@chilkat/react-native 11.6.1

package/src/specs/Cert.nitro.ts

@@ -0,0 +1,1279 @@
+// Generated by ReactNativeNs.RnGenerator -- do not edit.
+import type { HybridObject } from 'react-native-nitro-modules'
+import type { BinData } from './BinData.nitro'
+import type { CertChain } from './CertChain.nitro'
+import type { JsonObject } from './JsonObject.nitro'
+import type { Pkcs11 } from './Pkcs11.nitro'
+import type { PrivateKey } from './PrivateKey.nitro'
+import type { PublicKey } from './PublicKey.nitro'
+import type { XmlCertVault } from './XmlCertVault.nitro'
+
+/**
+ * Load, inspect, validate, and use X.509 certificates throughout Chilkat.
+ *
+ * `Cert` is the central certificate object used throughout
+ * Chilkat for TLS, S/MIME, PKCS7/CMS, PDF signing, XML signing, code signing,
+ * decryption, certificate stores, smart cards, HSMs, PKCS#11, and cloud-based
+ * signing. It provides a broad set of features for loading certificates,
+ * inspecting certificate fields, checking validity, accessing private keys,
+ * building chains, checking revocation status, exporting certificate data, and
+ * diagnosing certificate-related problems.
+ *
+ * **Load certificates**
+ *
+ * Load public certificates from PEM, DER, Base64, files, strings, binary
+ * data, certificate stores, PFX/P12 files, smart cards, and other sources.
+ *
+ * **Inspect certificate details**
+ *
+ * Read subject and issuer fields, serial numbers, fingerprints, validity
+ * dates, key usage, extensions, SAN values, and other X.509 information.
+ *
+ * **Private key access**
+ *
+ * Work with certificates backed by private keys from PFX/P12 files, OS
+ * certificate stores, smart cards, HSMs, PKCS#11 modules, or cloud signing
+ * providers.
+ *
+ * **Trust and validation**
+ *
+ * Build and inspect certificate chains, verify signatures, check expiration,
+ * examine trust-related information, and work with revocation data.
+ *
+ * **Use across Chilkat**
+ *
+ * Pass `Cert` objects to other Chilkat classes for TLS client
+ * authentication, S/MIME, signing, encryption, decryption, and verification.
+ *
+ * **Export and diagnostics**
+ *
+ * Export certificate data in common formats and use detailed diagnostic
+ * output to troubleshoot loading, validation, private-key, chain, or store
+ * problems.
+ *
+ * **Common pattern:**
+ * Use certificate-only formats such as PEM or DER when only the public
+ * certificate is needed. Use PFX/P12, an OS certificate store, smart-card
+ * loading, PKCS#11 linking, HSM integration, or cloud-signing configuration
+ * when a private key operation is required.
+ *
+ * For an extended overview, see
+ * [Cert Class Overview](https://www.chilkatsoft.com/cert_class_overview.asp).
+ *
+ * Each `Cert` instance owns a native Chilkat object. It is released when the JavaScript object is
+ * garbage collected, or immediately by `dispose()`; any use after `dispose()` throws.
+ * Create one with `new Cert()`.
+ *
+ * Methods that can take a while (network, files, compression, key generation) also have an
+ * `...Async` form returning a `Promise`; it runs on a native worker thread so the UI keeps
+ * rendering. While such a call is pending, every other call on this object throws, except
+ * {@link Cert.abort} and assigning {@link Cert.onPercentDone} / {@link Cert.onProgressInfo}.
+ */
+export interface Cert extends HybridObject<{ ios: 'c++', android: 'c++' }> {
+  // ---- Properties ----
+
+  /**
+   * Provides HTML-formatted information about the last called method or property. If a method call
+   * fails or behaves unexpectedly, check this property for details. Note that information is
+   * available regardless of the method call's success.
+   *
+   * This property is read-only.
+   */
+  readonly lastErrorHtml: string
+
+  /**
+   * Provides plain text information about the last called method or property. If a method call
+   * fails or behaves unexpectedly, check this property for details. Note that information is
+   * available regardless of the method call's success.
+   *
+   * This property is read-only.
+   */
+  readonly lastErrorText: string
+
+  /**
+   * Provides XML-formatted information about the last called method or property. If a method call
+   * fails or behaves unexpectedly, check this property for details. Note that information is
+   * available regardless of the method call's success.
+   *
+   * This property is read-only.
+   */
+  readonly lastErrorXml: string
+
+  /**
+   * Version of the component/library, such as "10.1.0"
+   *
+   * This property is read-only.
+   */
+  readonly version: string
+
+  /**
+   * If set to a file path, this property logs the LastErrorText of each Chilkat method or property
+   * call to the specified file. This logging helps identify the context and history of Chilkat
+   * calls leading up to any crash or hang, aiding in debugging.
+   *
+   * Enabling the VerboseLogging property provides more detailed information.
+   *
+   * This property is mainly used for debugging rare instances where a Chilkat method call causes a
+   * hang or crash, which should generally not happen.
+   *
+   * Possible causes of hangs include:
+   *
+   * - A timeout property set to 0, indicating an infinite timeout.
+   *
+   * - A hang occurring within an event callback in the application code.
+   *
+   * - An internal bug in the Chilkat code causing the hang.
+   */
+  debugLogFilePath: string
+
+  /**
+   * If set to `true`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may
+   * contain more verbose information. The default value is `false`. Verbose logging should only be
+   * used for debugging. The potentially large quantity of logged information may adversely affect
+   * peformance.
+   */
+  verboseLogging: boolean
+
+  /**
+   * Indicates the success or failure of the most recent method call: `true` means success, `false`
+   * means failure. This property remains unchanged by property setters or getters. This method is
+   * present to address challenges in checking for null or Nothing returns in certain programming
+   * languages. Note: This property does not apply to methods that return integer values or to
+   * boolean-returning methods where the boolean does not indicate success or failure.
+   */
+  lastMethodSuccess: boolean
+
+  /**
+   * The authority key identifier of the certificate in base64 string format. This is only present
+   * if the certificate contains the extension OID 2.5.29.35.
+   *
+   * This property is read-only.
+   */
+  readonly authorityKeyId: string
+
+  /**
+   * Applies only when running on a Microsoft Windows operating system. If `true`, then any method
+   * that returns a certificate will not try to also access the associated private key, assuming one
+   * exists. This is useful if the certificate was installed with high-security such that a private
+   * key access would trigger the Windows OS to display a security warning dialog. The default value
+   * of this property is `false`.
+   */
+  avoidWindowsPkAccess: boolean
+
+  /**
+   * The version of the certificate (1, 2, or 3). A value of 0 indicates an error -- the most likely
+   * cause being that the certificate object is empty (i.e. was never loaded with a certificate).
+   * Note: This is not the version of the software, it is the version of the X.509 certificate
+   * object. The version of the Chilkat certificate software is indicated by the Version property.
+   *
+   * This property is read-only.
+   */
+  readonly certVersion: number
+
+  /**
+   * Has a value of `true` if the certificate or any certificate in the chain of authority has
+   * expired. (This information is not available when running on Windows 95/98 computers.)
+   *
+   * This property is read-only.
+   */
+  readonly expired: boolean
+
+  /**
+   * `true` if this certificate can be used for client authentication, otherwise `false`.
+   *
+   * This property is read-only.
+   */
+  readonly forClientAuthentication: boolean
+
+  /**
+   * `true` if this certificate can be used for code signing, otherwise `false`.
+   *
+   * This property is read-only.
+   */
+  readonly forCodeSigning: boolean
+
+  /**
+   * `true` if this certificate can be used for sending secure email, otherwise `false`.
+   *
+   * This property is read-only.
+   */
+  readonly forSecureEmail: boolean
+
+  /**
+   * `true` if this certificate can be used for server authentication, otherwise `false`.
+   *
+   * This property is read-only.
+   */
+  readonly forServerAuthentication: boolean
+
+  /**
+   * `true` if this certificate can be used for time stamping, otherwise `false`.
+   *
+   * This property is read-only.
+   */
+  readonly forTimeStamping: boolean
+
+  /**
+   * Bitflags indicating the intended usages of the certificate.
+   * The flags are:
+   *
+   * Digital Signature: 0x80
+   *
+   * Non-Repudiation: 0x40
+   *
+   * Key Encipherment: 0x20
+   *
+   * Data Encipherment: 0x10
+   *
+   * Key Agreement: 0x08
+   *
+   * Certificate Signing: 0x04
+   *
+   * CRL Signing: 0x02
+   *
+   * Encipher-Only: 0x01
+   *
+   * This property is read-only.
+   */
+  readonly intendedKeyUsage: number
+
+  /**
+   * `true` if this is the root certificate, otherwise `false`.
+   *
+   * This property is read-only.
+   */
+  readonly isRoot: boolean
+
+  /**
+   * The certificate issuer's country.
+   *
+   * This property is read-only.
+   */
+  readonly issuerC: string
+
+  /**
+   * The certificate issuer's common name.
+   *
+   * This property is read-only.
+   */
+  readonly issuerCN: string
+
+  /**
+   * The issuer's full distinguished name.
+   *
+   * This property is read-only.
+   */
+  readonly issuerDN: string
+
+  /**
+   * The certificate issuer's email address.
+   *
+   * This property is read-only.
+   */
+  readonly issuerE: string
+
+  /**
+   * The certificate issuer's locality, which could be a city, count, township, or other geographic
+   * region.
+   *
+   * This property is read-only.
+   */
+  readonly issuerL: string
+
+  /**
+   * The certificate issuer's organization, which is typically the company name.
+   *
+   * This property is read-only.
+   */
+  readonly issuerO: string
+
+  /**
+   * The certificate issuer's organizational unit, which is the unit within the organization.
+   *
+   * This property is read-only.
+   */
+  readonly issuerOU: string
+
+  /**
+   * The certificate issuer's state or province.
+   *
+   * This property is read-only.
+   */
+  readonly issuerS: string
+
+  /**
+   * If present in the certificate's extensions, returns the OCSP URL of the certificate. (The
+   * Online Certificate Status Protocol (OCSP) is an Internet protocol used for obtaining the
+   * revocation status of an X.509 digital certificate.)
+   *
+   * This property is read-only.
+   */
+  readonly ocspUrl: string
+
+  /**
+   * (Relevant only when running on a Microsoft Windows operating system.) Indicates whether the
+   * private key was installed with security settings that allow it to be re-exported.
+   *
+   * This property is read-only.
+   */
+  readonly privateKeyExportable: boolean
+
+  /**
+   * `true` if the certificate or any certificate in the chain of authority has been revoked. This
+   * information is not available when running on Windows 95/98 computers.
+   * **Note: **If this property is `false`, it could mean that it was not able to check the
+   * revocation status. Because of this uncertainty, a CheckRevoked method has been added. It
+   * returns an integer indicating one of three possible states: 1 (revoked), 0 (not revoked), -1
+   * (unable to check revocation status).
+   *
+   * This property is read-only.
+   */
+  readonly revoked: boolean
+
+  /**
+   * The RFC822 name of the certificate. (The RFC822 name is one part of the Subject Alternative
+   * Name extension of a certificate, if it exists. It is often the only part of the SAN.)
+   *
+   * If the certificate contains a list of RFC822 names then this property will return the comma
+   * separated list of names.
+   *
+   * Starting in Chilkat v9.5.0.85, to get the complete Subject Alternative Name extension as XML,
+   * use the SubjectAlternativeName property.
+   *
+   * This property is read-only.
+   */
+  readonly rfc822Name: string
+
+  /**
+   * `true` if this is a self-signed certificate, otherwise `false`.
+   *
+   * This property is read-only.
+   */
+  readonly selfSigned: boolean
+
+  /**
+   * The certificate's serial number as a hexidecimal string.
+   *
+   * This property is read-only.
+   */
+  readonly serialNumber: string
+
+  /**
+   * Hexidecimal string of the SHA-1 thumbprint for the certificate. (This is the SHA1 hash of the
+   * binary DER representation of the entire X.509 certificate.)
+   *
+   * This property is read-only.
+   */
+  readonly sha1Thumbprint: string
+
+  /**
+   * Returns `true` if the certificate and all certificates in the chain of authority have valid
+   * signatures, otherwise returns `false`.
+   *
+   * This property is read-only.
+   */
+  readonly signatureVerified: boolean
+
+  /**
+   * The certificate subject's country.
+   *
+   * This property is read-only.
+   */
+  readonly subjectC: string
+
+  /**
+   * The certificate subject's common name.
+   *
+   * This property is read-only.
+   */
+  readonly subjectCN: string
+
+  /**
+   * The certificate subject's full distinguished name.
+   *
+   * This property is read-only.
+   */
+  readonly subjectDN: string
+
+  /**
+   * The certificate subject's email address.
+   *
+   * This property is read-only.
+   */
+  readonly subjectE: string
+
+  /**
+   * The subject key identifier of the certificate in base64 string format. This is only present if
+   * the certificate contains the extension OID 2.5.29.14.
+   *
+   * This property is read-only.
+   */
+  readonly subjectKeyId: string
+
+  /**
+   * The certificate subject's locality, which could be a city, count, township, or other geographic
+   * region.
+   *
+   * This property is read-only.
+   */
+  readonly subjectL: string
+
+  /**
+   * The certificate subject's organization, which is typically the company name.
+   *
+   * This property is read-only.
+   */
+  readonly subjectO: string
+
+  /**
+   * The certificate subject's organizational unit, which is the unit within the organization.
+   *
+   * This property is read-only.
+   */
+  readonly subjectOU: string
+
+  /**
+   * The certificate subject's state or province.
+   *
+   * This property is read-only.
+   */
+  readonly subjectS: string
+
+  /**
+   * Returns `true` if the certificate has a trusted root authority, otherwise returns `false`.
+   *
+   * Note: As of version 9.5.0.41, the notion of what your application deems as trusted becomes more
+   * specific. The TrustedRoots class/object was added in v9.5.0.0. Prior to this, a certificate was
+   * considered to be anchored by a trusted root if the certificate chain could be established to a
+   * root (self-signed) certificate, AND if the root certificate was located somewhere in the
+   * Windows registry-based certificate stores. There are two problems with this: (1) it's a
+   * Windows-only solution. This property would always return `false` on non-Windows systems, and
+   * (2) it might be considered not a strong enough set of conditions for trusting a root
+   * certificate.
+   *
+   * As of version 9.5.0.41, this property pays attention to the new TrustedRoots class/object,
+   * which allows for an application to specificallly indicate which root certificates are to be
+   * trusted. Certificates may be added to the TrustedRoots object via the LoadCaCertsPem or AddCert
+   * methods, and then activated by calling the TrustedRoots.Activate method. The activated trusted
+   * roots are deemed to be trusted in any Chilkat API method/property that needs to make this
+   * determination. In addition, the TrustedRoots object has a property named TrustSystemCaRoots,
+   * which defaults to `true`, which allows for backward compatibility. It will trust CA
+   * certificates stored in the Windows registry-based certificate stores, or if on Linux, will
+   * trust certificates found in /etc/ssl/certs/ca-certificates.crt.
+   *
+   * This property is read-only.
+   */
+  readonly trustedRoot: boolean
+
+  /**
+   * The date (in RFC822 string format) that this certificate becomes (or became) valid. It is a
+   * GMT/UTC date that is returned.
+   *
+   * This property is read-only.
+   */
+  readonly validFromStr: string
+
+  /**
+   * The date (in RFC822 string format) that this certificate expires. It is a GMT/UTC date that is
+   * returned.
+   *
+   * This property is read-only.
+   */
+  readonly validToStr: string
+
+  /**
+   * The certificate's serial number as a decimal string.
+   *
+   * This property is read-only.
+   */
+  readonly serialDecimal: string
+
+  /**
+   * Can be set to the PIN value for a certificate / private key stored on a smart card.
+   */
+  smartCardPin: string
+
+  /**
+   * If set to `true`, then no dialog will automatically popup if the SmartCardPin is incorrect.
+   * Instead, the method requiring the private key on the smart card will fail. The default value of
+   * this property is `false`, which means that if the SmartCardPin property is incorrect, a dialog
+   * with prompt will be displayed.
+   */
+  smartCardNoDialog: boolean
+
+  /**
+   * Returns a string containing a comma separated list of keywords with the extended key usages of
+   * the certificate. The list of possible extended key usages are:
+   *
+   * - serverAuth - TLS WWW server authentication
+   *
+   * - clientAuth - TLS WWW client authentication
+   *
+   * - codeSigning - Signing of downloadable executable code
+   *
+   * - emailProtection - Email protection
+   *
+   * - timeStamping - Binding the hash of an object to a time
+   *
+   * - OCSPSigning - Signing OCSP responses
+   *
+   * This property is read-only.
+   */
+  readonly extendedKeyUsage: string
+
+  /**
+   * The subject alternative name (SAN) name of the certificate returned as XML. See the examples
+   * linked below.
+   *
+   * This property is read-only.
+   */
+  readonly subjectAlternativeName: string
+
+  /**
+   * This is a catch-all property to be used for uncommon needs. This property defaults to the empty
+   * string, and should typically remain empty. Possible comma separated keywords can include:
+   *
+   * - `CheckRevokedCacheOnly`: Added in `v11.2.0`. In the `CheckRevoked` method, prevents network
+   *   access and only checks the cached revocation information on the local computer.
+   */
+  uncommonOptions: string
+
+  /**
+   * Set after calling LoadFromSmartcard. Possible values are:
+   *
+   * - 0 - No failure.  The call to LoadFromSmartcard was successful.
+   *
+   * - 1 - No smartcard or USB token was detected.
+   *
+   * - 2 - The SmartCardPin was provided and the PIN login failed. (Note: Chilkat only PIN
+   *   authenticates if PKCS11 was the chosen means for communicating with the smartcard.)
+   *
+   * - 3 - The certificate matching the specified criteria was not found.
+   *
+   * - 99 - Some other undefined failure.  Consult the LastErrorText for more information.
+   *
+   * This property is read-only.
+   */
+  readonly smartCardFailReason: number
+
+  // ---- Methods ----
+
+  /**
+   * Returns 1 if the certificate has been revoked, 0 if not revoked, and -1 if unable to check the
+   * revocation status.
+   *
+   * **Note:** This method is only implemented on Windows systems. It uses the underlying Microsoft
+   * CertVerifyRevocation Platform SDK function to check the revocation status of a certificate.
+   * (Search `CertVerifyRevocation` to get information about it.) Starting in `v11.2.0`, the keyword
+   * `"CheckRevokedCacheOnly"` can be included in the `UncommonOptions` to prevent the Microsoft
+   * revocation handler from
+   * accessing any network based resources for revocation checking. In other words, just check the
+   * cached revocation information on the local computer.
+   *
+   * Non-Windows (and Windows) applications can send an OCSP request as shown in the example below.
+   */
+  checkRevoked(): number
+
+  /**
+   * Exports the digital certificate to ASN.1 DER format binary file.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  exportCertDerFile(path: string): void
+
+  /**
+   * Exports the digital certificate to an unencrypted PEM formatted string.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  exportCertPem(): string
+
+  /**
+   * Exports the digital certificate to an unencrypted PEM formatted file.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  exportCertPemFile(path: string): void
+
+  /**
+   * Exports a certificate to an XML format where the XML tags are the names of the ASN.1 objects
+   * that compose the X.509 certificate. Binary data is either hex or base64 encoded. (The binary
+   * data for a `bits` ASN.1 tag is hex encoded, whereas for all other ASN.1 tags, such as `octets`,
+   * it is base64.)
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  exportCertXml(): string
+
+  /**
+   * Exports the certificate and private key (if available) to a PFX (.pfx or .p12) file. The output
+   * PFX is secured using the `pfxPassword`. If `bIncludeCertChain` is `true`, then the certificates
+   * in the chain of authority are also included in the PFX output file.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  exportToPfxFile(pfxFilename: string, pfxPassword: string, bIncludeCertChain: boolean): void
+
+  /**
+   * Finds and returns the issuer certificate. If the certificate is a root or self-issued, then the
+   * certificate returned is a copy of the caller certificate. (The IsRoot property can be check to
+   * see if the certificate is a root (or self-issued) certificate.)
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  findIssuer(): Cert
+
+  /**
+   * Returns a base64 encoded string representation of the certificate's binary DER format, which
+   * can be passed to SetFromEncoded to recreate the certificate object.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  getEncoded(): string
+
+  /**
+   * Returns the certificate extension data in XML format (converted from ASN.1). The `oid` is an
+   * OID, such as the ones listed here: <http://www.alvestrand.no/objectid/2.5.29.html>
+   *
+   * Note: In many cases, the data within the XML is returned base64 encoded. An application may
+   * need to take one further step to base64 decode the information contained within the XML.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  getExtensionAsXml(oid: string): string
+
+  /**
+   * Exports the certificate's private key to a PEM string (if the private key is available).
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  getPrivateKeyPem(): string
+
+  /**
+   * Returns the SPKI Fingerprint suitable for use in pinning. (See RFC 7469.) An SPKI Fingerprint
+   * is defined as the output of a known cryptographic hash algorithm whose input is the DER-encoded
+   * ASN.1 representation of the Subject Public Key Info (SPKI) of an X.509 certificate. The
+   * `hashAlg` specifies the hash algorithm and may be `sha256`, `sha384`, `sha512`, `sha1`, `md2`,
+   * `md5`, `haval`, `ripemd128`, `ripemd160`,`ripemd256`, or `ripemd320`. The `encoding` specifies
+   * the encoding, and may be `base64`, `hex`, or any of the encoding modes specified in the article
+   * at the link below.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  getSpkiFingerprint(hashAlg: string, encoding: string): string
+
+  /**
+   * Returns `true` if a private key associated with the certificate is available.
+   */
+  hasPrivateKey(): boolean
+
+  /**
+   * This method searches for a certificate with the specified common name (CN) on different
+   * operating systems.
+   *
+   * - On `Windows`, it searches the `Local Machine` and `Current User` certificate stores.
+   * - On `macOS` and `iOS`, it searches the Default and System `Keychains`.
+   *
+   * If the certificate is found, it is loaded and ready for use.
+   *
+   * Note: Chilkat v10.0.0 or later is needed for Apple Keychain.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  loadByCommonName(cn: string): void
+
+  /**
+   * This method searches for a certificate with the specified email address on different operating
+   * systems.
+   *
+   * - On `Windows`, it searches the `Local Machine` and `Current User` certificate stores.
+   * - On `macOS` and `iOS`, it searches the Default and System `Keychains`.
+   *
+   * If the certificate is found, it is loaded and ready for use.
+   *
+   * Note: Chilkat v10.0.0 or later is needed for Apple Keychain.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  loadByEmailAddress(emailAddress: string): void
+
+  /**
+   * This method searches for a certificate with the specified issuer common name (`issuerCN`) and
+   * serial number (`serialNumber`) on different operating systems.
+   *
+   * - On `Windows`, it searches the `Local Machine` and `Current User` certificate stores.
+   * - On `macOS` and `iOS`, it searches the Default and System `Keychains`.
+   *
+   * If the certificate is found, it is loaded and ready for use.
+   *
+   * Note: Chilkat v10.0.0 or later is needed for Apple Keychain.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  loadByIssuerAndSerialNumber(issuerCN: string, serialNumber: string): void
+
+  /**
+   * Loads an ASN.1 or DER encoded certificate represented in a Base64 string.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  loadFromBase64(encodedCert: string): void
+
+  /**
+   * Loads a certificate from a .cer, .crt, .p7b, or .pem file. This method accepts certificates
+   * from files in any of the following formats:
+   *
+   * 1. DER encoded binary X.509 (.CER)
+   * 2. Base-64 encoded X.509 (.CER)
+   * 3. Cryptographic Message Syntax Standard - PKCS #7 Certificates (.P7B)
+   * 4. PEM format
+   *    This method decodes the certificate based on the contents if finds within the file, and not
+   *    based on the file extension. If your certificate is in a file having a different extension,
+   *    try loading it using this method before assuming it won't work. This method does not load
+   *    .p12 or .pfx (PKCS #12) files.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  loadFromFile(path: string): void
+
+  /**
+   * Loads the certificate from a PEM string.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  loadPem(strPem: string): void
+
+  /**
+   * Loads a PFX file. Note: If the PFX contains multiple certificates, the 1st certificate in the
+   * PFX is loaded.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  loadPfxFile(pfxPath: string, password: string): void
+
+  /**
+   * Converts a PEM file to a DER file.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  pemFileToDerFile(fromPath: string, toPath: string): void
+
+  /**
+   * Saves a certificate object to a .cer file.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  saveToFile(path: string): void
+
+  /**
+   * Initializes the certificate object from a base64 encoded string representation of the
+   * certificate's binary DER format.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  setFromEncoded(encodedCert: string): void
+
+  /**
+   * Used to associate a private key with the certificate for subsequent (PKCS7) signature creation
+   * or decryption.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  setPrivateKey(privKey: PrivateKey): void
+
+  /**
+   * Same as SetPrivateKey, but the key is provided in unencrypted PEM format. (Note: The
+   * `privKeyPem` is not a file path, it is the actual PEM text.)
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  setPrivateKeyPem(privKeyPem: string): void
+
+  /**
+   * Adds an XML certificate vault to the object's internal list of sources to be searched for
+   * certificates for help in building certificate chains and verifying the certificate signature to
+   * the trusted root.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  useCertVault(vault: XmlCertVault): void
+
+  /**
+   * Verifies the certificate signature, as well as the signatures of all certificates in the chain
+   * of authentication to the trusted root. Returns `true` if all signatures are verified to the
+   * trusted root. Otherwise returns `false`.
+   */
+  verifySignature(): boolean
+
+  /**
+   * Exports the certificate and private key (if available) to `pfxData`. The `password` is what
+   * will be required to access the PFX contents at a later time. If `includeCertChain` is `true`,
+   * then the certificates in the chain of authority are also included in the PFX.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  exportToPfxBd(password: string, includeCertChain: boolean, pfxData: BinData): void
+
+  /**
+   * Exports the digital certificate in ASN.1 DER format to a BinData object.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  exportCertDerBd(cerData: BinData): void
+
+  /**
+   * Loads the certificate from the PFX contained in `pfxData`. Note: If the PFX contains multiple
+   * certificates, the 1st certificate in the PFX is loaded.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  loadPfxBd(pfxData: BinData, password: string): void
+
+  /**
+   * Loads an X.509 certificate from data contained in `certBytes`.
+   *
+   * **Note:** The `certBytes` may contain the certificate in any format. It can be binary DER
+   * (ASN.1), PEM, Base64, etc. Chilkat will automatically detect the format.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  loadFromBd(certBytes: BinData): void
+
+  /**
+   * Returns an encoded hash of a particular part of the certificate. The `part` may be one of the
+   * following:
+   *
+   * - IssuerDN
+   *
+   * - IssuerPublicKey
+   *
+   * - SubjectDN
+   *
+   * - SubjectPublicKey
+   *
+   * The `hashAlg` is the name of the hash algorithm, such as `sha1`, `sha256`, `sha384`, `sha512`,
+   * `md5`, etc. The `encoding` is the format to return, such as `hex`, `base64`, etc.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  hashOf(part: string, hashAlg: string, encoding: string): string
+
+  /**
+   * Verifies that the SmartCardPin property setting is correct. Returns 1 if correct, 0 if
+   * incorrect, and -1 if unable to check because the underlying CSP does not support the
+   * functionality.
+   */
+  checkSmartCardPin(): number
+
+  /**
+   * Returns the base64 representation of an X509PKIPathv1 containing just the calling certificate.
+   * This is typically used in an X.509 Binary Security Token. It is a PKIPath that contains an
+   * ordered list of X.509 public certificates packaged in a PKIPath. The X509PKIPathv1 token type
+   * may be used to represent a certificate path. (This is sometimes used in XAdES signatures.)
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  x509PKIPathv1(): string
+
+  /**
+   * **Important:** It's important to set the SmartCardPin property **before** calling this method.
+   *
+   * Loads a certificate and its associated private key (if available) from a connected USB token or
+   * smart card. This function works on Windows, Linux, MacOS, iOS, and Alpine Linux. If multiple
+   * USB tokens and/or smartcards are connected to the system, then each will be searched and the
+   * first matching certificate will be loaded.
+   *
+   * The `certSpec` can have the following formats and values:
+   *
+   * - **Empty String**: Passing the empty string is the most common way to call this function. Pass
+   *   the empty string when only one HSM (USB token or smart card) is connected to the system, and
+   *   it contains only one certificate with a private key. The HSM can contain other certificates,
+   *   but Chilkat will automatically choose and load the certificate that has the associated
+   *   private key also located on the HSM.
+   *
+   * - **cn=\<cert subject common name\>**: Finds and loads the certificate having the specified
+   *   subject common name (CN).
+   *
+   * - **subjectdn_withtags=\<distinguished name with tags\>**: Finds and loads the certificate
+   *   having the specified DN with tags. For example, subjectdn_withtags=C=US, O=Example
+   *   Corporation, OU=IT Department, CN=www.example.com
+   *
+   * - **subjectdn=\<distinguished name without tags\>**: Finds and loads the certificate having the
+   *   specified DN without tags. For example, subjectdn=US, California, San Francisco, Example
+   *   Corp, Engineering, www.example.com, support@example.com
+   *
+   * - **issuercn=\<subject hex serial:issuer common name\>**: Finds and loads the certificate
+   *   having the specified hex serial number and an issuer with the specified common name. For
+   *   example, `01020304: Let's Encrypt Authority X1`
+   *
+   * - **serial=\<hex serial number\>**: Finds and loads the certificate having the specified
+   *   hexidecimal serial number.
+   *
+   * - **thumbprint=\<hex SHA1 thumbprint\>**: Finds and loads the certificate having the specified
+   *   hexidecimal SHA1 thumbprint.
+   *
+   * - **policyoid=\<certificate policy OID\>**: Finds and loads the certificate having a policy OID
+   *   equal to the specified value, such as 2.16.840.1.101.2.1.11.39.
+   *
+   * - **o=\<subject organization\>**: Finds and loads the certificate having the `O` subject part
+   *   equal to the specified value.
+   *
+   * - **c=\<subject country\>**: Finds and loads the certificate having the `C` subject part equal
+   *   to the specified value.
+   *
+   * - **l=\<subject locality\>**: Finds and loads the certificate having the `L` subject part equal
+   *   to the specified value.
+   *
+   * - **ou=\<subject organizational unit\>**: Finds and loads the certificate having the `OU`
+   *   subject part equal to the specified value.
+   *
+   * - **st=\<subject state\>**: Finds and loads the certificate having the `ST` subject part equal
+   *   to the specified value.
+   *
+   * - **e=\<subject email\>**: Finds and loads the certificate having the `E` subject part equal to
+   *   the specified value.
+   *
+   * On Windows systems, `certSpec` can specify a CSP (Cryptographic Service Provider) name, such as
+   * `YubiHSM Key Storage Provider.` This option is retained for legacy support, as Chilkat
+   * initially handled USB tokens and smartcards only on Windows via CSPs. Chilkat now supports HSMs
+   * across multiple platforms (Windows, Linux, macOS, iOS, Alpine Linux) and uses various methods
+   * to communicate with HSMs, including PKCS11, macOS Keychain services, Windows ScMinidriver,
+   * MsCNG, and legacy Windows CryptoAPI. Chilkat automatically detects the HSM make/model and
+   * selects the optimal communication method.
+   *
+   * Some possible CSP values are:
+   *
+   * - Microsoft Smart Card Key Storage Provider
+   *
+   * - Microsoft Base Smart Card Crypto Provider
+   *
+   * - Bit4id Universal Middleware Provider
+   *
+   * - YubiHSM Key Storage Provider (starting in v9.5.0.83)
+   *
+   * - SafeSign Standard Cryptographic Service Provider
+   *
+   * - SafeSign Standard RSA and AES Cryptographic Service Provider
+   *
+   * - eToken Base Cryptographic Provider
+   *
+   * - cryptoCertum3 CSP
+   *
+   * - FTSafe ePass1000 RSA Cryptographic Service Provider
+   *
+   * - SecureStoreCSP
+   *
+   * - EnterSafe ePass2003 CSP v2.0
+   *
+   * - Gemalto Classic Card CSP
+   *
+   * - PROXKey CSP India V1.0
+   *
+   * - PROXKey CSP India V2.0
+   *
+   * - TRUST KEY CSP V1.0
+   *
+   * - Watchdata Brazil CSP V1.0
+   *
+   * - Luna Cryptographic Services for Microsoft Windows
+   *
+   * - Luna SChannel Cryptographic Services for Microsoft Windows
+   *
+   * - Safenet RSA Full Cryptographic Provider
+   *
+   * - nCipher Enhanced Cryptographic Provider
+   *
+   * - MySmartLogon NFC CSP
+   *
+   * - NFC Connector Enterprise
+   *
+   * - ActivClient Cryptographic Service Provider
+   *
+   * - EnterSafe ePass2003 CSP v1.0
+   *
+   * - Oberthur Card Systems Cryptographic Provider
+   *
+   * - Athena ASECard Crypto CSP
+   *
+   * - many others...
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  loadFromSmartcard(certSpec: string): void
+
+  /**
+   * This method searches for a certificate with the specified `thumbprint`. The `thumbprint` is
+   * passed as a string using the encoding specified by `encoding` (such as `base64`, `hex`, etc.).
+   *
+   * On `Windows`, it searches the `Local Machine` and `Current User` certificate stores.
+   *
+   * - On `macOS` and `iOS`, it searches the Default and System `Keychains`.
+   *
+   * If the certificate is found, it is loaded and ready for use.
+   *
+   * Note: Chilkat v10.0.0 or later is needed for Apple Keychain.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  loadByThumbprint(thumbprint: string, encoding: string): void
+
+  /**
+   * This method searches for a certificate containing a subject part matching the `oid` and
+   * `value`.
+   *
+   * On `Windows`, it searches the `Local Machine` and `Current User` certificate stores.
+   *
+   * - On `macOS` and `iOS`, it searches the Default and System `Keychains`.
+   *
+   * If the certificate is found, it is loaded and ready for use.
+   *
+   * Note: Chilkat v10.0.0 or later is needed for Apple Keychain.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  loadBySubjectOid(oid: string, value: string): void
+
+  /**
+   * Returns a part of the certificate's subject by name or OID. The `partNameOrOid` can be a part
+   * name, such as `CN`, `O`, `OU`, `E`, `S`, `L`, `C`, or `SERIALNUMBER`, or it can be an OID such
+   * as `2.5.4.3`.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  getSubjectPart(partNameOrOid: string): string
+
+  /**
+   * Returns the certificate extension data as a string. This method should only be called for those
+   * extensions with text values NOT stored as binary ASN.1. In most cases, applications should call
+   * GetExtensionAsXml because most extensions contain ASN.1 values that need to be decoded..
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  getExtensionAsText(oid: string): string
+
+  /**
+   * Loads the `bd` with the certificate's public key in ASN.1 DER format. If the key type (such as
+   * RSA) supports both PKCS1 and PKCS8 formats, then `preferPkcs1` selects which format to return.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  getPubKeyDer(preferPkcs1: boolean, bd: BinData): void
+
+  /**
+   * Loads the `bd` with the certificate's signature.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  getSignature(bd: BinData): void
+
+  /**
+   * Returns the certificate extension data specified by `oid` in `bd`.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  getExtensionBd(oid: string, bd: BinData): void
+
+  /**
+   * Links to the certificate's private key located on an HSM (smart card, token, or cloud HSM).
+   * Once linked, the certificate can be used for signing where the signing occurs on the HSM. See
+   * the example below for more detailed information.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  linkPkcs11(session: Pkcs11): void
+
+  /**
+   * This is an open-ended method to accomodate uploading the private key to a cloud service, such
+   * as AWS KMS, or Azure Key Vault. For details, see the examples below.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link Cert.uploadToCloudAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  uploadToCloud(jsonIn: JsonObject, jsonOut: JsonObject): void
+
+  /**
+   * Asynchronous form of {@link Cert.uploadToCloud}: the same call on a native worker thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link Cert.abort} (which cancels it) and the {@link Cert.onPercentDone} /
+   * {@link Cert.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  uploadToCloudAsync(jsonIn: JsonObject, jsonOut: JsonObject): Promise<void>
+
+  /**
+   * Provides information for a cloud signing service to do the signing via a remote signing server.
+   * Current supported services are AWS KMS, Azure Key Vault, and ARSS (Aruba Remote Signing
+   * Service). See the examples below.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link Cert.setCloudSignerAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  setCloudSigner(json: JsonObject): void
+
+  /**
+   * Asynchronous form of {@link Cert.setCloudSigner}: the same call on a native worker thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link Cert.abort} (which cancels it) and the {@link Cert.onPercentDone} /
+   * {@link Cert.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  setCloudSignerAsync(json: JsonObject): Promise<void>
+
+  /**
+   * Returns `true` if certificate is RSA-based (i.e. has an RSA key).
+   */
+  isRsa(): boolean
+
+  /**
+   * Returns `true` if certificate is ECDSA-based (i.e. has an ECDSA key).
+   */
+  isEcdsa(): boolean
+
+  /**
+   * Unload the certificate, which could mean closing a PKCS11 session if the certificate was loaded
+   * from a smart card.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  unload(): void
+
+  /**
+   * Loads the `privKey` with the certificate's private key, if it exists. Returns `false` if the
+   * certificate has no associated private key.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  getPrivateKey(privKey: PrivateKey): void
+
+  /**
+   * Loads the `pubKey` with the certificate's public key.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  getPublicKey(pubKey: PublicKey): void
+
+  /**
+   * Finds and returns the issuer certificate in `issuer`. If the certificate is a root or
+   * self-issued, then the certificate returned is a copy of the caller certificate. (The IsRoot
+   * property can be check to see if the certificate is a root (or self-issued) certificate.)
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  getIssuer(issuer: Cert): void
+
+  /**
+   * Builds the certificate chain in `certChain` containing all the certificates (including this
+   * one), in the chain of authentication to the trusted root (if possible). If this certificate
+   * object was loaded from a PFX, then the certiicates contained in the PFX are automatically
+   * available for building the certificate chain. The UseCertVault method can be called to provide
+   * additional certificates that might be required to build the cert chain. Finally, the
+   * TrustedRoots object can be used to provide a way of making trusted root certificates available.
+   *
+   * Note: Returns `true` even if certificate chain is not completed to the root. The certificate
+   * chain's ReachesRoot property can be examined to see if the chain was completed to the root.
+   *
+   * On Windows systems, the registry-based certificate stores are automatically consulted if needed
+   * to locate intermediate or root certificates in the chain. Chilkat searches certificate stores
+   * in the following order.
+   * See [System Store
+   * Locations](https://docs.microsoft.com/en-us/windows/desktop/seccrypto/system-store-locations)
+   * for more information.
+   *
+   * - Current-User `CA` Certificate Store
+   *
+   * - Local-Machine `CA` Certificate Store
+   *
+   * - Current-User `Root` Certificate Store
+   *
+   * - Local-Machine `Root` Certificate Store
+   *
+   * - Current-User `MY` Certificate Store
+   *
+   * - Local-Machine `MY` Certificate Store
+   *
+   * - Current-User `ADDRESSBOOK` Certificate Store (if it exists)
+   *
+   * - Local-Machine `ADDRESSBOOK` Certificate Store (if it exists)
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Cert.lastErrorText}.
+   */
+  buildCertChain(certChain: CertChain): void
+
+  // ---- Events (ReactNativeGen_DESIGN.md §6) ----
+
+  /**
+   * Called with the percent completed (0..100) while a long-running method runs, when Chilkat
+   * can measure progress. Runs on the JavaScript thread, so it is only useful with the
+   * `...Async` methods (during a synchronous call the thread is busy and the events arrive
+   * after it returns). Assign `undefined` to remove.
+   */
+  onPercentDone?: (pctDone: number) => void
+
+  /**
+   * Called with a name/value pair of progress information while a long-running method runs
+   * (what is reported depends on the class and method). Runs on the JavaScript thread; see
+   * {@link Cert.onPercentDone}. Assign `undefined` to remove.
+   */
+  onProgressInfo?: (name: string, value: string) => void
+
+  /**
+   * Requests that the pending `...Async` call on this object stop at its next progress check.
+   * The promise then rejects with Chilkat's abort error. Chilkat checks at least every
+   * `heartbeatMs` milliseconds on the classes that have that property, so set it (e.g. 250)
+   * for a responsive cancel. Harmless when nothing is pending.
+   */
+  abort(): void
+}