@noz-ele/edgca 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 NOZ-ELE
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,270 @@
+# EdgCA
+
+> [日本語](https://github.com/noz-ele/EdgCA/blob/main/docs/jp/README.md) | English
+
+EdgCA is a small TypeScript library that issues mTLS client certificates from a self-managed CA on Cloudflare Workers-compatible runtimes.
+
+The scope is intentionally narrow:
+
+- Create a self-signed root CA.
+- Issue an intermediate CA from a root CA.
+- Issue an mTLS client certificate and private key from an intermediate CA.
+- Decide whether a received client certificate was issued by your own CA.
+- Encode/decode certificates and keys as PEM/DER.
+- Delegate all cryptographic operations to `globalThis.crypto.subtle`.
+
+> ⚠ **Not a PKI runtime.** EdgCA is an issuance toolkit, not a general-purpose PKI library or runtime. It does **not** provide chain validation, revocation (CRL/OCSP), key storage, or rotation. `verifyClientCertificateIssuedBy` is **not** mTLS verification and does **not** authenticate the presenter — see [Verify](#verify-cloudflare-worker) below. Operating a CA safely is the caller's responsibility. Full list: [docs/en/NON_GOALS.md](https://github.com/noz-ele/EdgCA/blob/main/docs/en/NON_GOALS.md).
+
+## Status
+
+EdgCA is in **v0.1.x — early stabilization**. The author is currently validating the library against real Cloudflare Workers deployments, and the API surface may still shift. To keep that validation focused, **external Issues and PRs are temporarily restricted** and will be re-opened once the API settles. Reading, cloning, forking, and `npm install` are unaffected.
+
+## Install
+
+```sh
+npm install @noz-ele/edgca
+```
+
+ESM-only (`"type": "module"`). Runs on any runtime where `globalThis.crypto.subtle` is available (Cloudflare Workers, Node.js 20+, modern browsers, etc.). CommonJS `require` is not supported.
+
+## Quick Start
+
+```ts
+import {
+  createRootCA,
+  issueIntermediateCA,
+  issueClientCert
+} from "@noz-ele/edgca";
+
+const root = await createRootCA({
+  subject: [{ type: "CN", value: "dev-root" }],
+  days: 3650
+});
+
+const intermediate = await issueIntermediateCA({
+  ca: root,
+  subject: [{ type: "CN", value: "dev-intermediate" }],
+  days: 365
+});
+
+const client = await issueClientCert({
+  ca: intermediate,
+  subject: [
+    { type: "CN", value: "worker-client" },
+    { type: "UID", value: "worker-001" }
+  ],
+  days: 30
+});
+
+// Persist these via your secrets manager / KV / vault.
+// Treat client.privateKeyPem as a secret — never log or transmit it.
+//   client.certPem        — public certificate
+//   client.certChainPem   — full chain to present during mTLS
+//   client.privateKeyPem  — secret, hand off only over a trusted channel
+```
+
+The basic shape is:
+
+```text
+root CA -> intermediate CA -> mTLS client certificate
+```
+
+This is the deepest CA hierarchy EdgCA targets. Issuing further intermediate CAs from an intermediate is out of scope.
+
+`client.certChainPem` is concatenated in this order:
+
+```text
+client certificate
+issuer certificate
+issuer chain
+```
+
+For a client certificate issued by an EdgCA-built intermediate, the result is `client + intermediate + root`.
+
+## Verify (Cloudflare Worker)
+
+> ⚠ **What this is — and is not**
+>
+> `verifyClientCertificateIssuedBy` is **not** mTLS verification. (Real mTLS verification does not exist for a self-managed CA on Cloudflare Workers in the first place.) At most it is *issuance verification*: it confirms that the presented certificate was issued by the specified CA. **That is not the same as authenticating that the presenter is the certificate's legitimate owner.**
+>
+> A client certificate is, by design, presentable to anyone, and its contents are trivially copyable. You must assume that anyone can be holding a valid copy. Therefore possession of valid certificate data **never** proves legitimate ownership.
+>
+> Proving legitimate ownership additionally requires verifying possession of the corresponding private key — i.e., a signature made by the private key, verified against the certificate's public key. The TLS handshake's `CertificateVerify` message normally does this, but **the Cloudflare Workers runtime does not expose that signature to the application.** On non-Enterprise plans, Cloudflare's TLS layer also does not know about your self-managed CA, so `request.cf.tlsClientAuth.certVerified` will not be `"SUCCESS"` for certificates EdgCA issued. Workers application code (Enterprise plans excluded) has no way to verify proof-of-possession.
+>
+> Implication: an attacker who has obtained a copy of a valid certificate (logs, leaked storage, network capture, etc.) can present it and pass this check. Use this function as a *minimum* identity-check layer, not as authentication. For real authentication, either (a) use Cloudflare Enterprise with mTLS configured at the TLS layer (Cloudflare validates the handshake signature against your CA), or (b) add an application-layer challenge-response that has the client sign a server-issued nonce with its private key.
+>
+> Also out of scope (not checked by this function): `BasicConstraints CA=false`, `EKU clientAuth`, revocation, and chain walking.
+
+This section assumes a deployment where **Cloudflare has already extracted the client certificate** and exposes it to your application via `request.cf.tlsClientAuth`. EdgCA participates in neither the TLS handshake nor DER parsing of the cert; it consumes the values Cloudflare hands you and performs the issuance check above.
+
+### Formats Cloudflare exposes after extraction
+
+| field | format | example |
+| --- | --- | --- |
+| `certPresented` | whether a client cert was sent | `"1"` / `"0"` |
+| `certVerified` | TLS-layer verification status string. **For self-managed CAs on non-Enterprise plans this will not be `"SUCCESS"`** — the TLS layer does not know about your CA. | `"SUCCESS"` / `"FAILED:..."` / `"NONE"` |
+| `certRFC9440` | RFC 9440 Structured Field Item (Byte Sequence). Base64 wrapped in `:` | `":MIIB...:"` |
+| `certNotBefore` / `certNotAfter` | OpenSSL-style textual format (always GMT). Single-digit day padded with two spaces | `"Dec 24 23:59:59 2025 GMT"` / `"Dec  4 23:59:59 2025 GMT"` |
+| `certSubjectDN`, `certIssuerDN`, `certSerial`, etc. | strings | identity extraction |
+
+`verifyClientCertificateIssuedBy` accepts PEM (`certPem: string`) and `Date` / epoch ms (`validity.notBefore` / `notAfter`). Those forms **do not match** what Cloudflare provides, so the application must convert:
+
+- `certRFC9440` (`":...:"`) → strip the surrounding colons, wrap with PEM markers.
+- `certNotBefore` / `certNotAfter` (textual) → `new Date(...)` (V8 / the Workers runtime parses this format).
+
+These parsers live in the caller, not in the library, because (a) we do not want to track Cloudflare's output-format changes, (b) we do not want to rely on runtime-dependent `Date.parse` leniency, and (c) the caller already holds the values, so reimplementing them here would be redundant. See [docs/en/NON_GOALS.md](https://github.com/noz-ele/EdgCA/blob/main/docs/en/NON_GOALS.md) for the full rationale.
+
+### Example
+
+```ts
+import { importCertificateAuthority, verifyClientCertificateIssuedBy } from "@noz-ele/edgca";
+
+// At Worker startup: import the CA loaded from your vault once.
+const ca = await importCertificateAuthority({
+  certPem: env.CA_CERT_PEM,
+  privateKeyPem: env.CA_PRIVATE_KEY_PEM
+});
+
+export default {
+  async fetch(request: Request): Promise<Response> {
+    const tls = request.cf?.tlsClientAuth;
+    if (!tls || tls.certPresented !== "1") {
+      return new Response("client certificate required", { status: 401 });
+    }
+    // Note: tls.certVerified !== "SUCCESS" is expected for self-managed CAs
+    // on non-Enterprise plans. The application performs the issuance check below.
+
+    // Convert Cloudflare's formats to the library's formats.
+    //   certRFC9440 (":base64:")        -> PEM string
+    //   certNotBefore / certNotAfter    -> Date
+    const b64 = tls.certRFC9440.replace(/^:|:$/g, "");
+    const certPem = `-----BEGIN CERTIFICATE-----\n${b64}\n-----END CERTIFICATE-----`;
+
+    const ok = await verifyClientCertificateIssuedBy({
+      ca,
+      certPem,
+      validity: {
+        notBefore: new Date(tls.certNotBefore),
+        notAfter:  new Date(tls.certNotAfter)
+        // omit `now` to use Date.now()
+      }
+    });
+    if (!ok) {
+      return new Response("not issued by us, or expired", { status: 403 });
+    }
+
+    // Reminder: passing this check does NOT prove the presenter holds the
+    // private key. For real authentication, layer a challenge-response
+    // (nonce signed with the client's private key) on top.
+
+    // Authorization logic: derive identity from cf.tlsClientAuth.certSubjectDN, etc.
+    return new Response(`hello, ${tls.certSubjectDN}`);
+  }
+};
+```
+
+### Notes
+
+- Omitting `validity` performs only the identity check (issuer DN + AKI/SKI + signature). If you instead inline the time check as two comparisons in the application, the result is equivalent.
+- "Not issued by us" and "outside the validity window" return `false`; malformed PEM/DER throws. The two error categories are deliberately split.
+- Pass the **direct issuer (one cert)** as `ca`. Verifying a leaf issued via an intermediate against the root will return `false` — chain walking is not performed.
+
+## Subject
+
+Subject only accepts a structured input. DN strings such as `CN=dev-root,O=Example` are not accepted.
+
+```ts
+const subject = [
+  { type: "CN", value: "dev-root" },
+  { type: "O", value: "Example" },
+  { type: "1.2.3.4.5", value: "custom-value" }
+];
+```
+
+Supported short names:
+
+```text
+CN, O, OU, C, ST, L, E, DC, SERIALNUMBER, STREET,
+POSTALCODE, TITLE, GIVENNAME, SURNAME, UID
+```
+
+Dotted OID strings are also accepted. The ASN.1 string type for values is fixed at UTF8String, with `C` as PrintableString. Multi-valued RDNs are out of scope.
+
+## Scope
+
+In scope:
+
+- ECDSA P-256 + SHA-256.
+- Key generation, signing, digest, and key import/export via WebCrypto.
+- Root CA creation.
+- Intermediate CA issuance.
+- mTLS client certificate issuance.
+- Identity check that a cert was issued by your own CA (`verifyClientCertificateIssuedBy`, with optional time-validity check).
+- PEM/DER helpers.
+- Basic Constraints, Key Usage, Extended Key Usage, Subject Alternative Name, SKI, AKI.
+
+Intentionally out of scope:
+
+- Server certificate issuance.
+- Public chain-validation APIs.
+- Extracting time fields from a cert. `verifyClientCertificateIssuedBy`'s `validity` option performs the time check, but the `notBefore` / `notAfter` values are passed in by the caller from `cf.tlsClientAuth`.
+- CRL, OCSP, revocation databases, revocation checks.
+- Key storage, encryption-at-rest, rotation-state persistence, and integration with KV/D1/R2/Secrets.
+- RSA, EdDSA, other elliptic curves.
+- DN string parsing.
+- Multi-valued RDNs.
+
+## Key Handling
+
+This library returns private keys as PEM, so generated keys are extractable.
+
+EdgCA only handles key generation and import/export. Where keys are stored, how they are encrypted at rest, how rotation state is persisted, and how they integrate with Cloudflare storage products are all the application's responsibility.
+
+### Bringing your own CA key (recommended)
+
+Root and intermediate CAs are long-lived. To keep key management on the caller's side, `createRootCA` and `issueIntermediateCA` accept an existing `privateKeyPem`. This lets the caller's key-management infrastructure handle the full key lifecycle (generation, storage, rotation) consistently, which is the recommended path.
+
+```ts
+const root = await createRootCA({
+  subject: [{ type: "CN", value: "dev-root" }],
+  days: 3650,
+  privateKeyPem: loadFromVault("root")    // PKCS#8 PEM already in your vault
+});
+
+const intermediate = await issueIntermediateCA({
+  ca: root,
+  subject: [{ type: "CN", value: "dev-intermediate" }],
+  days: 365,
+  privateKeyPem: loadFromVault("intermediate")
+});
+```
+
+Omitting `privateKeyPem` causes the library to generate a key internally — convenient for tests and PoCs. Client-certificate keys are intended to be ephemeral, so `issueClientCert` always generates internally.
+
+## Development
+
+```sh
+npm run typecheck
+npm run build
+npm run test
+npm audit
+```
+
+Tests use `@cloudflare/vitest-pool-workers` to verify WebCrypto behavior on the Workers-compatible runtime.
+
+### Property-based tests
+
+Round-trip invariants in the lower layers are expressed as `fast-check` property-based tests, kept one file per target module under `test/<module>.property.test.ts`.
+
+- [test/der.property.test.ts](https://github.com/noz-ele/EdgCA/blob/main/test/der.property.test.ts) — TLV round-trip for INTEGER / OID / OCTET STRING / BIT STRING / SEQUENCE
+- [test/bytes.property.test.ts](https://github.com/noz-ele/EdgCA/blob/main/test/bytes.property.test.ts) — `concatBytes`, `binaryToBytes`/`bytesToBinary`, `bytesEqual`, `cloneBytes`
+- [test/ip.property.test.ts](https://github.com/noz-ele/EdgCA/blob/main/test/ip.property.test.ts) — IPv4 dotted-quad and IPv6 (full form / `::` compression) encoding
+- [test/pem.property.test.ts](https://github.com/noz-ele/EdgCA/blob/main/test/pem.property.test.ts) — round-trip between `certificateToPem` / `privateKeyDerToPem` / `publicKeyDerToPem` and `pemToDer` / `pemToDerWithLabel` / `splitPemBlocks`
+
+`vitest.config.ts` includes `test/**/*.test.ts`, so `npm run test` runs them all together. The certificate-assembly layer (`ca.ts` / `x509.ts`) is intentionally outside the PBT scope and stays example-based in [test/edgca.test.ts](https://github.com/noz-ele/EdgCA/blob/main/test/edgca.test.ts).
+
+## API Documentation
+
+See [docs/en/API.md](https://github.com/noz-ele/EdgCA/blob/main/docs/en/API.md) for the full API reference.
+
+The initial implementation plan is preserved as history in [docs/jp/PLAN_HISTORY.md](https://github.com/noz-ele/EdgCA/blob/main/docs/jp/PLAN_HISTORY.md) (Japanese only — archival material, not maintained in English).

package/SECURITY.md

@@ -0,0 +1,34 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report suspected security issues **privately** via GitHub Security Advisories:
+
+- https://github.com/noz-ele/EdgCA/security/advisories/new
+
+Do not open public issues for security reports. We will respond on a best-effort basis; this is a small project without an SLA.
+
+## Scope
+
+EdgCA is a stateless certificate-issuance toolkit for Cloudflare Workers-compatible runtimes. The following are **in scope** for security reports:
+
+- Incorrect ASN.1 / DER encoding of issued certificates that could mislead a verifier.
+- Cryptographic signature or KDF misuse, including incorrect use of `globalThis.crypto.subtle`.
+- Memory-safety problems, infinite loops, or unbounded allocations triggered by malformed PEM/DER input to public functions.
+- Public-API surface that allows a caller to produce a certificate that violates the documented invariants (e.g., `issueIntermediateCA` producing `pathLenConstraint > 0`).
+
+The following are **out of scope** (see [docs/en/NON_GOALS.md](docs/en/NON_GOALS.md) for the full list and rationale):
+
+- Chain validation, revocation (CRL/OCSP), key storage, rotation — EdgCA does not provide them.
+- Operational misuse of issued material (leaked private keys, logging secrets, weak storage).
+- Caller-controlled inputs producing wrong outputs by design ("garbage in, garbage out" behavior is documented; e.g., `importCertificateAuthority` does not cryptographically validate that `issuerChainPem` actually issued `certPem`).
+- `verifyClientCertificateIssuedBy` not authenticating the presenter — by design, this function only verifies issuance, not proof-of-possession of the private key. See the Verify section of the README for details.
+- Vulnerabilities in upstream dependencies (Workers runtime, Node.js, browser WebCrypto). Report those upstream.
+
+## Audit status
+
+EdgCA has **not** been independently audited. The implementation is small and self-contained, but you should treat this software as best-effort and review it yourself before relying on it for production trust hierarchies.
+
+## Supported versions
+
+Only the latest version published to npm is supported. Fixes will not be backported to older versions.

package/dist/bytes.d.ts

@@ -0,0 +1,9 @@
+export declare function concatBytes(parts: readonly Uint8Array[]): Uint8Array;
+export declare function bytesEqual(a: Uint8Array, b: Uint8Array): boolean;
+export declare function utf8Bytes(value: string): Uint8Array;
+export declare function asciiBytes(value: string): Uint8Array;
+export declare function bytesToBinary(bytes: Uint8Array): string;
+export declare function binaryToBytes(binary: string): Uint8Array;
+export declare function cloneBytes(bytes: Uint8Array): Uint8Array;
+export declare function arrayBufferFromBytes(bytes: Uint8Array): ArrayBuffer;
+//# sourceMappingURL=bytes.d.ts.map

package/dist/bytes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bytes.d.ts","sourceRoot":"","sources":["../src/bytes.ts"],"names":[],"mappings":"AAAA,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,CAWpE;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAWhE;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAEnD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAYpD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAUvD;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAQxD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAExD;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,CAInE"}

package/dist/bytes.js

@@ -0,0 +1,58 @@
+export function concatBytes(parts) {
+    const total = parts.reduce((sum, part) => sum + part.length, 0);
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const part of parts) {
+        out.set(part, offset);
+        offset += part.length;
+    }
+    return out;
+}
+export function bytesEqual(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    let diff = 0;
+    for (let i = 0; i < a.length; i += 1) {
+        diff |= a[i] ^ b[i];
+    }
+    return diff === 0;
+}
+export function utf8Bytes(value) {
+    return new TextEncoder().encode(value);
+}
+export function asciiBytes(value) {
+    const out = new Uint8Array(value.length);
+    for (let i = 0; i < value.length; i += 1) {
+        const code = value.charCodeAt(i);
+        if (code > 0x7f) {
+            throw new Error("Value must contain ASCII characters only");
+        }
+        out[i] = code;
+    }
+    return out;
+}
+export function bytesToBinary(bytes) {
+    const chunkSize = 0x8000;
+    let out = "";
+    for (let i = 0; i < bytes.length; i += chunkSize) {
+        const chunk = bytes.subarray(i, i + chunkSize);
+        out += String.fromCharCode(...chunk);
+    }
+    return out;
+}
+export function binaryToBytes(binary) {
+    const out = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i += 1) {
+        out[i] = binary.charCodeAt(i);
+    }
+    return out;
+}
+export function cloneBytes(bytes) {
+    return new Uint8Array(bytes);
+}
+export function arrayBufferFromBytes(bytes) {
+    const copy = new Uint8Array(bytes.length);
+    copy.set(bytes);
+    return copy.buffer;
+}

package/dist/ca.d.ts

@@ -0,0 +1,6 @@
+import type { CertificateAuthority, CreateRootCAOptions, ImportCertificateAuthorityOptions, IssueClientCertOptions, IssueIntermediateCAOptions, IssuedClientCertificate } from "./types.js";
+export declare function createRootCA(options: CreateRootCAOptions): Promise<CertificateAuthority>;
+export declare function issueIntermediateCA(options: IssueIntermediateCAOptions): Promise<CertificateAuthority>;
+export declare function issueClientCert(options: IssueClientCertOptions): Promise<IssuedClientCertificate>;
+export declare function importCertificateAuthority(options: ImportCertificateAuthorityOptions): Promise<CertificateAuthority>;
+//# sourceMappingURL=ca.d.ts.map

package/dist/ca.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ca.d.ts","sourceRoot":"","sources":["../src/ca.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,iCAAiC,EACjC,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,EACxB,MAAM,YAAY,CAAC;AAapB,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAwB9F;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA8B5G;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAyCvG;AAED,wBAAsB,0BAA0B,CAAC,OAAO,EAAE,iCAAiC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkB1H"}

package/dist/ca.js

@@ -0,0 +1,193 @@
+import { bytesEqual, cloneBytes } from "./bytes.js";
+import { assertKeyPairMatches, exportSpki, generateKeyPair, importPrivateKeyPem, keyIdentifierFromSpki, keyPairFromPrivateKeyPem, privateKeyToPem, publicKeyToPem, signDer } from "./crypto.js";
+import { encodeName } from "./name.js";
+import { certificateToPem, pemToDer, pemToDerWithLabel, splitPemBlocks } from "./pem.js";
+import { parseCertificateDer } from "./parser.js";
+import { authorityKeyIdentifierExtension, basicConstraintsCaExtension, basicConstraintsLeafExtension, buildCertificate, buildTbsCertificate, extendedKeyUsageClientAuthExtension, keyUsageExtension, subjectAltNameExtension, subjectKeyIdentifierExtension } from "./x509.js";
+export async function createRootCA(options) {
+    const keyPair = await resolveKeyPair(options.privateKeyPem);
+    const subjectNameDer = encodeName(options.subject);
+    const spki = await exportSpki(keyPair.publicKey);
+    const keyIdentifier = await keyIdentifierFromSpki(spki);
+    const pathLenConstraint = resolveRootPathLenConstraint(options.pathLenConstraint);
+    const extensions = [
+        basicConstraintsCaExtension(pathLenConstraint),
+        keyUsageExtension(["keyCertSign", "cRLSign"]),
+        subjectKeyIdentifierExtension(keyIdentifier),
+        authorityKeyIdentifierExtension(keyIdentifier)
+    ];
+    const { tbsCertificateDer } = buildTbsCertificate({
+        serialNumber: options.serialNumber,
+        notBefore: options.notBefore,
+        days: options.days,
+        issuerNameDer: subjectNameDer,
+        subjectNameDer,
+        subjectPublicKeyInfoDer: spki,
+        extensions
+    });
+    const signatureDer = await signDer(keyPair.privateKey, tbsCertificateDer);
+    const certDer = buildCertificate(tbsCertificateDer, signatureDer);
+    return assembleCertificateAuthority(certDer, keyPair, "");
+}
+export async function issueIntermediateCA(options) {
+    const issuer = await parseIssuer(options.ca);
+    const issuerChainPem = options.ca.issuerChainPem;
+    assertCanIssueCertificate(issuer);
+    assertCanIssueIntermediate(issuer, issuerChainPem, options.pathLenConstraint);
+    const keyPair = await resolveKeyPair(options.privateKeyPem);
+    const subjectNameDer = encodeName(options.subject);
+    const spki = await exportSpki(keyPair.publicKey);
+    const subjectKeyIdentifier = await keyIdentifierFromSpki(spki);
+    const authorityKeyIdentifier = issuer.subjectKeyIdentifier ?? await keyIdentifierFromSpki(issuer.subjectPublicKeyInfoDer);
+    const extensions = [
+        basicConstraintsCaExtension(0),
+        keyUsageExtension(["keyCertSign", "cRLSign"]),
+        subjectKeyIdentifierExtension(subjectKeyIdentifier),
+        authorityKeyIdentifierExtension(authorityKeyIdentifier)
+    ];
+    const { tbsCertificateDer } = buildTbsCertificate({
+        serialNumber: options.serialNumber,
+        notBefore: options.notBefore,
+        days: options.days,
+        issuerNameDer: issuer.subjectNameDer,
+        subjectNameDer,
+        subjectPublicKeyInfoDer: spki,
+        extensions
+    });
+    const signatureDer = await signDer(options.ca.privateKey, tbsCertificateDer);
+    const certDer = buildCertificate(tbsCertificateDer, signatureDer);
+    const childChainPem = joinPemChain([options.ca.certPem, issuerChainPem]);
+    return assembleCertificateAuthority(certDer, keyPair, childChainPem);
+}
+export async function issueClientCert(options) {
+    const issuer = await parseIssuer(options.ca);
+    const issuerChainPem = options.ca.issuerChainPem;
+    assertCanIssueCertificate(issuer);
+    const keyPair = await generateKeyPair();
+    const subjectNameDer = encodeName(options.subject);
+    const spki = await exportSpki(keyPair.publicKey);
+    const subjectKeyIdentifier = await keyIdentifierFromSpki(spki);
+    const authorityKeyIdentifier = issuer.subjectKeyIdentifier ?? await keyIdentifierFromSpki(issuer.subjectPublicKeyInfoDer);
+    const san = subjectAltNameExtension(options.dnsNames, options.ipAddresses);
+    const extensions = [
+        basicConstraintsLeafExtension(),
+        keyUsageExtension(["digitalSignature"]),
+        extendedKeyUsageClientAuthExtension(),
+        subjectKeyIdentifierExtension(subjectKeyIdentifier),
+        authorityKeyIdentifierExtension(authorityKeyIdentifier),
+        ...(san ? [san] : [])
+    ];
+    const { tbsCertificateDer } = buildTbsCertificate({
+        serialNumber: options.serialNumber,
+        notBefore: options.notBefore,
+        days: options.days,
+        issuerNameDer: issuer.subjectNameDer,
+        subjectNameDer,
+        subjectPublicKeyInfoDer: spki,
+        extensions
+    });
+    const signatureDer = await signDer(options.ca.privateKey, tbsCertificateDer);
+    const certDer = buildCertificate(tbsCertificateDer, signatureDer);
+    const certPem = certificateToPem(certDer);
+    return {
+        certPem,
+        privateKeyPem: await privateKeyToPem(keyPair.privateKey),
+        publicKeyPem: await publicKeyToPem(keyPair.publicKey),
+        certDer: cloneBytes(certDer),
+        privateKey: keyPair.privateKey,
+        publicKey: keyPair.publicKey,
+        certChainPem: joinPemChain([certPem, options.ca.certPem, issuerChainPem])
+    };
+}
+export async function importCertificateAuthority(options) {
+    const issuerChainPem = options.issuerChainPem ?? "";
+    assertIssuerChainPem(issuerChainPem);
+    const certDer = pemToDerWithLabel(options.certPem, "CERTIFICATE");
+    const parsed = await parseCertificateDer(certDer);
+    const privateKey = await importPrivateKeyPem(options.privateKeyPem);
+    await assertKeyPairMatches(privateKey, parsed.publicKey);
+    return {
+        certPem: options.certPem,
+        privateKeyPem: options.privateKeyPem,
+        publicKeyPem: await publicKeyToPem(parsed.publicKey),
+        certDer: cloneBytes(certDer),
+        privateKey,
+        publicKey: parsed.publicKey,
+        issuerChainPem
+    };
+}
+function assertIssuerChainPem(chainPem) {
+    if (chainPem.trim().length === 0) {
+        return;
+    }
+    const blocks = splitPemBlocks(chainPem);
+    if (blocks.length === 0) {
+        throw new Error("issuerChainPem must contain CERTIFICATE blocks");
+    }
+    for (const block of blocks) {
+        pemToDerWithLabel(block, "CERTIFICATE");
+    }
+}
+async function resolveKeyPair(privateKeyPem) {
+    if (privateKeyPem !== undefined) {
+        return keyPairFromPrivateKeyPem(privateKeyPem);
+    }
+    return generateKeyPair();
+}
+async function assembleCertificateAuthority(certDer, keyPair, issuerChainPem) {
+    return {
+        certPem: certificateToPem(certDer),
+        privateKeyPem: await privateKeyToPem(keyPair.privateKey),
+        publicKeyPem: await publicKeyToPem(keyPair.publicKey),
+        certDer: cloneBytes(certDer),
+        privateKey: keyPair.privateKey,
+        publicKey: keyPair.publicKey,
+        issuerChainPem
+    };
+}
+async function parseIssuer(ca) {
+    return await parseCertificateDer(ca.certDer?.length ? ca.certDer : pemToDer(ca.certPem));
+}
+function assertCanIssueCertificate(issuer) {
+    if (!issuer.isCA) {
+        throw new Error("Issuer certificate is not a CA");
+    }
+    if (!issuer.keyCertSign) {
+        throw new Error("Issuer certificate keyUsage does not allow certificate signing");
+    }
+}
+function assertCanIssueIntermediate(issuer, issuerChainPem, requestedPathLenConstraint) {
+    if (issuer.pathLenConstraint === 0) {
+        throw new Error("Issuer pathLenConstraint=0 does not allow issuing another intermediate CA");
+    }
+    if (!isRootCa(issuer, issuerChainPem)) {
+        throw new Error("Only root CAs may issue intermediate CAs");
+    }
+    if (requestedPathLenConstraint === undefined) {
+        return;
+    }
+    if (typeof requestedPathLenConstraint !== "number" || !Object.is(requestedPathLenConstraint, 0)) {
+        throw new Error("Intermediate pathLenConstraint must be 0");
+    }
+}
+function resolveRootPathLenConstraint(pathLenConstraint) {
+    if (pathLenConstraint === undefined) {
+        return 1;
+    }
+    if (typeof pathLenConstraint !== "number" || !Number.isInteger(pathLenConstraint)) {
+        throw new Error("Root pathLenConstraint must be 0 or 1");
+    }
+    if (!Object.is(pathLenConstraint, 0) && pathLenConstraint !== 1) {
+        throw new Error("Root pathLenConstraint must be 0 or 1");
+    }
+    return pathLenConstraint;
+}
+function isRootCa(issuer, issuerChainPem) {
+    return issuerChainPem.trim().length === 0 && bytesEqual(issuer.issuerNameDer, issuer.subjectNameDer);
+}
+function joinPemChain(parts) {
+    return parts
+        .map((part) => part.trim())
+        .filter((part) => part.length > 0)
+        .join("\n") + "\n";
+}

package/dist/crypto.d.ts

@@ -0,0 +1,16 @@
+export declare function generateKeyPair(): Promise<CryptoKeyPair>;
+export declare function signDer(privateKey: CryptoKey, data: Uint8Array): Promise<Uint8Array>;
+export declare function verifyDer(publicKey: CryptoKey, signatureDer: Uint8Array, data: Uint8Array): Promise<boolean>;
+export declare function digestSha256(data: Uint8Array): Promise<Uint8Array>;
+export declare function digestSha1(data: Uint8Array): Promise<Uint8Array>;
+export declare function keyIdentifierFromSpki(spki: Uint8Array): Promise<Uint8Array>;
+export declare function privateKeyToPem(key: CryptoKey): Promise<string>;
+export declare function publicKeyToPem(key: CryptoKey): Promise<string>;
+export declare function exportSpki(key: CryptoKey): Promise<Uint8Array>;
+export declare function importPrivateKeyPem(pem: string): Promise<CryptoKey>;
+export declare function keyPairFromPrivateKeyPem(pem: string): Promise<CryptoKeyPair>;
+export declare function importPublicKeySpki(spki: Uint8Array): Promise<CryptoKey>;
+export declare function assertKeyPairMatches(privateKey: CryptoKey, publicKey: CryptoKey): Promise<void>;
+export declare function ecdsaRawToDer(raw: Uint8Array): Uint8Array;
+export declare function ecdsaDerToRaw(signature: Uint8Array): Uint8Array;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAcA,wBAAsB,eAAe,IAAI,OAAO,CAAC,aAAa,CAAC,CAE9D;AAED,wBAAsB,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAG1F;AAED,wBAAsB,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAOlH;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAExE;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAEtE;AAID,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAWjF;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAGrE;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAGpE;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAEpE;AAED,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAEzE;AAED,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAOlF;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAE9E;AAED,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAQrG;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAMzD;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,UAAU,GAAG,UAAU,CAY/D"}