@matter/protocol 0.15.0-alpha.0-20250617-f4d4cad23 → 0.15.0-alpha.0-20250620-16e218ed3

package/dist/esm/certificate/CertificateManager.js

@@ -1,870 +0,0 @@
-/**
- * @license
- * Copyright 2022-2025 Matter.js Authors
- * SPDX-License-Identifier: Apache-2.0
- */
-import {
-  Bytes,
-  ContextTagged,
-  ContextTaggedBytes,
-  DatatypeOverride,
-  DerBitString,
-  DerCodec,
-  DerKey,
-  DerObject,
-  DerType,
-  Diagnostic,
-  ImplementationError,
-  Logger,
-  MatterError,
-  Pkcs7,
-  PublicKey,
-  RawBytes,
-  SHA256_CMS,
-  Time,
-  X509,
-  X520,
-  X962
-} from "#general";
-import {
-  BitFlag,
-  BitmapSchema,
-  CaseAuthenticatedTag,
-  FabricId,
-  NodeId,
-  TlvArray,
-  TlvBitmap,
-  TlvBoolean,
-  TlvByteString,
-  TlvCaseAuthenticatedTag,
-  TlvFabricId,
-  TlvField,
-  TlvNodeId,
-  TlvObject,
-  TlvObjectWithMaxSize,
-  TlvOptionalField,
-  TlvOptionalRepeatedField,
-  TlvString,
-  TlvTaggedList,
-  TlvUInt16,
-  TlvUInt32,
-  TlvUInt64,
-  TlvUInt8,
-  TlvVendorId
-} from "#types";
-const logger = Logger.get("CertificateManager");
-class CertificateError extends MatterError {
-}
-const YEAR_S = 365 * 24 * 60 * 60;
-const EPOCH_OFFSET_S = 10957 * 24 * 60 * 60;
-const MAX_DER_CERTIFICATE_SIZE = 600;
-const MAX_TLV_CERTIFICATE_SIZE = 400;
-function matterToJsDate(date) {
-  return date === 0 ? X520.NON_WELL_DEFINED_DATE : new Date((date + EPOCH_OFFSET_S) * 1e3);
-}
-function jsToMatterDate(date, addYears = 0) {
-  return date.getTime() === X520.NON_WELL_DEFINED_DATE.getTime() ? 0 : Math.floor(date.getTime() / 1e3) - EPOCH_OFFSET_S + addYears * YEAR_S;
-}
-function intTo16Chars(value) {
-  const byteArray = new Uint8Array(8);
-  const dataView = Bytes.dataViewOf(byteArray);
-  dataView.setBigUint64(0, typeof value === "bigint" ? value : BigInt(value));
-  return Bytes.toHex(byteArray).toUpperCase();
-}
-function uInt16To8Chars(value) {
-  const byteArray = new Uint8Array(4);
-  const dataView = Bytes.dataViewOf(byteArray);
-  dataView.setUint32(0, value);
-  return Bytes.toHex(byteArray).toUpperCase();
-}
-function uInt16To4Chars(value) {
-  const byteArray = new Uint8Array(2);
-  const dataView = Bytes.dataViewOf(byteArray);
-  dataView.setUint16(0, value);
-  return Bytes.toHex(byteArray).toUpperCase();
-}
-const GenericMatterOpCertObject = (id, valueConverter) => (value) => [
-  DerObject(`2b0601040182a27c01${id.toString(16).padStart(2, "0")}`, {
-    value: (valueConverter ?? intTo16Chars)(value)
-  })
-];
-const GenericMatterAttCertObject = (id, valueConverter) => (value) => [
-  DerObject(`2b0601040182a27c02${id.toString(16).padStart(2, "0")}`, {
-    value: (valueConverter ?? intTo16Chars)(value)
-  })
-];
-const NodeId_Matter = GenericMatterOpCertObject(1);
-const FirmwareSigningId_Matter = GenericMatterOpCertObject(2);
-const IcacId_Matter = GenericMatterOpCertObject(3);
-const RcacId_Matter = GenericMatterOpCertObject(4);
-const FabricId_Matter = GenericMatterOpCertObject(5);
-const NocCat_Matter = GenericMatterOpCertObject(6, uInt16To8Chars);
-const VendorId_Matter = GenericMatterAttCertObject(1, uInt16To4Chars);
-const ProductId_Matter = GenericMatterAttCertObject(2, uInt16To4Chars);
-const AllowedSubjectAndIssuerMatterFields = {
-  nodeId: TlvOptionalField(17, TlvNodeId),
-  firmwareSigningId: TlvOptionalField(18, TlvUInt32),
-  icacId: TlvOptionalField(19, TlvUInt64),
-  rcacId: TlvOptionalField(20, TlvUInt64),
-  fabricId: TlvOptionalField(21, TlvFabricId),
-  caseAuthenticatedTags: TlvOptionalRepeatedField(22, TlvCaseAuthenticatedTag, { maxLength: 3 })
-};
-const TlvGenericMatterSubjectOrIssuerTaggedList = (matterFields) => {
-  const fields = {
-    // Standard DNs
-    commonName: TlvOptionalField(1, TlvString),
-    sureName: TlvOptionalField(2, TlvString),
-    serialNum: TlvOptionalField(3, TlvString),
-    countryName: TlvOptionalField(4, TlvString),
-    localityName: TlvOptionalField(5, TlvString),
-    stateOrProvinceName: TlvOptionalField(6, TlvString),
-    orgName: TlvOptionalField(7, TlvString),
-    orgUnitName: TlvOptionalField(8, TlvString),
-    title: TlvOptionalField(9, TlvString),
-    name: TlvOptionalField(10, TlvString),
-    givenName: TlvOptionalField(11, TlvString),
-    initials: TlvOptionalField(12, TlvString),
-    genQualifier: TlvOptionalField(13, TlvString),
-    dnQualifier: TlvOptionalField(14, TlvString),
-    pseudonym: TlvOptionalField(15, TlvString),
-    domainComponent: TlvOptionalField(16, TlvString),
-    // Matter specific DNs
-    ...matterFields,
-    // Standard DNs when encoded as Printable String
-    commonNamePs: TlvOptionalField(129, TlvString),
-    sureNamePs: TlvOptionalField(130, TlvString),
-    serialNumPs: TlvOptionalField(131, TlvString),
-    countryNamePs: TlvOptionalField(132, TlvString),
-    localityNamePs: TlvOptionalField(133, TlvString),
-    stateOrProvinceNamePs: TlvOptionalField(134, TlvString),
-    orgNamePs: TlvOptionalField(135, TlvString),
-    orgUnitNamePs: TlvOptionalField(136, TlvString),
-    titlePs: TlvOptionalField(137, TlvString),
-    namePs: TlvOptionalField(138, TlvString),
-    givenNamePs: TlvOptionalField(139, TlvString),
-    initialsPs: TlvOptionalField(140, TlvString),
-    genQualifierPs: TlvOptionalField(141, TlvString),
-    dnQualifierPs: TlvOptionalField(142, TlvString),
-    pseudonymPs: TlvOptionalField(143, TlvString)
-  };
-  return TlvTaggedList(fields);
-};
-const ExtensionKeyUsageBitmap = {
-  digitalSignature: BitFlag(0),
-  nonRepudiation: BitFlag(1),
-  keyEncipherment: BitFlag(2),
-  dataEncipherment: BitFlag(3),
-  keyAgreement: BitFlag(4),
-  keyCertSign: BitFlag(5),
-  cRLSign: BitFlag(6),
-  encipherOnly: BitFlag(7),
-  decipherOnly: BitFlag(8)
-};
-const ExtensionKeyUsageSchema = BitmapSchema(ExtensionKeyUsageBitmap);
-const BaseMatterCertificate = (matterFields) => TlvObjectWithMaxSize(
-  {
-    serialNumber: TlvField(1, TlvByteString.bound({ maxLength: 20 })),
-    signatureAlgorithm: TlvField(2, TlvUInt8),
-    issuer: TlvField(
-      3,
-      TlvGenericMatterSubjectOrIssuerTaggedList({
-        ...AllowedSubjectAndIssuerMatterFields,
-        ...matterFields?.issuer ?? {}
-      })
-    ),
-    notBefore: TlvField(4, TlvUInt32),
-    notAfter: TlvField(5, TlvUInt32),
-    subject: TlvField(
-      6,
-      TlvGenericMatterSubjectOrIssuerTaggedList({
-        ...AllowedSubjectAndIssuerMatterFields,
-        ...matterFields?.subject ?? {}
-      })
-    ),
-    publicKeyAlgorithm: TlvField(7, TlvUInt8),
-    ellipticCurveIdentifier: TlvField(8, TlvUInt8),
-    ellipticCurvePublicKey: TlvField(9, TlvByteString),
-    extensions: TlvField(
-      10,
-      TlvTaggedList({
-        basicConstraints: TlvField(
-          1,
-          TlvObject({
-            isCa: TlvField(1, TlvBoolean),
-            pathLen: TlvOptionalField(2, TlvUInt8)
-          })
-        ),
-        keyUsage: TlvField(2, TlvBitmap(TlvUInt16, ExtensionKeyUsageBitmap)),
-        extendedKeyUsage: TlvOptionalField(3, TlvArray(TlvUInt8)),
-        subjectKeyIdentifier: TlvField(4, TlvByteString.bound({ length: 20 })),
-        authorityKeyIdentifier: TlvField(5, TlvByteString.bound({ length: 20 })),
-        futureExtension: TlvOptionalRepeatedField(6, TlvByteString)
-      })
-    ),
-    signature: TlvField(11, TlvByteString)
-  },
-  MAX_TLV_CERTIFICATE_SIZE
-);
-const TlvRootCertificate = BaseMatterCertificate({
-  subject: {
-    rcacId: TlvField(20, TlvUInt64),
-    fabricId: TlvOptionalField(21, TlvFabricId)
-  },
-  issuer: AllowedSubjectAndIssuerMatterFields
-});
-const TlvOperationalCertificate = BaseMatterCertificate({
-  subject: {
-    nodeId: TlvField(17, TlvNodeId),
-    fabricId: TlvField(21, TlvFabricId),
-    caseAuthenticatedTags: TlvOptionalRepeatedField(22, TlvCaseAuthenticatedTag, { maxLength: 3 })
-  },
-  issuer: AllowedSubjectAndIssuerMatterFields
-});
-const TlvIntermediateCertificate = BaseMatterCertificate({
-  subject: {
-    icacId: TlvField(19, TlvUInt64),
-    fabricId: TlvOptionalField(21, TlvFabricId)
-  },
-  issuer: AllowedSubjectAndIssuerMatterFields
-});
-const TlvBaseCertificate = BaseMatterCertificate();
-const TlvCertificationDeclaration = TlvObject({
-  formatVersion: TlvField(0, TlvUInt16),
-  vendorId: TlvField(1, TlvVendorId),
-  produceIdArray: TlvField(2, TlvArray(TlvUInt16, { minLength: 1, maxLength: 100 })),
-  deviceTypeId: TlvField(3, TlvUInt32),
-  certificateId: TlvField(4, TlvString.bound({ length: 19 })),
-  securityLevel: TlvField(5, TlvUInt8),
-  securityInformation: TlvField(6, TlvUInt16),
-  versionNumber: TlvField(7, TlvUInt16),
-  certificationType: TlvField(8, TlvUInt8),
-  dacOriginVendorId: TlvOptionalField(9, TlvVendorId),
-  dacOriginProductId: TlvOptionalField(10, TlvUInt16),
-  authorizedPaaList: TlvOptionalField(
-    11,
-    TlvArray(TlvByteString.bound({ length: 20 }), { minLength: 1, maxLength: 10 })
-  )
-});
-function subjectOrIssuerToAsn1(data) {
-  const asn = {};
-  Object.entries(data).forEach(([key, value]) => {
-    if (value === void 0) {
-      return;
-    }
-    switch (key) {
-      case "commonName":
-        asn.commonName = X520.CommonName(value);
-        break;
-      case "sureName":
-        asn.sureName = X520.SurName(value);
-        break;
-      case "serialNum":
-        asn.serialNum = X520.SerialNumber(value);
-        break;
-      case "countryName":
-        asn.countryName = X520.CountryName(value);
-        break;
-      case "localityName":
-        asn.localityName = X520.LocalityName(value);
-        break;
-      case "stateOrProvinceName":
-        asn.stateOrProvinceName = X520.StateOrProvinceName(value);
-        break;
-      case "orgName":
-        asn.orgName = X520.OrganisationName(value);
-        break;
-      case "orgUnitName":
-        asn.orgUnitName = X520.OrganizationalUnitName(value);
-        break;
-      case "title":
-        asn.title = X520.Title(value);
-        break;
-      case "name":
-        asn.name = X520.Name(value);
-        break;
-      case "givenName":
-        asn.givenName = X520.GivenName(value);
-        break;
-      case "initials":
-        asn.initials = X520.Initials(value);
-        break;
-      case "genQualifier":
-        asn.genQualifier = X520.GenerationQualifier(value);
-        break;
-      case "dnQualifier":
-        asn.dnQualifier = X520.DnQualifier(value);
-        break;
-      case "pseudonym":
-        asn.pseudonym = X520.Pseudonym(value);
-        break;
-      case "domainComponent":
-        asn.domainComponent = X520.DomainComponent(value);
-        break;
-      case "nodeId":
-        asn.nodeId = NodeId_Matter(value);
-        break;
-      case "firmwareSigningId":
-        asn.firmwareSigningId = FirmwareSigningId_Matter(value);
-        break;
-      case "icacId":
-        asn.icacId = IcacId_Matter(value);
-        break;
-      case "rcacId":
-        asn.rcacId = RcacId_Matter(value);
-        break;
-      case "fabricId":
-        asn.fabricId = FabricId_Matter(value);
-        break;
-      case "caseAuthenticatedTags":
-        const caseAuthenticatedTags = value;
-        CaseAuthenticatedTag.validateNocTagList(caseAuthenticatedTags);
-        const cat0 = caseAuthenticatedTags[0];
-        const cat1 = caseAuthenticatedTags[1];
-        const cat2 = caseAuthenticatedTags[2];
-        if (cat0 !== void 0) {
-          asn.caseAuthenticatedTag0 = NocCat_Matter(cat0);
-        }
-        if (cat1 !== void 0) {
-          asn.caseAuthenticatedTag1 = NocCat_Matter(cat1);
-        }
-        if (cat2 !== void 0) {
-          asn.caseAuthenticatedTag2 = NocCat_Matter(cat2);
-        }
-        break;
-      case "vendorId":
-        asn.vendorId = VendorId_Matter(value);
-        break;
-      case "productId":
-        asn.productId = ProductId_Matter(value);
-        break;
-      case "commonNamePs":
-        asn.commonNamePs = X520.CommonName(value, true);
-        break;
-      case "sureNamePs":
-        asn.sureNamePs = X520.SurName(value, true);
-        break;
-      case "serialNumPs":
-        asn.serialNumPs = X520.SerialNumber(value, true);
-        break;
-      case "countryNamePs":
-        asn.countryNamePs = X520.CountryName(value, true);
-        break;
-      case "localityNamePs":
-        asn.localityNamePs = X520.LocalityName(value, true);
-        break;
-      case "stateOrProvinceNamePs":
-        asn.stateOrProvinceNamePs = X520.StateOrProvinceName(value, true);
-        break;
-      case "orgNamePs":
-        asn.orgNamePs = X520.OrganisationName(value, true);
-        break;
-      case "orgUnitNamePs":
-        asn.orgUnitNamePs = X520.OrganizationalUnitName(value, true);
-        break;
-      case "titlePs":
-        asn.titlePs = X520.Title(value, true);
-        break;
-      case "namePs":
-        asn.namePs = X520.Name(value, true);
-        break;
-      case "givenNamePs":
-        asn.givenNamePs = X520.GivenName(value, true);
-        break;
-      case "initialsPs":
-        asn.initialsPs = X520.Initials(value, true);
-        break;
-      case "genQualifierPs":
-        asn.genQualifierPs = X520.GenerationQualifier(value, true);
-        break;
-      case "dnQualifierPs":
-        asn.dnQualifierPs = X520.DnQualifier(value, true);
-        break;
-      case "pseudonymPs":
-        asn.pseudonymPs = X520.Pseudonym(value, true);
-        break;
-    }
-  });
-  return asn;
-}
-function extensionsToAsn1(extensions) {
-  const asn = {};
-  Object.entries(extensions).forEach(([key, value]) => {
-    if (value === void 0) {
-      return;
-    }
-    switch (key) {
-      case "basicConstraints":
-        asn.basicConstraints = X509.BasicConstraints(value);
-        break;
-      case "keyUsage":
-        asn.keyUsage = X509.KeyUsage(
-          ExtensionKeyUsageSchema.encode(value)
-        );
-        break;
-      case "extendedKeyUsage":
-        asn.extendedKeyUsage = X509.ExtendedKeyUsage(value);
-        break;
-      case "subjectKeyIdentifier":
-        asn.subjectKeyIdentifier = X509.SubjectKeyIdentifier(value);
-        break;
-      case "authorityKeyIdentifier":
-        asn.authorityKeyIdentifier = X509.AuthorityKeyIdentifier(value);
-        break;
-      case "futureExtension":
-        asn.futureExtension = RawBytes(Bytes.concat(...value ?? []));
-        break;
-    }
-  });
-  return asn;
-}
-function genericBuildAsn1Structure({
-  serialNumber,
-  notBefore,
-  notAfter,
-  issuer,
-  subject,
-  ellipticCurvePublicKey,
-  extensions
-}) {
-  const {
-    basicConstraints: { isCa, pathLen }
-  } = extensions;
-  if (!isCa && pathLen !== void 0) {
-    throw new CertificateError("Path length must be undefined for non-CA certificates.");
-  }
-  return {
-    version: ContextTagged(0, 2),
-    // v3
-    serialNumber: DatatypeOverride(DerType.Integer, serialNumber),
-    signatureAlgorithm: X962.EcdsaWithSHA256,
-    issuer: subjectOrIssuerToAsn1(issuer),
-    validity: {
-      notBefore: matterToJsDate(notBefore),
-      notAfter: matterToJsDate(notAfter)
-    },
-    subject: subjectOrIssuerToAsn1(subject),
-    publicKey: X962.PublicKeyEcPrime256v1(ellipticCurvePublicKey),
-    extensions: ContextTagged(3, extensionsToAsn1(extensions))
-  };
-}
-function genericCertToAsn1(cert) {
-  const certBytes = DerCodec.encode(genericBuildAsn1Structure(cert));
-  assertCertificateDerSize(certBytes);
-  return certBytes;
-}
-function assertCertificateDerSize(certBytes) {
-  if (certBytes.length > MAX_DER_CERTIFICATE_SIZE) {
-    throw new ImplementationError(
-      `Certificate to generate is too big: ${certBytes.length} bytes instead of max ${MAX_DER_CERTIFICATE_SIZE} bytes`
-    );
-  }
-}
-class CertificateManager {
-  #crypto;
-  constructor(crypto) {
-    this.#crypto = crypto;
-  }
-  get crypto() {
-    return this.#crypto;
-  }
-  rootCertToAsn1(cert) {
-    const {
-      extensions: {
-        basicConstraints: { isCa }
-      }
-    } = cert;
-    if (!isCa) {
-      throw new CertificateError("Root certificate must be a CA.");
-    }
-    return genericCertToAsn1(cert);
-  }
-  intermediateCaCertToAsn1(cert) {
-    const {
-      extensions: {
-        basicConstraints: { isCa }
-      }
-    } = cert;
-    if (!isCa) {
-      throw new CertificateError("Intermediate certificate must be a CA.");
-    }
-    return genericCertToAsn1(cert);
-  }
-  nodeOperationalCertToAsn1(cert) {
-    const {
-      issuer: { icacId, rcacId },
-      extensions: {
-        basicConstraints: { isCa }
-      }
-    } = cert;
-    if (icacId === void 0 && rcacId === void 0) {
-      throw new CertificateError("Issuer RCAC or ICAC ID must be defined for an operational certificate.");
-    }
-    if (isCa) {
-      throw new CertificateError("Node operational certificate must not be a CA.");
-    }
-    return genericCertToAsn1(cert);
-  }
-  async deviceAttestationCertToAsn1(cert, key) {
-    const certificate = genericBuildAsn1Structure(cert);
-    const signature = await this.#crypto.signEcdsa(key, DerCodec.encode(certificate), "der");
-    const certBytes = DerCodec.encode({
-      certificate,
-      signAlgorithm: X962.EcdsaWithSHA256,
-      signature: DerBitString(signature)
-    });
-    assertCertificateDerSize(certBytes);
-    return certBytes;
-  }
-  async productAttestationIntermediateCertToAsn1(cert, key) {
-    const certificate = genericBuildAsn1Structure(cert);
-    const signature = await this.#crypto.signEcdsa(key, DerCodec.encode(certificate), "der");
-    const certBytes = DerCodec.encode({
-      certificate,
-      signAlgorithm: X962.EcdsaWithSHA256,
-      signature: DerBitString(signature)
-    });
-    assertCertificateDerSize(certBytes);
-    return certBytes;
-  }
-  async productAttestationAuthorityCertToAsn1(cert, key) {
-    const certificate = genericBuildAsn1Structure(cert);
-    const certBytes = DerCodec.encode({
-      certificate,
-      signAlgorithm: X962.EcdsaWithSHA256,
-      signature: DerBitString(await this.#crypto.signEcdsa(key, DerCodec.encode(certificate), "der"))
-    });
-    assertCertificateDerSize(certBytes);
-    return certBytes;
-  }
-  async certificationDeclarationToAsn1(eContent, subjectKeyIdentifier, privateKey) {
-    const certificate = {
-      version: 3,
-      digestAlgorithm: [SHA256_CMS],
-      encapContentInfo: Pkcs7.Data(eContent),
-      signerInfo: [
-        {
-          version: 3,
-          subjectKeyIdentifier: ContextTaggedBytes(0, subjectKeyIdentifier),
-          digestAlgorithm: SHA256_CMS,
-          signatureAlgorithm: X962.EcdsaWithSHA256,
-          signature: await this.#crypto.signEcdsa(privateKey, eContent, "der")
-        }
-      ]
-    };
-    const certBytes = DerCodec.encode(Pkcs7.SignedData(certificate));
-    assertCertificateDerSize(certBytes);
-    return certBytes;
-  }
-  /**
-   * Validate general requirements a Matter certificate fields must fulfill.
-   * Rules for this are listed in @see {@link MatterSpecification.v12.Core} §6.5.x
-   */
-  validateGeneralCertificateFields(cert) {
-    if (cert.serialNumber.length > 20)
-      throw new CertificateError(
-        `Serial number must not be longer then 20 octets. Current serial number has ${cert.serialNumber.length} octets.`
-      );
-    if (cert.signatureAlgorithm !== 1) {
-      throw new CertificateError(`Unsupported signature algorithm: ${cert.signatureAlgorithm}`);
-    }
-    if (cert.publicKeyAlgorithm !== 1) {
-      throw new CertificateError(`Unsupported public key algorithm: ${cert.publicKeyAlgorithm}`);
-    }
-    if (cert.ellipticCurveIdentifier !== 1) {
-      throw new CertificateError(`Unsupported elliptic curve identifier: ${cert.ellipticCurveIdentifier}`);
-    }
-    if (Object.keys(cert.subject).length > 5) {
-      throw new CertificateError(`Certificate subject must not contain more than 5 RDNs.`);
-    }
-    if (Object.keys(cert.issuer).length > 5) {
-      throw new CertificateError(`Certificate issuer must not contain more than 5 RDNs.`);
-    }
-    if (cert.notBefore * 1e3 > Time.nowMs()) {
-      logger.warn(`Certificate notBefore date is in the future: ${cert.notBefore * 1e3} vs ${Time.nowMs()}`);
-    }
-  }
-  /**
-   * Verify requirements a Matter Root certificate must fulfill.
-   * Rules for this are listed in @see {@link MatterSpecification.v12.Core} §6.5.x
-   */
-  async verifyRootCertificate(rootCert) {
-    this.validateGeneralCertificateFields(rootCert);
-    if ("nodeId" in rootCert.subject) {
-      throw new CertificateError(`Root certificate must not contain a nodeId.`);
-    }
-    if (rootCert.subject.fabricId !== void 0) {
-      if (Array.isArray(rootCert.subject.fabricId)) {
-        throw new CertificateError(
-          `Invalid fabricId in NoC certificate: ${Diagnostic.json(rootCert.subject.fabricId)}`
-        );
-      }
-      if (rootCert.subject.fabricId === FabricId(0)) {
-        throw new CertificateError(
-          `Invalid fabricId in NoC certificate: ${Diagnostic.json(rootCert.subject.fabricId)}`
-        );
-      }
-    }
-    if ("icacId" in rootCert.subject) {
-      throw new CertificateError(`Root certificate must not contain an icacId.`);
-    }
-    if (rootCert.subject.rcacId === void 0 || Array.isArray(rootCert.subject.rcacId)) {
-      throw new CertificateError(
-        `Invalid rcacId in Root certificate: ${Diagnostic.json(rootCert.subject.rcacId)}`
-      );
-    }
-    if ("caseAuthenticatedTags" in rootCert.subject) {
-      throw new CertificateError(`Root certificate must not contain a caseAuthenticatedTags.`);
-    }
-    if (rootCert.extensions.basicConstraints.isCa !== true) {
-      throw new CertificateError(`Root certificate must have isCa set to true.`);
-    }
-    if (ExtensionKeyUsageSchema.encode(rootCert.extensions.keyUsage) !== 96 && ExtensionKeyUsageSchema.encode(rootCert.extensions.keyUsage) !== 97) {
-      throw new CertificateError(
-        `Root certificate keyUsage must have keyCertSign and CRLSign and optionally digitalSignature set.`
-      );
-    }
-    if (rootCert.extensions.extendedKeyUsage !== void 0) {
-      throw new CertificateError(`Root certificate must not have extendedKeyUsage set.`);
-    }
-    if (rootCert.extensions.subjectKeyIdentifier === void 0) {
-      throw new CertificateError(`Root certificate must have subjectKeyIdentifier set.`);
-    }
-    if (rootCert.extensions.subjectKeyIdentifier.length !== 20) {
-      throw new CertificateError(`Root certificate subjectKeyIdentifier must be 160 bit.`);
-    }
-    if (rootCert.extensions.authorityKeyIdentifier === void 0) {
-      throw new CertificateError(`Root certificate must have authorityKeyIdentifier set.`);
-    }
-    if (rootCert.extensions.authorityKeyIdentifier.length !== 20) {
-      throw new CertificateError(`Root certificate authorityKeyIdentifier must be 160 bit.`);
-    }
-    if (!Bytes.areEqual(rootCert.extensions.authorityKeyIdentifier, rootCert.extensions.subjectKeyIdentifier)) {
-      throw new CertificateError(
-        `Root certificate authorityKeyIdentifier must be equal to subjectKeyIdentifier.`
-      );
-    }
-    await this.#crypto.verifyEcdsa(
-      PublicKey(rootCert.ellipticCurvePublicKey),
-      this.rootCertToAsn1(rootCert),
-      rootCert.signature
-    );
-  }
-  /**
-   * Verify requirements a Matter Node Operational certificate must fulfill.
-   * Rules for this are listed in @see {@link MatterSpecification.v12.Core} §6.5.x
-   */
-  async verifyNodeOperationalCertificate(nocCert, rootCert, icaCert) {
-    this.validateGeneralCertificateFields(nocCert);
-    if (nocCert.subject.nodeId === void 0 || Array.isArray(nocCert.subject.nodeId)) {
-      throw new CertificateError(`Invalid nodeId in NoC certificate: ${Diagnostic.json(nocCert.subject.nodeId)}`);
-    }
-    if (!NodeId.isOperationalNodeId(nocCert.subject.nodeId)) {
-      throw new CertificateError(`Invalid nodeId in NoC certificate: ${Diagnostic.json(nocCert.subject.nodeId)}`);
-    }
-    if (nocCert.subject.fabricId === void 0 || Array.isArray(nocCert.subject.fabricId)) {
-      throw new CertificateError(
-        `Invalid fabricId in NoC certificate: ${Diagnostic.json(nocCert.subject.fabricId)}`
-      );
-    }
-    if (nocCert.subject.fabricId === FabricId(0)) {
-      throw new CertificateError(
-        `Invalid fabricId in NoC certificate: ${Diagnostic.json(nocCert.subject.fabricId)}`
-      );
-    }
-    if ("icacId" in nocCert.subject) {
-      throw new CertificateError(`Noc certificate must not contain an icacId.`);
-    }
-    if ("rcacId" in nocCert.subject) {
-      throw new CertificateError(`Noc certificate must not contain an rcacId.`);
-    }
-    if (nocCert.subject.caseAuthenticatedTags !== void 0) {
-      CaseAuthenticatedTag.validateNocTagList(nocCert.subject.caseAuthenticatedTags);
-    }
-    if (rootCert.subject.fabricId !== void 0 && rootCert.subject.fabricId !== nocCert.subject.fabricId) {
-      throw new CertificateError(
-        `FabricId in NoC certificate does not match the fabricId in the parent certificate. ${Diagnostic.json(
-          rootCert.subject.fabricId
-        )} !== ${Diagnostic.json(nocCert.subject.fabricId)}`
-      );
-    }
-    if (icaCert !== void 0 && icaCert.subject.fabricId !== void 0 && icaCert.subject.fabricId !== nocCert.subject.fabricId) {
-      throw new CertificateError(
-        `FabricId in NoC certificate does not match the fabricId in the parent certificate. ${Diagnostic.json(
-          icaCert.subject.fabricId
-        )} !== ${Diagnostic.json(nocCert.subject.fabricId)}`
-      );
-    }
-    if (nocCert.extensions.basicConstraints.isCa) {
-      throw new CertificateError(`Noc certificate must not have isCa set to true.`);
-    }
-    if (!nocCert.extensions.keyUsage.digitalSignature) {
-      throw new CertificateError(`Noc certificate must have keyUsage set to digitalSignature.`);
-    }
-    if (nocCert.extensions.extendedKeyUsage === void 0 || !nocCert.extensions.extendedKeyUsage.includes(1) && !nocCert.extensions.extendedKeyUsage.includes(2)) {
-      throw new CertificateError(
-        `Noc certificate must have extendedKeyUsage with serverAuth and clientAuth: ${Diagnostic.json(nocCert.extensions.extendedKeyUsage)}`
-      );
-    }
-    if (nocCert.extensions.subjectKeyIdentifier === void 0) {
-      throw new CertificateError(`Noc certificate must have subjectKeyIdentifier set.`);
-    }
-    if (nocCert.extensions.subjectKeyIdentifier.length !== 20) {
-      throw new CertificateError(`Noc certificate subjectKeyIdentifier must be 160 bit.`);
-    }
-    if (nocCert.extensions.authorityKeyIdentifier === void 0) {
-      throw new CertificateError(`Noc certificate must have authorityKeyIdentifier set.`);
-    }
-    if (nocCert.extensions.authorityKeyIdentifier.length !== 20) {
-      throw new CertificateError(`Noc certificate authorityKeyIdentifier must be 160 bit.`);
-    }
-    if (!Bytes.areEqual(
-      nocCert.extensions.authorityKeyIdentifier,
-      (icaCert ?? rootCert).extensions.subjectKeyIdentifier
-    )) {
-      throw new CertificateError(
-        `Noc certificate authorityKeyIdentifier must be equal to Root/Ica subjectKeyIdentifier.`
-      );
-    }
-    await this.#crypto.verifyEcdsa(
-      PublicKey((icaCert ?? rootCert).ellipticCurvePublicKey),
-      this.nodeOperationalCertToAsn1(nocCert),
-      nocCert.signature
-    );
-  }
-  /**
-   * Verify requirements a Matter Intermediate CA certificate must fulfill.
-   * Rules for this are listed in @see {@link MatterSpecification.v12.Core} §6.5.x
-   */
-  async verifyIntermediateCaCertificate(rootCert, icaCert) {
-    this.validateGeneralCertificateFields(icaCert);
-    if ("nodeId" in icaCert.subject) {
-      throw new CertificateError(`Ica certificate must not contain a nodeId.`);
-    }
-    if (icaCert.subject.fabricId !== void 0) {
-      if (Array.isArray(icaCert.subject.fabricId)) {
-        throw new CertificateError(
-          `Invalid fabricId in NoC certificate: ${Diagnostic.json(icaCert.subject.fabricId)}`
-        );
-      }
-      if (icaCert.subject.fabricId === FabricId(0)) {
-        throw new CertificateError(
-          `Invalid fabricId in NoC certificate: ${Diagnostic.json(icaCert.subject.fabricId)}`
-        );
-      }
-    }
-    if (icaCert.subject.icacId === void 0 || Array.isArray(icaCert.subject.icacId)) {
-      throw new CertificateError(`Invalid icacId in Ica certificate: ${Diagnostic.json(icaCert.subject.icacId)}`);
-    }
-    if ("rcacId" in icaCert.subject) {
-      throw new CertificateError(`Ica certificate must not contain an rcacId.`);
-    }
-    if ("caseAuthenticatedTags" in icaCert.subject) {
-      throw new CertificateError(`Ica certificate must not contain a caseAuthenticatedTags.`);
-    }
-    if (rootCert.subject.fabricId !== void 0 && icaCert.subject.fabricId !== void 0 && rootCert.subject.fabricId !== icaCert.subject.fabricId) {
-      throw new CertificateError(
-        `FabricId in Ica certificate does not match the fabricId in the parent certificate. ${Diagnostic.json(
-          rootCert.subject.fabricId
-        )} !== ${Diagnostic.json(icaCert.subject.fabricId)}`
-      );
-    }
-    if (rootCert.subject.rcacId !== icaCert.issuer.rcacId) {
-      throw new CertificateError(
-        `RcacId in Ica certificate does not match the rcacId in the parent certificate. ${Diagnostic.json(
-          rootCert.subject.rcacId
-        )} !== ${Diagnostic.json(icaCert.issuer.rcacId)}`
-      );
-    }
-    if (!icaCert.extensions.basicConstraints.isCa) {
-      throw new CertificateError(`Ica certificate must have isCa set to true.`);
-    }
-    if (ExtensionKeyUsageSchema.encode(rootCert.extensions.keyUsage) !== 96 && ExtensionKeyUsageSchema.encode(rootCert.extensions.keyUsage) !== 97) {
-      throw new CertificateError(
-        `Ica certificate keyUsage must have keyCertSign and CRLSign and optionally digitalSignature set.`
-      );
-    }
-    if (icaCert.extensions.extendedKeyUsage !== void 0) {
-      throw new CertificateError(`Ica certificate must not have extendedKeyUsage set.`);
-    }
-    if (icaCert.extensions.subjectKeyIdentifier === void 0) {
-      throw new CertificateError(`Ica certificate must have subjectKeyIdentifier set.`);
-    }
-    if (icaCert.extensions.subjectKeyIdentifier.length !== 20) {
-      throw new CertificateError(`Ica certificate subjectKeyIdentifier must be 160 bit.`);
-    }
-    if (icaCert.extensions.authorityKeyIdentifier === void 0) {
-      throw new CertificateError(`Ica certificate must have authorityKeyIdentifier set.`);
-    }
-    if (icaCert.extensions.authorityKeyIdentifier.length !== 20) {
-      throw new CertificateError(`Ica certificate authorityKeyIdentifier must be 160 bit.`);
-    }
-    if (!Bytes.areEqual(icaCert.extensions.authorityKeyIdentifier, rootCert.extensions.subjectKeyIdentifier)) {
-      throw new CertificateError(
-        `Ica certificate authorityKeyIdentifier must be equal to root cert subjectKeyIdentifier.`
-      );
-    }
-    await this.#crypto.verifyEcdsa(
-      PublicKey(rootCert.ellipticCurvePublicKey),
-      this.intermediateCaCertToAsn1(icaCert),
-      icaCert.signature
-    );
-  }
-  async createCertificateSigningRequest(key) {
-    const request = {
-      version: 0,
-      subject: { organization: X520.OrganisationName("CSR") },
-      publicKey: X962.PublicKeyEcPrime256v1(key.publicKey),
-      endSignedBytes: ContextTagged(0)
-    };
-    return DerCodec.encode({
-      request,
-      signAlgorithm: X962.EcdsaWithSHA256,
-      signature: DerBitString(await this.#crypto.signEcdsa(key, DerCodec.encode(request), "der"))
-    });
-  }
-  async getPublicKeyFromCsr(csr) {
-    const { [DerKey.Elements]: rootElements } = DerCodec.decode(csr);
-    if (rootElements?.length !== 3) throw new CertificateError("Invalid CSR data");
-    const [requestNode, signAlgorithmNode, signatureNode] = rootElements;
-    const { [DerKey.Elements]: requestElements } = requestNode;
-    if (requestElements?.length !== 4) throw new CertificateError("Invalid CSR data");
-    const [versionNode, _subjectNode, publicKeyNode] = requestElements;
-    const requestVersion = versionNode[DerKey.Bytes][0];
-    if (requestVersion !== 0) throw new CertificateError(`Unsupported request version${requestVersion}`);
-    const { [DerKey.Elements]: publicKeyElements } = publicKeyNode;
-    if (publicKeyElements?.length !== 2) throw new CertificateError("Invalid CSR data");
-    const [_publicKeyTypeNode, publicKeyBytesNode] = publicKeyElements;
-    const publicKey = publicKeyBytesNode[DerKey.Bytes];
-    if (signAlgorithmNode[DerKey.Elements]?.[0]?.[DerKey.Bytes] === void 0 || !Bytes.areEqual(
-      X962.EcdsaWithSHA256[DerKey.ObjectId][DerKey.Bytes],
-      signAlgorithmNode[DerKey.Elements]?.[0]?.[DerKey.Bytes]
-    ))
-      throw new CertificateError("Unsupported signature type");
-    await this.#crypto.verifyEcdsa(
-      PublicKey(publicKey),
-      DerCodec.encode(requestNode),
-      signatureNode[DerKey.Bytes],
-      "der"
-    );
-    return publicKey;
-  }
-}
-export {
-  CertificateError,
-  CertificateManager,
-  FabricId_Matter,
-  FirmwareSigningId_Matter,
-  IcacId_Matter,
-  NocCat_Matter,
-  NodeId_Matter,
-  ProductId_Matter,
-  RcacId_Matter,
-  TlvCertificationDeclaration,
-  TlvIntermediateCertificate,
-  TlvOperationalCertificate,
-  TlvRootCertificate,
-  VendorId_Matter,
-  jsToMatterDate,
-  matterToJsDate
-};
-//# sourceMappingURL=CertificateManager.js.map