f = deferredAia[_di];
+        if (_f.fetched && _f.poolMark >= pool.length) continue;   // nothing left to fetch or to re-expand against
+        if (_bi === -1) { _bi = _di; continue; }
+        var _bf = deferredAia[_bi];
+        if (_f.hop > _bf.hop || (_f.hop === _bf.hop && _f.seq < _bf.seq)) _bi = _di;
+      }
+      if (_bi === -1) break;   // no deferred frame can make further progress
+      var fb = deferredAia[_bi];   // NOT removed: it stays eligible for certs a later sibling fetch adds
+      var fbCur = fb.chain[0];
+      if (!fb.fetched && aiaCtx && aiaCtx.fetches < aiaCtx.maxFetches) {
+        var fetched = await _fetchAiaIssuers(fbCur, aiaCtx);   // append newly-fetched issuer(s) to the SHARED pool
+        for (var fj = 0; fj < fetched.length; fj++) {
+          var fdk = certDerKey(fetched[fj]);
+          if (poolDerKeys.has(fdk)) continue;                  // a byte-duplicate (mirror URL / repeating CMS) -> add once, never re-charge the budget/ceiling
+          poolDerKeys.add(fdk);
+          if (pool.length < poolCeiling) pool.push(fetched[fj]);
+        }
+      }
+      fb.fetched = true;   // the fetch attempt is done (or budget-skipped); the frame stays eligible for FUTURE pool growth
+      // Re-expand fb against every pool cert added SINCE it last ran -- its OWN just-fetched certs AND any a SIBLING
+      // branch fetched into the shared pool. The pool-index mark skips certs fb already scored (no redundant work);
+      // advancing it means fb re-scores only certs added even later. This runs even when the budget is exhausted, so
+      // a budget-capped frame still benefits from a sibling fetch.
+      var fbAki = childAkiKeyId(fbCur);
+      var fbScored = [];
+      for (var pj = fb.poolMark; pj < pool.length; pj++) {
+        if (nameMatchSoft(pool[pj].subject.rdns, fbCur.issuer.rdns)) {
+          fbScored.push({ cand: pool[pj], score: scoreCandidate(pool[pj], fbAki, anchors, opts.time) });
+        }
+      }
+      fb.poolMark = pool.length;
+      considered += _pushCandidates(fb, fbScored, stack, counter);
+      continue;
+    }
     var frame = stack.pop();
     var current = frame.chain[0];
 
@@ -2290,28 +2561,32 @@ async function build(leaf, opts) {
         scored.push({ cand: pool[pi], score: scoreCandidate(pool[pi], childAki, anchors, opts.time) });
       }
     }
-    // Ascending sort -> push lowest priority first so the highest is on top.
-    scored.sort(function (a, bb) { return a.score - bb.score; });
-    for (var ci = 0; ci < scored.length; ci++) {
-      counter.tick();          // breadth / total-work cap -> throws path/build-limit
-      considered += 1;
-      var cand = scored[ci].cand;
-      var candKey = identityKey(cand);
-      if (frame.keys.has(candKey)) continue;   // the (subject,SAN,key) tuple is already on this branch -> a loop, prune
-      var childKeys = new Set(frame.keys);
-      childKeys.add(candKey);
-      stack.push({ chain: [cand].concat(frame.chain), hop: frame.hop + 1, keys: childKeys });
+    // Opt-in AIA caIssuers fetch as a FALLBACK: DEFER it (drained above only after the ENTIRE local search is
+    // exhausted, RFC 4158 sec. 7.2 "local before remote") rather than pushing it onto the stack, so it can never
+    // run ahead of an unexplored local sibling -- a build the static pool can complete never fetches. It is gated
+    // on `success` being unset (guaranteed by the continue above), NOT on the issuer name failing to match an
+    // anchor: an issuer DN that matches an anchor whose KEY did not validate this chain (a CA key rollover -- the
+    // real same-DN, different-key intermediate is missing and reachable only via AIA) still needs the fetch.
+    if (aiaCtx && frame.hop < maxDepth && aiaCtx.fetches < aiaCtx.maxFetches) {
+      // poolMark: the shared-pool length now, so the drain re-expands this frame only against certs added LATER
+      // (its own fetch + any sibling branch's fetch), never re-scoring the static pool it expands against below.
+      // seq: the deferral order, so the drain can tie-break same-depth frames by DFS priority (earliest first).
+      // fetched: false until this frame's own AIA fetch runs; it then stays eligible for later sibling pool growth.
+      deferredAia.push({ chain: frame.chain, hop: frame.hop, keys: frame.keys, poolMark: pool.length, seq: deferSeq, fetched: false });
+      deferSeq += 1;
     }
+    considered += _pushCandidates(frame, scored, stack, counter);
   }
 
+  var aiaFetches = aiaCtx ? aiaCtx.fetches : 0;   // the count of AIA caIssuers network GETs this build performed (0 when opts.fetchAia is off)
   if (success) {
-    if (doValidate) return { valid: true, path: success.path, trustAnchor: success.trustAnchor, result: success.result, candidatesConsidered: considered };
-    return { path: success.path, trustAnchor: success.trustAnchor, candidatesConsidered: considered };
+    if (doValidate) return { valid: true, path: success.path, trustAnchor: success.trustAnchor, result: success.result, candidatesConsidered: considered, aiaFetches: aiaFetches };
+    return { path: success.path, trustAnchor: success.trustAnchor, candidatesConsidered: considered, aiaFetches: aiaFetches };
   }
   if (anyChainAssembled) {
     // Chains reached an anchor but none validated -> the soft verdict carrying
     // the best failing validate result (parity with validate; never a throw).
-    return { valid: false, path: bestFail.path, trustAnchor: bestFail.trustAnchor, result: bestFail.result, candidatesConsidered: considered };
+    return { valid: false, path: bestFail.path, trustAnchor: bestFail.trustAnchor, result: bestFail.result, candidatesConsidered: considered, aiaFetches: aiaFetches };
   }
   // No chain to any configured anchor could even be assembled -- a permanent
   // structural verdict (name/key chaining dead-ended before the trust store).

package/lib/schema-cms.js

@@ -49,6 +49,8 @@ var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var oid = require("./oid");
 var frameworkError = require("./framework-error");
+var schemaX509 = require("./schema-x509");
+var schemaCrl = require("./schema-crl");
 
 var CmsError = frameworkError.CmsError;
 var PemError = frameworkError.PemError;
@@ -1225,11 +1227,54 @@ function assertAttachedCiphertext(eci, E, code, label) {
   return eci;
 }
 
+// The "certs-only" Simple PKI Response (RFC 5272 sec. 4.1): a degenerate SignedData carrying certificates (and
+// optionally CRLs) but NO signed content -- id-data with no eContent and EMPTY signerInfos. It is how RFC 7030
+// EST returns a CA chain (/cacerts) and how an RFC 5280 sec. 4.2.2.1 AIA caIssuers URL may serve issuers
+// (application/pkcs7-mime). Returns { certificates: [raw DER], crls: [raw DER] } -- the RAW bytes only; the
+// caller validates each cert/CRL for its own purpose (EST re-parses; path building runs each through validate).
+// Shared so the EST client and the path builder decode an identical shape; the caller passes its typed-error
+// factory `E(code, msg, cause)` and domain `prefix` so a fault surfaces the caller's own `prefix/*` code.
+// `maxCerts` (optional) caps how many certificates / CRLs are validated + returned, BEFORE the per-element
+// X.509 / CRL parse -- so an untrusted source (an AIA caIssuers URL) cannot force tens of thousands of parses
+// with one in-cap-bytes bundle; the EST client passes no cap (a /cacerts chain is small and fully returned).
+function parseCertsOnly(der, E, prefix, maxCerts) {
+  var r;
+  try { r = parse(der); }
+  catch (e) { throw E(prefix + "/bad-response", "a certs-only response did not decode as CMS: " + ((e && e.message) || String(e)), e); }
+  if (r.contentTypeName !== "signedData") throw E(prefix + "/not-certs-only", "a certs-only response must be a CMS SignedData (RFC 5272 sec. 4.1)");
+  if (r.encapContentInfo.eContentType !== OID_DATA || r.encapContentInfo.eContent !== null) {
+    throw E(prefix + "/not-certs-only", "a certs-only Simple PKI Response must carry id-data with no eContent (RFC 5272 sec. 4.1)");
+  }
+  if (r.signerInfos.length !== 0) throw E(prefix + "/not-certs-only", "a certs-only Simple PKI Response must have empty signerInfos (RFC 5272 sec. 4.1)");
+  if (!r.certificates || r.certificates.length === 0) throw E(prefix + "/no-certificates", "a certs-only response must contain at least one certificate (RFC 5272 sec. 4.1)");
+  // Cap BEFORE the per-certificate X.509 parse: bound parse work by count, not only by the decoded byte size.
+  var certs = (maxCerts != null && r.certificates.length > maxCerts) ? r.certificates.slice(0, maxCerts) : r.certificates;
+  for (var i = 0; i < certs.length; i++) {
+    // A universal-SEQUENCE CertificateChoice must be a well-formed X.509 Certificate, not merely any SEQUENCE;
+    // a tagged CertificateChoices alternative (attribute cert / other) is not a plain certificate.
+    if (certs[i].tagClass !== "universal") throw E(prefix + "/bad-certificate-choice", "a certs-only response exchanges plain X.509 certificates; a tagged CertificateChoices alternative is not permitted (RFC 5272)");
+    try { schemaX509.parse(certs[i].bytes); }
+    catch (e) { throw E(prefix + "/bad-certificate", "a certs-only response carried a non-certificate in its certificates field (RFC 5272 sec. 4.1)", e); }
+  }
+  var allCrls = r.crls || [];
+  var crls = (maxCerts != null && allCrls.length > maxCerts) ? allCrls.slice(0, maxCerts) : allCrls;
+  for (var j = 0; j < crls.length; j++) {
+    if (crls[j].tagClass !== "universal") throw E(prefix + "/bad-crl", "a certs-only response CRL must be a plain X.509 CertificateList, not a tagged otherRevInfo alternative (RFC 5652 sec. 10.2.1)");
+    try { schemaCrl.parse(crls[j].bytes); }
+    catch (e) { throw E(prefix + "/bad-crl", "a certs-only response carried a non-CRL in its crls field", e); }
+  }
+  return {
+    certificates: certs.map(function (c) { return c.bytes; }),
+    crls: crls.map(function (c) { return c.bytes; }),
+  };
+}
+
 module.exports = {
   parse: parse,
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matches: matches,
+  parseCertsOnly: parseCertsOnly,
   walkEnvelopedData: walkEnvelopedData,
   walkSignedData: walkSignedData,
   walkEncryptedData: walkEncryptedData,

package/lib/schema-pkcs12.js

@@ -73,11 +73,6 @@ var OID_X509_CRL = oid.byName("x509CRL");
 var OID_FRIENDLY_NAME = oid.byName("friendlyName");
 var OID_LOCAL_KEY_ID = oid.byName("localKeyId");
 var OID_PBMAC1 = oid.byName("pbmac1");
-// The PBKDF2-params prf DEFAULT is algid-hmacWithSHA1 -- hmacWithSHA1 with NULL
-// parameters (RFC 8018 sec. 5.2) -- needed for the encoded-DEFAULT rejection below.
-var OID_HMAC_SHA1 = oid.byName("hmacWithSHA1");
-var DER_NULL = asn1.build.nullValue();
-
 // DigestInfo ::= SEQUENCE { digestAlgorithm AlgorithmIdentifier, digest OCTET STRING }.
 var DIGEST_INFO = schema.seq([
   schema.field("digestAlgorithm", pkix.algorithmIdentifier(NS)),
@@ -89,67 +84,11 @@ var DIGEST_INFO = schema.seq([
   },
 });
 
-// PBKDF2-params (RFC 8018 sec. 5.2), constrained to the RFC 9579 PBMAC1 profile:
-// the salt MUST use the specified (OCTET STRING) choice and keyLength MUST be
-// present (sec. 4.b / sec. 5 -- a MacData consumer cannot infer the MAC key size).
-var PBKDF2_PARAMS = schema.seq([
-  schema.field("salt", schema.octetString()),
-  schema.field("iterationCount", schema.integerLeaf()),
-  schema.optional("keyLength", schema.integerLeaf(), { whenUniversal: [TAGS.INTEGER] }),
-  schema.optional("prf", pkix.algorithmIdentifier(NS), { whenUniversal: [TAGS.SEQUENCE] }),
-], {
-  assert: "sequence", code: "pkcs12/bad-mac-data", what: "PBKDF2-params",
-  build: function (m, ctx) {
-    if (!m.fields.keyLength.present) {
-      throw ctx.E("pkcs12/bad-mac-data", "PBMAC1 PBKDF2-params must carry keyLength (RFC 9579 sec. 5)");
-    }
-    // guard.range.positiveInt31 bounds + narrows each counter atomically -- a
-    // value past the bound would round silently and hand a verifier wrong inputs.
-    var iterationCount = guard.range.positiveInt31(m.fields.iterationCount.value, ctx.E, "pkcs12/bad-mac-data", "PBKDF2 iterationCount");
-    var keyLength = guard.range.positiveInt31(m.fields.keyLength.value, ctx.E, "pkcs12/bad-mac-data", "PBKDF2 keyLength");
-    var prf = m.fields.prf.present ? m.fields.prf.value.result : null;
-    // X.690 sec. 11.5 -- a DEFAULT-valued component must be omitted from a DER
-    // encoding, and the prf DEFAULT is algid-hmacWithSHA1: hmacWithSHA1 with
-    // NULL parameters (RFC 8018 sec. 5.2). An explicit prf byte-equal to that
-    // default is non-canonical and rejects -- the structured-value analogue of
-    // the MacData iterations rule below. hmacWithSHA1 with ABSENT parameters
-    // is a different value from the NULL-parameters default and decodes.
-    if (prf && prf.oid === OID_HMAC_SHA1 && prf.parameters !== null && prf.parameters.equals(DER_NULL)) {
-      throw ctx.E("pkcs12/bad-mac-data", "a PBKDF2 prf equal to its DEFAULT algid-hmacWithSHA1 must be omitted (X.690 sec. 11.5, RFC 8018 sec. 5.2)");
-    }
-    return {
-      salt: m.fields.salt.value,
-      iterationCount: iterationCount,
-      keyLength: keyLength,
-      prfOid: prf ? prf.oid : OID_HMAC_SHA1,
-      prfName: prf ? prf.name : "hmacWithSHA1",
-    };
-  },
-});
-
-// PBMAC1-params ::= SEQUENCE { keyDerivationFunc AlgorithmIdentifier{PBKDF2},
-// messageAuthScheme AlgorithmIdentifier } (RFC 8018 sec. A.5 / RFC 9579 sec. 4).
-var PBMAC1_PARAMS = schema.seq([
-  schema.field("keyDerivationFunc", schema.seq([
-    schema.field("algorithm", schema.oidLeaf()),
-    schema.field("parameters", PBKDF2_PARAMS),
-  ], { assert: "sequence", arity: { exact: 2 }, code: "pkcs12/bad-mac-data", what: "PBMAC1 keyDerivationFunc" })),
-  schema.field("messageAuthScheme", pkix.algorithmIdentifier(NS)),
-], {
-  assert: "sequence", arity: { exact: 2 }, code: "pkcs12/bad-mac-data", what: "PBMAC1-params",
-  build: function (m, ctx) {
-    var kdf = m.fields.keyDerivationFunc.value;
-    if (kdf.fields.algorithm.value !== oid.byName("pbkdf2")) {
-      throw ctx.E("pkcs12/bad-mac-data", "PBMAC1 keyDerivationFunc must be PBKDF2 (RFC 9579 sec. 4)");
-    }
-    var scheme = m.fields.messageAuthScheme.value.result;
-    return {
-      kdf: kdf.fields.parameters.value.result,
-      schemeOid: scheme.oid,
-      schemeName: scheme.name,
-    };
-  },
-});
+// PBKDF2-params + PBMAC1-params (RFC 8018 sec. 5.2 / App. A.5, RFC 9579 sec. 4) constrained to the PBMAC1
+// profile -- keyLength MUST be present, the prf DEFAULT is enforced non-canonical. Shared with CMP PBMAC1
+// protection verification, so the reader lives once in schema-pkix (ns-parameterized) rather than a second
+// copy per format; composed here with the pkcs12 namespace so it emits pkcs12/bad-mac-data.
+var PBMAC1_PARAMS = pkix.pbmac1Params(NS);
 
 // MacData ::= SEQUENCE { mac DigestInfo, macSalt OCTET STRING,
 //                        iterations INTEGER DEFAULT 1 }.