@blamejs/pki 0.6.15 → 0.6.17

package/CHANGELOG.md

@@ -4,6 +4,33 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.17 — 2026-09-01
+
+pki.scep.getCert and pki.scep.getCrl retrieve an already-issued certificate or a CA's CRL over SCEP, sending RFC 8894 GetCert and GetCRL queries and reading the result out of the CA's signed CertRep.
+
+### Added
+
+- pki.scep.getCert(baseUrl, opts) retrieves an issued certificate over SCEP (RFC 8894 sec. 3.3.4). Name the target by { certificate } (the certificate whose issuer and serial identify it) or by { issuer, serialNumber } directly; the serial accepts a BigInt, a number, or a hex string. The CA response is verified against caCert (or responderCert), its recipientNonce must echo the query's fresh senderNonce, and the returned certificate is matched to the requested issuer and serial before it is handed back. A response carrying no matching certificate throws scep/cert-not-found; more than one throws scep/ambiguous-cert.
+- pki.scep.getCrl(baseUrl, opts) retrieves a CA's CRL over SCEP (RFC 8894 sec. 3.3.4), named the same way as getCert. The response is authenticated identically, and the returned CRL is bound to the query: getCrl returns the CRL whose issuer matches the requested CA, throwing scep/no-crl when the response carries no such CRL and scep/ambiguous-crl when it carries more than one. Per RFC 8894 sec. 2.7 a client should compose a GetCRL only when the CA supports neither a CRL distribution point nor HTTP access; prefer those and pki.schema.crl.parse where available.
+- pki.scep.build and pki.scep.parse now handle the GetCert (messageType 21) and GetCRL (messageType 22) queries: a pkcsPKIEnvelope carrying an IssuerAndSerialNumber (a CMS SEQUENCE of the issuer Name and the certificate serial), signed under the transaction attributes (RFC 8894 sec. 3.3.4).
+
+### Changed
+
+- pki.scep.parse accepts every messageType the RFC 8894 registry defines, including GetCert and GetCRL. A messageType outside the registry is still refused with scep/bad-message-type.
+
+## v0.6.16 — 2026-09-01
+
+pki.scep.enroll and pki.scep.renew poll a PENDING enrollment to its issued certificate, sending RFC 8894 CertPoll requests until the CA answers or a bounded poll-count and wait budget is exhausted.
+
+### Added
+
+- pki.scep.build and pki.scep.parse now handle the CertPoll (GetCertInitial, messageType 20) request: a pkcsPKIEnvelope carrying an IssuerAndSubject (the CA's subject name and the request's subject name), signed under the transaction attributes with the original transactionID (RFC 8894 sec. 3.3.3).
+- pki.scep.enroll and pki.scep.renew poll a PENDING response to a terminal status. New options bound the loop: pollCount (maximum CertPoll requests, default 5), maxTotalWait (total Retry-After sleep budget in seconds), sleep (an injectable (ms) -> Promise sleeper), and onRetryAfter (an observer of each delay). A budget exhausted with no terminal response throws scep/poll-exhausted carrying the transactionId to resume with. For a deployment whose request is encrypted to a separate RA certificate, issuerCert names the issuing CA the CertPoll must carry (default caCert).
+
+### Changed
+
+- pki.scep.enroll and pki.scep.renew poll by default when the CA answers PENDING: a PENDING enrollment now resolves to the issued certificate or throws, rather than returning { status: "PENDING" } for the caller to retry. Pass pollCount: 0 to restore the single-shot PENDING return and drive the retry yourself.
+
 ## v0.6.15 — 2026-09-01
 
 Verifying a Sigstore bundle no longer matches a pinned identity against a non-text subjectAltName value; the value is surfaced as null so the policy fails closed instead of comparing raw bytes. The library source also ships without its explanatory comments, keeping the JSDoc that generates the API reference and the SPDX license headers.

package/README.md

@@ -222,7 +222,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.schema.cmp` | CMP messages (RFC 9810): the header (version, sender and recipient including the anonymous NULL-DN, nonces, transaction id, general info), the 27-arm body (certificate requests via the CRMF parser, an encrypted certificate's EnvelopedData via CMS, response / revocation / confirmation / error / support / polling arms structural, the rest raw), and the exact `headerBytes` and `bodyBytes` slices an external verifier reconstructs the protected part from. The CMP-before-OCSP dispatch order is enforced Fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csrattrs` | EST CSR Attributes (`CsrAttrs`, RFC 8951 §3.5 / RFC 9908) — the `AttrOrOID` items a server sends to shape an enrollment: bare OIDs, attributes with raw values, and decoded views of the RFC 9908 meaningful types (extension requests, EC and RSA key-type conventions, the certification-request-info template). Unknown types are surfaced raw; structure and the RFC 9908 semantic MUSTs are fail-closed — `parse` |
 | `pki.est` | Enrollment over Secure Transport (RFC 7030 / 8951 / 9908 / 7616). The client verbs `cacerts`, `simpleenroll`, `simplereenroll`, `serverkeygen`, `csrattrs`, and `fullcmc` drive the RFC 7030 flow over `pki.transport` (inject your own via `opts.transport`, or take the fail-closed default): HTTPS only, an explicit trust anchor required, same-origin redirects followed while a downgrade or loop is refused, a 202 Retry-After surfaced but never slept, HTTP Basic or Digest (RFC 7616, SHA-256 / SHA-512-256; MD5 and no-qop refused by default) answered only after the server is authenticated, and the issued certificate chosen by public-key match. `serverkeygen` requests a server-generated key, cleartext or an opaque CMS EnvelopedData, with encryption bound to the CSR's key-identifier attribute over a confidentiality-bearing cipher. `csrattrs` fetches the CA's RFC 9908 attributes policy. `fullcmc` (§4.3) carries a CMC Full PKI Request and reduces the CA's answer through `pki.cmc.verify` to one terminal outcome, refusing a response that fails to echo the transaction and nonce the request carried, or that covers a key the request never asked for; a certs-only reply to a bound request is refused rather than read as an issuance. Under the verbs sit the transport-agnostic codecs they compose: the RFC 8951 base64 transfer codec (which ignores Content-Transfer-Encoding), the `multipart/mixed` splitter, the certs-only and serverkeygen response validators over CMS, the enroll-attribute builders, and the HTTP response classifier — `transferDecode`/`transferEncode`, `parseCertsOnly`, `splitMultipartMixed`, `parseServerKeygenResponse`, `findIssuedCert`, `classifyResponse`, `paths`, and the builders |
-| `pki.scep` | SCEP pkiMessage codec (RFC 8894), the client side of Simple Certificate Enrollment. `build(spec)` assembles a `PKCSReq` or `RenewalReq` request: it verifies the PKCS#10 certification request's own proof-of-possession, encrypts it to the CA as the inner EnvelopedData (`pkcsPKIEnvelope`, AES-128-CBC), and signs that under the transaction attributes RFC 8894 §3.2 defines, a messageType, a caller-unique transactionId, and a 16-byte senderNonce. The recipient CA certificate must assert `keyEncipherment`. `parse(bytes, opts?)` reads a `PKCSReq`, `RenewalReq`, or `CertRep` back (the `CertPoll`, `GetCert`, and `GetCRL` client queries are refused): it verifies the outer signature first and refuses a message whose signature does not check, so the transaction attributes it returns come only from a verified signer, never alongside a false verdict. Because a valid signature only proves self-consistency with the embedded certificate, pass `opts.signerCert` to authenticate a CA response against the CA certificate you hold (a public-key mismatch is refused, `signerAuthenticated` reports the result); a caller that omits it gets a crypto-only verdict and must authenticate the surfaced `signerCert` itself. It maps the messageType, pkiStatus, failInfo, and the nonces from their RFC 8894 enumerants and refuses an unknown one; given `recipientKey` it decrypts the `pkcsPKIEnvelope` to the messageData, and given `expectedSenderNonce` it refuses a response whose recipientNonce does not echo it. It reads a CA's CertRep in full. `getCACaps(baseUrl, opts?)`, `getCACert(baseUrl, opts?)`, `getNextCACert(baseUrl, opts)`, `enroll(baseUrl, opts)`, and `renew(baseUrl, opts)` carry that codec to a live CA over HTTP (RFC 8894 §4) through an injectable transport (`pki.transport.https` by default): `getCACaps` reports the CA's advertised capabilities and never lowers the client's algorithm choice on the unauthenticated response, `getCACert` pins the CA certificate to an out-of-band `expectedFingerprint` a returned certificate must match, `getNextCACert` fetches the CA's next (rollover) certificate and verifies the SignedData response against the current CA certificate (`caCertificate`) before returning it, refusing a response signed by any other key, and `enroll` and `renew` POST a PKCSReq or RenewalReq, authenticate the CertRep against the CA certificate and its nonce echo, select the issued certificate by public-key match, throw on a FAILURE with the CA's failInfo, and return a PENDING to retry. Issuing a CertRep and automatic polling are not yet built — `build`, `parse`, `getCACaps`, `getCACert`, `getNextCACert`, `enroll`, `renew` |
+| `pki.scep` | SCEP pkiMessage codec (RFC 8894), the client side of Simple Certificate Enrollment. `build(spec)` assembles a request: a `PKCSReq` or `RenewalReq` wraps a PKCS#10 certification request, whose own proof-of-possession it verifies first; a `CertPoll` wraps an IssuerAndSubject naming the issuing CA and the request subject; and a `GetCert` or `GetCRL` wraps an IssuerAndSerialNumber naming a certificate by its issuer and a positive serial of at most 20 octets. It encrypts the messageData to the CA as the inner EnvelopedData (`pkcsPKIEnvelope`, AES-128-CBC), and signs that under the transaction attributes RFC 8894 §3.2 defines, a messageType, a caller-unique transactionId, and a 16-byte senderNonce. The recipient CA certificate must assert `keyEncipherment`. `parse(bytes, opts?)` reads a `PKCSReq`, `RenewalReq`, `CertPoll`, `GetCert`, `GetCRL`, or `CertRep` back (a messageType outside the RFC 8894 registry is refused): it verifies the outer signature first and refuses a message whose signature does not check, so the transaction attributes it returns come only from a verified signer, never alongside a false verdict. Because a valid signature only proves self-consistency with the embedded certificate, pass `opts.signerCert` to authenticate a CA response against the CA certificate you hold (a public-key mismatch is refused, `signerAuthenticated` reports the result); a caller that omits it gets a crypto-only verdict and must authenticate the surfaced `signerCert` itself. It maps the messageType, pkiStatus, failInfo, and the nonces from their RFC 8894 enumerants and refuses an unknown one; given `recipientKey` it decrypts the `pkcsPKIEnvelope` to the messageData, and given `expectedSenderNonce` it refuses a response whose recipientNonce does not echo it. It reads a CA's CertRep in full. `getCACaps(baseUrl, opts?)`, `getCACert(baseUrl, opts?)`, `getNextCACert(baseUrl, opts)`, `enroll(baseUrl, opts)`, `renew(baseUrl, opts)`, `getCert(baseUrl, opts)`, and `getCrl(baseUrl, opts)` carry that codec to a live CA over HTTP (RFC 8894 §4) through an injectable transport (`pki.transport.https` by default): `getCACaps` reports the CA's advertised capabilities and never lowers the client's algorithm choice on the unauthenticated response, `getCACert` pins the CA certificate to an out-of-band `expectedFingerprint` a returned certificate must match, `getNextCACert` fetches the CA's next (rollover) certificate and verifies the SignedData response against the current CA certificate (`caCertificate`) before returning it, refusing a response signed by any other key, and `enroll` and `renew` POST a PKCSReq or RenewalReq, authenticate the CertRep against the CA certificate and its nonce echo, select the issued certificate by public-key match, throw on a FAILURE with the CA's failInfo, and poll a PENDING response with CertPoll requests until the CA answers or a bounded poll-count and total-wait budget is spent. `getCert` and `getCrl` retrieve an already-issued certificate or a CA CRL by issuer and serial number, authenticated the same way; RFC 8894 §2.6, §2.7, and §3.3.4 recommend these queries only where HTTP certificate-store access (RFC 4387), LDAP, or a CRL distribution point is unavailable, so prefer those where a CA offers them. Issuing a CertRep (the certification-authority side) is not yet built — `build`, `parse`, `parseCapabilities`, `getCACaps`, `getCACert`, `getNextCACert`, `enroll`, `renew`, `getCert`, `getCrl` |
 | `pki.transport` | The shared, fail-closed `node:https` transport the enrollment clients drive. `pki.transport.https(defaults)` returns a `transport(request) → { status, headers, body, tls }`, where `tls` carries the negotiated `protocol`, `cipher`, and raw `peerCertificate`. This is the toolkit's only socket choke point: an explicit trust anchor (or an opt-in to the system store) is required, `rejectUnauthorized` is always on, TLS is floored at 1.2, the response body is capped while it streams, and a stalled socket times out. The EST, ACME, and CMP clients reuse it verbatim. If you inject your own transport, return `tls` too: `pki.est.serverkeygen` asserts the negotiated cipher can protect the delivered private key, and a transport that reports no cipher is trusted rather than refused, so omitting the field silently skips that check — `https` |
 | `pki.jose` | Flattened JWS (RFC 7515) and JWK thumbprints (RFC 7638). `sign` and `verify` run a Flattened JWS against declarative profiles (ACME outer, EAB inner, keyChange inner) that carry the required and forbidden header rules as data. `base64url` is the strict RFC 4648 §5 codec, rejecting padding, non-alphabet characters, and non-canonical trailing bits. `parseJson` is a bounded reader that refuses duplicate members at any depth. `thumbprint` is the RFC 7638 / 8037 / 9964 canonical digest. The algorithm registry binds each `alg` to its key type (ES/RS/PS/EdDSA/ML-DSA), leaving no code path for `alg:none`, an RS256→HS256 key confusion, or an all-zero ECDSA signature; `assertPublicJwk` refuses a JWK carrying private material, so an exported private key is never published. `opts.key` names the key a message must be signed under and governs: where the profile also permits an embedded header `jwk`, the two must be the same key — compared as RFC 7638 thumbprints, so member order cannot make equal keys differ — and a disagreement is refused rather than resolved in the message's favor. `keySource` reports which key answered, since a signature checked against a key you named is a different claim from one checked against the key the message carried — `sign`, `verify`, `base64url`, `parseJson`, `thumbprint`, `assertPublicJwk` |
 | `pki.acme` | ACME (RFC 8555 / 8737 / 8738 / 9773). `client(directoryUrl, opts)` is a stateful client driving a live CA directory over `pki.transport`: `newAccount`, `newOrder`, `newAuthz`, `getOrder`, `getAuthorization`, `getChallenge`, `respondToChallenge`, `finalize`, `pollOrder`, `pollAuthorization`, and `downloadCertificate` walk the issuance flow, with `newAuthz` pre-authorizing a single identifier (§7.4.1) and `downloadCertificate` binding the issued certificate to the order — its key, its identifiers, or both; at least one is required by default and the result reports `boundToKey` / `boundToIdentifiers` — before choosing among alternate chains (`Link rel="alternate"`, §7.4.2, via a `selectChain` predicate bounded by `maxAlternates`). `revokeCert` (account-key or certificate-key signed), `keyChange`, `updateAccount` (change the account contacts, §7.3.2), `listOrders` (the account's orders list, following the §7.1.2.1 `Link rel="next"` pagination bounded by a page cap and confined to the orders origin), `deactivateAccount`, `deactivateAuthorization`, `renewalInfo` (ARI), and `renewalWindow` (the RFC 9773 §4.2/4.3 renewal decision) complete the lifecycle. Every URL is HTTPS only, an explicit trust anchor is required, each request carries a fresh single-use nonce with a bounded badNonce retry (and, when `opts.resignKeys` supplies caller-approved alternative account-key algorithms, a bounded RFC 8555 §6.2 badSignatureAlgorithm re-sign that the CA's advertised list can only filter, never widen, so it cannot force a weaker algorithm), reads are POST-as-GET, polling is bounded and sleeps on a Retry-After via an injectable sleeper capped by a poll count and a total-wait budget, and every response body is size-capped. The transport is injectable via `opts.transport`. Over the message layer it composes resource-object validators (closed status enums, conditional-required fields, unknown fields ignored), the three §7.1.6 state machines, the request builders (newAccount with External Account Binding, newOrder with `replaces`, finalize with a CSR identifier-set match and account-key-reuse rejection, challenge responses, deactivation, revokeCert in both key modes, the keyChange nested JWS, POST-as-GET), the http-01 / dns-01 / tls-alpn-01 challenge computations, the dns and ip identifier validators, and the ARI certID with serial sign-padding preserved — `client`, `validate`, `identify`, `assertTransition`, the builders, `keyAuthorization`, `http01`, `dns01`, `tlsAlpn01Extension`, `verifyTlsAlpn01`, `ariCertId` |

package/index.js

@@ -171,7 +171,7 @@ module.exports = {
   // splitter, certs-only + serverkeygen validators over CMS, the enroll-attribute
   // builders, the HTTP response classifier). est opens no socket; fail-closed.
   est:       est,
-  scep:      { build: scep.build, parse: scep.parse, getCACaps: scep.getCACaps, getCACert: scep.getCACert, getNextCACert: scep.getNextCACert, enroll: scep.enroll, renew: scep.renew, parseCapabilities: scep.parseCapabilities },
+  scep:      { build: scep.build, parse: scep.parse, getCACaps: scep.getCACaps, getCACert: scep.getCACert, getNextCACert: scep.getNextCACert, enroll: scep.enroll, renew: scep.renew, getCert: scep.getCert, getCrl: scep.getCrl, parseCapabilities: scep.parseCapabilities },
   // `transport` is the shared fail-closed node:https transport the enrollment clients
   // drive -- pki.transport.https(defaults) returns a transport(request) -> {status,
   // headers, body}. The toolkit's sole socket choke point: explicit trust anchors,

package/lib/scep.js

@@ -16,7 +16,8 @@
  *   outer SignedData that signs it under a set of authenticated transaction
  *   attributes -- messageType, transactionID, pkiStatus, failInfo, and the
  *   sender/recipient nonces (RFC 8894 sec. 3). `pki.scep.build` assembles a
- *   request pkiMessage (PKCSReq / RenewalReq); `pki.scep.parse` verifies the
+ *   request pkiMessage (PKCSReq, RenewalReq, CertPoll, GetCert, or GetCRL);
+ *   `pki.scep.parse` verifies the
  *   outer signature, reads the transaction attributes BOUND to the verified
  *   signer, and (given the recipient key) decrypts the pkcsPKIEnvelope to the
  *   messageData.
@@ -28,10 +29,10 @@
  *   pki.transport separately.
  *
  * @card
- *   Build and read SCEP (RFC 8894) enrollment messages: a PKCSReq / RenewalReq
- *   request wrapped in the signed-over-encrypted CMS layering, and a PKCSReq,
- *   RenewalReq, or CertRep parsed back to its verified transaction attributes and
- *   decrypted messageData.
+ *   Build and read SCEP (RFC 8894) client messages: a PKCSReq, RenewalReq,
+ *   CertPoll, GetCert, or GetCRL request wrapped in the signed-over-encrypted CMS
+ *   layering, and any of those or a CertRep parsed back to its verified transaction
+ *   attributes and decrypted messageData.
  */
 
 var frameworkError = require("./framework-error");
@@ -50,9 +51,12 @@ var schemaCsr = require("./schema-csr");
 var schemaX509 = require("./schema-x509");
 var schemaCrl = require("./schema-crl");
 var pkix = require("./schema-pkix");
+var schema = require("./schema-engine");
 var guard = require("./guard-all");
 var C = require("./constants");
 var httpTransport = require("./http-transport");
+var retryAfter = require("./http-retry-after");
+var _defaultSleep = require("./sleep").sleep;
 var nodeCrypto = require("node:crypto");
 
 function _err(code, msg, cause) { return new ScepError(code, msg, cause); }
@@ -66,7 +70,7 @@ var FAIL_INFO = { badAlg: "0", badMessageCheck: "1", badRequest: "2", badTime: "
 function _invert(table) { var o = Object.create(null); for (var k in table) if (Object.prototype.hasOwnProperty.call(table, k)) o[table[k]] = k; return o; }
 var MESSAGE_TYPE_BY_CODE = _invert(MESSAGE_TYPE), PKI_STATUS_BY_CODE = _invert(PKI_STATUS), FAIL_INFO_BY_CODE = _invert(FAIL_INFO);
 
-var _PARSE_SUPPORTED = { PKCSReq: 1, RenewalReq: 1, CertRep: 1 };
+var _PARSE_SUPPORTED = { PKCSReq: 1, RenewalReq: 1, CertRep: 1, CertPoll: 1, GetCert: 1, GetCRL: 1 };
 
 var ENVELOPE_CIPHER = "aes-128-cbc";
 
@@ -207,7 +211,10 @@ function _captureRecipientKey(rk) {
  * Assemble a SCEP pkiMessage (RFC 8894 sec. 3). A request (`PKCSReq` / `RenewalReq`) encrypts the
  * supplied PKCS#10 `messageData` to the recipient CA certificate as the inner EnvelopedData
  * (`pkcsPKIEnvelope`, AES-128-CBC), then signs it under the transaction attributes with the caller's
- * signer certificate and key. `transactionId` is a caller-unique PrintableString; `senderNonce` is a
+ * signer certificate and key. A `CertPoll` (GetCertInitial) query wraps an IssuerAndSubject that names
+ * the issuing CA and the request subject; a `GetCert` or `GetCRL` query wraps an IssuerAndSerialNumber
+ * that names a certificate by its issuer and serial. Every form is enveloped and signed the same way.
+ * `transactionId` is a caller-unique PrintableString; `senderNonce` is a
  * 16-byte value (a fresh random one is generated when omitted). The recipient CA certificate must
  * assert the `keyEncipherment` key usage (the EnvelopedData uses RSA key transport). The content key
  * is transported under RSAES-OAEP (SHA-256), the toolkit's key-transport algorithm; the legacy
@@ -219,8 +226,11 @@ function _captureRecipientKey(rk) {
  * match. The proof-of-possession over the PKCS#10 itself is verified regardless.
  *
  * @opts
- *   - `messageType` -- "PKCSReq" | "RenewalReq" (this release's request set).
- *   - `messageData` -- the PKCS#10 CertificationRequest DER to enrol.
+ *   - `messageType` -- "PKCSReq" | "RenewalReq" | "CertPoll" | "GetCert" | "GetCRL".
+ *   - `messageData` -- the PKCS#10 CertificationRequest DER, for a PKCSReq or RenewalReq.
+ *   - `requestSubject` -- the request subject Name DER, for a CertPoll.
+ *   - `certificate` -- for a GetCert or GetCRL, the certificate DER whose issuer and serial name the target (the convenience form).
+ *   - `issuer` / `serialNumber` -- for a GetCert or GetCRL, the issuer Name DER and a positive serial (a BigInt, number, or hex string) naming the target directly. For a CertPoll, `issuer` alone names the issuing CA (defaulting to the recipient's subject) when the request is encrypted to a separate RA.
  *   - `recipient` -- the CA (or RA) certificate DER the messageData is encrypted to (an RSA key-transport certificate; a non-RSA recipient is refused, since the envelope uses RSAES-OAEP).
  *   - `signer` -- `{ cert, key }`, the outer SignedData signer (the client for a request).
  *   - `transactionId` -- a caller-unique PrintableString identifying the transaction.
@@ -239,23 +249,30 @@ async function build(spec) {
   guard.identifier.assertKnownKeys(spec, _BUILD_KEYS, _err, "scep/bad-input", "pki.scep.build has an unknown option: ");
   var mtCode = MESSAGE_TYPE[spec.messageType];
   if (mtCode == null) throw _err("scep/bad-message-type", "unknown messageType " + JSON.stringify(spec.messageType) + " (RFC 8894 sec. 3.2.1.2)");
-  if (spec.messageType !== "PKCSReq" && spec.messageType !== "RenewalReq") {
-    throw _err("scep/bad-message-type", "pki.scep.build issues a request (PKCSReq / RenewalReq); " + spec.messageType + " is not built in this release");
+  if (spec.messageType !== "PKCSReq" && spec.messageType !== "RenewalReq" && spec.messageType !== "CertPoll" && spec.messageType !== "GetCert" && spec.messageType !== "GetCRL") {
+    throw _err("scep/bad-message-type", "pki.scep.build issues a request (PKCSReq / RenewalReq / CertPoll / GetCert / GetCRL); " + spec.messageType + " is not built in this release");
   }
   if (spec.signer == null || typeof spec.signer !== "object") throw _err("scep/bad-input", "a signer { cert, key } is required");
   var senderNonce = _nonce(spec.senderNonce, "senderNonce");
   var txnId = _transactionId(spec.transactionId);
-  var messageData = guard.bytes.snapshotSource(spec.messageData, ScepError, "scep/bad-input", "messageData");
   var recipient = guard.bytes.snapshotSource(spec.recipient, ScepError, "scep/bad-input", "recipient");
   _assertRsaRecipient(recipient);
   var signerCert = guard.bytes.snapshotSource(spec.signer.cert, ScepError, "scep/bad-input", "signer.cert");
   _assertSigningKeyUsage(signerCert, "signer certificate");
   var signerKey = spec.signer.key;
-  var parsedCsr;
-  try { parsedCsr = schemaCsr.parse(messageData); }
-  catch (e) { throw _err("scep/bad-input", "messageData is not a valid PKCS#10 CertificationRequest (RFC 8894 sec. 3.3.1): " + e.message, e); }
-  if (!(await csrVerify.verifyCsrSignature(parsedCsr))) {
-    throw _err("scep/bad-popo", "the PKCS#10 messageData failed its proof-of-possession: its self-signature does not verify under its own subject public key, so a CA would reject it");
+  var messageData;
+  if (spec.messageType === "CertPoll") {
+    messageData = _buildIssuerAndSubject(recipient, spec.requestSubject, spec.issuer);
+  } else if (spec.messageType === "GetCert" || spec.messageType === "GetCRL") {
+    messageData = _buildIssuerAndSerial(spec);
+  } else {
+    messageData = guard.bytes.snapshotSource(spec.messageData, ScepError, "scep/bad-input", "messageData");
+    var parsedCsr;
+    try { parsedCsr = schemaCsr.parse(messageData); }
+    catch (e) { throw _err("scep/bad-input", "messageData is not a valid PKCS#10 CertificationRequest (RFC 8894 sec. 3.3.1): " + e.message, e); }
+    if (!(await csrVerify.verifyCsrSignature(parsedCsr))) {
+      throw _err("scep/bad-popo", "the PKCS#10 messageData failed its proof-of-possession: its self-signature does not verify under its own subject public key, so a CA would reject it");
+    }
   }
   var pkcsPKIEnvelope;
   try {
@@ -276,7 +293,73 @@ async function build(spec) {
     throw e;
   }
 }
-var _BUILD_KEYS = { messageType: 1, messageData: 1, recipient: 1, signer: 1, transactionId: 1, senderNonce: 1 };
+var _BUILD_KEYS = { messageType: 1, messageData: 1, recipient: 1, requestSubject: 1, issuer: 1, certificate: 1, serialNumber: 1, signer: 1, transactionId: 1, senderNonce: 1 };
+
+function _buildIssuerAndSubject(recipientCertDer, requestSubjectSource, issuerOverride) {
+  var subject = guard.bytes.snapshotSource(requestSubjectSource, ScepError, "scep/bad-input", "requestSubject");
+  var issuer, issuerNode, subjNode;
+  try {
+    issuer = issuerOverride != null
+      ? guard.bytes.snapshotSource(issuerOverride, ScepError, "scep/bad-input", "issuer")
+      : schemaX509.parse(recipientCertDer).subject.bytes;
+    issuerNode = asn1.decode(issuer);
+    subjNode = asn1.decode(subject);
+  } catch (e) {
+    if (e instanceof ScepError) throw e;
+    throw _err("scep/bad-input", "the CertPoll IssuerAndSubject Names are not valid DER (RFC 8894 sec. 3.3.3): " + e.message, e);
+  }
+  _assertNameNode(issuerNode, "scep/bad-input", "the CertPoll issuer must be an X.509 Name DER (RFC 8894 sec. 3.3.3)", true);
+  _assertNameNode(subjNode, "scep/bad-input", "the CertPoll requestSubject must be an X.509 Name DER (RFC 8894 sec. 3.3.3)");
+  return b.sequence([issuer, subject]);
+}
+
+function _serialToInteger(s) {
+  var n;
+  if (typeof s === "bigint") n = s;
+  else if (typeof s === "number") { if (!Number.isSafeInteger(s)) throw _err("scep/bad-input", "serialNumber as a number must be a safe integer"); n = BigInt(s); }
+  else if (typeof s === "string" && s.length > 0) {
+    var t = (s.slice(0, 2) === "0x" || s.slice(0, 2) === "0X") ? s.slice(2) : s;
+    try { n = BigInt("0x" + t); } catch (_e) { throw _err("scep/bad-input", "serialNumber must be a hex string, a non-negative safe integer, or a BigInt: " + JSON.stringify(s)); }
+  } else {
+    throw _err("scep/bad-input", "serialNumber must be a hex string, a non-negative safe integer, or a BigInt");
+  }
+  if (n <= 0n) throw _err("scep/bad-input", "serialNumber must be a positive integer (RFC 5280 sec. 4.1.2.2)");
+  return n;
+}
+
+function _assertNameNode(node, code, message, requireNonEmpty) {
+  var walked;
+  try { walked = schema.walk(pkix.name(_KU_NS), node, _KU_NS); }
+  catch (e) {
+    throw _err(code, message + " (RFC 5280 sec. 4.1.2.4): " + e.message, e);
+  }
+  if (requireNonEmpty && !walked.result.rdns.length) {
+    throw _err(code, message + ": a distinguished name naming a certificate issuer must be non-empty (RFC 5280 sec. 4.1.2.4)");
+  }
+}
+
+function _buildIssuerAndSerial(spec) {
+  var hasCert = spec.certificate != null;
+  var hasExplicit = spec.issuer != null || spec.serialNumber != null;
+  if (hasCert === hasExplicit) throw _err("scep/bad-input", "a GetCert / GetCRL query needs exactly one of { certificate } or { issuer, serialNumber } (RFC 8894 sec. 3.3.4)");
+  var issuer, serial;
+  if (hasCert) {
+    var cert = guard.bytes.snapshotSource(spec.certificate, ScepError, "scep/bad-input", "certificate");
+    try { var w = schemaX509.parse(cert); issuer = w.issuer.bytes; serial = w.serialNumber; }
+    catch (e) { throw _err("scep/bad-input", "certificate is not a parseable X.509 certificate (RFC 8894 sec. 3.3.4): " + e.message, e); }
+  } else {
+    if (spec.issuer == null || spec.serialNumber == null) throw _err("scep/bad-input", "the explicit form of a GetCert / GetCRL query needs both issuer and serialNumber (RFC 8894 sec. 3.3.4)");
+    serial = _serialToInteger(spec.serialNumber);
+    issuer = guard.bytes.snapshotSource(spec.issuer, ScepError, "scep/bad-input", "issuer");
+    var node;
+    try { node = asn1.decode(issuer); } catch (e) { throw _err("scep/bad-input", "issuer is not a valid Name DER (RFC 8894 sec. 3.3.4): " + e.message, e); }
+    _assertNameNode(node, "scep/bad-input", "issuer must be an X.509 Name DER (RFC 8894 sec. 3.3.4)", true);
+  }
+  if (serial <= 0n) throw _err("scep/bad-input", "the query serialNumber must be a positive integer; a certificate with a non-positive serial cannot be named in a conforming query (RFC 5280 sec. 4.1.2.2)");
+  var serialTlv = b.integer(serial);
+  if (asn1.decode(serialTlv).content.length > 20) throw _err("scep/bad-input", "the query serialNumber must not exceed 20 octets (RFC 5280 sec. 4.1.2.2)");
+  return b.sequence([issuer, serialTlv]);
+}
 
 /**
  * @primitive  pki.scep.parse
@@ -289,8 +372,8 @@ var _BUILD_KEYS = { messageType: 1, messageData: 1, recipient: 1, signer: 1, tra
  * Disassemble a SCEP pkiMessage (RFC 8894 sec. 3): verify the outer SignedData signature, read the
  * transaction attributes BOUND to the verified signer (never from a separate untrusted parse), and,
  * given the recipient key, decrypt the pkcsPKIEnvelope to recover the messageData. It reads the
- * enrollment message types PKCSReq, RenewalReq, and CertRep; the CertPoll, GetCert, and GetCRL client
- * queries a CA processes are refused (`scep/unsupported-message-type`). The verdict is
+ * message types PKCSReq, RenewalReq, CertRep, CertPoll, GetCert, and GetCRL; a messageType the RFC 8894
+ * registry does not define is refused (`scep/bad-message-type`). The verdict is
  * `{ signatureValid, signerAuthenticated, signerCert, messageType, transactionId, senderNonce,
  * recipientNonce, pkiStatus, failInfo, failInfoText, messageData, certificates, crls }` (fields null
  * when the message does not carry them). For a decrypted SUCCESS CertRep, `certificates` and `crls`
@@ -418,6 +501,26 @@ async function parse(bytes, opts) {
     } else if (messageType === "PKCSReq" || messageType === "RenewalReq") {
       try { schemaCsr.parse(dec.content); }
       catch (e) { throw _err("scep/bad-request-payload", "a " + messageType + " messageData must be a PKCS#10 CertificationRequest (RFC 8894 sec. 3.3.1)", e); }
+    } else if (messageType === "CertPoll") {
+      var ias;
+      try { ias = asn1.decode(dec.content); }
+      catch (e) { throw _err("scep/bad-request-payload", "a CertPoll messageData must be an IssuerAndSubject (RFC 8894 sec. 3.3.3)", e); }
+      var iasCh = pkix.rootSequenceChildren(ias, 2, 2);
+      if (!iasCh) throw _err("scep/bad-request-payload", "a CertPoll messageData must be an IssuerAndSubject: a SEQUENCE of two Name values (RFC 8894 sec. 3.3.3)");
+      _assertNameNode(iasCh[0], "scep/bad-request-payload", "a CertPoll messageData issuer must be an X.509 Name (RFC 8894 sec. 3.3.3)", true);
+      _assertNameNode(iasCh[1], "scep/bad-request-payload", "a CertPoll messageData requestSubject must be an X.509 Name (RFC 8894 sec. 3.3.3)");
+    } else if (messageType === "GetCert" || messageType === "GetCRL") {
+      var isn;
+      try { isn = asn1.decode(dec.content); }
+      catch (e) { throw _err("scep/bad-request-payload", "a " + messageType + " messageData must be an IssuerAndSerialNumber (RFC 8894 sec. 3.3.4)", e); }
+      var isnCh = pkix.rootSequenceChildren(isn, 2, 2);
+      if (!isnCh) throw _err("scep/bad-request-payload", "a " + messageType + " messageData must be an IssuerAndSerialNumber: a SEQUENCE of a Name and an INTEGER (RFC 8894 sec. 3.3.4)");
+      _assertNameNode(isnCh[0], "scep/bad-request-payload", "a " + messageType + " messageData issuer must be an X.509 Name (RFC 8894 sec. 3.3.4)", true);
+      var isnSerial;
+      try { isnSerial = asn1.read.integer(isnCh[1]); }
+      catch (e) { throw _err("scep/bad-request-payload", "a " + messageType + " messageData serialNumber must be a DER INTEGER (RFC 8894 sec. 3.3.4)", e); }
+      if (isnSerial <= 0n) throw _err("scep/bad-request-payload", "a " + messageType + " messageData serialNumber must be a positive integer (RFC 5280 sec. 4.1.2.2)");
+      if (isnCh[1].content.length > 20) throw _err("scep/bad-request-payload", "a " + messageType + " messageData serialNumber must not exceed 20 octets (RFC 5280 sec. 4.1.2.2)");
     }
   }
   return out;
@@ -763,6 +866,62 @@ async function getNextCACert(baseUrl, opts) {
 function _defaultTransactionId() {
   return nodeCrypto.randomBytes(16).toString("hex");
 }
+var POLL_COUNT_MAX = 1000;
+
+function _dispatchCertRep(rep, transactionId, spki) {
+  if (rep.messageType !== "CertRep") throw _err("scep/unexpected-message-type", "the SCEP response is a " + rep.messageType + ", not a CertRep");
+  if (rep.transactionId !== transactionId) throw _err("scep/transaction-id-mismatch", "the CertRep transactionID does not match the request (RFC 8894 sec. 3.2.1.1)");
+  if (rep.pkiStatus === "FAILURE") {
+    var failErr = _err("scep/enrollment-failed", "the CA refused the request with failInfo " + JSON.stringify(rep.failInfo) + (rep.failInfoText ? " (" + rep.failInfoText + ")" : ""));
+    failErr.failInfo = rep.failInfo;
+    failErr.failInfoText = rep.failInfoText;
+    throw failErr;
+  }
+  if (rep.pkiStatus === "PENDING") return { pending: true };
+  var repCerts = rep.certificates || [];
+  var issued = findIssuedCert(repCerts, spki.bytes);
+  if (issued == null) throw _err("scep/no-issued-cert", "the SUCCESS CertRep did not carry a certificate matching the request public key");
+  if (findIssuedCert(repCerts.filter(function (c) { return c !== issued; }), spki.bytes) != null) {
+    throw _err("scep/ambiguous-issued-cert", "the SUCCESS CertRep carried more than one certificate matching the request public key; the issued certificate is ambiguous (RFC 8894 sec. 3.3)");
+  }
+  return { pending: false, result: { status: "SUCCESS", certificate: issued, certificates: repCerts, transactionId: rep.transactionId } };
+}
+
+function _pollExhausted(which, transactionId, senderNonce) {
+  var e = _err("scep/poll-exhausted", "the CA kept the request PENDING and " + which + " was exhausted before it resolved (RFC 8894 sec. 4.4); resume the transaction later with this transactionId");
+  e.transactionId = transactionId;
+  e.senderNonce = senderNonce;
+  return e;
+}
+
+async function _pollForIssuance(ctx) {
+  var issuerName;
+  try { issuerName = schemaX509.parse(ctx.issuerCert).subject.bytes; }
+  catch (e) { throw _err("scep/bad-input", "the issuerCert whose subject names the CertPoll issuer is not a parseable certificate (RFC 8894 sec. 3.3.3)", e); }
+  var res = ctx.firstResponse, count = 0, waitedMs = 0, lastNonce = ctx.firstSenderNonce;
+  for (;;) {
+    var delaySec = 1;
+    var ra = _header(res.headers, "retry-after");
+    if (typeof ra === "string" && ra.trim() !== "") {
+      var parsed = retryAfter.parse(ra, { now: Date.now(), E: _err, code: "scep/bad-input", lenient: true });
+      if (parsed.retryAfterSeconds != null) delaySec = parsed.retryAfterSeconds;
+    }
+    count += 1;
+    if (count > ctx.pollCount) throw _pollExhausted("the poll count", ctx.transactionId, lastNonce);
+    waitedMs += delaySec * C.TIME.seconds(1);
+    if (waitedMs > ctx.maxTotalWait * C.TIME.seconds(1)) throw _pollExhausted("the total wait budget", ctx.transactionId, lastNonce);
+    if (ctx.onRetryAfter) ctx.onRetryAfter(delaySec);
+    await ctx.sleep(delaySec * C.TIME.seconds(1));
+    var sn = nodeCrypto.randomBytes(16);
+    lastNonce = sn;
+    var certPoll = await build({ messageType: "CertPoll", requestSubject: ctx.csrSubject, issuer: issuerName, recipient: ctx.caCert, signer: ctx.signer, transactionId: ctx.transactionId, senderNonce: sn });
+    res = await _client("POST", ctx.postUrl, certPoll, { "content-type": CT_PKI_MESSAGE }, ctx.clientOpts);
+    var body = _requireOk(res, [CT_PKI_MESSAGE], "PKIOperation");
+    var rep = await parse(body, { signerCert: ctx.signerCert, expectedSenderNonce: sn, recipientKey: ctx.recipientKey });
+    var d = _dispatchCertRep(rep, ctx.transactionId, ctx.spki);
+    if (!d.pending) return d.result;
+  }
+}
 async function _pkiOperation(messageType, baseUrl, opts, verbName) {
   opts = guard.identifier.optionsObject(opts, _err, "scep/bad-input", "pki.scep." + verbName + " options");
   guard.identifier.assertKnownKeys(opts, _ENROLL_KEYS, _err, "scep/bad-input", "pki.scep." + verbName + " has an unknown option: ");
@@ -772,8 +931,9 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
   if (opts.recipientKey == null || typeof opts.recipientKey !== "object") throw _err("scep/bad-input", "a recipientKey { cert, key } is required to decrypt the CA response");
   var caCert = guard.bytes.snapshotSource(opts.caCert, ScepError, "scep/bad-input", "the caCert");
   var signerCert = opts.responderCert != null ? guard.bytes.snapshotSource(opts.responderCert, ScepError, "scep/bad-input", "the responderCert") : caCert;
+  var issuerCert = opts.issuerCert != null ? guard.bytes.snapshotSource(opts.issuerCert, ScepError, "scep/bad-input", "the issuerCert") : caCert;
   var recipientKey = _captureRecipientKey(opts.recipientKey);
-  var signer = opts.signer;
+  var signer = { cert: guard.bytes.snapshotSource(opts.signer.cert, ScepError, "scep/bad-input", "signer.cert"), key: opts.signer.key };
   var clientOpts = {
     transport: opts.transport,
     tls: opts.tls != null ? Object.assign({}, opts.tls) : opts.tls,
@@ -784,31 +944,28 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
   };
   var postUrl = _scepUrl(baseUrl, "PKIOperation");
   var csrView = guard.bytes.snapshotSource(opts.csr, ScepError, "scep/bad-input", "the csr");
-  var spki;
-  try { spki = schemaCsr.parse(csrView).subjectPublicKeyInfo; }
+  var spki, csrSubject;
+  try { var _pcsr = schemaCsr.parse(csrView); spki = _pcsr.subjectPublicKeyInfo; csrSubject = _pcsr.subject.bytes; }
   catch (e) { throw _err("scep/bad-input", "the csr is not a valid PKCS#10 CertificationRequest", e); }
+  var pollCount = guard.limits.cap(opts.pollCount, "pollCount", 5, { E: _err, code: "scep/bad-input", min: 0, max: POLL_COUNT_MAX });
+  var maxTotalWait = guard.limits.cap(opts.maxTotalWait, "maxTotalWait", retryAfter.MAX_RETRY_AFTER_SECONDS, { E: _err, code: "scep/bad-input", min: 0, max: retryAfter.MAX_RETRY_AFTER_SECONDS });
+  var sleep = typeof opts.sleep === "function" ? opts.sleep : _defaultSleep;
+  var onRetryAfter = typeof opts.onRetryAfter === "function" ? opts.onRetryAfter : null;
   var senderNonce = nodeCrypto.randomBytes(16);
   var transactionId = opts.transactionId != null ? opts.transactionId : _defaultTransactionId();
   var reqMsg = await build({ messageType: messageType, messageData: csrView, recipient: caCert, signer: signer, transactionId: transactionId, senderNonce: senderNonce });
   var res = await _client("POST", postUrl, reqMsg, { "content-type": CT_PKI_MESSAGE }, clientOpts);
   var body = _requireOk(res, [CT_PKI_MESSAGE], "PKIOperation");
   var rep = await parse(body, { signerCert: signerCert, expectedSenderNonce: senderNonce, recipientKey: recipientKey });
-  if (rep.messageType !== "CertRep") throw _err("scep/unexpected-message-type", "the SCEP response is a " + rep.messageType + ", not a CertRep");
-  if (rep.transactionId !== transactionId) throw _err("scep/transaction-id-mismatch", "the CertRep transactionID does not match the request (RFC 8894 sec. 3.2.1.1)");
-  if (rep.pkiStatus === "FAILURE") {
-    var failErr = _err("scep/enrollment-failed", "the CA refused the request with failInfo " + JSON.stringify(rep.failInfo) + (rep.failInfoText ? " (" + rep.failInfoText + ")" : ""));
-    failErr.failInfo = rep.failInfo;
-    failErr.failInfoText = rep.failInfoText;
-    throw failErr;
-  }
-  if (rep.pkiStatus === "PENDING") return { status: "PENDING", transactionId: rep.transactionId, senderNonce: senderNonce };
-  var repCerts = rep.certificates || [];
-  var issued = findIssuedCert(repCerts, spki.bytes);
-  if (issued == null) throw _err("scep/no-issued-cert", "the SUCCESS CertRep did not carry a certificate matching the request public key");
-  if (findIssuedCert(repCerts.filter(function (c) { return c !== issued; }), spki.bytes) != null) {
-    throw _err("scep/ambiguous-issued-cert", "the SUCCESS CertRep carried more than one certificate matching the request public key; the issued certificate is ambiguous (RFC 8894 sec. 3.3)");
-  }
-  return { status: "SUCCESS", certificate: issued, certificates: repCerts, transactionId: rep.transactionId };
+  var d = _dispatchCertRep(rep, transactionId, spki);
+  if (!d.pending) return d.result;
+  if (pollCount <= 0) return { status: "PENDING", transactionId: rep.transactionId, senderNonce: senderNonce };
+  return _pollForIssuance({
+    firstResponse: res, firstSenderNonce: senderNonce, postUrl: postUrl, clientOpts: clientOpts,
+    caCert: caCert, csrSubject: csrSubject, issuerCert: issuerCert, signer: signer, signerCert: signerCert, recipientKey: recipientKey,
+    spki: spki, transactionId: transactionId, pollCount: pollCount, maxTotalWait: maxTotalWait,
+    sleep: sleep, onRetryAfter: onRetryAfter,
+  });
 }
 
 /**
@@ -824,8 +981,13 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
  * the CertRep. The CA response is authenticated against the CA certificate and its `recipientNonce` must
  * echo the request's fresh `senderNonce`. On SUCCESS the issued certificate is selected out of the
  * response by SubjectPublicKeyInfo byte-match against the request; a FAILURE throws
- * `scep/enrollment-failed` carrying the CA's failInfo; a PENDING returns `{ status: "PENDING",
- * transactionId }` for the caller to retry. The content key is transported under RSAES-OAEP, so the CA
+ * `scep/enrollment-failed` carrying the CA's failInfo. A CA that answers PENDING (manual enrollment, RFC
+ * 8894 sec. 2.5) is polled automatically: the client issues CertPoll (GetCertInitial) messages reusing
+ * the transactionID, each authenticated against the CA certificate with a fresh nonce it must echo,
+ * until the CA answers SUCCESS or FAILURE or a `pollCount` / `maxTotalWait` budget is exhausted
+ * (`scep/poll-exhausted`, carrying the `transactionId` to resume). Pass `pollCount: 0` to disable polling
+ * and get the single `{ status: "PENDING", transactionId }` return for a caller that drives the retry
+ * itself. The content key is transported under RSAES-OAEP, so the CA
  * certificate must be an RSA `keyEncipherment` certificate that accepts OAEP; the shared-secret
  * authenticator (RFC 8894 sec. 2.4) is the `challengePassword` the caller placed in the PKCS#10.
  *
@@ -835,14 +997,19 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
  *   - `signer` -- `{ cert, key }`, the outer SignedData signer (for a PKCSReq, a self-signed certificate over the request key).
  *   - `recipientKey` -- `{ cert, key }`, the RSA key the CA encrypts the response to, to decrypt the CertRep.
  *   - `responderCert` -- the certificate to authenticate the CA's response signature against (defaults to `caCert`).
+ *   - `issuerCert` -- the issuing CA certificate whose subject names the CertPoll issuer (defaults to `caCert`; set it when the request is encrypted to a separate RA certificate, RFC 8894 sec. 3.3.3).
  *   - `transactionId` -- a caller-unique PrintableString (defaults to 16 random bytes, hex-encoded, unique per call).
+ *   - `pollCount` -- the maximum number of CertPoll requests on a PENDING response (default 5; `0` disables polling).
+ *   - `maxTotalWait` -- the total Retry-After sleep budget in seconds across all polls (default the Retry-After horizon).
+ *   - `sleep` -- an injectable sleeper `(ms) -> Promise` for the Retry-After wait (default a real timer).
+ *   - `onRetryAfter` -- an optional observer `(delaySeconds) -> void` called before each poll sleep.
  *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` -- transport bounds.
  * @example
  *   // requires: scepCsr, caCertDer, clientCertDer, clientKeyPkcs8, scepTransport
  *   var out = await pki.scep.enroll("http://ca.example/scep", { csr: scepCsr, caCert: caCertDer,
  *     signer: { cert: clientCertDer, key: clientKeyPkcs8 },
  *     recipientKey: { cert: clientCertDer, key: clientKeyPkcs8 }, transport: scepTransport });
- *   out.status;   // "SUCCESS", or "PENDING" to retry
+ *   out.status;   // "SUCCESS" (a PENDING request is polled to a terminal status unless pollCount is 0)
  */
 function enroll(baseUrl, opts) { return _pkiOperation("PKCSReq", baseUrl, opts, "enroll"); }
 
@@ -869,12 +1036,164 @@ function enroll(baseUrl, opts) { return _pkiOperation("PKCSReq", baseUrl, opts,
  */
 function renew(baseUrl, opts) { return _pkiOperation("RenewalReq", baseUrl, opts, "renew"); }
 
+function _dispatchQueryRep(rep, transactionId) {
+  if (rep.messageType !== "CertRep") throw _err("scep/unexpected-message-type", "the SCEP response is a " + rep.messageType + ", not a CertRep");
+  if (rep.transactionId !== transactionId) throw _err("scep/transaction-id-mismatch", "the CertRep transactionID does not match the request (RFC 8894 sec. 3.2.1.1)");
+  if (rep.pkiStatus === "FAILURE") {
+    var e = _err("scep/query-failed", "the CA refused the query with failInfo " + JSON.stringify(rep.failInfo) + (rep.failInfoText ? " (" + rep.failInfoText + ")" : ""));
+    e.failInfo = rep.failInfo;
+    e.failInfoText = rep.failInfoText;
+    throw e;
+  }
+  if (rep.pkiStatus === "PENDING") throw _err("scep/unexpected-pending", "a GetCert / GetCRL query cannot be answered PENDING; the CA grants or rejects it (RFC 8894 sec. 4.5.1)");
+}
+
+function _resolveQueryTarget(opts) {
+  var hasCert = opts.certificate != null;
+  var hasExplicit = opts.issuer != null || opts.serialNumber != null;
+  if (hasCert === hasExplicit) throw _err("scep/bad-input", "a GetCert / GetCRL query needs exactly one of { certificate } or { issuer, serialNumber } (RFC 8894 sec. 3.3.4)");
+  if (hasCert) {
+    var certDer = guard.bytes.snapshotSource(opts.certificate, ScepError, "scep/bad-input", "certificate");
+    var w;
+    try { w = schemaX509.parse(certDer); }
+    catch (e) { throw _err("scep/bad-input", "certificate is not a parseable X.509 certificate (RFC 8894 sec. 3.3.4): " + e.message, e); }
+    return { issuerRdns: w.issuer.rdns, serial: w.serialNumber, buildSpec: { certificate: certDer } };
+  }
+  if (opts.issuer == null || opts.serialNumber == null) throw _err("scep/bad-input", "the explicit form of a GetCert / GetCRL query needs both issuer and serialNumber (RFC 8894 sec. 3.3.4)");
+  var serial = _serialToInteger(opts.serialNumber);
+  var issuerDer = guard.bytes.snapshotSource(opts.issuer, ScepError, "scep/bad-input", "issuer");
+  var issuerRdns;
+  try { issuerRdns = schema.walk(pkix.name(_KU_NS), asn1.decode(issuerDer), _KU_NS).result.rdns; }
+  catch (e) { throw _err("scep/bad-input", "issuer is not a valid Name DER (RFC 8894 sec. 3.3.4): " + e.message, e); }
+  return { issuerRdns: issuerRdns, serial: serial, buildSpec: { issuer: issuerDer, serialNumber: opts.serialNumber } };
+}
+
+async function _queryOperation(messageType, baseUrl, opts, verbName) {
+  opts = guard.identifier.optionsObject(opts, _err, "scep/bad-input", "pki.scep." + verbName + " options");
+  guard.identifier.assertKnownKeys(opts, _QUERY_KEYS, _err, "scep/bad-input", "pki.scep." + verbName + " has an unknown option: ");
+  if (opts.caCert == null) throw _err("scep/bad-input", "a caCert (the SCEP CA certificate DER) is required");
+  if (opts.signer == null || typeof opts.signer !== "object") throw _err("scep/bad-input", "a signer { cert, key } is required");
+  if (opts.recipientKey == null || typeof opts.recipientKey !== "object") throw _err("scep/bad-input", "a recipientKey { cert, key } is required to decrypt the CA response");
+  var caCert = guard.bytes.snapshotSource(opts.caCert, ScepError, "scep/bad-input", "the caCert");
+  var signerCert = opts.responderCert != null ? guard.bytes.snapshotSource(opts.responderCert, ScepError, "scep/bad-input", "the responderCert") : caCert;
+  var recipientKey = _captureRecipientKey(opts.recipientKey);
+  var signer = { cert: guard.bytes.snapshotSource(opts.signer.cert, ScepError, "scep/bad-input", "signer.cert"), key: opts.signer.key };
+  var want = _resolveQueryTarget(opts);
+  var clientOpts = { transport: opts.transport, tls: opts.tls != null ? Object.assign({}, opts.tls) : opts.tls, maxRedirects: opts.maxRedirects, allowCrossOriginRedirect: opts.allowCrossOriginRedirect, timeout: opts.timeout, maxResponseBytes: opts.maxResponseBytes };
+  var senderNonce = nodeCrypto.randomBytes(16);
+  var transactionId = opts.transactionId != null ? opts.transactionId : _defaultTransactionId();
+  var reqMsg = await build(Object.assign({ messageType: messageType, recipient: caCert, signer: signer, transactionId: transactionId, senderNonce: senderNonce }, want.buildSpec));
+  var res = await _client("POST", _scepUrl(baseUrl, "PKIOperation"), reqMsg, { "content-type": CT_PKI_MESSAGE }, clientOpts);
+  var body = _requireOk(res, [CT_PKI_MESSAGE], "PKIOperation");
+  var rep = await parse(body, { signerCert: signerCert, expectedSenderNonce: senderNonce, recipientKey: recipientKey });
+  _dispatchQueryRep(rep, transactionId);
+  return { rep: rep, want: want, transactionId: transactionId };
+}
+
+/**
+ * @primitive  pki.scep.getCert
+ * @signature  pki.scep.getCert(baseUrl, opts) -> Promise<{ certificate, certificates, transactionId }>
+ * @since      0.6.17
+ * @status     stable
+ * @spec       RFC 8894
+ * @related    pki.scep.enroll, pki.scep.getCrl
+ *
+ * Retrieve an already-issued certificate over SCEP (RFC 8894 sec. 3.3.4): POST a GetCert query naming the
+ * certificate's issuer and serial number, and select it out of the CA's certs-only CertRep by canonical
+ * issuer-name and serial match. This is an OPTIONAL fallback: RFC 8894 sec. 3.3.4 advises a client to prefer
+ * an HTTP certificate store (RFC 4387) or LDAP and to use this only against a CA that offers no such access.
+ * The response is authenticated against the CA certificate and its recipientNonce must echo the request's
+ * fresh senderNonce; a FAILURE throws `scep/query-failed`, a PENDING is refused (`scep/unexpected-pending`, a
+ * query grants or rejects), and a SUCCESS not carrying the requested certificate throws `scep/cert-not-found`.
+ * `certificate` is the one matched to the requested issuer and serial; `certificates` is every certificate the
+ * authenticated response carried, raw, so a caller relies on `certificate` for the queried identity.
+ *
+ * @opts
+ *   - `certificate` -- the certificate DER whose issuer and serial name the one to retrieve (the convenience form).
+ *   - `issuer` / `serialNumber` -- the issuer Name DER and serial (a BigInt, number, or hex string) naming the certificate, for a caller that did not retain it.
+ *   - `caCert` -- the SCEP CA certificate DER the query is encrypted to.
+ *   - `signer` -- `{ cert, key }`, the outer SignedData signer.
+ *   - `recipientKey` -- `{ cert, key }`, the RSA key the CA encrypts the response to, to decrypt the CertRep.
+ *   - `responderCert` -- the certificate to authenticate the CA response signature against (defaults to `caCert`).
+ *   - `transactionId` -- a caller-unique PrintableString (defaults to 16 random bytes, hex-encoded).
+ *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` -- transport bounds.
+ * @example
+ *   // requires: clientCertDer, caCertDer, clientKeyPkcs8, scepTransport
+ *   var out = await pki.scep.getCert("http://ca.example/scep", { certificate: clientCertDer, caCert: caCertDer,
+ *     signer: { cert: clientCertDer, key: clientKeyPkcs8 },
+ *     recipientKey: { cert: clientCertDer, key: clientKeyPkcs8 }, transport: scepTransport });
+ *   out.certificate;   // the retrieved certificate DER
+ */
+async function getCert(baseUrl, opts) {
+  var q = await _queryOperation("GetCert", baseUrl, opts, "getCert");
+  var certs = q.rep.certificates || [];
+  var match = null;
+  for (var i = 0; i < certs.length; i++) {
+    var w = schemaX509.parse(certs[i]);
+    if (guard.name.dnEqual(w.issuer.rdns, q.want.issuerRdns, _err, "scep/bad-response", "the returned certificate issuer") && w.serialNumber === q.want.serial) {
+      if (match != null) throw _err("scep/ambiguous-cert", "the CA returned more than one certificate matching the requested issuer and serial (RFC 8894 sec. 3.3.4)");
+      match = certs[i];
+    }
+  }
+  if (match == null) throw _err("scep/cert-not-found", "the CA response did not carry a certificate matching the requested issuer and serial (RFC 8894 sec. 3.3.4)");
+  return { certificate: match, certificates: certs, transactionId: q.transactionId };
+}
+
+/**
+ * @primitive  pki.scep.getCrl
+ * @signature  pki.scep.getCrl(baseUrl, opts) -> Promise<{ crl, crls, transactionId }>
+ * @since      0.6.17
+ * @status     stable
+ * @spec       RFC 8894
+ * @related    pki.scep.getCert, pki.crl.verify
+ *
+ * Retrieve a CRL over SCEP (RFC 8894 sec. 3.3.4): POST a GetCRL query naming the CA by the issuer and serial
+ * of a certificate it issued, and read the CRL out of the CA's CRL-only CertRep. This is an OPTIONAL fallback:
+ * RFC 8894 sec. 2.7 says a client should compose a GetCRL only if the CA supports neither a CRL distribution
+ * point nor HTTP access, and prefer those. The response is authenticated against the CA certificate and its
+ * recipientNonce must echo the request's fresh senderNonce; a FAILURE throws `scep/query-failed`, and a PENDING is
+ * refused. The returned CRL is bound to the query: `crl` is the one whose issuer matches the requested CA, so a
+ * response carrying no such CRL throws `scep/no-crl` and one carrying more than one throws `scep/ambiguous-crl`.
+ * The full response list is on `crls`, raw for the caller to validate with `pki.crl.verify`.
+ *
+ * @opts
+ *   - `certificate` -- a certificate DER the CA issued, whose issuer and serial name the CA to query (the convenience form).
+ *   - `issuer` / `serialNumber` -- the issuer Name DER and serial (a BigInt, number, or hex string) naming the CA, when the caller did not retain such a certificate.
+ *   - `caCert` -- the SCEP CA certificate DER the query is encrypted to.
+ *   - `signer` -- `{ cert, key }`, the outer SignedData signer.
+ *   - `recipientKey` -- `{ cert, key }`, the RSA key the CA encrypts the response to.
+ *   - `responderCert` -- the certificate to authenticate the CA response against (defaults to `caCert`).
+ *   - `transactionId` -- a caller-unique PrintableString (defaults to 16 random bytes, hex-encoded).
+ *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` -- transport bounds.
+ * @example
+ *   // requires: clientCertDer, caCertDer, clientKeyPkcs8, scepTransport
+ *   var out = await pki.scep.getCrl("http://ca.example/scep", { certificate: clientCertDer, caCert: caCertDer,
+ *     signer: { cert: clientCertDer, key: clientKeyPkcs8 },
+ *     recipientKey: { cert: clientCertDer, key: clientKeyPkcs8 }, transport: scepTransport });
+ *   out.crl;   // the retrieved CRL DER
+ */
+async function getCrl(baseUrl, opts) {
+  var q = await _queryOperation("GetCRL", baseUrl, opts, "getCrl");
+  var crls = q.rep.crls || [];
+  var match = null;
+  for (var i = 0; i < crls.length; i++) {
+    var w = schemaCrl.parse(crls[i]);
+    if (guard.name.dnEqual(w.issuer.rdns, q.want.issuerRdns, _err, "scep/bad-response", "the returned CRL issuer")) {
+      if (match != null) throw _err("scep/ambiguous-crl", "the CA returned more than one CRL issued by the requested CA (RFC 8894 sec. 3.3.4)");
+      match = crls[i];
+    }
+  }
+  if (match == null) throw _err("scep/no-crl", "the CA response did not carry a CRL issued by the requested CA (RFC 8894 sec. 3.3.4)");
+  return { crl: match, crls: crls, transactionId: q.transactionId };
+}
+
 var _TRANSPORT_KEYS = { transport: 1, timeout: 1, maxResponseBytes: 1, maxRedirects: 1, tls: 1, allowCrossOriginRedirect: 1 };
 function _withKeys(extra) { var o = {}, k; for (k in _TRANSPORT_KEYS) o[k] = 1; for (k in extra) o[k] = 1; return o; }
 var _CACAPS_KEYS = _withKeys({ expectSCEPStandard: 1, requireStrongProfile: 1 });
 var _CACERT_KEYS = _withKeys({ expectedFingerprint: 1, fingerprintAlgorithm: 1 });
 var _NEXTCACERT_KEYS = _withKeys({ caCertificate: 1 });
-var _ENROLL_KEYS = _withKeys({ csr: 1, caCert: 1, signer: 1, recipientKey: 1, responderCert: 1, transactionId: 1 });
+var _ENROLL_KEYS = _withKeys({ csr: 1, caCert: 1, signer: 1, recipientKey: 1, responderCert: 1, issuerCert: 1, transactionId: 1, pollCount: 1, maxTotalWait: 1, sleep: 1, onRetryAfter: 1 });
+var _QUERY_KEYS = _withKeys({ certificate: 1, issuer: 1, serialNumber: 1, caCert: 1, signer: 1, recipientKey: 1, responderCert: 1, transactionId: 1 });
 
 module.exports = {
   build: build,
@@ -884,6 +1203,8 @@ module.exports = {
   getNextCACert: getNextCACert,
   enroll: enroll,
   renew: renew,
+  getCert: getCert,
+  getCrl: getCrl,
   parseCapabilities: parseCapabilities,
   MESSAGE_TYPES: MESSAGE_TYPE,
   PKI_STATUS: PKI_STATUS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.15",
+  "version": "0.6.17",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:b21c243d-9b6e-49ab-9c19-3427ff43e9bc",
+  "serialNumber": "urn:uuid:ea4426a6-da57-4694-9766-3f651e6423ae",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-01T08:58:18.522Z",
+    "timestamp": "2026-09-01T14:08:00.688Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.15",
+      "bom-ref": "@blamejs/pki@0.6.17",
       "type": "application",
       "name": "pki",
-      "version": "0.6.15",
+      "version": "0.6.17",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.15",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.17",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.15",
+      "ref": "@blamejs/pki@0.6.17",
       "dependsOn": []
     }
   ]