@blamejs/pki 0.4.1 → 0.4.3

package/lib/schema-c509.js

@@ -257,22 +257,21 @@ function _assertAttrValue(rdn) {
   }
 }
 
-function _name509(node, isSubject) {
+function _name509(node, isSubject, isNative) {
   if (!isSubject && node.majorType === 7 && node.ai === 22) return null;   // issuer == subject (self-signed)
   // A bare SpecialText (not an array) is a single commonName attribute (attributeType == +1).
   if (node.majorType === 3 || node.majorType === 2 || node.majorType === 6) {
     var sv = _specialText(node);
     // The bare form is a single commonName -- hold its value to the SAME rules the array form applies, so a
     // natively-signed certificate (which never reconstructs) cannot carry a value the reconstruction would refuse.
-    if (sv.eui64) {
-      var euiRdn = { type: "commonName", eui64: sv.eui64 };
-      _assertAttrValue(euiRdn);
-      return { rdns: [euiRdn], eui64: sv.eui64, dn: "CN=" + _macToEui64String(sv.eui64) };
-    }
+    // A tag-48 MAC renders to a fixed 17-character EUI-64 string that satisfies every value rule by
+    // construction, and _reconAttrValue short-circuits on eui64 before any of them -- so asserting here would
+    // be a no-op. The rules bind on the TEXT forms below.
+    if (sv.eui64) return { rdns: [{ type: "commonName", eui64: sv.eui64 }], eui64: sv.eui64, dn: "CN=" + _macToEui64String(sv.eui64) };
     var val = sv.text !== undefined ? sv.text : sv.hex;
     var bareRdn = { type: "commonName", value: val };
     _assertAttrValue(bareRdn);
-    return { rdns: [bareRdn], dn: "CN=" + val };
+    return { rdns: [bareRdn], dn: "CN=" + guard.name.escapeDnValue(val) };
   }
   if (node.majorType !== 4) throw _err("c509/bad-name", "a C509 Name must be null, a SpecialText, or an array of RDN attributes");
   var rdns = [];
@@ -281,6 +280,10 @@ function _name509(node, isSubject) {
   // Each RDN attribute is an (attributeType, attributeValue) pair; an odd-length array is a dangling
   // attribute type with no value -- reject rather than silently drop the trailing element.
   if (kids.length % 2 !== 0) throw _err("c509/bad-name", "a C509 Name array must be attribute-type/value pairs (dangling attribute type)");
+  // RFC 5280 sec. 4.1.2.4 -- the issuer MUST be a non-empty distinguished name (only the SUBJECT may be empty,
+  // for the subjectAltName case). An empty issuer array would reconstruct a certificate this toolkit's OWN
+  // x509.parse refuses to load (x509/bad-issuer), so the codec must not produce one.
+  if (kids.length === 0 && !isSubject) throw _err("c509/bad-name", "the issuer Name must not be empty (RFC 5280 sec. 4.1.2.4)");
   for (var i = 0; i + 1 < kids.length; i += 2) {
     // The attributeType slot must be a CBOR integer (major type 0/1). Guard the major type BEFORE the read
     // so a non-integer type slot fails in this module's own domain (c509/bad-name), matching the value slot,
@@ -289,6 +292,11 @@ function _name509(node, isSubject) {
     // Identifier issuer, cRLDistributionPoints cRLIssuer, nameConstraints subtree base) and the top-level Name.
     if (kids[i].majorType !== 0 && kids[i].majorType !== 1) throw _err("c509/bad-name", "a C509 Name attribute type must be a CBOR integer");
     var ti = Number(cbor.read.int(kids[i]));
+    // draft sec. 3.1.4: "in natively signed C509 certificates all CBOR ints SHALL be non-negative." The sign
+    // exists ONLY to reproduce the string type of an original X.509 DER, which a native certificate does not
+    // have -- so a negative attributeType there is an encoding no conformant producer emits, and accepting it
+    // would let this parser read a natively-signed name a conformant peer must reject.
+    if (isNative && ti < 0) throw _err("c509/bad-name", "a natively signed C509 Name attribute type integer must be non-negative (draft sec. 3.1.4), got " + ti);
     var tname = ATTR_BY_INT[Math.abs(ti)];
     if (tname === undefined) throw _err("c509/bad-name", "attribute type integer " + ti + " has no C509 registry row");
     var v = _specialText(kids[i + 1]);
@@ -300,10 +308,14 @@ function _name509(node, isSubject) {
     var rdn = { type: tname, value: vv, printable: ti < 0 };
     _assertAttrValue(rdn);
     rdns.push(rdn);
-    parts.push(_shortName(tname) + "=" + vv);
+    parts.push(_shortName(tname) + "=" + guard.name.escapeDnValue(vv));
   }
   return { rdns: rdns, dn: parts.join(",") };
 }
+// The rendered dn is an RFC 4514 string, so every VALUE is escaped through the shared guard the rest of the
+// toolkit renders names with. Raw concatenation would let a single attribute whose value contains a comma
+// render identically to a genuine multi-RDN name (a spoofable identity string, and the ONLY name surface a
+// natively signed certificate has, since it never reconstructs DER), and would carry control bytes into logs.
 function _shortName(n) { return n === "commonName" ? "CN" : n === "countryName" ? "C" : n === "organizationName" ? "O" : n === "organizationalUnitName" ? "OU" : n === "localityName" ? "L" : n === "stateOrProvinceName" ? "ST" : n; }
 
 // ---- compact per-extension value codec (draft-20 sec. 3.3) -------------------
@@ -392,9 +404,9 @@ function _namedBitsFromContent(bytes, unusedBits) {
 
 // One C509 (int, value) general name -> one DER GeneralName TLV. `ipMode` (name-constraints subtree base)
 // only changes the iPAddress arm: SAN is a bare 4/16-octet address, a subtree base is the RFC 9549 form.
-function _generalNameToDer(intVal, valueNode, ipMode) {
+function _generalNameToDer(intVal, valueNode, ipMode, isNative) {
   if (intVal === 1 || intVal === 2 || intVal === 6) return b.contextPrimitive(intVal, _ia5Bytes(valueNode, intVal));   // IMPLICIT IA5String
-  if (intVal === 4) return b.explicit(4, _reconName(_name509(valueNode, true)));                                       // directoryName [4] EXPLICIT Name
+  if (intVal === 4) return b.explicit(4, _reconName(_name509(valueNode, true, isNative)));                                       // directoryName [4] EXPLICIT Name
   if (intVal === 7) return b.contextPrimitive(7, ipMode ? _ncIpToDer(valueNode) : _sanIpBytes(valueNode));             // iPAddress [7] IMPLICIT OCTET STRING
   if (intVal === 8) return b.contextPrimitive(8, asn1.encodeOidContent(_oidName(valueNode, "c509/bad-extensions", "a registeredID [8]").oid));  // registeredID [8] IMPLICIT OID
   if (intVal === 0 || intVal === -1 || intVal === -2 || intVal === -3) return _otherNameToDer(valueNode, intVal);      // otherName [0]
@@ -420,12 +432,12 @@ function _generalNameFromDer(gn, ipMode) {
 // them: a universal SEQUENCE for SAN/IAN, an implicit [n] for AKI issuer / DP cRLIssuer). These are always
 // SAN-form (the RFC 9549 subtree-base iPAddress form is name-constraints-only and routes through
 // _subtreesToDer / _subtreesFromDer, which call the singular codec with ipMode directly).
-function _generalNamesToDer(node) {
+function _generalNamesToDer(node, isNative) {
   if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a GeneralNames value must be a CBOR array");
   var kids = node.children;
   if (kids.length === 0 || kids.length % 2 !== 0) throw _err("c509/bad-extensions", "a GeneralNames array must be non-empty (int, value) pairs (sec. 3.3)");
   var out = [];
-  for (var i = 0; i + 1 < kids.length; i += 2) out.push(_generalNameToDer(Number(_cborIntVal(kids[i], "a GeneralName type")), kids[i + 1], false));
+  for (var i = 0; i + 1 < kids.length; i += 2) out.push(_generalNameToDer(Number(_cborIntVal(kids[i], "a GeneralName type")), kids[i + 1], false, isNative));
   return out;
 }
 // The inverse: a list of DER GeneralName nodes -> the flat CBOR items, or null if ANY member is not
@@ -546,12 +558,12 @@ function _ncIpFromDer(buf) {
 // GeneralSubtrees = [ + GeneralName ] (the flat int/value array) <-> the concatenated GeneralSubtree
 // SEQUENCEs (RFC 5280 sec. 4.2.1.10: SEQUENCE { base, minimum [0] DEFAULT 0, maximum [1] OPTIONAL }); the
 // C509 profile omits minimum/maximum, so each GeneralSubtree is base-only.
-function _subtreesToDer(node) {
+function _subtreesToDer(node, isNative) {
   if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a GeneralSubtrees value must be a CBOR array");
   var kids = node.children;
   if (kids.length === 0 || kids.length % 2 !== 0) throw _err("c509/bad-extensions", "a GeneralSubtrees array must be non-empty (int, value) pairs");
   var out = [];
-  for (var i = 0; i + 1 < kids.length; i += 2) out.push(b.sequence([_generalNameToDer(Number(_cborIntVal(kids[i], "a GeneralSubtree base type")), kids[i + 1], true)]));
+  for (var i = 0; i + 1 < kids.length; i += 2) out.push(b.sequence([_generalNameToDer(Number(_cborIntVal(kids[i], "a GeneralSubtree base type")), kids[i + 1], true, isNative)]));
   return Buffer.concat(out);
 }
 function _subtreesFromDer(subtreeNodes) {
@@ -659,7 +671,7 @@ function _qualifierFromDer(pq) {
 // One CBOR DistributionPointName [ fullName, reasons, cRLIssuer ] -> one DER DistributionPoint SEQUENCE.
 // distributionPoint [0] is EXPLICIT (it wraps the DistributionPointName CHOICE); fullName [0], reasons [1],
 // cRLIssuer [2] are IMPLICIT (RFC 5280 sec. 4.2.1.13) -- mixing these is the classic byte-exactness trap.
-function _dpToDer(dpNode) {
+function _dpToDer(dpNode, isNative) {
   if (dpNode.majorType !== 4 || !dpNode.children || dpNode.children.length !== 3) throw _err("c509/bad-extensions", "a DistributionPoint must be a CBOR [ fullName, reasons, cRLIssuer ] array");
   var fullName = dpNode.children[0], reasons = dpNode.children[1], crlIssuer = dpNode.children[2];
   var uris;
@@ -670,7 +682,7 @@ function _dpToDer(dpNode) {
   } else throw _err("c509/bad-extensions", "a DistributionPoint fullName must be a URI text or an array of URIs");
   var fields = [b.explicit(0, b.contextConstructed(0, Buffer.concat(uris)))];   // distributionPoint [0] EXPLICIT { fullName [0] IMPLICIT GeneralNames }
   if (!_isCborNull(reasons)) fields.push(_reasonsBitsToDer(Number(_cborUint(reasons, "cRLDistributionPoints reasons"))));
-  if (!_isCborNull(crlIssuer)) fields.push(b.contextConstructed(2, b.explicit(4, _reconName(_name509(crlIssuer, true)))));   // cRLIssuer [2] { [4] directoryName }
+  if (!_isCborNull(crlIssuer)) fields.push(b.contextConstructed(2, b.explicit(4, _reconName(_name509(crlIssuer, true, isNative)))));   // cRLIssuer [2] { [4] directoryName }
   return b.sequence(fields);
 }
 // One DER DistributionPoint SEQUENCE -> the pieces for the CBOR DistributionPointName, or null when the DP
@@ -717,7 +729,7 @@ function _dpFromDer(dp) {
 
 // Decode a compact extension value (a decoded CBOR node) to the DER extnValue inner content. Fails closed
 // (c509/bad-extensions) on a CBOR shape the named extension does not define.
-function _extValueToDer(name, node) {
+function _extValueToDer(name, node, isNative) {
   switch (name) {
     case "subjectKeyIdentifier":   // KeyIdentifier = bytes -> OCTET STRING(keyid)
       if (node.majorType !== 2) throw _err("c509/bad-extensions", "a subjectKeyIdentifier value must be a CBOR byte string");
@@ -737,7 +749,7 @@ function _extValueToDer(name, node) {
         if (node.children[0].majorType !== 2) throw _err("c509/bad-extensions", "an authorityKeyIdentifier keyIdentifier must be a CBOR byte string");
         return b.sequence([
           b.contextPrimitive(0, node.children[0].content),                                           // keyIdentifier [0] IMPLICIT OCTET STRING
-          b.contextConstructed(1, Buffer.concat(_generalNamesToDer(node.children[1]))),       // authorityCertIssuer [1] IMPLICIT GeneralNames
+          b.contextConstructed(1, Buffer.concat(_generalNamesToDer(node.children[1], isNative))),       // authorityCertIssuer [1] IMPLICIT GeneralNames
           b.contextPrimitive(2, _serialIntContent(node.children[2])),                                // authorityCertSerialNumber [2] IMPLICIT INTEGER
         ]);
       }
@@ -764,12 +776,12 @@ function _extValueToDer(name, node) {
     case "subjectAltName":
     case "issuerAltName":          // SubjectAltName = GeneralNames / text (exactly one dNSName -> bare text)
       if (node.majorType === 3) return b.sequence([b.contextPrimitive(2, _ia5Bytes(node, 2))]);
-      return b.sequence(_generalNamesToDer(node));
+      return b.sequence(_generalNamesToDer(node, isNative));
     case "nameConstraints": {      // [ permittedSubtrees / null, excludedSubtrees / null ]
       if (node.majorType !== 4 || !node.children || node.children.length !== 2) throw _err("c509/bad-extensions", "a nameConstraints value must be a 2-element CBOR array [ permitted, excluded ] (sec. 3.3)");
       var ncFields = [];
-      if (!_isCborNull(node.children[0])) ncFields.push(b.contextConstructed(0, _subtreesToDer(node.children[0])));   // permittedSubtrees [0]
-      if (!_isCborNull(node.children[1])) ncFields.push(b.contextConstructed(1, _subtreesToDer(node.children[1])));   // excludedSubtrees [1]
+      if (!_isCborNull(node.children[0])) ncFields.push(b.contextConstructed(0, _subtreesToDer(node.children[0], isNative)));   // permittedSubtrees [0]
+      if (!_isCborNull(node.children[1])) ncFields.push(b.contextConstructed(1, _subtreesToDer(node.children[1], isNative)));   // excludedSubtrees [1]
       if (ncFields.length === 0) throw _err("c509/bad-extensions", "nameConstraints must contain permittedSubtrees or excludedSubtrees (RFC 5280 sec. 4.2.1.10)");
       return b.sequence(ncFields);
     }
@@ -786,7 +798,7 @@ function _extValueToDer(name, node) {
     case "freshestCRL":            // [ + DistributionPointName ] / text (one DP, one-URI fullName -> bare text)
       if (node.majorType === 3) return b.sequence([b.sequence([b.explicit(0, b.contextConstructed(0, b.contextPrimitive(6, _ia5Bytes(node, 6))))])]);
       if (node.majorType !== 4 || !node.children || node.children.length < 1) throw _err("c509/bad-extensions", "a " + name + " value must be a CBOR array of DistributionPoints or a bare URI text (sec. 3.3)");
-      return b.sequence(node.children.map(function (dp) { return _dpToDer(dp); }));
+      return b.sequence(node.children.map(function (dp) { return _dpToDer(dp, isNative); }));
     case "certificatePolicies": {   // [ pid, [ *(qid, qtext) ], ... ] -> SEQUENCE OF PolicyInformation
       if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a certificatePolicies value must be a CBOR array");
       var cpKids = node.children;
@@ -834,7 +846,7 @@ function _extValueToDer(name, node) {
       return b.sequence(pcFields);   // positional slot -> tag makes [0] < [1] unique + ascending by construction
     }
     case "subjectDirectoryAttributes":   // [ type, values, type, values, ... ] -> SEQUENCE OF Attribute (sec. 3.3)
-      return _sdaToDer(node);
+      return _sdaToDer(node, isNative);
     default:
       throw _err("c509/bad-extensions", "extension " + name + " has no compact value decoder");
   }
@@ -1032,8 +1044,8 @@ function _extValueFromDer(name, der) {
 // Every universal PRIMITIVE tag whose content this toolkit can strictly validate, mapped to its reader. A
 // universal primitive OUTSIDE this map has no strict content validator here, so it is REJECTED rather than
 // spliced unchecked. The documented residual: a value whose type this toolkit cannot yet strictly validate is
-// not compact-representable -- NumericString / VideotexString / GraphicString / GeneralString (no content reader),
-// and a fractional-seconds GeneralizedTime (the X.690 sec. 11.7 relaxation is deliberately scoped to the codec
+// not compact-representable -- VideotexString / GraphicString / GeneralString / ObjectDescriptor / REAL (no
+// content reader in this toolkit), and a fractional-seconds GeneralizedTime (the X.690 sec. 11.7 relaxation is deliberately scoped to the codec
 // and RFC 3161 timestamping, and must not creep into a third consumer). On the ENCODE path such a value simply
 // degrades to the byte-exact ~oid + byte-string form, losing nothing; on the DECODE path it is a fail-closed
 // verdict rather than a guess.
@@ -1042,7 +1054,10 @@ var _ANY_VALUE_READERS = (function () {
   m[T.BOOLEAN] = R.boolean; m[T.INTEGER] = R.integer; m[T.ENUMERATED] = R.enumerated;
   m[T.BIT_STRING] = R.bitString; m[T.OCTET_STRING] = R.octetString; m[T.NULL] = R.nullValue;
   m[T.OBJECT_IDENTIFIER] = R.oid; m[T.UTC_TIME] = R.time; m[T.GENERALIZED_TIME] = R.time;
-  [T.UTF8_STRING, T.PRINTABLE_STRING, T.NUMERIC_STRING, T.IA5_STRING, T.TELETEX_STRING, T.VISIBLE_STRING, T.BMP_STRING, T.UNIVERSAL_STRING].forEach(function (t) { m[t] = R.string; });
+  // NumericString reads through its OWN reader: it is not a DirectoryString type, and routing it through
+  // read.string would fold it into the RFC 5280 sec. 7.1 name-comparison identity class (see asn1-der.js).
+  m[T.NUMERIC_STRING] = R.numericString;
+  [T.UTF8_STRING, T.PRINTABLE_STRING, T.IA5_STRING, T.TELETEX_STRING, T.VISIBLE_STRING, T.BMP_STRING, T.UNIVERSAL_STRING].forEach(function (t) { m[t] = R.string; });
   return m;
 })();
 
@@ -1123,7 +1138,7 @@ function _derSetInDeclaredOrder(vals) {
 
 // [ type1, values1, ... ] -> the DER SubjectDirectoryAttributes. A malformed native value fails closed
 // (c509/bad-extensions); on the encode path the same throw is a round-trip mismatch -> whole-ext ~oid fallback.
-function _sdaToDer(node) {
+function _sdaToDer(node, isNative) {
   if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes value must be a CBOR array");
   var kids = node.children;
   if (kids.length === 0 || kids.length % 2 !== 0) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes array must be non-empty (attributeType, attributeValue) pairs (sec. 3.3)");
@@ -1134,12 +1149,15 @@ function _sdaToDer(node) {
     var vals = [];
     if (typeNode.majorType === 0 || typeNode.majorType === 1) {          // int form: a sec. 8.6 registry alias, text values
       var ti = Number(cbor.read.int(typeNode));
+      // draft sec. 3.1.4 applies to EVERY int in a natively signed certificate, not just the top-level Name's.
+      if (isNative && ti < 0) throw _err("c509/bad-extensions", "a natively signed C509 subjectDirectoryAttributes attribute type integer must be non-negative (draft sec. 3.1.4), got " + ti);
       var tname = ATTR_BY_INT[Math.abs(ti)];
       if (tname === undefined) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes attribute type int " + ti + " has no C509 sec. 8.6 registry row");
-      // countryName / serialNumber are PrintableString-restricted -- their int MUST carry the negative
-      // (printableString) sign. A non-negative sign is ambiguous/nonconformant: fail closed rather than
-      // silently coerce the value to PrintableString (the ~oid form is the escape hatch for a genuine odd value).
-      if ((tname === "countryName" || tname === "serialNumber") && ti >= 0) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes " + tname + " must carry the negative (printableString) sign (it is PrintableString-restricted)");
+      // countryName / serialNumber carry a CHARACTER restriction (draft sec. 3.1.4 "SHALL contain only
+      // characters from the 74-character ASCII subset permitted by PrintableString"), NOT a sign override --
+      // _reconAttrValue asserts the charset and honours the declared string type. Requiring the negative sign
+      // here would also make these attributes unrepresentable in a NATIVE certificate, whose ints SHALL all be
+      // non-negative (same sec.), so the rule is the charset, not the sign.
       for (var vi = 0; vi < valuesNode.children.length; vi++) {
         var vn = valuesNode.children[vi];
         if (vn.majorType !== 3) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes int-form attribute value must be a CBOR text string (a non-string value requires the ~oid form)");
@@ -1240,7 +1258,7 @@ function _tryCompactExtValue(name, der) {
 }
 
 // extensions (sec. 3.1.10/sec. 3.3/sec. 8.8): [ * Extension ] | a single keyUsage int-shortcut.
-function _extensions(node) {
+function _extensions(node, isNative) {
   // The keyUsage int-shortcut (sec. 3.1.10): a bare int -> one keyUsage extension, criticality from the
   // sign, value = abs(int) (Appendix A.1.1: the single int 1 -> non-critical keyUsage digitalSignature).
   if (node.majorType === 0 || node.majorType === 1) {
@@ -1267,7 +1285,7 @@ function _extensions(node) {
       // non-byte-string value there is an unsupported compact form and MUST fail closed -- a text/array value
       // is NOT raw DER, and copying its bytes would reconstruct a structurally invalid extension.
       if (EXT_COMPACT[name]) {
-        valContent = _extValueToDer(name, valNode);
+        valContent = _extValueToDer(name, valNode, isNative);
       } else if (valNode.majorType === 2) {
         valContent = valNode.content;
       } else {
@@ -1323,7 +1341,14 @@ function _reconAttrValue(rdn) {
   // emailAddress is an IA5String-only attribute (draft sec. 3.1.4): its type, not the int's sign, fixes the
   // string type, so it reconstructs as an IA5String whichever way the non-negative int was written.
   if (rdn.type === "emailAddress") return b.ia5(s);
-  if (rdn.type === "countryName" || rdn.type === "serialNumber") return b.printable(s);
+  // serialNumber / countryName carry a CHARACTER restriction, not a string-type override: draft sec. 3.1.4
+  // "SHALL contain only characters from the 74-character ASCII subset permitted by PrintableString". Enforce
+  // that on the CHARACTERS and still honour the sign for the string type -- coercing them to PrintableString
+  // regardless of sign would make the +N and -N encodings of one value reconstruct IDENTICAL DER, so a single
+  // X.509 signature would cover two distinct C509 encodings (a malleability window in the type-3 transform).
+  // b.printable IS the PrintableString charset authority -- run it for the assert even when the sign selects
+  // utf8String, so the restriction binds on the characters without overriding the declared string type.
+  if (!rdn.printable && (rdn.type === "countryName" || rdn.type === "serialNumber")) b.printable(s);
   return rdn.printable ? b.printable(s) : b.utf8(s);
 }
 
@@ -1494,10 +1519,16 @@ function parse(input) {
   var sHex = serialBytes.content.toString("hex");
 
   var sigAlg = _algorithm(f[2], SIG_ALG_BY_INT, "c509/unknown-algorithm", "issuerSignatureAlgorithm");
-  var issuer = _name509(f[3], false);
+  var issuer = _name509(f[3], false, type === 2);
   var notBefore = _time(f[4], false, "validityNotBefore");
   var notAfter = _time(f[5], true, "validityNotAfter");
-  var subject = _name509(f[6], true);
+  var subject = _name509(f[6], true, type === 2);
+  // A CBOR-null issuer means issuer == subject (self-signed), so the EFFECTIVE issuer is the subject -- and it
+  // must still satisfy RFC 5280 sec. 4.1.2.4. Checking only the array form would let the null form rebuild the
+  // very empty issuer the array form is refused for.
+  if (issuer === null && (!subject || !subject.rdns || subject.rdns.length === 0)) {
+    throw _err("c509/bad-name", "a self-signed C509 (issuer == subject) requires a non-empty subject, since it is also the issuer (RFC 5280 sec. 4.1.2.4)");
+  }
   var spkAlg = _algorithm(f[7], PK_ALG_BY_INT, "c509/unknown-algorithm", "subjectPublicKeyAlgorithm");
   var subjectPublicKey = null, rsaKey = null;
   if (spkAlg.name === "rsaEncryption") {
@@ -1511,7 +1542,7 @@ function parse(input) {
     if (f[8].majorType !== 2) throw _err("c509/bad-spki", "subjectPublicKey must be a CBOR byte string");
     subjectPublicKey = f[8].content;
   }
-  var extensions = _extensions(f[9]);
+  var extensions = _extensions(f[9], type === 2);
   if (f[10].majorType !== 2) throw _err("c509/bad-signature", "issuerSignatureValue must be a CBOR byte string");
   var signatureValue = f[10].content;
 
@@ -1751,7 +1782,12 @@ function _c509NameFromDer(nameBytes) {
     var attrName = oid.name(asn1.read.oid(attr.children[0]));
     if (attrName == null || ATTR_TO_INT[attrName] === undefined) throw _err("c509/non-invertible", "attribute type " + attrName + " has no C509 registry integer");
     var valNode = attr.children[1];
-    var value = asn1.read.string(valNode);
+    // A value whose string type this codec cannot represent (NumericString and the other non-DirectoryString
+    // types read.string declines) is NOT compact-representable -- report that in THIS module's domain rather
+    // than leaking the codec's own asn1/* fault out of encode(), which is what every sibling shape does.
+    var value;
+    try { value = asn1.read.string(valNode); }
+    catch (e) { throw _err("c509/non-invertible", "attribute " + attrName + " carries a value whose string type the C509 sec. 8.6 int form cannot represent", e); }
     // The IA5String type belongs ONLY to an IA5-only attribute (emailAddress, draft sec. 3.1.4), whose value
     // reconstructs from its type rather than the int's sign. Refuse either mismatch here with a precise verdict
     // instead of emitting an int form whose reconstruction would differ from the source bytes.

package/lib/schema-pkix.js

@@ -331,6 +331,15 @@ function attrValueToString(ns) {
       if (!e || (e.code !== "asn1/expected-string" && e.code !== "asn1/expected-primitive")) {
         throw ns.E(ns.prefix + "/bad-atv", "malformed string in attribute value: " + ((e && e.message) || String(e)));
       }
+      // NumericString is deliberately NOT read by asn1.read.string -- a value that returns a plain string joins
+      // the RFC 5280 sec. 7.1 name-comparison identity class, and NumericString is not a DirectoryString type.
+      // It does have its own strict reader though, so VALIDATE the content here (an out-of-alphabet value is
+      // malformed DER and must not be accepted merely because it falls to the opaque form) while still
+      // surfacing it in the type-distinct RFC 4514 hex form, which keeps it out of that identity class.
+      if (node.tagClass === "universal" && node.tagNumber === asn1.TAGS.NUMERIC_STRING) {
+        try { asn1.read.numericString(node); }
+        catch (e2) { throw ns.E(ns.prefix + "/bad-atv", "malformed NumericString in attribute value: " + ((e2 && e2.message) || String(e2))); }
+      }
       return "#" + node.bytes.toString("hex");
     }
     if (s.charAt(0) === "#" || s.charAt(0) === "\\") return "\\" + s;