@harperfast/harper 5.0.0-alpha.10

package/dist/security/certificateVerification/verificationConfig.js

@@ -0,0 +1,121 @@
+"use strict";
+/**
+ * Configuration parsing and default values for certificate verification
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CRL_USER_AGENT = exports.ERROR_CACHE_TTL = exports.CRL_DEFAULT_VALIDITY_PERIOD = void 0;
+exports.getCachedCertificateVerificationConfig = getCachedCertificateVerificationConfig;
+const logger_ts_1 = require("../../utility/logging/logger.js");
+const packageUtils_js_1 = require("../../utility/packageUtils.js");
+const configValidation_ts_1 = require("./configValidation.js");
+const logger = (0, logger_ts_1.loggerWithTag)('cert-verification-config');
+// Constants for hardcoded values
+exports.CRL_DEFAULT_VALIDITY_PERIOD = 7 * 24 * 60 * 60 * 1000; // 7 days in milliseconds
+exports.ERROR_CACHE_TTL = 300000; // 5 minutes for error caching
+exports.CRL_USER_AGENT = `Harper/${packageUtils_js_1.packageJson.version} CRL-Client`;
+// Configuration cache to avoid redundant parsing on every certificate verification
+// Using WeakMap to prevent memory leaks from holding strong references to config objects
+// This allows garbage collection of config objects when they're no longer referenced elsewhere
+const configCache = new WeakMap();
+let lastPrimitiveConfig = null;
+let lastPrimitiveResult = null;
+// Track validation errors to prevent repeated error logging and provide graceful degradation
+// Maps config object to the error that occurred during validation
+const validationErrorCache = new WeakMap();
+let lastPrimitiveValidationError = null;
+/**
+ * Cached version of getCertificateVerificationConfig to avoid redundant parsing
+ * This is the recommended function to use in hot paths like certificate verification.
+ *
+ * MEMORY SAFETY:
+ * - Uses WeakMap for object configs to prevent memory leaks
+ * - Config objects can be garbage collected when no longer referenced elsewhere
+ * - Primitive values (boolean, null, undefined) use simple reference equality
+ * - No strong references held to config objects, preventing memory accumulation
+ *
+ * ERROR HANDLING:
+ * - Invalid config causes validation errors to be thrown on first access
+ * - Validation errors are logged once and then cached
+ * - Subsequent accesses with the same invalid config return false (disabled) to prevent
+ *   repeated error logging and allow the application to continue running
+ * - This provides fail-safe behavior: invalid security config defaults to disabled
+ *   rather than crashing on every request
+ *
+ * @param mtlsConfig - The mTLS configuration from env.get()
+ * @returns Configuration object or false if verification is disabled or invalid
+ */
+function getCachedCertificateVerificationConfig(mtlsConfig) {
+    // Handle primitive values (boolean, null, undefined) with simple caching
+    if (typeof mtlsConfig === 'boolean' || mtlsConfig == null) {
+        // Check if we've already seen a validation error for this primitive config
+        if (mtlsConfig === lastPrimitiveConfig && lastPrimitiveValidationError) {
+            logger.trace?.('Using cached validation error result (primitive) - returning disabled');
+            return false;
+        }
+        if (mtlsConfig === lastPrimitiveConfig && lastPrimitiveResult !== null) {
+            logger.trace?.('Using cached certificate verification config (primitive)');
+            return lastPrimitiveResult;
+        }
+        logger.trace?.('Parsing and caching certificate verification config (primitive)');
+        lastPrimitiveConfig = mtlsConfig;
+        try {
+            lastPrimitiveResult = getCertificateVerificationConfig(mtlsConfig);
+            lastPrimitiveValidationError = null; // Clear any previous error
+            return lastPrimitiveResult;
+        }
+        catch (error) {
+            // Cache the validation error to prevent repeated logging
+            lastPrimitiveValidationError = error;
+            logger.error?.(`Certificate verification config validation failed - defaulting to disabled: ${error.message}`);
+            return false; // Fail-safe: invalid config = disabled verification
+        }
+    }
+    // Check for cached validation error
+    const cachedError = validationErrorCache.get(mtlsConfig);
+    if (cachedError) {
+        logger.trace?.('Using cached validation error result (object) - returning disabled');
+        return false;
+    }
+    const cached = configCache.get(mtlsConfig);
+    if (cached !== undefined) {
+        logger.trace?.('Using cached certificate verification config (object)');
+        return cached;
+    }
+    // Cache miss: parse and store the result
+    logger.trace?.('Parsing and caching certificate verification config (object)');
+    try {
+        const result = getCertificateVerificationConfig(mtlsConfig);
+        configCache.set(mtlsConfig, result);
+        return result;
+    }
+    catch (error) {
+        // Cache the validation error to prevent repeated logging
+        validationErrorCache.set(mtlsConfig, error);
+        logger.error?.(`Certificate verification config validation failed - defaulting to disabled: ${error.message}`);
+        return false; // Fail-safe: invalid config = disabled verification
+    }
+}
+/**
+ * Determine if certificate verification should be performed based on configuration
+ * @param mtlsConfig - The mTLS configuration (can be boolean or object)
+ * @returns Configuration object or false if verification is disabled
+ */
+function getCertificateVerificationConfig(mtlsConfig) {
+    logger.trace?.(`getCertificateVerificationConfig called with: ${JSON.stringify({ mtlsConfig })}`);
+    if (!mtlsConfig)
+        return false;
+    const verificationConfig = mtlsConfig === true ? undefined : mtlsConfig.certificateVerification;
+    logger.trace?.(`Certificate verification config: ${JSON.stringify({ verificationConfig })}`);
+    // Default to disabled for initial rollout to allow intentional real-world testing
+    // Users must explicitly enable certificate verification with certificateVerification: true or config object
+    if (verificationConfig == null || verificationConfig === false)
+        return false;
+    // Pass through validator for enabled cases (true or object)
+    // Convert true to empty object so validator applies all defaults
+    // This ensures we always get a complete config with crl and ocsp defaults
+    const configToValidate = verificationConfig === true ? {} : verificationConfig;
+    // Let validation errors propagate up to getCachedCertificateVerificationConfig
+    // which will log them once and cache the error
+    return (0, configValidation_ts_1.validateAndParseCertificateVerificationConfig)(configToValidate);
+}
+//# sourceMappingURL=verificationConfig.js.map

package/dist/security/certificateVerification/verificationConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verificationConfig.js","sourceRoot":"","sources":["../../../security/certificateVerification/verificationConfig.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AA+CH,wFA2DC;AAxGD,+DAAgE;AAChE,mEAA4D;AAE5D,+DAAsF;AAEtF,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,0BAA0B,CAAC,CAAC;AAEzD,iCAAiC;AACpB,QAAA,2BAA2B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,yBAAyB;AAChF,QAAA,eAAe,GAAG,MAAM,CAAC,CAAC,8BAA8B;AACxD,QAAA,cAAc,GAAG,UAAU,6BAAW,CAAC,OAAO,aAAa,CAAC;AAEzE,mFAAmF;AACnF,yFAAyF;AACzF,+FAA+F;AAC/F,MAAM,WAAW,GAAG,IAAI,OAAO,EAA8D,CAAC;AAC9F,IAAI,mBAAmB,GAA+B,IAAI,CAAC;AAC3D,IAAI,mBAAmB,GAAiD,IAAI,CAAC;AAE7E,6FAA6F;AAC7F,kEAAkE;AAClE,MAAM,oBAAoB,GAAG,IAAI,OAAO,EAA8B,CAAC;AACvE,IAAI,4BAA4B,GAAiB,IAAI,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,sCAAsC,CACrD,UAAiD;IAEjD,yEAAyE;IACzE,IAAI,OAAO,UAAU,KAAK,SAAS,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QAC3D,2EAA2E;QAC3E,IAAI,UAAU,KAAK,mBAAmB,IAAI,4BAA4B,EAAE,CAAC;YACxE,MAAM,CAAC,KAAK,EAAE,CAAC,uEAAuE,CAAC,CAAC;YACxF,OAAO,KAAK,CAAC;QACd,CAAC;QAED,IAAI,UAAU,KAAK,mBAAmB,IAAI,mBAAmB,KAAK,IAAI,EAAE,CAAC;YACxE,MAAM,CAAC,KAAK,EAAE,CAAC,0DAA0D,CAAC,CAAC;YAC3E,OAAO,mBAAmB,CAAC;QAC5B,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,CAAC,iEAAiE,CAAC,CAAC;QAClF,mBAAmB,GAAG,UAAwC,CAAC;QAC/D,IAAI,CAAC;YACJ,mBAAmB,GAAG,gCAAgC,CAAC,UAAU,CAAC,CAAC;YACnE,4BAA4B,GAAG,IAAI,CAAC,CAAC,2BAA2B;YAChE,OAAO,mBAAmB,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,yDAAyD;YACzD,4BAA4B,GAAG,KAAc,CAAC;YAC9C,MAAM,CAAC,KAAK,EAAE,CACb,+EAAgF,KAAe,CAAC,OAAO,EAAE,CACzG,CAAC;YACF,OAAO,KAAK,CAAC,CAAC,oDAAoD;QACnE,CAAC;IACF,CAAC;IAED,oCAAoC;IACpC,MAAM,WAAW,GAAG,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,EAAE,CAAC,oEAAoE,CAAC,CAAC;QACrF,OAAO,KAAK,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,KAAK,EAAE,CAAC,uDAAuD,CAAC,CAAC;QACxE,OAAO,MAAM,CAAC;IACf,CAAC;IAED,yCAAyC;IACzC,MAAM,CAAC,KAAK,EAAE,CAAC,8DAA8D,CAAC,CAAC;IAC/E,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,gCAAgC,CAAC,UAAU,CAAC,CAAC;QAC5D,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,yDAAyD;QACzD,oBAAoB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAc,CAAC,CAAC;QACrD,MAAM,CAAC,KAAK,EAAE,CACb,+EAAgF,KAAe,CAAC,OAAO,EAAE,CACzG,CAAC;QACF,OAAO,KAAK,CAAC,CAAC,oDAAoD;IACnE,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAS,gCAAgC,CACxC,UAAiD;IAEjD,MAAM,CAAC,KAAK,EAAE,CAAC,iDAAiD,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IAElG,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9B,MAAM,kBAAkB,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC;IAChG,MAAM,CAAC,KAAK,EAAE,CAAC,oCAAoC,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC;IAE7F,kFAAkF;IAClF,4GAA4G;IAC5G,IAAI,kBAAkB,IAAI,IAAI,IAAI,kBAAkB,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAE7E,4DAA4D;IAC5D,iEAAiE;IACjE,0EAA0E;IAC1E,MAAM,gBAAgB,GAAG,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;IAE/E,+EAA+E;IAC/E,+CAA+C;IAC/C,OAAO,IAAA,mEAA6C,EAAC,gBAAgB,CAAC,CAAC;AACxE,CAAC"}

package/dist/security/certificateVerification/verificationUtils.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Shared utilities for certificate verification
+ */
+import type { PeerCertificate, CertificateChainEntry } from './types.ts';
+/**
+ * Convert a buffer to PEM format
+ * @param buffer - Certificate data as buffer
+ * @param type - Certificate type (e.g., 'CERTIFICATE')
+ * @returns PEM formatted string
+ */
+export declare function bufferToPem(buffer: Buffer, type: string): string;
+/**
+ * Extract certificate chain from peer certificate object
+ * @param peerCertificate - Peer certificate object from TLS connection
+ * @returns Certificate chain with issuer relationships
+ */
+export declare function extractCertificateChain(peerCertificate: PeerCertificate): CertificateChainEntry[];
+/**
+ * Extract CRL Distribution Points from a certificate using PKI.js
+ * @param certPem - Certificate in PEM format
+ * @returns Array of CRL distribution point URLs
+ */
+export declare function extractCRLDistributionPoints(certPem: string): string[];
+/**
+ * Extract both CRL and OCSP URLs from a certificate in a single parse operation
+ * @param certPem - Certificate in PEM format
+ * @returns Object containing arrays of CRL and OCSP URLs
+ */
+export declare function extractRevocationUrls(certPem: string): {
+    crlUrls: string[];
+    ocspUrls: string[];
+};
+/**
+ * Extract OCSP responder URLs from a certificate
+ * @param certPem - Certificate in PEM format
+ * @returns Array of OCSP responder URLs
+ */
+export declare function extractOCSPUrls(certPem: string): string[];
+/**
+ * Convert PEM string to buffer for PKI.js parsing
+ * @param pem - PEM formatted certificate
+ * @returns Buffer containing certificate data
+ */
+export declare function pemToBuffer(pem: string): ArrayBuffer;
+/**
+ * Create a cache key for certificate verification
+ * @param certPem - Certificate in PEM format
+ * @param issuerPem - Issuer certificate in PEM format
+ * @param method - Verification method (ocsp, crl)
+ * @param additionalData - Additional data to include in hash
+ * @returns Cache key string
+ */
+export declare function createCacheKey(certPem: string, issuerPem: string, method: 'ocsp' | 'crl', additionalData?: Record<string, any>): string;
+/**
+ * Create a cache key for CRL storage
+ * @param distributionPoint - CRL distribution point URL
+ * @returns Cache key string
+ */
+export declare function createCRLCacheKey(distributionPoint: string): string;
+/**
+ * Create a composite ID for revoked certificate lookup
+ * @param issuerKeyId - Issuer key identifier or DN hash
+ * @param serialNumber - Certificate serial number
+ * @returns Composite ID string
+ */
+export declare function createRevokedCertificateId(issuerKeyId: string, serialNumber: string): string;
+/**
+ * Extract serial number from a certificate
+ * @param certPem - Certificate in PEM format
+ * @returns Certificate serial number as string
+ */
+export declare function extractSerialNumber(certPem: string): string;
+/**
+ * Extract issuer key identifier from a certificate
+ * @param certPem - Certificate in PEM format
+ * @returns Issuer key identifier as hex string, or hash of issuer DN if not available
+ */
+export declare function extractIssuerKeyId(certPem: string): string;
+export declare function getCertificateCacheTable(): unknown;

package/dist/security/certificateVerification/verificationUtils.js

@@ -0,0 +1,441 @@
+"use strict";
+/**
+ * Shared utilities for certificate verification
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bufferToPem = bufferToPem;
+exports.extractCertificateChain = extractCertificateChain;
+exports.extractCRLDistributionPoints = extractCRLDistributionPoints;
+exports.extractRevocationUrls = extractRevocationUrls;
+exports.extractOCSPUrls = extractOCSPUrls;
+exports.pemToBuffer = pemToBuffer;
+exports.createCacheKey = createCacheKey;
+exports.createCRLCacheKey = createCRLCacheKey;
+exports.createRevokedCertificateId = createRevokedCertificateId;
+exports.extractSerialNumber = extractSerialNumber;
+exports.extractIssuerKeyId = extractIssuerKeyId;
+exports.getCertificateCacheTable = getCertificateCacheTable;
+const node_crypto_1 = require("node:crypto");
+const pkijs = __importStar(require("pkijs"));
+const asn1js = __importStar(require("asn1js"));
+const logger_ts_1 = require("../../utility/logging/logger.js");
+const databases_ts_1 = require("../../resources/databases.js");
+const logger = (0, logger_ts_1.loggerWithTag)('cert-verification-utils');
+/**
+ * Convert a buffer to PEM format
+ * @param buffer - Certificate data as buffer
+ * @param type - Certificate type (e.g., 'CERTIFICATE')
+ * @returns PEM formatted string
+ */
+function bufferToPem(buffer, type) {
+    const base64 = buffer.toString('base64');
+    const lines = [`-----BEGIN ${type}-----`];
+    // Split into 64-char lines
+    for (let i = 0; i < base64.length; i += 64) {
+        lines.push(base64.substring(i, i + 64));
+    }
+    lines.push(`-----END ${type}-----`);
+    return lines.join('\n');
+}
+/**
+ * Extract certificate chain from peer certificate object
+ * @param peerCertificate - Peer certificate object from TLS connection
+ * @returns Certificate chain with issuer relationships
+ */
+function extractCertificateChain(peerCertificate) {
+    const chain = [];
+    let current = peerCertificate;
+    while (current?.raw) {
+        const entry = { cert: current.raw };
+        // Get issuer if available and different from self
+        if (current.issuerCertificate && current.issuerCertificate !== current && current.issuerCertificate.raw) {
+            entry.issuer = current.issuerCertificate.raw;
+        }
+        chain.push(entry);
+        // Move to next in chain
+        if (current.issuerCertificate && current.issuerCertificate !== current) {
+            current = current.issuerCertificate;
+        }
+        else {
+            break;
+        }
+    }
+    return chain;
+}
+/**
+ * Extract CRL Distribution Points from a certificate using PKI.js
+ * @param certPem - Certificate in PEM format
+ * @returns Array of CRL distribution point URLs
+ */
+function extractCRLDistributionPoints(certPem) {
+    try {
+        // Parse the certificate using PKI.js
+        const certBuffer = pemToBuffer(certPem);
+        const cert = pkijs.Certificate.fromBER(certBuffer);
+        // Look for CRL Distribution Points extension (OID: 2.5.29.31)
+        const crlDistExt = cert.extensions?.find((ext) => ext.extnID === '2.5.29.31');
+        if (!crlDistExt) {
+            logger.debug?.('Certificate has no CRL Distribution Points extension');
+            return [];
+        }
+        // Parse the extension value
+        const asn1 = asn1js.fromBER(crlDistExt.extnValue.valueBlock.valueHexView);
+        if (asn1.offset === -1) {
+            throw new Error('Failed to parse ASN.1 structure in CRL Distribution Points extension');
+        }
+        const crlDistPoints = new pkijs.CRLDistributionPoints({
+            schema: asn1.result,
+        });
+        const distributionPoints = [];
+        // Extract distribution point URLs
+        for (const distPoint of crlDistPoints.distributionPoints) {
+            if (distPoint.distributionPoint && Array.isArray(distPoint.distributionPoint)) {
+                // Handle the actual PKI.js structure where distributionPoint is an array
+                for (const dp of distPoint.distributionPoint) {
+                    if (dp.type === 6 && typeof dp.value === 'string') {
+                        // uniformResourceIdentifier
+                        const url = dp.value;
+                        if (url.startsWith('http://') || url.startsWith('https://')) {
+                            distributionPoints.push(url);
+                        }
+                    }
+                }
+            }
+        }
+        logger.debug?.(`Found ${distributionPoints.length} CRL distribution points: ${distributionPoints}`);
+        return distributionPoints;
+    }
+    catch (error) {
+        // Parsing failures are treated as "no CRL URLs available"
+        // Rationale: The certificate was already validated by Node.js TLS (signature, trust chain)
+        // If PKI.js can't parse it, it's likely a library incompatibility or unsupported extension format
+        // Not a security issue since TLS already validated the cert - we just can't extract revocation URLs
+        // The higher-level fail-open/fail-closed configuration determines final behavior when no URLs found
+        logger.warn?.(`Failed to extract CRL distribution points: ${error}`);
+        return [];
+    }
+}
+/**
+ * Extract both CRL and OCSP URLs from a certificate in a single parse operation
+ * @param certPem - Certificate in PEM format
+ * @returns Object containing arrays of CRL and OCSP URLs
+ */
+function extractRevocationUrls(certPem) {
+    try {
+        // Parse the certificate using PKI.js (single parse for both URL types)
+        const certBuffer = pemToBuffer(certPem);
+        const cert = pkijs.Certificate.fromBER(certBuffer);
+        const crlUrls = [];
+        const ocspUrls = [];
+        // Single pass through extensions to extract both CRL and OCSP URLs
+        for (const ext of cert.extensions || []) {
+            if (ext.extnID === '2.5.29.31') {
+                // CRL Distribution Points extension
+                try {
+                    const asn1 = asn1js.fromBER(ext.extnValue.valueBlock.valueHexView);
+                    if (asn1.offset !== -1) {
+                        const crlDistPoints = new pkijs.CRLDistributionPoints({
+                            schema: asn1.result,
+                        });
+                        // Extract CRL distribution point URLs
+                        for (const distPoint of crlDistPoints.distributionPoints) {
+                            if (distPoint.distributionPoint && Array.isArray(distPoint.distributionPoint)) {
+                                // Handle the actual PKI.js structure where distributionPoint is an array
+                                for (const dp of distPoint.distributionPoint) {
+                                    if (dp.type === 6 && typeof dp.value === 'string') {
+                                        // uniformResourceIdentifier
+                                        const url = dp.value;
+                                        if (url.startsWith('http://') || url.startsWith('https://')) {
+                                            crlUrls.push(url);
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+                catch (crlError) {
+                    logger.warn?.(`Failed to parse CRL Distribution Points extension: ${crlError}`);
+                }
+            }
+            else if (ext.extnID === '1.3.6.1.5.5.7.1.1') {
+                // Authority Information Access extension
+                try {
+                    const asn1 = asn1js.fromBER(ext.extnValue.valueBlock.valueHexView);
+                    if (asn1.offset !== -1 && asn1.result instanceof asn1js.Sequence) {
+                        for (const accessDesc of asn1.result.valueBlock.value) {
+                            if (accessDesc instanceof asn1js.Sequence && accessDesc.valueBlock.value.length >= 2) {
+                                const accessMethod = accessDesc.valueBlock.value[0];
+                                const accessLocation = accessDesc.valueBlock.value[1];
+                                // Check if accessMethod is OCSP (OID 1.3.6.1.5.5.7.48.1)
+                                if (accessMethod instanceof asn1js.ObjectIdentifier &&
+                                    accessMethod.valueBlock.toString() === '1.3.6.1.5.5.7.48.1') {
+                                    // Check if accessLocation is a URI (context tag 6)
+                                    if (accessLocation.idBlock.tagNumber === 6) {
+                                        const url = String.fromCharCode(...Array.from(accessLocation.valueBlock.valueHexView));
+                                        if (url.startsWith('http://') || url.startsWith('https://')) {
+                                            ocspUrls.push(url);
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+                catch (ocspError) {
+                    logger.warn?.(`Failed to parse Authority Information Access extension: ${ocspError}`);
+                }
+            }
+        }
+        logger.debug?.(`Found ${crlUrls.length} CRL distribution points and ${ocspUrls.length} OCSP responder URLs`);
+        return { crlUrls, ocspUrls };
+    }
+    catch (error) {
+        // Parsing failures are treated as "no revocation URLs available"
+        // Rationale: The certificate was already validated by Node.js TLS (signature, trust chain)
+        // If PKI.js can't parse it, it's likely a library incompatibility or unsupported extension format
+        // Not a security issue since TLS already validated the cert - we just can't extract revocation URLs
+        // The higher-level fail-open/fail-closed configuration determines final behavior when no URLs found
+        logger.warn?.(`Failed to extract revocation URLs: ${error}`);
+        return { crlUrls: [], ocspUrls: [] };
+    }
+}
+/**
+ * Extract OCSP responder URLs from a certificate
+ * @param certPem - Certificate in PEM format
+ * @returns Array of OCSP responder URLs
+ */
+function extractOCSPUrls(certPem) {
+    try {
+        // Parse the certificate using PKI.js
+        const certBuffer = pemToBuffer(certPem);
+        const cert = pkijs.Certificate.fromBER(certBuffer);
+        // Look for Authority Information Access extension (OID: 1.3.6.1.5.5.7.1.1)
+        const aiaExt = cert.extensions?.find((ext) => ext.extnID === '1.3.6.1.5.5.7.1.1');
+        if (!aiaExt) {
+            logger.debug?.('Certificate has no Authority Information Access extension');
+            return [];
+        }
+        // Parse the extension value using asn1js
+        const asn1 = asn1js.fromBER(aiaExt.extnValue.valueBlock.valueHexView);
+        if (asn1.offset === -1) {
+            throw new Error('Failed to parse ASN.1 structure in Authority Information Access extension');
+        }
+        const ocspUrls = [];
+        // The AIA extension contains a sequence of AccessDescription entries
+        // Each AccessDescription has: accessMethod (OID) and accessLocation (GeneralName)
+        if (asn1.result instanceof asn1js.Sequence) {
+            for (const accessDesc of asn1.result.valueBlock.value) {
+                if (accessDesc instanceof asn1js.Sequence && accessDesc.valueBlock.value.length >= 2) {
+                    const accessMethod = accessDesc.valueBlock.value[0];
+                    const accessLocation = accessDesc.valueBlock.value[1];
+                    // Check if accessMethod is OCSP (OID 1.3.6.1.5.5.7.48.1)
+                    if (accessMethod instanceof asn1js.ObjectIdentifier &&
+                        accessMethod.valueBlock.toString() === '1.3.6.1.5.5.7.48.1') {
+                        // Check if accessLocation is a URI (context tag 6)
+                        if (accessLocation.idBlock.tagNumber === 6) {
+                            const url = String.fromCharCode(...Array.from(accessLocation.valueBlock.valueHexView));
+                            if (url.startsWith('http://') || url.startsWith('https://')) {
+                                ocspUrls.push(url);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        logger.debug?.(`Found ${ocspUrls.length} OCSP responder URLs: ${ocspUrls}`);
+        return ocspUrls;
+    }
+    catch (error) {
+        logger.error?.(`Failed to extract OCSP URLs: ${error}`);
+        return [];
+    }
+}
+/**
+ * Convert PEM string to buffer for PKI.js parsing
+ * @param pem - PEM formatted certificate
+ * @returns Buffer containing certificate data
+ */
+function pemToBuffer(pem) {
+    // Remove PEM headers and whitespace
+    const base64 = pem
+        .replace(/-----BEGIN [^-]+-----/g, '')
+        .replace(/-----END [^-]+-----/g, '')
+        .replace(/\s/g, '');
+    // Convert to buffer
+    const binaryString = atob(base64);
+    const buffer = new ArrayBuffer(binaryString.length);
+    const view = new Uint8Array(buffer);
+    for (let i = 0; i < binaryString.length; i++) {
+        view[i] = binaryString.charCodeAt(i);
+    }
+    return buffer;
+}
+/**
+ * Create a cache key for certificate verification
+ * @param certPem - Certificate in PEM format
+ * @param issuerPem - Issuer certificate in PEM format
+ * @param method - Verification method (ocsp, crl)
+ * @param additionalData - Additional data to include in hash
+ * @returns Cache key string
+ */
+function createCacheKey(certPem, issuerPem, method, additionalData) {
+    const cacheData = {
+        certPem,
+        issuerPem,
+        method,
+        ...additionalData,
+    };
+    const cacheKeyHash = (0, node_crypto_1.createHash)('sha256').update(JSON.stringify(cacheData)).digest('hex');
+    return `${method}:${cacheKeyHash}`;
+}
+/**
+ * Create a cache key for CRL storage
+ * @param distributionPoint - CRL distribution point URL
+ * @returns Cache key string
+ */
+function createCRLCacheKey(distributionPoint) {
+    const hash = (0, node_crypto_1.createHash)('sha256').update(distributionPoint).digest('hex');
+    return `crl:${hash}`;
+}
+/**
+ * Create a composite ID for revoked certificate lookup
+ * @param issuerKeyId - Issuer key identifier or DN hash
+ * @param serialNumber - Certificate serial number
+ * @returns Composite ID string
+ */
+function createRevokedCertificateId(issuerKeyId, serialNumber) {
+    return `${issuerKeyId}:${serialNumber}`;
+}
+/**
+ * Extract serial number from a certificate
+ * @param certPem - Certificate in PEM format
+ * @returns Certificate serial number as string
+ */
+function extractSerialNumber(certPem) {
+    try {
+        const certBuffer = pemToBuffer(certPem);
+        const cert = pkijs.Certificate.fromBER(certBuffer);
+        // Convert serial number to string
+        const serialNumber = cert.serialNumber.valueBlock.valueHexView;
+        return Array.from(serialNumber)
+            .map((b) => b.toString(16).padStart(2, '0'))
+            .join('');
+    }
+    catch (error) {
+        logger.error?.(`Failed to extract serial number: ${error}`);
+        throw new Error(`Failed to extract certificate serial number: ${error.message}`);
+    }
+}
+/**
+ * Extract issuer key identifier from a certificate
+ * @param certPem - Certificate in PEM format
+ * @returns Issuer key identifier as hex string, or hash of issuer DN if not available
+ */
+function extractIssuerKeyId(certPem) {
+    try {
+        const certBuffer = pemToBuffer(certPem);
+        const cert = pkijs.Certificate.fromBER(certBuffer);
+        // Look for Authority Key Identifier extension (OID: 2.5.29.35)
+        const akiExt = cert.extensions?.find((ext) => ext.extnID === '2.5.29.35');
+        if (akiExt) {
+            try {
+                // Parse the extension value manually since parsedValue may be undefined for Ed25519 certs
+                const asn1 = asn1js.fromBER(akiExt.extnValue.valueBlock.valueHexView);
+                if (asn1.offset !== -1) {
+                    const aki = new pkijs.AuthorityKeyIdentifier({
+                        schema: asn1.result,
+                    });
+                    if (aki.keyIdentifier) {
+                        const keyId = aki.keyIdentifier.valueBlock.valueHexView;
+                        return Array.from(keyId)
+                            .map((b) => b.toString(16).padStart(2, '0'))
+                            .join('');
+                    }
+                }
+            }
+            catch (parseError) {
+                logger.debug?.(`Failed to parse Authority Key Identifier: ${parseError}, falling back to hash`);
+            }
+        }
+        // Fall back to hash of issuer DN
+        const issuerDN = cert.issuer.typesAndValues.map((tv) => `${tv.type}=${tv.value.valueBlock.value}`).join(',');
+        return (0, node_crypto_1.createHash)('sha256').update(issuerDN).digest('hex');
+    }
+    catch (error) {
+        logger.error?.(`Failed to extract issuer key ID: ${error}`);
+        throw new Error(`Failed to extract issuer key ID: ${error.message}`);
+    }
+}
+/**
+ * Get shared certificate verification cache table
+ * @returns Harper table instance for certificate verification cache
+ */
+// Cache the certificate cache table instance to avoid recreating it
+let certificateCacheTable = null;
+function getCertificateCacheTable() {
+    if (!certificateCacheTable) {
+        certificateCacheTable = (0, databases_ts_1.table)({
+            table: 'hdb_certificate_cache',
+            database: 'system',
+            attributes: [
+                {
+                    name: 'certificate_id',
+                    isPrimaryKey: true,
+                },
+                {
+                    name: 'status', // 'good', 'revoked', 'unknown'
+                },
+                {
+                    name: 'reason',
+                },
+                {
+                    name: 'checked_at',
+                },
+                {
+                    name: 'expiresAt',
+                    expiresAt: true,
+                    indexed: true,
+                },
+                {
+                    name: 'method', // 'ocsp' or 'crl'
+                },
+            ],
+        });
+    }
+    return certificateCacheTable;
+}
+//# sourceMappingURL=verificationUtils.js.map