@blamejs/pki 0.6.13 → 0.6.15

package/lib/scep.js

@@ -43,8 +43,8 @@ var cmsSign = require("./cms-sign");
 var cmsVerify = require("./cms-verify");
 var cmsEncrypt = require("./cms-encrypt");
 var cmsDecrypt = require("./cms-decrypt");
-require("./path-validate");   // side-effect: injects the certification-path signature engine into csr-verify at load
-var csrVerify = require("./csr-verify");   // verify an embedded PKCS#10's proof-of-possession before enveloping it
+require("./path-validate");
+var csrVerify = require("./csr-verify");
 var schemaCms = require("./schema-cms");
 var schemaCsr = require("./schema-csr");
 var schemaX509 = require("./schema-x509");
@@ -52,42 +52,26 @@ var schemaCrl = require("./schema-crl");
 var pkix = require("./schema-pkix");
 var guard = require("./guard-all");
 var C = require("./constants");
-var httpTransport = require("./http-transport");   // the injectable https transport for the client verbs (sec. 4)
+var httpTransport = require("./http-transport");
 var nodeCrypto = require("node:crypto");
 
 function _err(code, msg, cause) { return new ScepError(code, msg, cause); }
 
-// The namespace pkix.keyUsageOf reads a certificate's keyUsage extension through.
 var _KU_NS = pkix.makeNS("scep", ScepError, oid);
 
-// The messageType values are a DATA table (RFC 8894 sec. 3.2.1.2, Table 3), never a switch: name <-> the
-// decimal ASCII a PrintableString carries. RFC 8894 renumbered the legacy draft (RenewalReq is 17, and
-// there is no GetCertInitial -- it is CertPoll 20).
 var MESSAGE_TYPE = { CertRep: "3", RenewalReq: "17", PKCSReq: "19", CertPoll: "20", GetCert: "21", GetCRL: "22" };
-// pkiStatus (Table 4): SUCCESS 0, FAILURE 2, PENDING 3 -- note there is NO value 1.
 var PKI_STATUS = { SUCCESS: "0", FAILURE: "2", PENDING: "3" };
-// failInfo (Table 5).
 var FAIL_INFO = { badAlg: "0", badMessageCheck: "1", badRequest: "2", badTime: "3", badCertId: "4" };
 
-// name -> code and code -> name, built once from each table so a lookup is a data read, not a switch.
 function _invert(table) { var o = Object.create(null); for (var k in table) if (Object.prototype.hasOwnProperty.call(table, k)) o[table[k]] = k; return o; }
 var MESSAGE_TYPE_BY_CODE = _invert(MESSAGE_TYPE), PKI_STATUS_BY_CODE = _invert(PKI_STATUS), FAIL_INFO_BY_CODE = _invert(FAIL_INFO);
 
-// The message types pki.scep.parse reads: the enrollment request pair a client builds and the CertRep
-// response it receives. The CertPoll / GetCert / GetCRL client queries are refused (see parse).
 var _PARSE_SUPPORTED = { PKCSReq: 1, RenewalReq: 1, CertRep: 1 };
 
-// The RFC 8894 sec. 3 EnvelopedData content-encryption profile. AES-128-CBC is the mandatory strong
-// cipher; the toolkit's own cms.encrypt refuses the weak legacy ciphers structurally, so the builder
-// only names the one it emits.
 var ENVELOPE_CIPHER = "aes-128-cbc";
 
-// The empty external content a conforming FAILURE / PENDING CertRep is verified against: its
-// pkcsPKIEnvelope is omitted, so the SignedData carries no encapsulated content (RFC 8894 sec. 3.3.2).
 var EMPTY_CONTENT = Buffer.alloc(0);
 
-// A 16-byte nonce (RFC 8894 sec. 3.2.1.5): a caller value copied at the door and validated to width, or
-// a fresh random one. The copy makes a caller value read after an await immune to concurrent mutation.
 function _nonce(v, label) {
   if (v == null) return nodeCrypto.randomBytes(16);
   var buf = guard.bytes.snapshotSource(v, ScepError, "scep/bad-nonce", label);
@@ -95,19 +79,12 @@ function _nonce(v, label) {
   return buf;
 }
 
-// A caller PrintableString for a transaction id: bounded (the RFC sets no length, so cap it against a DoS)
-// and restricted to the PrintableString character set (asn1.build.printable enforces the set).
 function _transactionId(v) {
   if (typeof v !== "string" || v.length === 0) throw _err("scep/bad-input", "transactionId must be a non-empty string (RFC 8894 sec. 3.2.1.1)");
   if (v.length > C.LIMITS.SCEP_TRANSACTION_ID_MAX) throw _err("scep/bad-input", "transactionId exceeds the " + C.LIMITS.SCEP_TRANSACTION_ID_MAX + "-character cap");
   return v;
 }
 
-// Assert some bytes are a CMS ContentInfo wrapping a well-formed EnvelopedData whose encrypted content
-// type is id-data -- the pkcsPKIEnvelope profile (RFC 8894 sec. 3.2, sec. 3.2.2). Delegated to the
-// strict CMS parser, and checked structurally without decryption, so an absent, malformed, or
-// off-profile envelope is refused for every envelope-carrying message whether or not a recipient key
-// was supplied.
 function _assertValidEnvelope(bytes, messageType) {
   if (bytes == null) throw _err("scep/missing-envelope", "the pkcsPKIEnvelope is mandatory for a " + messageType + " message but the signed content is absent (RFC 8894 sec. 3.2)");
   var parsed;
@@ -115,17 +92,10 @@ function _assertValidEnvelope(bytes, messageType) {
   catch (e) { throw _err("scep/missing-envelope", "the pkcsPKIEnvelope of a " + messageType + " message is not a decodable CMS EnvelopedData (RFC 8894 sec. 3.2)", e); }
   if (parsed.contentTypeName !== "envelopedData") throw _err("scep/missing-envelope", "the pkcsPKIEnvelope of a " + messageType + " message must be an EnvelopedData (RFC 8894 sec. 3.2), got " + parsed.contentTypeName);
   if (parsed.encryptedContentInfo.contentType !== oid.byName("data")) throw _err("scep/bad-envelope-content-type", "the pkcsPKIEnvelope's encrypted content type must be id-data (RFC 8894 sec. 3.2.2), got " + parsed.encryptedContentInfo.contentType);
-  // The EnvelopedData must actually carry ciphertext: an inner envelope whose encryptedContent is absent
-  // or a zero-length OCTET STRING has no messageData to recover (SCEP provides none out of band), so it
-  // is refused (RFC 8894 sec. 3.2).
   var ct = parsed.encryptedContentInfo.encryptedContent;
   if (ct == null || ct.length === 0) throw _err("scep/missing-envelope", "the pkcsPKIEnvelope of a " + messageType + " message carries no encrypted content (RFC 8894 sec. 3.2)");
 }
 
-// Validate a SUCCESS CertRep's messageData as a degenerate certificates-only CMS SignedData (RFC 8894
-// sec. 3.4) and surface its certificates and CRLs raw, for the caller to path-validate. The issued
-// certificate(s) answer an enrollment; a CRL answers a GetCRL (sec. 3.3.4), so certificates and CRLs are
-// accepted independently and a payload carrying neither is refused.
 function _readIssuancePayload(der) {
   var r;
   try { r = schemaCms.parse(der); }
@@ -134,9 +104,6 @@ function _readIssuancePayload(der) {
       r.encapContentInfo.eContent !== null || r.signerInfos.length !== 0) {
     throw _err("scep/not-certs-only", "a SUCCESS CertRep messageData must be a degenerate certificates-only CMS SignedData (RFC 8894 sec. 3.4)");
   }
-  // Validate each entry as a plain X.509 certificate / CRL: a universal-SEQUENCE CertificateChoice or
-  // RevocationInfoChoice must be a well-formed certificate / CRL, and a tagged alternative (attribute
-  // cert, other-message, otherRevInfo) is not a plain issuance object and is refused.
   var certs = [], crls = [], i;
   var rc = r.certificates || [], rl = r.crls || [];
   for (i = 0; i < rc.length; i++) {
@@ -157,14 +124,8 @@ function _readIssuancePayload(der) {
   return { certificates: certs, crls: crls };
 }
 
-// Build one SCEP transaction attribute { type, values:[valueDER] } for cms.sign's additionalSignedAttributes.
 function _attr(name, valueDer) { return { type: oid.byName(name), values: [valueDer] }; }
 
-// Find the single surfaced signed attribute of a given OID name (the values are raw AttributeValue
-// DER). The CMS parser rejects a repeated attribute type (cms/duplicate-signed-attr) before these
-// attributes are surfaced, so a SCEP transaction attribute appears at most once. It is also
-// single-valued: a value SET that does not hold exactly one value is an ambiguous transaction state
-// and is refused rather than resolved to the first value (RFC 8894 sec. 3.2.1).
 function _find(attrs, name) {
   var want = oid.byName(name);
   for (var i = 0; i < attrs.length; i++) {
@@ -176,9 +137,6 @@ function _find(attrs, name) {
   }
   return null;
 }
-// Read a string transaction attribute to its JS string, requiring the exact ASN.1 string type RFC 8894
-// sec. 3.2 pins for it (a generic string reader would accept an off-profile UTF8String or IA5String
-// where a PrintableString is required). Returns null when the attribute is absent.
 function _readStr(attrs, name, expectedTag) {
   var a = _find(attrs, name);
   if (a == null) return null;
@@ -192,7 +150,6 @@ function _readStr(attrs, name, expectedTag) {
   catch (e) { throw _err("scep/bad-attribute", "the " + name + " transaction attribute is not a readable string", e); }
 }
 var _T_PRINTABLE = asn1.TAGS.PRINTABLE_STRING, _T_UTF8 = asn1.TAGS.UTF8_STRING;
-// Read a 16-byte OCTET STRING nonce attribute, or null when absent.
 function _readNonce(attrs, name) {
   var a = _find(attrs, name);
   if (a == null) return null;
@@ -203,9 +160,6 @@ function _readNonce(attrs, name) {
   return n;
 }
 
-// Whether two certificates carry the same subject public key -- the SCEP signer-authentication test
-// (a CertRep must be signed by the CA the client already holds, RFC 8894 sec. 3.1). Compared by the
-// SubjectPublicKeyInfo so a re-encoded certificate of the same key still matches.
 function _sameKey(certA, certB) {
   var a, bb;
   try { a = schemaX509.parse(certA).subjectPublicKeyInfo.bytes; bb = schemaX509.parse(certB).subjectPublicKeyInfo.bytes; }
@@ -213,9 +167,6 @@ function _sameKey(certA, certB) {
   return guard.crypto.constantTimeEqual(a, bb);
 }
 
-// The pkcsPKIEnvelope uses RSAES-OAEP key transport, so the recipient MUST be an RSA key-transport
-// certificate (RFC 8894 sec. 3). An EC / X25519 / ML-KEM recipient would make cms.encrypt emit a
-// key-agreement or KEM recipient off the SCEP profile, so it is refused before the CMS dispatch.
 function _assertRsaRecipient(recipientDer) {
   var spki;
   try { spki = schemaX509.parse(recipientDer).subjectPublicKeyInfo; }
@@ -225,10 +176,6 @@ function _assertRsaRecipient(recipientDer) {
   }
 }
 
-// A SCEP signer's certificate MUST be authorized to sign: its keyUsage extension, when present, must
-// assert digitalSignature (RFC 8894 sec. 2.3 requires that bit specifically). A certificate whose
-// keyUsage omits it, permitting only encryption or non-repudiation, is refused, so a signature it makes
-// is not read as authenticated. A certificate with no keyUsage extension is unrestricted and passes.
 function _assertSigningKeyUsage(certDer, label) {
   var cert;
   try { cert = schemaX509.parse(certDer); }
@@ -239,9 +186,6 @@ function _assertSigningKeyUsage(certDer, label) {
   }
 }
 
-// Snapshot the recipient key material at the parse door: the certificate byte source is copied so a
-// concurrent mutation cannot redirect the decryption, and the private / content key is held by
-// reference (copying a secret is the worse defect). null passes through unchanged.
 function _captureRecipientKey(rk) {
   if (rk == null) return null;
   rk = guard.identifier.optionsObject(rk, _err, "scep/bad-input", "opts.recipientKey");
@@ -301,14 +245,6 @@ async function build(spec) {
   if (spec.signer == null || typeof spec.signer !== "object") throw _err("scep/bad-input", "a signer { cert, key } is required");
   var senderNonce = _nonce(spec.senderNonce, "senderNonce");
   var txnId = _transactionId(spec.transactionId);
-  // The messageData is a PKCS#10 CertificationRequest whose self-signature is its proof-of-possession
-  // (RFC 8894 sec. 3.3.1, over RFC 2986). Verify the structure and that proof before enveloping it, so
-  // arbitrary bytes or a request whose signature does not verify under its own subject public key are
-  // refused here rather than encrypted into a message a CA would reject.
-  // Capture every input read after an await at this synchronous door, so a caller that mutates or reuses
-  // the spec while verification or encryption is pending cannot desync what was verified from what is
-  // emitted, or substitute the recipient a request is encrypted to. The certificate byte sources are
-  // copied; the signer private key is held by reference (copying a secret is the worse defect).
   var messageData = guard.bytes.snapshotSource(spec.messageData, ScepError, "scep/bad-input", "messageData");
   var recipient = guard.bytes.snapshotSource(spec.recipient, ScepError, "scep/bad-input", "recipient");
   _assertRsaRecipient(recipient);
@@ -321,7 +257,6 @@ async function build(spec) {
   if (!(await csrVerify.verifyCsrSignature(parsedCsr))) {
     throw _err("scep/bad-popo", "the PKCS#10 messageData failed its proof-of-possession: its self-signature does not verify under its own subject public key, so a CA would reject it");
   }
-  // Inner EnvelopedData: encrypt the PKCS#10 to the recipient CA, AES-128-CBC (RFC 8894 sec. 3).
   var pkcsPKIEnvelope;
   try {
     pkcsPKIEnvelope = await cmsEncrypt.encrypt(messageData, [{ cert: recipient }], { contentEncryptionAlgorithm: ENVELOPE_CIPHER });
@@ -329,7 +264,6 @@ async function build(spec) {
     if (e && e.isPkiError) throw _err("scep/bad-input", "the pkcsPKIEnvelope could not be built (recipient must be a keyEncipherment CA certificate and messageData a PKCS#10): " + e.message, e);
     throw e;
   }
-  // Outer SignedData over the envelope, carrying the transaction attributes as authenticated attributes.
   var attrs = [
     _attr("scepMessageType", b.printable(mtCode)),
     _attr("scepTransactionId", b.printable(txnId)),
@@ -386,24 +320,13 @@ var _BUILD_KEYS = { messageType: 1, messageData: 1, recipient: 1, signer: 1, tra
 async function parse(bytes, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "scep/bad-input", "pki.scep.parse options");
   guard.identifier.assertKnownKeys(opts, _PARSE_KEYS, _err, "scep/bad-input", "pki.scep.parse has an unknown option: ");
-  // Snapshot the message bytes once at this synchronous door: parse verifies them twice (a detached
-  // FAILURE / PENDING is re-verified against an empty payload), so a caller that swaps a mutable Buffer
-  // between the two attempts must not be able to return one message's attributes for another.
   var msgBytes = guard.bytes.snapshotSource(bytes, ScepError, "scep/bad-der", "pkiMessage");
-  // Capture every option read after the awaited verification at this synchronous door, so a caller that
-  // mutates or reuses opts while verification is pending cannot swap the authenticated signer, the echo
-  // nonce, or the decryption recipient after the checks that depend on them have started. Certificate
-  // byte sources are copied; the recipient private key is held by reference.
   var expectedSignerCert = opts.signerCert != null ? guard.bytes.snapshotSource(opts.signerCert, ScepError, "scep/bad-input", "opts.signerCert") : null;
   var expectedSenderNonce = opts.expectedSenderNonce != null ? _nonce(opts.expectedSenderNonce, "expectedSenderNonce") : null;
   var recipientKey = _captureRecipientKey(opts.recipientKey);
   var v;
   try { v = await cmsVerify.verify(msgBytes); }
   catch (e) {
-    // A conforming FAILURE or PENDING CertRep omits the pkcsPKIEnvelope, so the SignedData has no
-    // encapsulated content and cms.verify reports it as detached. Re-verify against an empty payload,
-    // which the signature accepts only when the message-digest was taken over no content; a message
-    // signed over any other bytes still fails (RFC 8894 sec. 3.3.2).
     if (e && e.code === "cms/detached-content-required") {
       try { v = await cmsVerify.verify(msgBytes, { content: EMPTY_CONTENT }); }
       catch (e2) {
@@ -415,29 +338,12 @@ async function parse(bytes, opts) {
     } else { throw e; }
   }
   if (v.signers.length !== 1) throw _err("scep/bad-signer", "a SCEP pkiMessage MUST carry exactly one SignerInfo (RFC 8894 sec. 3.1), got " + v.signers.length);
-  // Fail closed: the transaction attributes are only trustworthy once the outer signature verifies.
-  // cms.verify returns a per-signer verdict rather than throwing, so a bad signature MUST be refused
-  // here before any attribute is read -- never surfaced as a false verdict alongside the attributes.
   if (v.valid !== true) throw _err("scep/bad-signature", "the pkiMessage outer signature did not verify (RFC 8894 sec. 3.1)");
-  // The SignedData eContentType MUST be id-data (RFC 8894 sec. 3.2): a message that verifies as CMS but
-  // names another encapsulated content type is not a valid SCEP pkiMessage.
   if (v.eContentType !== oid.byName("data")) throw _err("scep/bad-content-type", "the pkiMessage eContentType must be id-data (RFC 8894 sec. 3.2)");
   var signer = v.signers[0];
-  // A SCEP signer's certificate must be authorized to sign (RFC 8894 sec. 2.3): a signature from a
-  // certificate whose keyUsage permits only encryption is not read as an authenticated pkiMessage.
   _assertSigningKeyUsage(signer.cert, "pkiMessage signer certificate");
-  // A valid signature proves only that the message is self-consistent with the certificate it embeds,
-  // NOT that the signer is the expected party: anyone can mint a certificate and sign a forged CertRep
-  // that echoes an observed nonce. A SCEP client MUST authenticate a CA response against the CA
-  // certificate it already holds (RFC 8894 sec. 3.1). When opts.signerCert names the expected signer,
-  // require the message signer's public key to match it; a caller that omits it gets a crypto-only
-  // verdict (signerAuthenticated: false) and MUST authenticate the surfaced signerCert itself before
-  // acting on the transaction state.
   var signerAuthenticated = false;
   if (expectedSignerCert != null) {
-    // The certificate the caller pins is authenticated only if it is itself authorized to sign: a
-    // same-key certificate embedded in the message cannot lend its digitalSignature bit to a pinned
-    // certificate that permits only encryption (RFC 8894 sec. 2.3).
     _assertSigningKeyUsage(expectedSignerCert, "opts.signerCert");
     if (!_sameKey(signer.cert, expectedSignerCert)) {
       throw _err("scep/untrusted-signer", "the pkiMessage signer's public key does not match opts.signerCert (RFC 8894 sec. 3.1)");
@@ -445,7 +351,6 @@ async function parse(bytes, opts) {
     signerAuthenticated = true;
   }
   var attrs = signer.signedAttributes;
-  // The mandatory attributes (RFC 8894 sec. 3.2.1): transactionID, messageType, senderNonce.
   var messageTypeCode = _readStr(attrs, "scepMessageType", _T_PRINTABLE);
   var transactionId = _readStr(attrs, "scepTransactionId", _T_PRINTABLE);
   var senderNonce = _readNonce(attrs, "scepSenderNonce");
@@ -454,10 +359,6 @@ async function parse(bytes, opts) {
   if (senderNonce == null) throw _err("scep/missing-attribute", "the pkiMessage is missing its senderNonce attribute (RFC 8894 sec. 3.2.1)");
   var messageType = MESSAGE_TYPE_BY_CODE[messageTypeCode];
   if (messageType == null) throw _err("scep/bad-message-type", "unknown messageType " + JSON.stringify(messageTypeCode) + " (RFC 8894 sec. 3.2.1.2)");
-  // This release reads the enrollment messages a SCEP client builds and receives: PKCSReq, RenewalReq,
-  // and the CertRep response. The CertPoll / GetCert / GetCRL client queries a CA processes carry
-  // IssuerAndSubject / IssuerAndSerialNumber messageData this codec does not model, so they are refused
-  // rather than accepted with an unvalidated payload (RFC 8894 sec. 3.3.3, sec. 3.3.4).
   if (_PARSE_SUPPORTED[messageType] !== 1) {
     throw _err("scep/unsupported-message-type", "pki.scep.parse reads PKCSReq, RenewalReq, and CertRep; " + messageType + " is not read in this release");
   }
@@ -467,16 +368,12 @@ async function parse(bytes, opts) {
     recipientNonce: null, pkiStatus: null, failInfo: null, failInfoText: null, messageData: null,
     certificates: null, crls: null,
   };
-  // A CertRep carries pkiStatus (+ failInfo/failInfoText on FAILURE) and echoes the request's senderNonce.
   if (messageType === "CertRep") {
     var statusCode = _readStr(attrs, "scepPkiStatus", _T_PRINTABLE);
     if (statusCode == null) throw _err("scep/missing-attribute", "a CertRep is missing its pkiStatus attribute (RFC 8894 sec. 3.2.1.3)");
     out.pkiStatus = PKI_STATUS_BY_CODE[statusCode];
     if (out.pkiStatus == null) throw _err("scep/bad-pki-status", "unknown pkiStatus " + JSON.stringify(statusCode) + " (RFC 8894 sec. 3.2.1.3)");
     out.recipientNonce = _readNonce(attrs, "scepRecipientNonce");
-    // A CertRep MUST echo the request's senderNonce in a recipientNonce (RFC 8894 sec. 3.1), so a
-    // response missing it cannot be correlated to its request and is refused regardless of whether the
-    // caller supplied expectedSenderNonce.
     if (out.recipientNonce == null) throw _err("scep/missing-attribute", "a CertRep is missing its recipientNonce attribute (RFC 8894 sec. 3.2.1.5)");
     if (out.pkiStatus === "FAILURE") {
       var failCode = _readStr(attrs, "scepFailInfo", _T_PRINTABLE);
@@ -485,43 +382,23 @@ async function parse(bytes, opts) {
       if (out.failInfo == null) throw _err("scep/bad-fail-info", "unknown failInfo " + JSON.stringify(failCode) + " (RFC 8894 sec. 3.2.1.4)");
       out.failInfoText = _readStr(attrs, "scepFailInfoText", _T_UTF8);
     } else if (_find(attrs, "scepFailInfo") != null || _find(attrs, "scepFailInfoText") != null) {
-      // failInfo and failInfoText are defined for a FAILURE response (RFC 8894 sec. 3.2.1.4): a SUCCESS
-      // or PENDING CertRep carrying them asserts a contradictory authenticated status and is refused.
       throw _err("scep/unexpected-attribute", "a " + out.pkiStatus + " CertRep must not carry a failInfo or failInfoText attribute (RFC 8894 sec. 3.2.1.4)");
     }
   } else {
-    // A request (PKCSReq / RenewalReq) is an initial message: the response-only attributes pkiStatus,
-    // failInfo, failInfoText, and recipientNonce are defined for a CertRep and MUST NOT appear here
-    // (RFC 8894 sec. 3.2.1). A request carrying any of them is off-profile and refused.
     if (_find(attrs, "scepPkiStatus") != null || _find(attrs, "scepFailInfo") != null ||
         _find(attrs, "scepFailInfoText") != null || _find(attrs, "scepRecipientNonce") != null) {
       throw _err("scep/unexpected-attribute", "a " + messageType + " request must not carry a CertRep response attribute, pkiStatus / failInfo / failInfoText / recipientNonce (RFC 8894 sec. 3.2.1)");
     }
   }
-  // A caller-stated expected senderNonce echo (RFC 8894 sec. 3.2.1.5): a message whose recipientNonce
-  // does not match the nonce we sent MUST be rejected.
   if (expectedSenderNonce != null) {
     if (out.recipientNonce == null || !guard.crypto.constantTimeEqual(out.recipientNonce, expectedSenderNonce)) {
       throw _err("scep/nonce-mismatch", "the pkiMessage recipientNonce does not echo the sent senderNonce (RFC 8894 sec. 3.2.1.5)");
     }
   }
-  // The pkcsPKIEnvelope is carried by a request and a SUCCESS CertRep, and is OMITTED by a FAILURE or
-  // PENDING CertRep, whose payload is the status itself (RFC 8894 sec. 3.3.2.1). Decrypt only when the
-  // message is one that carries the envelope, so a non-SUCCESS CertRep's authenticated status is
-  // returned rather than turned into a decrypt failure over content that is not an EnvelopedData. The
-  // eContent is bound to the verified signature (cms.verify).
   var carriesEnvelope = !(messageType === "CertRep" && (out.pkiStatus === "FAILURE" || out.pkiStatus === "PENDING"));
   if (carriesEnvelope) {
-    // For a message that carries messageData, the pkcsPKIEnvelope is mandatory, MUST be an EnvelopedData,
-    // and MUST encrypt id-data (RFC 8894 sec. 3.2, sec. 3.2.2). This is checked structurally, before any
-    // recipient-key decryption, so an absent or off-profile envelope is never accepted as a valid
-    // message with a null messageData, whether or not a recipient key was supplied.
     _assertValidEnvelope(v.eContent, messageType);
   } else {
-    // A FAILURE or PENDING CertRep MUST omit the pkcsPKIEnvelope (RFC 8894 sec. 3.3.2): its payload is
-    // the status itself, so the SignedData carries no encapsulated content (cms.verify surfaces it as a
-    // null eContent). Any present eContent -- an attached OCTET STRING even a zero-length one -- is
-    // off-profile and refused, so attacker-supplied bytes are never accepted under a non-SUCCESS verdict.
     if (v.eContent != null) {
       throw _err("scep/unexpected-envelope", "a " + out.pkiStatus + " CertRep must omit the pkcsPKIEnvelope (RFC 8894 sec. 3.3.2), but it carries encapsulated content");
     }
@@ -534,18 +411,11 @@ async function parse(bytes, opts) {
       throw e;
     }
     out.messageData = dec.content;
-    // A SUCCESS CertRep's messageData MUST be a degenerate certs-only CMS SignedData carrying the
-    // issued certificate(s) (RFC 8894 sec. 3.3.2, sec. 3.4). Validate that structure through the strict
-    // CMS parser and surface the certificates, so a decrypted payload that is not a valid issuance
-    // cannot read as a successful enrollment. The certificates are raw, for the caller to path-validate.
     if (messageType === "CertRep" && out.pkiStatus === "SUCCESS") {
       var payload = _readIssuancePayload(dec.content);
       out.certificates = payload.certificates;
       out.crls = payload.crls;
     } else if (messageType === "PKCSReq" || messageType === "RenewalReq") {
-      // A request's messageData MUST be a PKCS#10 CertificationRequest (RFC 8894 sec. 3.3.1). Validate
-      // the structure so a decrypted payload that is not one cannot read as a valid request; the raw
-      // bytes stay in messageData for the caller to verify the proof-of-possession.
       try { schemaCsr.parse(dec.content); }
       catch (e) { throw _err("scep/bad-request-payload", "a " + messageType + " messageData must be a PKCS#10 CertificationRequest (RFC 8894 sec. 3.3.1)", e); }
     }
@@ -554,34 +424,20 @@ async function parse(bytes, opts) {
 }
 var _PARSE_KEYS = { recipientKey: 1, expectedSenderNonce: 1, signerCert: 1 };
 
-// ---- HTTP client (RFC 8894 sec. 4) -------------------------------------------
-//
-// The client verbs compose the shipped pkiMessage codec (build / parse) over an injectable transport
-// (pki.transport.https by default; tests inject a fake). SCEP's message security is the CMS layer, not
-// the transport (RFC 8894 sec. 2.8), so https is not forced at the URL level; a caller with a plain-HTTP
-// CA injects its own transport. This release ships the mandatory-to-implement set (GetCACaps, GetCACert,
-// PKCSReq via HTTP POST, AES-128-CBC + SHA-256, sec. 2.9) plus RenewalReq. Deferred, each re-opening
-// under its named condition: GetNextCACert (the rollover-certificate authentication model, sec. 4.7);
-// auto-poll / GetCert / GetCRL (their CertPoll / IssuerAndSerialNumber messageData builders are not in
-// this codec); GET-carried PKIOperation (POST is mandatory, sec. 4.3); and HTTP auth (a CA behind an
-// authenticating proxy).
 var DEFAULT_TIMEOUT = C.TIME.seconds(30);
 var MAX_TIMEOUT = C.TIME.seconds(600);
 
-// The SCEP media types (RFC 8894 sec. 4.2 / 4.6). A 200 response MUST carry the operation's media type;
-// a proxy error page or a wrong type is refused (fail-closed).
-var CT_CA_CERT = "application/x-x509-ca-cert";       // GetCACert, a single DER certificate
-var CT_CA_RA_CERT = "application/x-x509-ca-ra-cert";  // GetCACert, a certs-only CMS chain
-var CT_PKI_MESSAGE = "application/x-pki-message";      // PKIOperation, a pkiMessage
-var CT_PLAIN = "text/plain";                           // GetCACaps, a newline-separated capability list
+var CT_CA_CERT = "application/x-x509-ca-cert";
+var CT_CA_RA_CERT = "application/x-x509-ca-ra-cert";
+var CT_PKI_MESSAGE = "application/x-pki-message";
+var CT_NEXT_CA_CERT = "application/x-x509-next-ca-cert";
+var CT_PLAIN = "text/plain";
 
 function _isWs(c) { return c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d || c === 0x0b || c === 0x0c; }
 function _foldLower(s) { var o = "", i, n = s.length; for (i = 0; i < n; i++) { var c = s.charCodeAt(i); o += String.fromCharCode(c >= 65 && c <= 90 ? c + 32 : c); } return o; }
 function _foldUpper(s) { var o = "", i, n = s.length; for (i = 0; i < n; i++) { var c = s.charCodeAt(i); o += String.fromCharCode(c >= 97 && c <= 122 ? c - 32 : c); } return o; }
 function _trim(s) { var a = 0, e = s.length; while (a < e && _isWs(s.charCodeAt(a))) a += 1; while (e > a && _isWs(s.charCodeAt(e - 1))) e -= 1; return s.slice(a, e); }
 
-// A case-insensitive single-header read. A duplicated header is refused: an injected transport promises
-// only { status, headers, body }, and a smuggled duplicate must never be silently coalesced.
 function _header(headers, name) {
   if (!headers || typeof headers !== "object") return null;
   var found = null, seen = 0, k;
@@ -592,7 +448,6 @@ function _header(headers, name) {
   if (seen > 1) throw _err("scep/bad-response", "the response carried more than one " + name + " header");
   return found == null ? null : String(found);
 }
-// The bare media type of a Content-Type (strip parameters, lower-case), by character scan (no regex).
 function _mediaType(ct) {
   if (ct == null) return "";
   var s = String(ct), semi = s.indexOf(";");
@@ -602,73 +457,45 @@ function _bodyBuf(body) {
   if (Buffer.isBuffer(body)) return body;
   if (body == null) return Buffer.alloc(0);
   if (typeof body === "string") return Buffer.from(body, "utf8");
-  // A BufferSource (Uint8Array, ArrayBuffer, DataView) from an injected transport: normalize its raw bytes
-  // rather than String()-coercing it, which would turn a Uint8Array into its "48,1,..." toString.
   return guard.bytes.snapshotSource(body, ScepError, "scep/bad-response", "the response body");
 }
-// The byte length of a transport response body, read without a full copy so the size cap is enforced before
-// the body is materialized (cap-before-copy): a string is measured as UTF-8, a Buffer or other BufferSource
-// through the byte guard, which reads the length via a captured intrinsic rather than a shadowable accessor.
 function _responseLen(body) {
   if (body == null) return 0;
   if (typeof body === "string") return Buffer.byteLength(body, "utf8");
   if (Buffer.isBuffer(body)) return guard.bytes.lengthOf(body);
   return guard.bytes.lengthOf(guard.bytes.source(body, ScepError, "scep/bad-response", "the response body"));
 }
-// Map opts.tls to the transport request.tls shape. rejectUnauthorized is NOT set -- the transport forces
-// it on for an https connection.
 function _tlsForRequest(opts) {
   var t = opts.tls || {};
   return { anchors: t.anchors, useSystemStore: t.useSystemStore, cert: t.cert, key: t.key, minVersion: t.minVersion, servername: t.servername, checkServerIdentity: t.checkServerIdentity };
 }
-// Resolve a redirect target: refuse an https->http downgrade (a stripping MITM) and a cross-origin
-// redirect on a non-idempotent method without opt-in; an unparseable Location is scep/bad-url.
 function _redirectTarget(current, location, method, allowCrossOrigin) {
   if (location == null || _trim(String(location)) === "") throw _err("scep/bad-response", "a redirect response carried no Location header");
   var resolved;
   try { resolved = new URL(String(location), current.href); }
   catch (e) { throw _err("scep/bad-url", "a redirect Location did not parse: " + location, e); }
-  // SCEP is an HTTP operation (RFC 8894 sec. 4): a redirect target on any other scheme (ftp:, file:, ...)
-  // is refused before it reaches the transport, so a CA cannot steer an injected transport off HTTP.
   if (resolved.protocol !== "http:" && resolved.protocol !== "https:") throw _err("scep/bad-url", "a redirect to a non-HTTP scheme is refused: " + resolved.protocol);
   if (current.protocol === "https:" && resolved.protocol !== "https:") throw _err("scep/insecure-redirect", "a redirect from https to " + resolved.protocol + " is refused");
   var safe = method === "GET" || method === "HEAD";
   if (resolved.origin !== current.origin && !safe && !allowCrossOrigin) throw _err("scep/cross-origin-redirect", "a cross-origin redirect on a " + method + " needs opts.allowCrossOriginRedirect");
   return resolved;
 }
-// Build a SCEP operation URL: the caller's base URL with ?operation=<op> appended (RFC 8894 sec. 4.1;
-// SCEPPATH is whatever the base carries, the CA typically ignores it).
 function _scepUrl(baseUrl, operation) {
   var url;
   try { url = new URL(String(baseUrl)); }
   catch (e) { throw _err("scep/bad-url", "the SCEP base URL did not parse: " + String(baseUrl), e); }
-  // SCEP is an HTTP operation (RFC 8894 sec. 4): any other scheme (ftp:, file:, ...) is refused before the
-  // URL reaches the transport, so an injected transport cannot be steered off HTTP.
   if (url.protocol !== "http:" && url.protocol !== "https:") throw _err("scep/bad-url", "the SCEP base URL must be http or https, got " + url.protocol);
   if (url.hash) throw _err("scep/bad-url", "the SCEP base URL must not carry a fragment");
   url.searchParams.set("operation", operation);
   return url;
 }
-// The transport request / redirect loop. Returns the terminal transport response ({ status, headers,
-// body }). Digest / Basic auth is not answered (deferred); a 401 is returned to the verb, which throws.
 function _drive(method, url, body, headers, opts, transport, budgets) {
   var redirects = 0, curMethod = method, curBody = body, initialOrigin = url.origin;
-  // Snapshot the caller's TLS fields and redirect policy once, at the start, before the first transport call:
-  // the redirect loop reruns per hop after each transport promise settles, so a hop must use the identity and
-  // policy the initial hop did even if opts (or opts.tls) is replaced while a request is in flight.
   var tlsBase = _tlsForRequest(opts);
   var allowCrossOrigin = !!opts.allowCrossOriginRedirect;
-  // The mTLS client identity (cert / key / pinned SNI) is sent ONLY to the origin the caller intended; a
-  // cross-origin redirect gets a copy with those stripped, so a CA that redirects to another origin cannot
-  // make the client authenticate to it with the caller's client credential. Derived fresh each hop, so a
-  // redirect back to the original origin restores it.
   function _hopTls(current) {
     var t = tlsBase;
     if (current.origin !== initialOrigin) {
-      // Every cross-origin hop overrides the client identity with an explicit null, unconditionally: an
-      // omitted field falls back to the transport's own configured defaults (http-transport resolves
-      // reqTls.cert !== undefined ? reqTls.cert : tlsDefaults.cert), so the override must fire even when the
-      // request-level tls carries no credential, or a transport default would still reach the new origin.
       t = Object.assign({}, t);
       t.cert = null; t.key = null; t.servername = null;
     }
@@ -703,7 +530,6 @@ function _client(method, url, body, headers, opts) {
   };
   return _drive(method, url, body, Object.assign({}, headers), opts, transport, budgets);
 }
-// Require a 200 with one of the expected media types; otherwise a typed error. Returns the body Buffer.
 function _requireOk(res, expected, what) {
   var status = res.status;
   if (status !== 200) {
@@ -717,8 +543,6 @@ function _requireOk(res, expected, what) {
   return _bodyBuf(res.body);
 }
 
-// The GetCACaps keyword set (RFC 8894 sec. 3.5.2, Table 7). Comparison is case-folded; the canonical
-// spelling is stored. An unknown keyword is ignored (sec. 3.5.2). SCEPStandard implies the sec. 2.9 set.
 var CAP_CANON = { AES: "AES", DES3: "DES3", GETNEXTCACERT: "GetNextCACert", POSTPKIOPERATION: "POSTPKIOperation",
   RENEWAL: "Renewal", "SHA-1": "SHA-1", "SHA-256": "SHA-256", "SHA-512": "SHA-512", SCEPSTANDARD: "SCEPStandard" };
 function _splitLines(s) {
@@ -789,29 +613,17 @@ function _assertStrongProfile(caps, profile) {
 async function getCACaps(baseUrl, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "scep/bad-input", "pki.scep.getCACaps options");
   guard.identifier.assertKnownKeys(opts, _CACAPS_KEYS, _err, "scep/bad-input", "pki.scep.getCACaps has an unknown option: ");
-  // Capture the strong-profile policy at the door: the downgrade check runs only after the GET await, so a
-  // caller must not be able to relax its own guard by mutating opts while the request is in flight.
   var profile = { expectSCEPStandard: !!opts.expectSCEPStandard, requireStrongProfile: !!opts.requireStrongProfile };
   var res = await _client("GET", _scepUrl(baseUrl, "GetCACaps"), null, {}, opts);
-  // An HTTP error or empty body means "none supported" (RFC 8894 sec. 3.5.1); a non-200 that is not a
-  // clean error is still surfaced so a caller is not silently told "no capabilities" on a broken CA.
   if (res.status === 200) {
-    // A conforming GetCACaps response carries content-type text/plain (RFC 8894 sec. 3.5.1). Enforcing it
-    // stops a proxy's 200 HTML error page from being read as an empty (no capabilities) capability set.
     var caps = parseCapabilities(_requireOk(res, [CT_PLAIN], "GetCACaps"));
     _assertStrongProfile(caps, profile);
     return caps;
   }
-  // A CA that does not implement GetCACaps signals it with an HTTP error, which RFC 8894 sec. 3.5.1 reads
-  // as "no capabilities advertised": the codes that mean the operation is unsupported or unrecognized are
-  // 400 (an old CA that does not parse the query), 404 (no such operation), 405 (GET not allowed on it), and
-  // 501 Not Implemented. A transient server error (500, 502, 503) is surfaced instead of masked.
   if (res.status === 204 || res.status === 400 || res.status === 404 || res.status === 405 || res.status === 501) { _assertStrongProfile({}, profile); return {}; }
   throw _err("scep/http-error", "the SCEP GetCACaps returned HTTP " + res.status);
 }
 
-// The exact SPKI byte-match that identifies an issued certificate (RFC 5272 sec. 4.1); positional
-// guessing is forbidden. `certs` is an array of raw cert Buffers, `wantSpki` the SPKI Buffer to match.
 function findIssuedCert(certs, wantSpki) {
   if (!Buffer.isBuffer(wantSpki)) return null;
   for (var i = 0; i < certs.length; i++) {
@@ -822,12 +634,8 @@ function findIssuedCert(certs, wantSpki) {
   }
   return null;
 }
-// Normalize an expected fingerprint (hex string, optionally colon/space separated, or a Buffer) to
-// { algorithm, value }. Character-scan the hex (Hard rule #11).
 function _normalizeFingerprint(fp, algName) {
   var algorithm = _foldLower(String(algName == null ? "sha256" : algName));
-  // Validate the digest name at the entry point so a misspelled or build-unavailable fingerprintAlgorithm
-  // is the typed scep/bad-input the client API documents, not a native createHash exception downstream.
   try { nodeCrypto.createHash(algorithm); }
   catch (_e) { throw _err("scep/bad-input", "fingerprintAlgorithm " + JSON.stringify(algorithm) + " is not an available hash"); }
   var value;
@@ -877,9 +685,6 @@ function _normalizeFingerprint(fp, algName) {
 async function getCACert(baseUrl, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "scep/bad-input", "pki.scep.getCACert options");
   guard.identifier.assertKnownKeys(opts, _CACERT_KEYS, _err, "scep/bad-input", "pki.scep.getCACert has an unknown option: ");
-  // Normalize the expected fingerprint at the synchronous entry point: fail fast on a bad hash before the
-  // network call, and pin against the value the caller supplied at the call rather than one mutated while
-  // the GET is in flight.
   var fp = opts.expectedFingerprint != null ? _normalizeFingerprint(opts.expectedFingerprint, opts.fingerprintAlgorithm) : null;
   var res = await _client("GET", _scepUrl(baseUrl, "GetCACert"), null, {}, opts);
   var body = _requireOk(res, [CT_CA_CERT, CT_CA_RA_CERT], "GetCACert");
@@ -889,7 +694,6 @@ async function getCACert(baseUrl, opts) {
     certs = [Buffer.from(body)];
     single = true;
   } else {
-    // parseCertsOnly fails closed with scep/no-certificates on an empty CertificateSet, so certs is non-empty here.
     certs = schemaCms.parseCertsOnly(body, _err, "scep").certificates;
   }
   var caCertificate = null;
@@ -902,18 +706,60 @@ async function getCACert(baseUrl, opts) {
     if (!matched) throw _err("scep/fingerprint-mismatch", "no GetCACert certificate matched the expected " + fp.algorithm + " fingerprint (RFC 8894 sec. 2.2)");
     caCertificate = matched;
   } else if (single) {
-    // A single-certificate response (application/x-x509-ca-cert) is unambiguously the CA certificate. A
-    // ca-ra chain carries the CA, any intermediates, and RA certificate(s) in a CMS CertificateSet whose
-    // DER order does not identify the CA role, so caCertificate stays null there unless a fingerprint pins it.
     caCertificate = certs[0];
   }
   return { caCertificate: caCertificate, certificates: certs };
 }
 
-// The default transaction ID: 16 random bytes, hex-encoded. RFC 8894 sec. 3.2.1.1 requires the ID to be
-// unique per operation, so a per-key value would collide across separate enrollments of the same key (a
-// renewal could not be told from the original request). A caller wanting a stable per-device ID passes an
-// explicit transactionId.
+/**
+ * @primitive  pki.scep.getNextCACert
+ * @signature  pki.scep.getNextCACert(baseUrl, opts) -> Promise<{ certificates }>
+ * @since      0.6.14
+ * @status     stable
+ * @spec       RFC 8894
+ * @related    pki.scep.getCACert, pki.cms.verify
+ *
+ * Retrieve a SCEP CA's next (rollover) certificate (RFC 8894 sec. 4.7): a GET
+ * `?operation=GetNextCACert` returning a SignedData signed by the CURRENT CA signing key
+ * (`application/x-x509-next-ca-cert`), whose content is a degenerate certs-only SignedData carrying the
+ * CA certificate(s) to install when the current one expires. The current CA certificate the caller
+ * already holds authenticates the response: the outer signature is verified AND pinned to that
+ * certificate's key, so a self-consistent CMS signed by any other (embedded) certificate is refused
+ * (`scep/untrusted-signer`) rather than trusted as the rollover certificate. `caCertificate` is
+ * required; an unauthenticated rollover certificate becomes a future trust anchor, so it is refused
+ * rather than returned. The verified next certificate(s) are returned in `certificates`.
+ *
+ * @opts
+ *   - `caCertificate` -- the current SCEP CA certificate DER; the response is authenticated against its key (required).
+ *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` -- transport bounds.
+ * @example
+ *   // requires: caCertDer -- the current CA certificate (from getCACert), scepTransport
+ *   var next = await pki.scep.getNextCACert("http://ca.example/scep", { caCertificate: caCertDer, transport: scepTransport });
+ *   next.certificates[0];   // the next CA certificate DER, to install when the current one expires
+ */
+async function getNextCACert(baseUrl, opts) {
+  opts = guard.identifier.optionsObject(opts, _err, "scep/bad-input", "pki.scep.getNextCACert options");
+  guard.identifier.assertKnownKeys(opts, _NEXTCACERT_KEYS, _err, "scep/bad-input", "pki.scep.getNextCACert has an unknown option: ");
+  if (opts.caCertificate == null) throw _err("scep/bad-input", "a caCertificate (the current SCEP CA certificate DER) is required to authenticate the GetNextCACert response (RFC 8894 sec. 4.7.1)");
+  var currentCa = guard.bytes.snapshotSource(opts.caCertificate, ScepError, "scep/bad-input", "the caCertificate");
+  _assertSigningKeyUsage(currentCa, "the caCertificate");
+  var url = _scepUrl(baseUrl, "GetNextCACert");
+  var res = await _client("GET", url, null, {}, opts);
+  var body = _requireOk(res, [CT_NEXT_CA_CERT], "GetNextCACert");
+  var v;
+  try { v = await cmsVerify.verify(body, { certs: [currentCa] }); }
+  catch (e) {
+    if (e && e.code === "cms/detached-content-required") throw _err("scep/bad-response", "the GetNextCACert SignedData has no content; the rollover certificate(s) are the content (RFC 8894 sec. 4.7.1)", e);
+    if (e && e.isPkiError) throw _err("scep/bad-response", "the GetNextCACert response is not a verifiable CMS SignedData (RFC 8894 sec. 4.7.1): " + e.message, e);
+    throw e;
+  }
+  if (v.signers.length !== 1) throw _err("scep/bad-signer", "a GetNextCACert response must carry exactly one SignerInfo (RFC 8894 sec. 4.7.1), got " + v.signers.length);
+  if (v.valid !== true) throw _err("scep/bad-signature", "the GetNextCACert outer signature did not verify (RFC 8894 sec. 4.7.1)");
+  if (!_sameKey(v.signers[0].cert, currentCa)) throw _err("scep/untrusted-signer", "the GetNextCACert response was not signed by the current CA key (RFC 8894 sec. 4.7.1)");
+  var certs = schemaCms.parseCertsOnly(v.eContent, _err, "scep").certificates;
+  return { certificates: certs };
+}
+
 function _defaultTransactionId() {
   return nodeCrypto.randomBytes(16).toString("hex");
 }
@@ -924,22 +770,10 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
   if (opts.caCert == null) throw _err("scep/bad-input", "a caCert (the SCEP CA certificate DER) is required");
   if (opts.signer == null || typeof opts.signer !== "object") throw _err("scep/bad-input", "a signer { cert, key } is required");
   if (opts.recipientKey == null || typeof opts.recipientKey !== "object") throw _err("scep/bad-input", "a recipientKey { cert, key } is required to decrypt the CA response");
-  // Snapshot the response-authentication inputs at the synchronous entry point: the response is
-  // authenticated (signerCert) and decrypted (recipientKey) only after the build and POST awaits, so a
-  // caller mutating opts mid-flight cannot switch the trusted signer, or the CA the request was encrypted
-  // to, out from under the exchange. Certificate bytes are copied; the recipient private key and the
-  // request signer are held by reference.
   var caCert = guard.bytes.snapshotSource(opts.caCert, ScepError, "scep/bad-input", "the caCert");
   var signerCert = opts.responderCert != null ? guard.bytes.snapshotSource(opts.responderCert, ScepError, "scep/bad-input", "the responderCert") : caCert;
-  // Capture the recipient-key FIELDS at the door (snapshotSource copies the cert bytes; the private key is
-  // held by reference), not the opts.recipientKey object: a caller replacing opts.recipientKey.cert or .key
-  // while the POST is in flight must not switch the credential the response is decrypted with.
   var recipientKey = _captureRecipientKey(opts.recipientKey);
   var signer = opts.signer;
-  // The transport options are read by _client only after the build await, so snapshot them at the door too:
-  // a caller replacing opts.transport (rerouting the completed request) or opts.tls.cert/.key (presenting the
-  // next operation's mTLS identity) while the POST is in flight must not take effect. tls is shallow-copied
-  // so a replaced field does not reach the transport; the transport function and budgets are held by value.
   var clientOpts = {
     transport: opts.transport,
     tls: opts.tls != null ? Object.assign({}, opts.tls) : opts.tls,
@@ -948,8 +782,6 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
     timeout: opts.timeout,
     maxResponseBytes: opts.maxResponseBytes,
   };
-  // Resolve the request URL at the door: _scepUrl reads String(baseUrl) only when the POST is sent (after the
-  // build await), so a baseUrl whose toString() the caller changes mid-flight could otherwise redirect it.
   var postUrl = _scepUrl(baseUrl, "PKIOperation");
   var csrView = guard.bytes.snapshotSource(opts.csr, ScepError, "scep/bad-input", "the csr");
   var spki;
@@ -962,13 +794,8 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
   var body = _requireOk(res, [CT_PKI_MESSAGE], "PKIOperation");
   var rep = await parse(body, { signerCert: signerCert, expectedSenderNonce: senderNonce, recipientKey: recipientKey });
   if (rep.messageType !== "CertRep") throw _err("scep/unexpected-message-type", "the SCEP response is a " + rep.messageType + ", not a CertRep");
-  // Every message in one SCEP transaction carries the same transactionID (RFC 8894 sec. 3.2.1.1); a
-  // response whose transactionID does not echo the request is for a different exchange and is refused,
-  // even if its nonce and signer check out.
   if (rep.transactionId !== transactionId) throw _err("scep/transaction-id-mismatch", "the CertRep transactionID does not match the request (RFC 8894 sec. 3.2.1.1)");
   if (rep.pkiStatus === "FAILURE") {
-    // Surface the CA's reason as structured fields, not only interpolated text, so a caller can branch on
-    // the failInfo enumerant (RFC 8894 sec. 3.3.2.1) without parsing the human-readable message.
     var failErr = _err("scep/enrollment-failed", "the CA refused the request with failInfo " + JSON.stringify(rep.failInfo) + (rep.failInfoText ? " (" + rep.failInfoText + ")" : ""));
     failErr.failInfo = rep.failInfo;
     failErr.failInfoText = rep.failInfoText;
@@ -978,9 +805,6 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
   var repCerts = rep.certificates || [];
   var issued = findIssuedCert(repCerts, spki.bytes);
   if (issued == null) throw _err("scep/no-issued-cert", "the SUCCESS CertRep did not carry a certificate matching the request public key");
-  // A CMS CertificateSet states no issuance order, so a second certificate carrying the request public key
-  // (a same-key renewal returning old and new, or a duplicate) leaves the issued certificate ambiguous; it
-  // is refused rather than resolved by position.
   if (findIssuedCert(repCerts.filter(function (c) { return c !== issued; }), spki.bytes) != null) {
     throw _err("scep/ambiguous-issued-cert", "the SUCCESS CertRep carried more than one certificate matching the request public key; the issued certificate is ambiguous (RFC 8894 sec. 3.3)");
   }
@@ -1049,6 +873,7 @@ var _TRANSPORT_KEYS = { transport: 1, timeout: 1, maxResponseBytes: 1, maxRedire
 function _withKeys(extra) { var o = {}, k; for (k in _TRANSPORT_KEYS) o[k] = 1; for (k in extra) o[k] = 1; return o; }
 var _CACAPS_KEYS = _withKeys({ expectSCEPStandard: 1, requireStrongProfile: 1 });
 var _CACERT_KEYS = _withKeys({ expectedFingerprint: 1, fingerprintAlgorithm: 1 });
+var _NEXTCACERT_KEYS = _withKeys({ caCertificate: 1 });
 var _ENROLL_KEYS = _withKeys({ csr: 1, caCert: 1, signer: 1, recipientKey: 1, responderCert: 1, transactionId: 1 });
 
 module.exports = {
@@ -1056,6 +881,7 @@ module.exports = {
   parse: parse,
   getCACaps: getCACaps,
   getCACert: getCACert,
+  getNextCACert: getNextCACert,
   enroll: enroll,
   renew: renew,
   parseCapabilities: parseCapabilities,