@matter/protocol 0.11.0-alpha.0-20241005-e3e4e4a7a

package/dist/esm/certificate/CertificateManager.js

@@ -0,0 +1,837 @@
+/**
+ * @license
+ * Copyright 2022-2024 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import {
+  BitByteArray,
+  Bytes,
+  ContextTagged,
+  ContextTaggedBytes,
+  Crypto,
+  DatatypeOverride,
+  DerCodec,
+  DerKey,
+  DerObject,
+  DerType,
+  ImplementationError,
+  Logger,
+  MatterError,
+  Pkcs7,
+  PublicKey,
+  RawBytes,
+  SHA256_CMS,
+  Time,
+  X509,
+  X520,
+  X962
+} from "#general";
+import {
+  BitFlag,
+  BitmapSchema,
+  CaseAuthenticatedTag,
+  FabricId,
+  NodeId,
+  TlvArray,
+  TlvBitmap,
+  TlvBoolean,
+  TlvByteString,
+  TlvCaseAuthenticatedTag,
+  TlvFabricId,
+  TlvField,
+  TlvNodeId,
+  TlvObject,
+  TlvObjectWithMaxSize,
+  TlvOptionalField,
+  TlvOptionalRepeatedField,
+  TlvString,
+  TlvTaggedList,
+  TlvUInt16,
+  TlvUInt32,
+  TlvUInt64,
+  TlvUInt8,
+  TlvVendorId
+} from "#types";
+const logger = Logger.get("CertificateManager");
+class CertificateError extends MatterError {
+}
+const YEAR_S = 365 * 24 * 60 * 60;
+const EPOCH_OFFSET_S = 10957 * 24 * 60 * 60;
+const MAX_DER_CERTIFICATE_SIZE = 600;
+const MAX_TLV_CERTIFICATE_SIZE = 400;
+function matterToJsDate(date) {
+  return date === 0 ? X520.NON_WELL_DEFINED_DATE : new Date((date + EPOCH_OFFSET_S) * 1e3);
+}
+function jsToMatterDate(date, addYears = 0) {
+  return date.getTime() === X520.NON_WELL_DEFINED_DATE.getTime() ? 0 : Math.floor(date.getTime() / 1e3) - EPOCH_OFFSET_S + addYears * YEAR_S;
+}
+function intTo16Chars(value) {
+  const byteArray = new Uint8Array(8);
+  const dataView = Bytes.dataViewOf(byteArray);
+  dataView.setBigUint64(0, typeof value === "bigint" ? value : BigInt(value));
+  return Bytes.toHex(byteArray).toUpperCase();
+}
+function uInt16To8Chars(value) {
+  const byteArray = new Uint8Array(4);
+  const dataView = Bytes.dataViewOf(byteArray);
+  dataView.setUint32(0, value);
+  return Bytes.toHex(byteArray).toUpperCase();
+}
+function uInt16To4Chars(value) {
+  const byteArray = new Uint8Array(2);
+  const dataView = Bytes.dataViewOf(byteArray);
+  dataView.setUint16(0, value);
+  return Bytes.toHex(byteArray).toUpperCase();
+}
+const GenericMatterOpCertObject = (id, valueConverter) => (value) => [
+  DerObject(`2b0601040182a27c01${id.toString(16).padStart(2, "0")}`, {
+    value: (valueConverter ?? intTo16Chars)(value)
+  })
+];
+const GenericMatterAttCertObject = (id, valueConverter) => (value) => [
+  DerObject(`2b0601040182a27c02${id.toString(16).padStart(2, "0")}`, {
+    value: (valueConverter ?? intTo16Chars)(value)
+  })
+];
+const NodeId_Matter = GenericMatterOpCertObject(1);
+const FirmwareSigningId_Matter = GenericMatterOpCertObject(2);
+const IcacId_Matter = GenericMatterOpCertObject(3);
+const RcacId_Matter = GenericMatterOpCertObject(4);
+const FabricId_Matter = GenericMatterOpCertObject(5);
+const NocCat_Matter = GenericMatterOpCertObject(6, uInt16To8Chars);
+const VendorId_Matter = GenericMatterAttCertObject(1, uInt16To4Chars);
+const ProductId_Matter = GenericMatterAttCertObject(2, uInt16To4Chars);
+const AllowedSubjectAndIssuerMatterFields = {
+  nodeId: TlvOptionalField(17, TlvNodeId),
+  firmwareSigningId: TlvOptionalField(18, TlvUInt32),
+  icacId: TlvOptionalField(19, TlvUInt64),
+  rcacId: TlvOptionalField(20, TlvUInt64),
+  fabricId: TlvOptionalField(21, TlvFabricId),
+  caseAuthenticatedTags: TlvOptionalRepeatedField(22, TlvCaseAuthenticatedTag, { maxLength: 3 })
+};
+const TlvGenericMatterSubjectOrIssuerTaggedList = (matterFields) => {
+  const fields = {
+    // Standard DNs
+    commonName: TlvOptionalField(1, TlvString),
+    sureName: TlvOptionalField(2, TlvString),
+    serialNum: TlvOptionalField(3, TlvString),
+    countryName: TlvOptionalField(4, TlvString),
+    localityName: TlvOptionalField(5, TlvString),
+    stateOrProvinceName: TlvOptionalField(6, TlvString),
+    orgName: TlvOptionalField(7, TlvString),
+    orgUnitName: TlvOptionalField(8, TlvString),
+    title: TlvOptionalField(9, TlvString),
+    name: TlvOptionalField(10, TlvString),
+    givenName: TlvOptionalField(11, TlvString),
+    initials: TlvOptionalField(12, TlvString),
+    genQualifier: TlvOptionalField(13, TlvString),
+    dnQualifier: TlvOptionalField(14, TlvString),
+    pseudonym: TlvOptionalField(15, TlvString),
+    domainComponent: TlvOptionalField(16, TlvString),
+    // Matter specific DNs
+    ...matterFields,
+    // Standard DNs when encoded as Printable String
+    commonNamePs: TlvOptionalField(129, TlvString),
+    sureNamePs: TlvOptionalField(130, TlvString),
+    serialNumPs: TlvOptionalField(131, TlvString),
+    countryNamePs: TlvOptionalField(132, TlvString),
+    localityNamePs: TlvOptionalField(133, TlvString),
+    stateOrProvinceNamePs: TlvOptionalField(134, TlvString),
+    orgNamePs: TlvOptionalField(135, TlvString),
+    orgUnitNamePs: TlvOptionalField(136, TlvString),
+    titlePs: TlvOptionalField(137, TlvString),
+    namePs: TlvOptionalField(138, TlvString),
+    givenNamePs: TlvOptionalField(139, TlvString),
+    initialsPs: TlvOptionalField(140, TlvString),
+    genQualifierPs: TlvOptionalField(141, TlvString),
+    dnQualifierPs: TlvOptionalField(142, TlvString),
+    pseudonymPs: TlvOptionalField(143, TlvString)
+  };
+  return TlvTaggedList(fields);
+};
+const ExtensionKeyUsageBitmap = {
+  digitalSignature: BitFlag(0),
+  nonRepudiation: BitFlag(1),
+  keyEncipherment: BitFlag(2),
+  dataEncipherment: BitFlag(3),
+  keyAgreement: BitFlag(4),
+  keyCertSign: BitFlag(5),
+  cRLSign: BitFlag(6),
+  encipherOnly: BitFlag(7),
+  decipherOnly: BitFlag(8)
+};
+const ExtensionKeyUsageSchema = BitmapSchema(ExtensionKeyUsageBitmap);
+const BaseMatterCertificate = (matterFields) => TlvObjectWithMaxSize(
+  {
+    serialNumber: TlvField(1, TlvByteString.bound({ maxLength: 20 })),
+    signatureAlgorithm: TlvField(2, TlvUInt8),
+    issuer: TlvField(
+      3,
+      TlvGenericMatterSubjectOrIssuerTaggedList({
+        ...AllowedSubjectAndIssuerMatterFields,
+        ...matterFields?.issuer ?? {}
+      })
+    ),
+    notBefore: TlvField(4, TlvUInt32),
+    notAfter: TlvField(5, TlvUInt32),
+    subject: TlvField(
+      6,
+      TlvGenericMatterSubjectOrIssuerTaggedList({
+        ...AllowedSubjectAndIssuerMatterFields,
+        ...matterFields?.subject ?? {}
+      })
+    ),
+    publicKeyAlgorithm: TlvField(7, TlvUInt8),
+    ellipticCurveIdentifier: TlvField(8, TlvUInt8),
+    ellipticCurvePublicKey: TlvField(9, TlvByteString),
+    extensions: TlvField(
+      10,
+      TlvTaggedList({
+        basicConstraints: TlvField(
+          1,
+          TlvObject({
+            isCa: TlvField(1, TlvBoolean),
+            pathLen: TlvOptionalField(2, TlvUInt8)
+          })
+        ),
+        keyUsage: TlvField(2, TlvBitmap(TlvUInt16, ExtensionKeyUsageBitmap)),
+        extendedKeyUsage: TlvOptionalField(3, TlvArray(TlvUInt8)),
+        subjectKeyIdentifier: TlvField(4, TlvByteString.bound({ length: 20 })),
+        authorityKeyIdentifier: TlvField(5, TlvByteString.bound({ length: 20 })),
+        futureExtension: TlvOptionalRepeatedField(6, TlvByteString)
+      })
+    ),
+    signature: TlvField(11, TlvByteString)
+  },
+  MAX_TLV_CERTIFICATE_SIZE
+);
+const TlvRootCertificate = BaseMatterCertificate({
+  subject: {
+    rcacId: TlvField(20, TlvUInt64),
+    fabricId: TlvOptionalField(21, TlvFabricId)
+  },
+  issuer: AllowedSubjectAndIssuerMatterFields
+});
+const TlvOperationalCertificate = BaseMatterCertificate({
+  subject: {
+    nodeId: TlvField(17, TlvNodeId),
+    fabricId: TlvField(21, TlvFabricId),
+    caseAuthenticatedTags: TlvOptionalRepeatedField(22, TlvCaseAuthenticatedTag, { maxLength: 3 })
+  },
+  issuer: AllowedSubjectAndIssuerMatterFields
+});
+const TlvIntermediateCertificate = BaseMatterCertificate({
+  subject: {
+    icacId: TlvField(19, TlvUInt64),
+    fabricId: TlvOptionalField(21, TlvFabricId)
+  },
+  issuer: AllowedSubjectAndIssuerMatterFields
+});
+const TlvBaseCertificate = BaseMatterCertificate();
+const TlvCertificationDeclaration = TlvObject({
+  formatVersion: TlvField(0, TlvUInt16),
+  vendorId: TlvField(1, TlvVendorId),
+  produceIdArray: TlvField(2, TlvArray(TlvUInt16, { minLength: 1, maxLength: 100 })),
+  deviceTypeId: TlvField(3, TlvUInt32),
+  certificateId: TlvField(4, TlvString.bound({ length: 19 })),
+  securityLevel: TlvField(5, TlvUInt8),
+  securityInformation: TlvField(6, TlvUInt16),
+  versionNumber: TlvField(7, TlvUInt16),
+  certificationType: TlvField(8, TlvUInt8),
+  dacOriginVendorId: TlvOptionalField(9, TlvVendorId),
+  dacOriginProductId: TlvOptionalField(10, TlvUInt16),
+  authorizedPaaList: TlvOptionalField(
+    11,
+    TlvArray(TlvByteString.bound({ length: 20 }), { minLength: 1, maxLength: 10 })
+  )
+});
+function subjectOrIssuerToAsn1(data) {
+  const asn = {};
+  Object.entries(data).forEach(([key, value]) => {
+    if (value === void 0) {
+      return;
+    }
+    switch (key) {
+      case "commonName":
+        asn.commonName = X520.CommonName(value);
+        break;
+      case "sureName":
+        asn.sureName = X520.SurName(value);
+        break;
+      case "serialNum":
+        asn.serialNum = X520.SerialNumber(value);
+        break;
+      case "countryName":
+        asn.countryName = X520.CountryName(value);
+        break;
+      case "localityName":
+        asn.localityName = X520.LocalityName(value);
+        break;
+      case "stateOrProvinceName":
+        asn.stateOrProvinceName = X520.StateOrProvinceName(value);
+        break;
+      case "orgName":
+        asn.orgName = X520.OrganisationName(value);
+        break;
+      case "orgUnitName":
+        asn.orgUnitName = X520.OrganizationalUnitName(value);
+        break;
+      case "title":
+        asn.title = X520.Title(value);
+        break;
+      case "name":
+        asn.name = X520.Name(value);
+        break;
+      case "givenName":
+        asn.givenName = X520.GivenName(value);
+        break;
+      case "initials":
+        asn.initials = X520.Initials(value);
+        break;
+      case "genQualifier":
+        asn.genQualifier = X520.GenerationQualifier(value);
+        break;
+      case "dnQualifier":
+        asn.dnQualifier = X520.DnQualifier(value);
+        break;
+      case "pseudonym":
+        asn.pseudonym = X520.Pseudonym(value);
+        break;
+      case "domainComponent":
+        asn.domainComponent = X520.DomainComponent(value);
+        break;
+      case "nodeId":
+        asn.nodeId = NodeId_Matter(value);
+        break;
+      case "firmwareSigningId":
+        asn.firmwareSigningId = FirmwareSigningId_Matter(value);
+        break;
+      case "icacId":
+        asn.icacId = IcacId_Matter(value);
+        break;
+      case "rcacId":
+        asn.rcacId = RcacId_Matter(value);
+        break;
+      case "fabricId":
+        asn.fabricId = FabricId_Matter(value);
+        break;
+      case "caseAuthenticatedTags":
+        const caseAuthenticatedTags = value;
+        CaseAuthenticatedTag.validateNocTagList(caseAuthenticatedTags);
+        const cat0 = caseAuthenticatedTags[0];
+        const cat1 = caseAuthenticatedTags[1];
+        const cat2 = caseAuthenticatedTags[2];
+        if (cat0 !== void 0) {
+          asn.caseAuthenticatedTag0 = NocCat_Matter(cat0);
+        }
+        if (cat1 !== void 0) {
+          asn.caseAuthenticatedTag1 = NocCat_Matter(cat1);
+        }
+        if (cat2 !== void 0) {
+          asn.caseAuthenticatedTag2 = NocCat_Matter(cat2);
+        }
+        break;
+      case "vendorId":
+        asn.vendorId = VendorId_Matter(value);
+        break;
+      case "productId":
+        asn.productId = ProductId_Matter(value);
+        break;
+      case "commonNamePs":
+        asn.commonNamePs = X520.CommonName(value, true);
+        break;
+      case "sureNamePs":
+        asn.sureNamePs = X520.SurName(value, true);
+        break;
+      case "serialNumPs":
+        asn.serialNumPs = X520.SerialNumber(value, true);
+        break;
+      case "countryNamePs":
+        asn.countryNamePs = X520.CountryName(value, true);
+        break;
+      case "localityNamePs":
+        asn.localityNamePs = X520.LocalityName(value, true);
+        break;
+      case "stateOrProvinceNamePs":
+        asn.stateOrProvinceNamePs = X520.StateOrProvinceName(value, true);
+        break;
+      case "orgNamePs":
+        asn.orgNamePs = X520.OrganisationName(value, true);
+        break;
+      case "orgUnitNamePs":
+        asn.orgUnitNamePs = X520.OrganizationalUnitName(value, true);
+        break;
+      case "titlePs":
+        asn.titlePs = X520.Title(value, true);
+        break;
+      case "namePs":
+        asn.namePs = X520.Name(value, true);
+        break;
+      case "givenNamePs":
+        asn.givenNamePs = X520.GivenName(value, true);
+        break;
+      case "initialsPs":
+        asn.initialsPs = X520.Initials(value, true);
+        break;
+      case "genQualifierPs":
+        asn.genQualifierPs = X520.GenerationQualifier(value, true);
+        break;
+      case "dnQualifierPs":
+        asn.dnQualifierPs = X520.DnQualifier(value, true);
+        break;
+      case "pseudonymPs":
+        asn.pseudonymPs = X520.Pseudonym(value, true);
+        break;
+    }
+  });
+  return asn;
+}
+function extensionsToAsn1(extensions) {
+  const asn = {};
+  Object.entries(extensions).forEach(([key, value]) => {
+    if (value === void 0) {
+      return;
+    }
+    switch (key) {
+      case "basicConstraints":
+        asn.basicConstraints = X509.BasicConstraints(value);
+        break;
+      case "keyUsage":
+        asn.keyUsage = X509.KeyUsage(
+          ExtensionKeyUsageSchema.encode(value)
+        );
+        break;
+      case "extendedKeyUsage":
+        asn.extendedKeyUsage = X509.ExtendedKeyUsage(value);
+        break;
+      case "subjectKeyIdentifier":
+        asn.subjectKeyIdentifier = X509.SubjectKeyIdentifier(value);
+        break;
+      case "authorityKeyIdentifier":
+        asn.authorityKeyIdentifier = X509.AuthorityKeyIdentifier(value);
+        break;
+      case "futureExtension":
+        asn.futureExtension = RawBytes(Bytes.concat(...value ?? []));
+        break;
+    }
+  });
+  return asn;
+}
+var CertificateManager;
+((CertificateManager2) => {
+  function assertCertificateDerSize(certBytes) {
+    if (certBytes.length > MAX_DER_CERTIFICATE_SIZE) {
+      throw new ImplementationError(
+        `Certificate to generate is too big: ${certBytes.length} bytes instead of max ${MAX_DER_CERTIFICATE_SIZE} bytes`
+      );
+    }
+  }
+  function genericBuildAsn1Structure({
+    serialNumber,
+    notBefore,
+    notAfter,
+    issuer,
+    subject,
+    ellipticCurvePublicKey,
+    extensions
+  }) {
+    const {
+      basicConstraints: { isCa, pathLen }
+    } = extensions;
+    if (!isCa && pathLen !== void 0) {
+      throw new CertificateError("Path length must be undefined for non-CA certificates.");
+    }
+    return {
+      version: ContextTagged(0, 2),
+      // v3
+      serialNumber: DatatypeOverride(DerType.Integer, serialNumber),
+      signatureAlgorithm: X962.EcdsaWithSHA256,
+      issuer: subjectOrIssuerToAsn1(issuer),
+      validity: {
+        notBefore: matterToJsDate(notBefore),
+        notAfter: matterToJsDate(notAfter)
+      },
+      subject: subjectOrIssuerToAsn1(subject),
+      publicKey: X962.PublicKeyEcPrime256v1(ellipticCurvePublicKey),
+      extensions: ContextTagged(3, extensionsToAsn1(extensions))
+    };
+  }
+  function genericCertToAsn1(cert) {
+    const certBytes = DerCodec.encode(genericBuildAsn1Structure(cert));
+    assertCertificateDerSize(certBytes);
+    return certBytes;
+  }
+  function rootCertToAsn1(cert) {
+    const {
+      extensions: {
+        basicConstraints: { isCa }
+      }
+    } = cert;
+    if (!isCa) {
+      throw new CertificateError("Root certificate must be a CA.");
+    }
+    return genericCertToAsn1(cert);
+  }
+  CertificateManager2.rootCertToAsn1 = rootCertToAsn1;
+  function intermediateCaCertToAsn1(cert) {
+    const {
+      extensions: {
+        basicConstraints: { isCa }
+      }
+    } = cert;
+    if (!isCa) {
+      throw new CertificateError("Intermediate certificate must be a CA.");
+    }
+    return genericCertToAsn1(cert);
+  }
+  CertificateManager2.intermediateCaCertToAsn1 = intermediateCaCertToAsn1;
+  function nodeOperationalCertToAsn1(cert) {
+    const {
+      issuer: { icacId, rcacId },
+      extensions: {
+        basicConstraints: { isCa }
+      }
+    } = cert;
+    if (icacId === void 0 && rcacId === void 0) {
+      throw new CertificateError("Issuer RCAC or ICAC ID must be defined for an operational certificate.");
+    }
+    if (isCa) {
+      throw new CertificateError("Node operational certificate must not be a CA.");
+    }
+    return genericCertToAsn1(cert);
+  }
+  CertificateManager2.nodeOperationalCertToAsn1 = nodeOperationalCertToAsn1;
+  function deviceAttestationCertToAsn1(cert, key) {
+    const certificate = genericBuildAsn1Structure(cert);
+    const certBytes = DerCodec.encode({
+      certificate,
+      signAlgorithm: X962.EcdsaWithSHA256,
+      signature: BitByteArray(Crypto.sign(key, DerCodec.encode(certificate), "der"))
+    });
+    assertCertificateDerSize(certBytes);
+    return certBytes;
+  }
+  CertificateManager2.deviceAttestationCertToAsn1 = deviceAttestationCertToAsn1;
+  function productAttestationIntermediateCertToAsn1(cert, key) {
+    const certificate = genericBuildAsn1Structure(cert);
+    const certBytes = DerCodec.encode({
+      certificate,
+      signAlgorithm: X962.EcdsaWithSHA256,
+      signature: BitByteArray(Crypto.sign(key, DerCodec.encode(certificate), "der"))
+    });
+    assertCertificateDerSize(certBytes);
+    return certBytes;
+  }
+  CertificateManager2.productAttestationIntermediateCertToAsn1 = productAttestationIntermediateCertToAsn1;
+  function productAttestationAuthorityCertToAsn1(cert, key) {
+    const certificate = genericBuildAsn1Structure(cert);
+    const certBytes = DerCodec.encode({
+      certificate,
+      signAlgorithm: X962.EcdsaWithSHA256,
+      signature: BitByteArray(Crypto.sign(key, DerCodec.encode(certificate), "der"))
+    });
+    assertCertificateDerSize(certBytes);
+    return certBytes;
+  }
+  CertificateManager2.productAttestationAuthorityCertToAsn1 = productAttestationAuthorityCertToAsn1;
+  function certificationDeclarationToAsn1(eContent, subjectKeyIdentifier, privateKey) {
+    const certificate = {
+      version: 3,
+      digestAlgorithm: [SHA256_CMS],
+      encapContentInfo: Pkcs7.Data(eContent),
+      signerInfo: [
+        {
+          version: 3,
+          subjectKeyIdentifier: ContextTaggedBytes(0, subjectKeyIdentifier),
+          digestAlgorithm: SHA256_CMS,
+          signatureAlgorithm: X962.EcdsaWithSHA256,
+          signature: Crypto.sign(privateKey, eContent, "der")
+        }
+      ]
+    };
+    const certBytes = DerCodec.encode(Pkcs7.SignedData(certificate));
+    assertCertificateDerSize(certBytes);
+    return certBytes;
+  }
+  CertificateManager2.certificationDeclarationToAsn1 = certificationDeclarationToAsn1;
+  function validateGeneralCertificateFields(cert) {
+    if (cert.serialNumber.length > 20)
+      throw new CertificateError(
+        `Serial number must not be longer then 20 octets. Current serial number has ${cert.serialNumber.length} octets.`
+      );
+    if (cert.signatureAlgorithm !== 1) {
+      throw new CertificateError(`Unsupported signature algorithm: ${cert.signatureAlgorithm}`);
+    }
+    if (cert.publicKeyAlgorithm !== 1) {
+      throw new CertificateError(`Unsupported public key algorithm: ${cert.publicKeyAlgorithm}`);
+    }
+    if (cert.ellipticCurveIdentifier !== 1) {
+      throw new CertificateError(`Unsupported elliptic curve identifier: ${cert.ellipticCurveIdentifier}`);
+    }
+    if (Object.keys(cert.subject).length > 5) {
+      throw new CertificateError(`Certificate subject must not contain more than 5 RDNs.`);
+    }
+    if (Object.keys(cert.issuer).length > 5) {
+      throw new CertificateError(`Certificate issuer must not contain more than 5 RDNs.`);
+    }
+    if (cert.notBefore * 1e3 > Time.nowMs()) {
+      logger.warn(`Certificate notBefore date is in the future: ${cert.notBefore * 1e3} vs ${Time.nowMs()}`);
+    }
+  }
+  CertificateManager2.validateGeneralCertificateFields = validateGeneralCertificateFields;
+  function verifyRootCertificate(rootCert) {
+    CertificateManager2.validateGeneralCertificateFields(rootCert);
+    if ("nodeId" in rootCert.subject) {
+      throw new CertificateError(`Root certificate must not contain a nodeId.`);
+    }
+    if (rootCert.subject.fabricId !== void 0) {
+      if (Array.isArray(rootCert.subject.fabricId)) {
+        throw new CertificateError(
+          `Invalid fabricId in NoC certificate: ${Logger.toJSON(rootCert.subject.fabricId)}`
+        );
+      }
+      if (rootCert.subject.fabricId === FabricId(0)) {
+        throw new CertificateError(
+          `Invalid fabricId in NoC certificate: ${Logger.toJSON(rootCert.subject.fabricId)}`
+        );
+      }
+    }
+    if ("icacId" in rootCert.subject) {
+      throw new CertificateError(`Root certificate must not contain an icacId.`);
+    }
+    if (rootCert.subject.rcacId === void 0 || Array.isArray(rootCert.subject.rcacId)) {
+      throw new CertificateError(`Invalid rcacId in Root certificate: ${Logger.toJSON(rootCert.subject.rcacId)}`);
+    }
+    if ("caseAuthenticatedTags" in rootCert.subject) {
+      throw new CertificateError(`Root certificate must not contain a caseAuthenticatedTags.`);
+    }
+    if (rootCert.extensions.basicConstraints.isCa !== true) {
+      throw new CertificateError(`Root certificate must have isCa set to true.`);
+    }
+    if (!rootCert.extensions.keyUsage.keyCertSign || !rootCert.extensions.keyUsage.cRLSign) {
+      throw new CertificateError(`Root certificate keyUsage must have keyCertSign and CRLSign set.`);
+    }
+    if (rootCert.extensions.extendedKeyUsage !== void 0) {
+      throw new CertificateError(`Root certificate must not have extendedKeyUsage set.`);
+    }
+    if (rootCert.extensions.subjectKeyIdentifier === void 0) {
+      throw new CertificateError(`Root certificate must have subjectKeyIdentifier set.`);
+    }
+    if (rootCert.extensions.subjectKeyIdentifier.length !== 20) {
+      throw new CertificateError(`Root certificate subjectKeyIdentifier must be 160 bit.`);
+    }
+    if (rootCert.extensions.authorityKeyIdentifier === void 0) {
+      throw new CertificateError(`Root certificate must have authorityKeyIdentifier set.`);
+    }
+    if (rootCert.extensions.authorityKeyIdentifier.length !== 20) {
+      throw new CertificateError(`Root certificate authorityKeyIdentifier must be 160 bit.`);
+    }
+    if (!Bytes.areEqual(rootCert.extensions.authorityKeyIdentifier, rootCert.extensions.subjectKeyIdentifier)) {
+      throw new CertificateError(
+        `Root certificate authorityKeyIdentifier must be equal to subjectKeyIdentifier.`
+      );
+    }
+    Crypto.verify(PublicKey(rootCert.ellipticCurvePublicKey), rootCertToAsn1(rootCert), rootCert.signature);
+  }
+  CertificateManager2.verifyRootCertificate = verifyRootCertificate;
+  function verifyNodeOperationalCertificate(rootOrIcaCert, nocCert) {
+    CertificateManager2.validateGeneralCertificateFields(nocCert);
+    if (nocCert.subject.nodeId === void 0 || Array.isArray(nocCert.subject.nodeId)) {
+      throw new CertificateError(`Invalid nodeId in NoC certificate: ${Logger.toJSON(nocCert.subject.nodeId)}`);
+    }
+    if (!NodeId.isOperationalNodeId(nocCert.subject.nodeId)) {
+      throw new CertificateError(`Invalid nodeId in NoC certificate: ${Logger.toJSON(nocCert.subject.nodeId)}`);
+    }
+    if (nocCert.subject.fabricId === void 0 || Array.isArray(nocCert.subject.fabricId)) {
+      throw new CertificateError(
+        `Invalid fabricId in NoC certificate: ${Logger.toJSON(nocCert.subject.fabricId)}`
+      );
+    }
+    if (nocCert.subject.fabricId === FabricId(0)) {
+      throw new CertificateError(
+        `Invalid fabricId in NoC certificate: ${Logger.toJSON(nocCert.subject.fabricId)}`
+      );
+    }
+    if ("icacId" in nocCert.subject) {
+      throw new CertificateError(`Noc certificate must not contain an icacId.`);
+    }
+    if ("rcacId" in nocCert.subject) {
+      throw new CertificateError(`Noc certificate must not contain an rcacId.`);
+    }
+    if (nocCert.subject.caseAuthenticatedTags !== void 0) {
+      CaseAuthenticatedTag.validateNocTagList(nocCert.subject.caseAuthenticatedTags);
+    }
+    if (rootOrIcaCert.subject.fabricId !== void 0 && rootOrIcaCert.subject.fabricId !== nocCert.subject.fabricId) {
+      throw new CertificateError(
+        `FabricId in NoC certificate does not match the fabricId in the parent certificate. ${Logger.toJSON(
+          rootOrIcaCert.subject.fabricId
+        )} !== ${Logger.toJSON(nocCert.subject.fabricId)}`
+      );
+    }
+    if (nocCert.extensions.basicConstraints.isCa) {
+      throw new CertificateError(`Noc certificate must not have isCa set to true.`);
+    }
+    if (!nocCert.extensions.keyUsage.digitalSignature) {
+      throw new CertificateError(`Noc certificate must have keyUsage set to digitalSignature.`);
+    }
+    if (nocCert.extensions.extendedKeyUsage === void 0 || !nocCert.extensions.extendedKeyUsage.includes(1) && !nocCert.extensions.extendedKeyUsage.includes(2)) {
+      throw new CertificateError(
+        `Noc certificate must have extendedKeyUsage with serverAuth and clientAuth: ${Logger.toJSON(nocCert.extensions.extendedKeyUsage)}`
+      );
+    }
+    if (nocCert.extensions.subjectKeyIdentifier === void 0) {
+      throw new CertificateError(`Noc certificate must have subjectKeyIdentifier set.`);
+    }
+    if (nocCert.extensions.subjectKeyIdentifier.length !== 20) {
+      throw new CertificateError(`Noc certificate subjectKeyIdentifier must be 160 bit.`);
+    }
+    if (nocCert.extensions.authorityKeyIdentifier === void 0) {
+      throw new CertificateError(`Noc certificate must have authorityKeyIdentifier set.`);
+    }
+    if (nocCert.extensions.authorityKeyIdentifier.length !== 20) {
+      throw new CertificateError(`Noc certificate authorityKeyIdentifier must be 160 bit.`);
+    }
+    if (!Bytes.areEqual(nocCert.extensions.authorityKeyIdentifier, rootOrIcaCert.extensions.subjectKeyIdentifier)) {
+      throw new CertificateError(
+        `Noc certificate authorityKeyIdentifier must be equal to Root/Ica subjectKeyIdentifier.`
+      );
+    }
+    Crypto.verify(
+      PublicKey(rootOrIcaCert.ellipticCurvePublicKey),
+      nodeOperationalCertToAsn1(nocCert),
+      nocCert.signature
+    );
+  }
+  CertificateManager2.verifyNodeOperationalCertificate = verifyNodeOperationalCertificate;
+  function verifyIntermediateCaCertificate(rootCert, icaCert) {
+    CertificateManager2.validateGeneralCertificateFields(icaCert);
+    if ("nodeId" in icaCert.subject) {
+      throw new CertificateError(`Ica certificate must not contain a nodeId.`);
+    }
+    if (icaCert.subject.fabricId !== void 0) {
+      if (Array.isArray(icaCert.subject.fabricId)) {
+        throw new CertificateError(
+          `Invalid fabricId in NoC certificate: ${Logger.toJSON(icaCert.subject.fabricId)}`
+        );
+      }
+      if (icaCert.subject.fabricId === FabricId(0)) {
+        throw new CertificateError(
+          `Invalid fabricId in NoC certificate: ${Logger.toJSON(icaCert.subject.fabricId)}`
+        );
+      }
+      if (rootCert.subject.fabricId !== icaCert.subject.fabricId) {
+        throw new CertificateError(
+          `FabricId in Ica certificate does not match the fabricId in the parent certificate. ${Logger.toJSON(
+            rootCert.subject.fabricId
+          )} !== ${Logger.toJSON(icaCert.subject.fabricId)}`
+        );
+      }
+    }
+    if (icaCert.subject.icacId === void 0 || Array.isArray(icaCert.subject.icacId)) {
+      throw new CertificateError(`Invalid icacId in Ica certificate: ${Logger.toJSON(icaCert.subject.icacId)}`);
+    }
+    if ("rcacId" in icaCert.subject) {
+      throw new CertificateError(`Ica certificate must not contain an rcacId.`);
+    }
+    if ("caseAuthenticatedTags" in icaCert.subject) {
+      throw new CertificateError(`Ica certificate must not contain a caseAuthenticatedTags.`);
+    }
+    if (rootCert.subject.fabricId !== icaCert.subject.fabricId) {
+      throw new CertificateError(
+        `FabricId in Ica certificate does not match the fabricId in the parent certificate. ${Logger.toJSON(
+          rootCert.subject.fabricId
+        )} !== ${Logger.toJSON(icaCert.subject.fabricId)}`
+      );
+    }
+    if (rootCert.subject.rcacId !== icaCert.issuer.rcacId) {
+      throw new CertificateError(
+        `RcacId in Ica certificate does not match the rcacId in the parent certificate. ${Logger.toJSON(
+          rootCert.subject.rcacId
+        )} !== ${Logger.toJSON(icaCert.issuer.rcacId)}`
+      );
+    }
+    if (!icaCert.extensions.basicConstraints.isCa) {
+      throw new CertificateError(`Ica certificate must have isCa set to true.`);
+    }
+    if (!icaCert.extensions.keyUsage.keyCertSign || !icaCert.extensions.keyUsage.cRLSign) {
+      throw new CertificateError(`Ica certificate must have keyUsage set to keyCertSign and CRLSign.`);
+    }
+    if (icaCert.extensions.extendedKeyUsage !== void 0) {
+      throw new CertificateError(`Ica certificate must not have extendedKeyUsage set.`);
+    }
+    if (icaCert.extensions.subjectKeyIdentifier === void 0) {
+      throw new CertificateError(`Ica certificate must have subjectKeyIdentifier set.`);
+    }
+    if (icaCert.extensions.subjectKeyIdentifier.length !== 20) {
+      throw new CertificateError(`Ica certificate subjectKeyIdentifier must be 160 bit.`);
+    }
+    if (icaCert.extensions.authorityKeyIdentifier === void 0) {
+      throw new CertificateError(`Ica certificate must have authorityKeyIdentifier set.`);
+    }
+    if (icaCert.extensions.authorityKeyIdentifier.length !== 20) {
+      throw new CertificateError(`Ica certificate authorityKeyIdentifier must be 160 bit.`);
+    }
+    if (!Bytes.areEqual(icaCert.extensions.authorityKeyIdentifier, rootCert.extensions.subjectKeyIdentifier)) {
+      throw new CertificateError(
+        `Ica certificate authorityKeyIdentifier must be equal to root cert subjectKeyIdentifier.`
+      );
+    }
+    Crypto.verify(PublicKey(rootCert.ellipticCurvePublicKey), intermediateCaCertToAsn1(icaCert), icaCert.signature);
+  }
+  CertificateManager2.verifyIntermediateCaCertificate = verifyIntermediateCaCertificate;
+  function createCertificateSigningRequest(key) {
+    const request = {
+      version: 0,
+      subject: { organization: X520.OrganisationName("CSR") },
+      publicKey: X962.PublicKeyEcPrime256v1(key.publicKey),
+      endSignedBytes: ContextTagged(0)
+    };
+    return DerCodec.encode({
+      request,
+      signAlgorithm: X962.EcdsaWithSHA256,
+      signature: BitByteArray(Crypto.sign(key, DerCodec.encode(request), "der"))
+    });
+  }
+  CertificateManager2.createCertificateSigningRequest = createCertificateSigningRequest;
+  function getPublicKeyFromCsr(csr) {
+    const { [DerKey.Elements]: rootElements } = DerCodec.decode(csr);
+    if (rootElements?.length !== 3) throw new CertificateError("Invalid CSR data");
+    const [requestNode, signAlgorithmNode, signatureNode] = rootElements;
+    const { [DerKey.Elements]: requestElements } = requestNode;
+    if (requestElements?.length !== 4) throw new CertificateError("Invalid CSR data");
+    const [versionNode, _subjectNode, publicKeyNode] = requestElements;
+    const requestVersion = versionNode[DerKey.Bytes][0];
+    if (requestVersion !== 0) throw new CertificateError(`Unsupported request version${requestVersion}`);
+    const { [DerKey.Elements]: publicKeyElements } = publicKeyNode;
+    if (publicKeyElements?.length !== 2) throw new CertificateError("Invalid CSR data");
+    const [_publicKeyTypeNode, publicKeyBytesNode] = publicKeyElements;
+    const publicKey = publicKeyBytesNode[DerKey.Bytes];
+    if (signAlgorithmNode[DerKey.Elements]?.[0]?.[DerKey.Bytes] === void 0 || !Bytes.areEqual(
+      X962.EcdsaWithSHA256[DerKey.ObjectId][DerKey.Bytes],
+      signAlgorithmNode[DerKey.Elements]?.[0]?.[DerKey.Bytes]
+    ))
+      throw new CertificateError("Unsupported signature type");
+    Crypto.verify(PublicKey(publicKey), DerCodec.encode(requestNode), signatureNode[DerKey.Bytes], "der");
+    return publicKey;
+  }
+  CertificateManager2.getPublicKeyFromCsr = getPublicKeyFromCsr;
+})(CertificateManager || (CertificateManager = {}));
+export {
+  CertificateError,
+  CertificateManager,
+  FabricId_Matter,
+  FirmwareSigningId_Matter,
+  IcacId_Matter,
+  NocCat_Matter,
+  NodeId_Matter,
+  ProductId_Matter,
+  RcacId_Matter,
+  TlvCertificationDeclaration,
+  TlvIntermediateCertificate,
+  TlvOperationalCertificate,
+  TlvRootCertificate,
+  VendorId_Matter,
+  jsToMatterDate,
+  matterToJsDate
+};
+//# sourceMappingURL=CertificateManager.js.map