@blamejs/pki 0.8.4 → 0.8.5

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.5 — 2026-09-25
+
+A key this process cannot export can sign, and every verb that signs proves its signature first.
+
+### Added
+
+- A signer `{ algorithm, publicKey, sign }` is accepted wherever a signing verb takes a private key: `pki.x509.sign`, `pki.crl.sign`, `pki.csr.sign`, `pki.cms.sign` and its countersignatures, `pki.attrcert.sign`, `pki.cmp.build`, `pki.crmf.build`, `pki.ocsp.buildRequest`, `pki.ocsp.sign` and `pki.tsp.sign`. `sign(bytes)` is handed the bytes WebCrypto would be handed and returns the bytes WebCrypto would return, or a promise of them; for ECDSA that is the fixed-width `r || s` of RFC 9053 sec. 2.1, and a DER `SEQUENCE` is refused by name rather than encoded a second time. The private half never reaches the toolkit.
+- A signer's declared `algorithm` is held to the algorithm of the key the artifact certifies, and its declared `publicKey` to the key the signature is verified against, both before the callback is asked to sign. The caller's object is read once, in the synchronous prologue, so an accessor cannot answer one way to the check and another to the use. For an ECDSA key, whose curve is named but whose digest is chosen per signature, the digest the signer declares is checked on its own, before any remote signing request. The bytes the callback is handed are a copy in an allocation of its own, so a callback that rewrites them rewrites only its own copy and cannot reach the bytes the artifact carries. The bytes it returns are copied before use. Hold a client or any mutable state in the callback's closure: a signing verb snapshots its options, so the signer object the callback sees is a copy of the one you passed. A composite ML-DSA signature is refused by name, since it is produced from both component private keys and one callback cannot do that.
+
+### Fixed
+
+- `pki.ocsp.sign`, `pki.ocsp.buildRequest` and `pki.cms.sign`'s countersignature path verify the signature they produced against the public key the artifact declares, which the other signing verbs already did. A signer holding a key that does not match the certificate it signs under produced an OCSP response, an OCSP request or a countersignature that no relying party could validate, and the emitting side reported success.
+
 ## v0.8.4 — 2026-09-25
 
 A decode cap bounds every structure a parse reads, and a refusal caused by a cap is no longer reported as malformed input.

package/README.md

@@ -190,6 +190,33 @@ var ok  = await subtle.verify({ name: "ML-DSA-65" }, kp.publicKey, sig, data); /
 // same call shape, and every key it exports is OpenSSL/NSS-interoperable.
 ```
 
+### Sign with a key this process cannot export
+
+Every signing verb takes a signer object wherever it takes a private key, for a
+key held in a hardware security module, a cloud key management service, a PKCS#11
+token, a PIV slot or a Trusted Platform Module. The private half never reaches
+the toolkit.
+
+```js
+var signer = {
+  algorithm: { name: "ECDSA", namedCurve: "P-256", hash: { name: "SHA-256" } },
+  publicKey: spkiDer,                       // the SPKI DER of the public half
+  sign: function (bytes) { return kms.sign(keyId, bytes); },   // bytes or a promise of them
+};
+
+var cert = await pki.x509.sign(spec, { key: signer, cert: caCert });
+```
+
+`sign(bytes)` is handed the bytes WebCrypto would be handed and returns the bytes
+WebCrypto would return: for ECDSA the fixed-width `r || s` of RFC 9053 §2.1, not a
+DER `SEQUENCE`. `algorithm` is held to the certificate's key algorithm, `publicKey`
+is held to the key the signature is verified against, and the signature is
+verified before the artifact is returned. The bytes handed to the callback are a
+copy, so rewriting them rewrites nothing the artifact carries. Hold the client and
+any mutable state in the callback's closure, as the example does: a signing verb
+snapshots its options, so the signer object the callback sees is a copy of the one
+you passed.
+
 ## What ships today
 
 Everything below is callable now; nothing is a stub. The whole documented

package/lib/cms-sign.js

@@ -214,7 +214,10 @@ function _keyOnlyCertStandIn(spkiDer) {
     if (e && typeof e.code === "string" && e.code.indexOf("cms/") === 0) throw e;
     throw _err("cms/bad-input", "a key-only signer's spki is not a SubjectPublicKeyInfo", e);
   }
-  return { subjectPublicKeyInfo: { algorithm: alg } };
+  /** @internal The SPKI bytes travel with the stand-in, because the key this signature is verified
+   * against is what a signer's declared publicKey is held to, and this form names that key by SPKI
+   * rather than by certificate. */
+  return { subjectPublicKeyInfo: { bytes: spkiDer, algorithm: alg } };
 }
 
 function _keyOnlyKeyId(so) {
@@ -432,11 +435,18 @@ function _buildCountersignature(targetSigOctets, countersigner, opts) {
       return _buildSignedAttrs(pairs.concat(extra));
     });
   }).then(function (attrs) {
-    return signScheme.signOverTbs(scheme, soKey, attrs ? attrs.setOf : targetSigOctets, _signE).then(function (sig) {
-      var fields = [b.integer(BigInt(sidv.version)), sidv.sid, scheme.digestAlgId];
-      if (attrs) fields.push(attrs.wire);
-      fields.push(scheme.sigAlgId, b.octetString(sig));
-      return { value: b.sequence(fields), certDer: certDer };
+    var preimage = attrs ? attrs.setOf : targetSigOctets;
+    return signScheme.signOverTbs(scheme, soKey, preimage, _signE).then(function (sig) {
+      /** @internal The countersignature is held to the same proof the signature is: it verifies
+       * against the public key the countersigner's certificate declares. */
+      return guard.async.deferred(function () {
+        return _b.assertSignatureVerifies(preimage, sig, cert.subjectPublicKeyInfo.bytes, scheme);
+      }).then(function () {
+        var fields = [b.integer(BigInt(sidv.version)), sidv.sid, scheme.digestAlgId];
+        if (attrs) fields.push(attrs.wire);
+        fields.push(scheme.sigAlgId, b.octetString(sig));
+        return { value: b.sequence(fields), certDer: certDer };
+      });
     });
   });
 }

package/lib/cms-verify.js

@@ -721,7 +721,8 @@ function _addCert(out, der) {
  * S/MIME signed mail, RFC 3161 timestamp tokens, and code signing rest on, and exactly what
  * `pki.cms.verify` consumes and OpenSSL `cms -verify` validates. Each `signers[i]` is
  * `{ cert, key, digestAlgorithm?, pss? }`: `cert` the signer certificate (PEM or DER), `key`
- * its private key (a WebCrypto `CryptoKey` or a PKCS#8 DER `Buffer` / PEM string; for a composite
+ * its private key (a WebCrypto `CryptoKey`, a PKCS#8 DER `Buffer` / PEM string, or a signer
+ * `{ algorithm, publicKey, sign }` for a key held outside this process; for a composite
  * ML-DSA signer, the two component keys `{ mldsa, trad }`, each PKCS#8). The
  * signature covers the RFC 5652 sec. 5.4 preimage: with signed attributes (the default) the
  * message-digest attribute is bound to the content digest and the signature is over the

package/lib/csr-sign.js

@@ -77,7 +77,8 @@ function _challengePassword(pw) {
  * `challengePassword`. An extension the issuing CA assigns (authorityKeyIdentifier, the
  * certificate-transparency pair, the CA version and previous-certificate hash, ocspNoCheck) is not a
  * request and is refused by name. `key` (or
- * `{ key }`) is the subject's own PKCS#8 private key / WebCrypto CryptoKey, so the request is self-signed
+ * `{ key }`) is the subject's own PKCS#8 private key, WebCrypto CryptoKey, or signer
+ * `{ algorithm, publicKey, sign }`, so the request is self-signed
  * to prove possession of the private half of `subjectPublicKey`, and that proof is verified before the
  * request is returned. The signature algorithm is resolved from the subject key (RSA PKCS#1 v1.5 or PSS,
  * ECDSA, EdDSA, ML-DSA, SLH-DSA, or a composite arm). Returns DER, or a PEM `CERTIFICATE REQUEST` with

package/lib/ocsp.js

@@ -45,6 +45,9 @@ var b = asn1.build;
 function O(name) { return oid.byName(name); }
 function _err(code, message, cause) { return new OcspError(code, message, cause); }
 function _signE(kind, message, cause) { return new OcspError("ocsp/" + kind, message, cause); }
+/** @internal Only the signature self-check is taken from the shared builder here; the name and
+ * SPKI schemas it also serves belong to the certificate verbs, and this module reads neither. */
+var _b = pkiBuild.makeBuilder({ ErrorClass: OcspError, prefix: "ocsp", O: O, NS: null, NAME_SCHEMA: null, SPKI_SCHEMA: null, EXT_DECODERS: {} });
 
 var HASH_WC = Object.assign(Object.create(null), { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
 var REASON_CODE = Object.create(null);
@@ -214,8 +217,12 @@ function _buildRequest(query, opts) {
     if (signerCert === null) return _emitReq(b.sequence([tbsRequest]), opts);
     var scheme = signScheme.resolveSignScheme(signerCert, { combinedRsaSig: true }, true, _signE);
     return signScheme.signOverTbs(scheme, opts.signer.key, tbsRequest, _signE).then(function (sig) {
-      var optionalSignature = b.sequence([scheme.sigAlgId, b.bitString(sig, 0), b.explicit(0, b.sequence([b.raw(signerCertDer)]))]);
-      return _emitReq(b.sequence([tbsRequest, b.explicit(0, optionalSignature)]), opts);
+      /** @internal The request is held to the same proof a certificate is: the signature verifies
+       * against the public key the certificate it carries declares. */
+      return Promise.resolve(_b.assertSignatureVerifies(tbsRequest, sig, signerCert.subjectPublicKeyInfo.bytes, scheme)).then(function () {
+        var optionalSignature = b.sequence([scheme.sigAlgId, b.bitString(sig, 0), b.explicit(0, b.sequence([b.raw(signerCertDer)]))]);
+        return _emitReq(b.sequence([tbsRequest, b.explicit(0, optionalSignature)]), opts);
+      });
     });
   });
 }
@@ -349,11 +356,15 @@ function _signResponse(responseData, responder, respCert, respCertDer, responder
       var responseDataDer = b.sequence(rdChildren);
       var scheme = signScheme.resolveSignScheme(respCert, { combinedRsaSig: true }, true, _signE);
       return signScheme.signOverTbs(scheme, responderKey, responseDataDer, _signE).then(function (sig) {
-        var basicChildren = [responseDataDer, scheme.sigAlgId, b.bitString(sig, 0)];
-        if (opts.embedCert !== false) basicChildren.push(b.explicit(0, b.sequence([b.raw(respCertDer)])));
-        var responseBytes = b.sequence([b.oid(OID_OCSP_BASIC), b.octetString(b.sequence(basicChildren))]);
-        var der = b.sequence([b.enumerated(0n), b.explicit(0, responseBytes)]);
-        return opts.pem ? ocspSchema.pemEncode(der, "OCSP RESPONSE") : der;
+        /** @internal The response is held to the same proof a certificate is: the signature verifies
+         * against the public key the responder certificate declares. */
+        return Promise.resolve(_b.assertSignatureVerifies(responseDataDer, sig, respCert.subjectPublicKeyInfo.bytes, scheme)).then(function () {
+          var basicChildren = [responseDataDer, scheme.sigAlgId, b.bitString(sig, 0)];
+          if (opts.embedCert !== false) basicChildren.push(b.explicit(0, b.sequence([b.raw(respCertDer)])));
+          var responseBytes = b.sequence([b.oid(OID_OCSP_BASIC), b.octetString(b.sequence(basicChildren))]);
+          var der = b.sequence([b.enumerated(0n), b.explicit(0, responseBytes)]);
+          return opts.pem ? ocspSchema.pemEncode(der, "OCSP RESPONSE") : der;
+        });
       });
     });
   });

package/lib/pki-build.js

@@ -1290,7 +1290,7 @@ function makeBuilder(ctx) {
     var keyOid;
     try { keyOid = asn1.read.oid(alg.children[0]); }
     catch (e) { throw E("bad-input", "the signing key SPKI algorithm is not an OID", e); }
-    return { subjectPublicKeyInfo: { algorithm: { oid: keyOid, parameters: alg.children.length > 1 ? alg.children[1].bytes : undefined } } };
+    return { subjectPublicKeyInfo: { bytes: spkiDer, algorithm: { oid: keyOid, parameters: alg.children.length > 1 ? alg.children[1].bytes : undefined } } };
   }
 
   function assertSignatureVerifies(preimage, sig, spki, scheme) {

package/lib/sign-scheme.js

@@ -6,6 +6,8 @@
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var pkcs8 = require("./schema-pkcs8");
+var pkix = require("./schema-pkix");
+var frameworkError = require("./framework-error");
 var webcrypto = require("./webcrypto");
 var subtle = webcrypto.webcrypto.subtle;
 var validator = require("./validator-all");
@@ -23,6 +25,7 @@ var _toUpperCase = intrinsic.toUpperCase;
 var _isBuffer = intrinsic.isBuffer;
 var _bufferFrom = intrinsic.bufferFrom;
 var _isU8 = intrinsic.types.isUint8Array;
+var _resolve = intrinsic.uncurry(intrinsic.promiseResolve);
 
 var HASH = intrinsic.assign(intrinsic.create(null), { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
 var NODE_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512", shake128: "shake128", shake256: "shake256" });
@@ -98,7 +101,17 @@ function pssSpkiPinnedHash(cert, E) {
   return HASH[d];
 }
 
+/** @internal The SPKI the signature will be verified against travels on the scheme, because the
+ *  signer form declares a public key and the door has to hold it to the one the certificate names.
+ *  Attached here rather than on each return, so a new algorithm branch cannot omit it. */
 function resolveSignScheme(cert, so, noSignedAttrs, E) {
+  var scheme = _resolveSignScheme(cert, so, noSignedAttrs, E);
+  var spki = cert && cert.subjectPublicKeyInfo;
+  scheme.spki = (spki && spki.bytes) || null;
+  return scheme;
+}
+
+function _resolveSignScheme(cert, so, noSignedAttrs, E) {
   so = so || {};
   var alg = cert.subjectPublicKeyInfo.algorithm;
   var keyOid = alg.oid;
@@ -154,15 +167,16 @@ function resolveSignScheme(cert, so, noSignedAttrs, E) {
   throw E("unsupported-algorithm", "unsupported signer key algorithm " + keyOid);
 }
 
-function _assertKeyMatchesScheme(key, imp, E) {
+function _assertKeyMatchesScheme(key, imp, E, what) {
   var ka = key.algorithm || {};
+  var subject = what || "CryptoKey";
   if (_toUpperCase(_String(ka.name)) !== _toUpperCase(_String(imp.name))) {
     var hint = (_toUpperCase(_String(ka.name)) === "RSA-PSS" && _toUpperCase(_String(imp.name)) === "RSASSA-PKCS1-V1_5")
-      ? "; this CryptoKey is bound to RSASSA-PSS -- pass opts.pss to sign with RSASSA-PSS" : "";
-    throw E("bad-input", "the signer CryptoKey algorithm (" + ka.name + ") does not match the certificate's key algorithm (" + imp.name + ")" + hint);
+      ? "; this " + subject + " is bound to RSASSA-PSS -- pass opts.pss to sign with RSASSA-PSS" : "";
+    throw E("bad-input", "the signer " + subject + " algorithm (" + ka.name + ") does not match the certificate's key algorithm (" + imp.name + ")" + hint);
   }
-  if (imp.hash && (!ka.hash || ka.hash.name !== imp.hash)) throw E("bad-input", "the signer CryptoKey hash (" + (ka.hash && ka.hash.name) + ") does not match the signing digest (" + imp.hash + ")");
-  if (imp.namedCurve && ka.namedCurve !== imp.namedCurve) throw E("bad-input", "the signer CryptoKey curve (" + ka.namedCurve + ") does not match the certificate curve (" + imp.namedCurve + ")");
+  if (imp.hash && (!ka.hash || ka.hash.name !== imp.hash)) throw E("bad-input", "the signer " + subject + " hash (" + (ka.hash && ka.hash.name) + ") does not match the signing digest (" + imp.hash + ")");
+  if (imp.namedCurve && ka.namedCurve !== imp.namedCurve) throw E("bad-input", "the signer " + subject + " curve (" + ka.namedCurve + ") does not match the certificate curve (" + imp.namedCurve + ")");
 }
 /** @internal `owned`, when given, collects the copies this makes of the caller's key so the caller can
  * wipe them: a Buffer is viewed and stays the caller's, while a Uint8Array or a PEM string produces a
@@ -218,7 +232,105 @@ function _importKey(key, imp, E) {
   });
 }
 
+/** @internal The signer form, read ONCE. A caller's object is not asked the same question twice:
+ *  an accessor that answers differently on a second read would let the algorithm the door checked
+ *  differ from the one that signs, and the callback the door validated differ from the one it
+ *  calls. `sign` doubles as the discriminator, so the read that classifies is the read that runs. */
+function _snapshotSigner(key) {
+  if (!key || typeof key !== "object" || _isBuffer(key) || _isU8(key)) return null;   // allow:byte-source-narrow -- signer-form discrimination: a raw-key BufferSource is correctly classed as not a signer and normalized by _importKey
+  var sign = key.sign;
+  if (typeof sign !== "function") return null;
+  var algorithm = key.algorithm;
+  if (typeof algorithm === "string") algorithm = { name: algorithm };
+  var flat = null;
+  if (algorithm != null && typeof algorithm === "object") {
+    var hash = algorithm.hash;
+    var hashName = typeof hash === "string" ? hash : (hash == null ? undefined : hash.name);
+    flat = {
+      name: algorithm.name,
+      hash: hashName === undefined ? undefined : { name: hashName },
+      namedCurve: algorithm.namedCurve,
+    };
+  }
+  /** @internal `receiver` is the object this door was handed, so `sign` is called on it and plain
+   *  configuration read off `this` answers. A signing verb snapshots its options, so a client or a
+   *  counter a signer holds on itself is a copy by the time it arrives; a callback keeps those in
+   *  its closure instead, which is where the documented examples put them. */
+  return { sign: sign, receiver: key, algorithm: flat, publicKey: key.publicKey };
+}
+
+/** @internal An SPKI a signer declares, from the shapes a public key arrives in. */
+function _signerSpki(publicKey, E) {
+  if (typeof publicKey === "string") {
+    try { return pkix.pemDecode(publicKey, "PUBLIC KEY", frameworkError.PemError); }
+    catch (e) { throw E("bad-input", "the signer publicKey PEM could not be decoded", e); }
+  }
+  return guard.bytes.snapshotSource(publicKey, E, "bad-input", "the signer publicKey");
+}
+
+/** @internal The signature a signer returned, held to the contract the callback is documented
+ *  against: the bytes `subtle.sign` would return for this scheme. An ECDSA signature is the
+ *  fixed-width r||s of RFC 9053 sec. 2.1, and the DER SEQUENCE a token usually emits is named
+ *  rather than re-derived, because guessing which encoding arrived is how one gets converted twice. */
+function _assertSignerSignature(sig, scheme, E) {
+  if (!scheme.ecdsaDer) return sig;
+  var want = scheme.coordLen * 2;
+  if (sig.length === want) return sig;
+  if (sig.length > 1 && sig[0] === 0x30) {
+    throw E("bad-input", "the signer returned a DER SEQUENCE for an ECDSA signature; sign() returns the " +
+      want + "-byte r||s a WebCrypto signature carries (RFC 9053 sec. 2.1), and this toolkit encodes it");
+  }
+  throw E("bad-input", "the signer returned " + sig.length + " byte(s) for an ECDSA signature on this curve; " +
+    "sign() returns the " + want + "-byte r||s a WebCrypto signature carries (RFC 9053 sec. 2.1)");
+}
+
+function _signExternally(signer, scheme, signedBytes, E) {
+  if (scheme.composite) {
+    throw E("bad-input", "a composite " + scheme.composite.name + " signature is produced from both component private keys, " +
+      "which one sign() callback cannot do; pass { mldsa, trad } PKCS#8 keys");
+  }
+  if (signer.algorithm == null) throw E("bad-input", "a signer must declare the algorithm it signs with: { algorithm, publicKey, sign }");
+  if (signer.publicKey == null) throw E("bad-input", "a signer must declare its publicKey as SPKI DER, so the door can hold it to the key the signature is verified against");
+  _assertKeyMatchesScheme(signer, scheme.imp, E, "signer");
+  /** @internal The digest a scheme signs under is not always part of the key's import parameters:
+   *  an ECDSA key names only its curve, and the digest is chosen per signature. A signer declares
+   *  what it will do, so it is held to that here rather than after a remote signing request. */
+  var wantHash = scheme.sign && scheme.sign.hash;
+  if (wantHash && signer.algorithm.hash && signer.algorithm.hash.name !== wantHash) {
+    throw E("bad-input", "the signer algorithm hash (" + signer.algorithm.hash.name +
+      ") does not match the signing digest (" + wantHash + ")");
+  }
+  var declared = _signerSpki(signer.publicKey, E);
+  if (!scheme.spki) throw E("bad-input", "this signing path does not name the public key a signature is verified against, so a signer's publicKey cannot be held to it");
+  var named = guard.bytes.snapshotSource(scheme.spki, E, "bad-input", "the public key this signature is verified against");
+  if (!guard.crypto.constantTimeEqual(declared, named)) {
+    throw E("bad-input", "the signer publicKey is not the key this signature is verified against");
+  }
+  /** @internal The callback is handed a COPY, in an allocation of its own. It is a caller's
+   *  function over the bytes an artifact is built from, and a callback that rewrote them in place
+   *  would rewrite what is verified and what is emitted together, so the self-check would pass on
+   *  the rewritten artifact. `Buffer.from` is not enough: a small copy comes out of Node's shared
+   *  pool, whose backing ArrayBuffer the callback could reach the original through. */
+  var handed = new intrinsic.Uint8Array(signedBytes.length);
+  handed.set(signedBytes);
+  var produced;
+  try { produced = intrinsic.apply(signer.sign, signer.receiver, [handed]); }
+  catch (e) { throw E("bad-input", "the signer sign() callback failed", e); }
+  return _resolve(Promise, produced).then(function (raw) {
+    var sig = guard.bytes.snapshotSource(raw, E, "bad-input", "the signature the signer returned");
+    return _assertSignerSignature(sig, scheme, E);
+  }, function (e) {
+    throw E("bad-input", "the signer sign() callback failed", e);
+  });
+}
+
 function signOverTbs(scheme, key, signedBytes, E) {
+  var signer = _snapshotSigner(key);
+  if (signer) {
+    return _signExternally(signer, scheme, signedBytes, E).then(function (sig) {
+      return scheme.ecdsaDer ? validator.sig.rawToEcdsaDer(sig, scheme.coordLen) : sig;
+    });
+  }
   if (scheme.composite) {
     return compositeSig.compositeSign(scheme.composite, _normCompositeKeys(key, scheme.composite, E), signedBytes).then(function (sig) { return _bufferFrom(sig); });
   }

package/lib/x509-sign.js

@@ -366,8 +366,13 @@ function _hasCriticalSan(extSpec) {
  * `extensions` object. `issuer` is the signing side: `{ key }` alone issues a self-signed certificate
  * (issuer = subject, signed with the subject's own key); `{ name, publicKey, key }` or `{ cert, key }`
  * issues a CA-signed one. The signing key `key` is a WebCrypto `CryptoKey` (a `pki.key.generate`
- * private key passed directly, without exporting) or a PKCS#8 private key as DER (`Buffer`) or PEM
- * (`string`); a public or secret CryptoKey, or a `node:crypto` KeyObject, is refused. A `subjectAltName`
+ * private key passed directly, without exporting), a PKCS#8 private key as DER (`Buffer`) or PEM
+ * (`string`), or a signer `{ algorithm, publicKey, sign }` for a key this process cannot export,
+ * such as one in a hardware security module, a cloud key management service, a PKCS#11 token or a
+ * PIV slot. `sign(bytes)` returns the bytes WebCrypto would return for that algorithm, which for
+ * ECDSA is the fixed-width `r || s` of RFC 9053 sec. 2.1, and holds its client in its own closure,
+ * since this verb snapshots its options. A public or secret CryptoKey,
+ * or a `node:crypto` KeyObject, is refused. A `subjectAltName`
  * (or any `GeneralName`) entry may be a form object (`{ dNSName: "..." }`) or a bare string classified
  * fail-closed into its form (`"host.example"`, `"a@b.example"`, `"10.0.0.1"`, `"https://host.example/"`).
  * The signature algorithm is resolved from the signing key: RSA (PKCS#1 v1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.4",
+  "version": "0.8.5",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:ca3c695a-64b2-4346-9529-6a6c719eb6bb",
+  "serialNumber": "urn:uuid:67dbc768-79f1-44d5-921c-53ce9accac3e",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-20T06:26:19.862Z",
+    "timestamp": "2026-09-20T07:17:13.483Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.4",
+      "bom-ref": "@blamejs/pki@0.8.5",
       "type": "application",
       "name": "pki",
-      "version": "0.8.4",
+      "version": "0.8.5",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.4",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.5",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.4",
+      "ref": "@blamejs/pki@0.8.5",
       "dependsOn": []
     }
   ]