@noz-ele/edgca 0.5.0 → 0.5.2

package/README.md

@@ -2,22 +2,25 @@
 
 > [日本語](https://github.com/noz-ele/EdgCA/blob/main/docs/jp/README.md) | English
 
-EdgCA is a small TypeScript library that issues mTLS client certificates and document-signing certificates from a self-managed CA on Cloudflare Workers-compatible runtimes. It supports internal keygen, CSR-based enrollment for mTLS leaves (PKCS#10 + proof-of-possession), and PFX (PKCS#12) export for OS keystore import.
+EdgCA is a small TypeScript library for issuing mTLS client certificates and document-signing certificates from a self-managed CA on Cloudflare Workers-compatible runtimes.
 
-The scope is intentionally narrow:
+## Features
 
-- Create a self-signed root CA.
-- Issue an intermediate CA from a root CA.
-- Issue an mTLS client certificate and private key from an intermediate CA.
-- Issue an mTLS client certificate from a caller-provided public key (no private key returned). Pairs with the CSR helpers below.
-- Issue a document-signing certificate (RFC 9336 `id-kp-documentSigning`) and private key from a CA. Used as the signer cert for CAdES / CMS / ASiC-style document signatures, which are produced by separate tooling.
-- Parse a PKCS#10 CSR (subject, requested SAN, public key, raw extensions/attributes) and verify its proof-of-possession signature.
-- Decide whether a received client certificate was issued by your own CA.
-- Encode/decode certificates as PEM/DER. Keys are exchanged as `CryptoKey` only — the library never returns or accepts string forms (PEM, JWK, etc.) of private keys.
-- Bundle an issued cert + private key into a password-protected PFX (PKCS#12) file for OS keystore import (Win11+, macOS 15+, iOS/iPadOS 18+, modern Linux consumers).
-- Delegate all cryptographic operations to `globalThis.crypto.subtle`.
+- **WebCrypto-only, zero runtime dependencies.** All cryptographic operations go through `globalThis.crypto.subtle`. The same code runs on Cloudflare Workers, Node.js 20+, and modern browsers without polyfills or bundler shims.
+- **Lightweight.** v0.5.2 — tarball **45.2 kB** · unpacked **167.3 kB** · 73 files. No transitive dependencies; the CLI uses only `node:util.parseArgs`. (Re-measured on every release.)
+- **CA hierarchy (two-level).** Create a self-signed root CA and, optionally, issue an intermediate CA from it. Three or more levels of intermediates are intentionally out of scope.
+- **PFX (PKCS#12) bundling.** Wrap a cert + private key (and optional chain) into a password-protected `.pfx` / `.p12` for OS keystore import (Win11+, macOS 15+, iOS/iPadOS 18+, modern Linux). Algorithm-agnostic — accepts arbitrary PKCS#8 DER bytes (ECDSA, RSA, Ed25519, …).
+- **mTLS client certificate issuance.** Issue a leaf with internal key generation, or from a caller-managed key via the CSR path below.
+- **PKCS#10 CSR support.** Build a CSR (with proof-of-possession), parse a received CSR (subject, requested SAN, public key, raw extensions/attributes), verify its POP signature, and issue a cert from a CSR's public key without ever handling the private key.
+- **Document-signing certificates (RFC 9336).** Issue a leaf with EKU `id-kp-documentSigning`, usable as the signer cert for CAdES / CMS / ASiC tooling (containers themselves are built separately).
+- **Issuance check.** Decide whether a received client certificate was issued by your own CA (issuer-identity match — not full mTLS verification).
+- **PEM/DER encode/decode** for certificates and PKCS#10 CSRs.
+- **Secret key hygiene at the API boundary.** Private keys flow through the public API only as `CryptoKey` (issuance path) or `Uint8Array` PKCS#8 bytes (`exportPkcs12`); never as `string`. JS strings are immutable and stay on the heap until GC, so they cannot be wiped — secret material must not be held in that form. PEM ↔ CryptoKey conversion is the caller's job (so the lifetime of any string representation stays under caller control).
 
-ECDSA on **NIST P-256, P-384, and P-521** is supported throughout (signing, verification, CSR parsing). RSA, EdDSA, and other curves are intentionally out of scope.
+### Supported algorithms
+
+- **Issuance layer**: ECDSA on NIST P-256 / P-384 / P-521 (with the standard SHA-256 / SHA-384 / SHA-512 pairings). RSA, EdDSA, and other curves are intentionally out of scope at issuance.
+- **PFX bundling (`exportPkcs12`)**: algorithm-agnostic — accepts any PKCS#8 DER bytes verbatim.
 
 > ⚠ **Not a PKI runtime.** EdgCA is an issuance toolkit, not a general-purpose PKI library or runtime. It does **not** provide chain validation, revocation (CRL/OCSP), key storage, or rotation. `verifyClientCertificateIssuedBy` is **not** mTLS verification and does **not** authenticate the presenter — see [Verify](#verify-cloudflare-worker) below. Operating a CA safely is the caller's responsibility. Full list: [docs/en/NON_GOALS.md](https://github.com/noz-ele/EdgCA/blob/main/docs/en/NON_GOALS.md).
 
@@ -168,7 +171,9 @@ import { exportPkcs12 } from "@noz-ele/edgca/pkcs12";
 const pfxBytes = await exportPkcs12({
   certDer: client.certDer,
   chainDer: [intermediate.certDer, root.certDer],   // optional
-  privateKey: client.privateKey,                     // CryptoKey, must be extractable
+  // exportPkcs12 takes raw PKCS#8 DER bytes (algorithm-agnostic), not a CryptoKey.
+  // If you hold a CryptoKey, extract the bytes first:
+  privateKey: new Uint8Array(await crypto.subtle.exportKey("pkcs8", client.privateKey)),
   password: new TextEncoder().encode(passwordString),
   friendlyName: new TextEncoder().encode("worker-client") // optional, BMPString
 });

package/dist/cli/commands/pem-to-pfx.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pem-to-pfx.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/pem-to-pfx.ts"],"names":[],"mappings":"AAYA,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA+CnE"}
+{"version":3,"file":"pem-to-pfx.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/pem-to-pfx.ts"],"names":[],"mappings":"AAWA,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCnE"}

package/dist/cli/commands/pem-to-pfx.js

@@ -1,8 +1,8 @@
 import { readFile, writeFile } from "node:fs/promises";
 import { parseArgs } from "node:util";
-import { exportPkcs12, importCertificateAuthority, pemToDer, pemToDerWithLabel, splitPemBlocks } from "../../index.js";
+import { exportPkcs12, pemToDer, pemToDerWithLabel, splitPemBlocks } from "../../index.js";
 import { requireString } from "../flags.js";
-import { defaultPfxPath, importPkcs8PrivateKeyFromPem } from "../io.js";
+import { defaultPfxPath } from "../io.js";
 export async function pemToPfxCommand(args) {
     const { values } = parseArgs({
         args,
@@ -29,13 +29,7 @@ export async function pemToPfxCommand(args) {
     const chainDer = chainPem
         ? splitPemBlocks(chainPem).map((block) => pemToDerWithLabel(block, "CERTIFICATE"))
         : [];
-    const privateKey = await importPkcs8PrivateKeyFromPem(keyPem);
-    // Refuse to emit a PFX whose key does not match the leaf cert. The library's
-    // exportPkcs12 does not check this, so without the guard a mismatched pair
-    // silently produces a structurally valid but unusable .pfx file. We discard
-    // the returned CertificateAuthority — only the sign/verify round-trip
-    // performed inside importCertificateAuthority matters here.
-    await importCertificateAuthority({ certPem, privateKey });
+    const privateKey = pemToDerWithLabel(keyPem, "PRIVATE KEY");
     const pfx = await exportPkcs12({
         certDer,
         ...(chainDer.length > 0 ? { chainDer } : {}),

package/dist/parser.d.ts

@@ -12,6 +12,7 @@ export interface ParsedCertificate {
     subjectKeyIdentifier?: Uint8Array;
     authorityKeyIdentifier?: Uint8Array;
 }
+export declare function extractCertificateSpkiDer(der: Uint8Array): Uint8Array;
 export declare function parseCertificateDer(der: Uint8Array): Promise<ParsedCertificate>;
 export declare function assertIssuerSubjectMatches(issuer: ParsedCertificate, issued: ParsedCertificate): void;
 //# sourceMappingURL=parser.d.ts.map

package/dist/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,UAAU,CAAC;IAChB,iBAAiB,EAAE,UAAU,CAAC;IAC9B,YAAY,EAAE,UAAU,CAAC;IACzB,aAAa,EAAE,UAAU,CAAC;IAC1B,cAAc,EAAE,UAAU,CAAC;IAC3B,uBAAuB,EAAE,UAAU,CAAC;IACpC,SAAS,EAAE,SAAS,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,OAAO,CAAC;IACrB,oBAAoB,CAAC,EAAE,UAAU,CAAC;IAClC,sBAAsB,CAAC,EAAE,UAAU,CAAC;CACrC;AAED,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkErF;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAIrG"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,UAAU,CAAC;IAChB,iBAAiB,EAAE,UAAU,CAAC;IAC9B,YAAY,EAAE,UAAU,CAAC;IACzB,aAAa,EAAE,UAAU,CAAC;IAC1B,cAAc,EAAE,UAAU,CAAC;IAC3B,uBAAuB,EAAE,UAAU,CAAC;IACpC,SAAS,EAAE,SAAS,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,OAAO,CAAC;IACrB,oBAAoB,CAAC,EAAE,UAAU,CAAC;IAClC,sBAAsB,CAAC,EAAE,UAAU,CAAC;CACrC;AAQD,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CA+BrE;AAED,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkErF;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAIrG"}

package/dist/parser.js

@@ -2,6 +2,44 @@ import { bytesEqual } from "./bytes.js";
 import { decodeInteger, decodeOid, readChildren, readElement, readSequenceChildren, TAG } from "./der.js";
 import { importPublicKeySpki } from "./crypto.js";
 import { OID } from "./oids.js";
+// Read just the SubjectPublicKeyInfo DER from a v3 X.509 certificate without
+// importing the public key. Used by exportPkcs12, which needs the SPKI for
+// localKeyId computation (SHA-1 of the BIT STRING value) regardless of the
+// inner key algorithm. parseCertificateDer below additionally imports the
+// SPKI as an ECDSA CryptoKey for the issuance/verify paths; that import is
+// EC-only and must not be on the pkcs12 path.
+export function extractCertificateSpkiDer(der) {
+    const certificate = readElement(der);
+    if (certificate.tag !== TAG.SEQUENCE || certificate.end !== der.length) {
+        throw new Error("Invalid certificate DER");
+    }
+    const [tbsCertificate] = readSequenceChildren(certificate);
+    if (!tbsCertificate) {
+        throw new Error("Invalid certificate structure");
+    }
+    const tbsChildren = readSequenceChildren(tbsCertificate);
+    const versionTag = tbsChildren[0];
+    if (!versionTag || versionTag.tag !== 0xa0) {
+        throw new Error("Unsupported X.509 version (only v3 is supported)");
+    }
+    const versionInner = readElement(versionTag.value);
+    if (versionInner.tag !== TAG.INTEGER || decodeInteger(versionInner.value) !== 2n) {
+        throw new Error("Unsupported X.509 version (only v3 is supported)");
+    }
+    // tbsCertificate (v3) layout:
+    //   [0] version [0] EXPLICIT INTEGER 2
+    //   [1] serialNumber
+    //   [2] signature (AlgorithmIdentifier)
+    //   [3] issuer
+    //   [4] validity
+    //   [5] subject
+    //   [6] subjectPublicKeyInfo
+    const subjectPublicKeyInfo = tbsChildren[6];
+    if (!subjectPublicKeyInfo || subjectPublicKeyInfo.tag !== TAG.SEQUENCE) {
+        throw new Error("Invalid certificate: missing subjectPublicKeyInfo");
+    }
+    return subjectPublicKeyInfo.raw;
+}
 export async function parseCertificateDer(der) {
     const certificate = readElement(der);
     if (certificate.tag !== TAG.SEQUENCE || certificate.end !== der.length) {

package/dist/pkcs12.d.ts

@@ -1,7 +1,7 @@
 export interface ExportPkcs12Input {
     certDer: Uint8Array;
     chainDer?: Uint8Array[];
-    privateKey: CryptoKey;
+    privateKey: Uint8Array;
     password: Uint8Array;
     friendlyName?: Uint8Array;
     iterations?: number;

package/dist/pkcs12.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pkcs12.d.ts","sourceRoot":"","sources":["../src/pkcs12.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,UAAU,CAAC;IACpB,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;IACxB,UAAU,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,UAAU,CAAC;IACrB,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAUD,wBAAsB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CA8FhF"}
+{"version":3,"file":"pkcs12.d.ts","sourceRoot":"","sources":["../src/pkcs12.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,UAAU,CAAC;IACpB,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;IACxB,UAAU,EAAE,UAAU,CAAC;IACvB,QAAQ,EAAE,UAAU,CAAC;IACrB,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAUD,wBAAsB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CA4FhF"}

package/dist/pkcs12.js

@@ -2,7 +2,7 @@ import { arrayBufferFromBytes, concatBytes, randomBytes } from "./bytes.js";
 import { digestSha256, keyIdentifierFromSpki } from "./crypto.js";
 import { contextPrimitive, der, explicit, integer, nullValue, octetString, oid, sequence, set } from "./der.js";
 import { OID } from "./oids.js";
-import { parseCertificateDer } from "./parser.js";
+import { extractCertificateSpkiDer } from "./parser.js";
 const DEFAULT_PBKDF2_ITERATIONS = 600_000;
 const DEFAULT_MAC_ITERATIONS = 100_000;
 const SALT_LENGTH = 16;
@@ -14,8 +14,8 @@ export async function exportPkcs12(input) {
     const iterations = input.iterations ?? DEFAULT_PBKDF2_ITERATIONS;
     const macIterations = input.macIterations ?? DEFAULT_MAC_ITERATIONS;
     validateInput(input, iterations, macIterations);
-    const parsedLeaf = await parseCertificateDer(input.certDer);
-    const localKeyId = await keyIdentifierFromSpki(parsedLeaf.subjectPublicKeyInfoDer);
+    const spkiDer = extractCertificateSpkiDer(input.certDer);
+    const localKeyId = await keyIdentifierFromSpki(spkiDer);
     const friendlyNameAttr = input.friendlyName !== undefined && input.friendlyName.length > 0
         ? buildFriendlyNameAttr(input.friendlyName)
         : undefined;
@@ -35,9 +35,7 @@ export async function exportPkcs12(input) {
     const pbkdf2BaseKey = await crypto.subtle.importKey("raw", arrayBufferFromBytes(input.password), "PBKDF2", false, ["deriveKey"]);
     const certEncrypted = await pbes2EncryptAesCbc(certSafeContents, pbkdf2BaseKey, iterations);
     const certContentInfo = sequence(oid(OID.encryptedData), explicit(0, sequence(integer(0n), sequence(oid(OID.data), certEncrypted.algorithm, contextPrimitive(0, certEncrypted.ciphertext)))));
-    const pkcs8 = new Uint8Array(await crypto.subtle.exportKey("pkcs8", input.privateKey));
-    const keyEncrypted = await pbes2EncryptAesCbc(pkcs8, pbkdf2BaseKey, iterations);
-    wipe(pkcs8);
+    const keyEncrypted = await pbes2EncryptAesCbc(input.privateKey, pbkdf2BaseKey, iterations);
     const epki = sequence(keyEncrypted.algorithm, octetString(keyEncrypted.ciphertext));
     const keyBag = buildKeySafeBag(epki, leafAttrs);
     const keySafeContents = sequence(keyBag);
@@ -55,14 +53,24 @@ export async function exportPkcs12(input) {
     return sequence(integer(3n), pfxAuthSafeContentInfo, macData);
 }
 function validateInput(input, iterations, macIterations) {
+    if (!(input.certDer instanceof Uint8Array) || input.certDer.length === 0) {
+        throw new Error("certDer must be a non-empty Uint8Array of certificate DER bytes");
+    }
+    if (input.chainDer !== undefined) {
+        if (!Array.isArray(input.chainDer)) {
+            throw new Error("chainDer must be an array of Uint8Array");
+        }
+        for (const entry of input.chainDer) {
+            if (!(entry instanceof Uint8Array) || entry.length === 0) {
+                throw new Error("chainDer entries must be non-empty Uint8Array");
+            }
+        }
+    }
     if (!(input.password instanceof Uint8Array) || input.password.length === 0) {
         throw new Error("password must be a non-empty Uint8Array of UTF-8 bytes");
     }
-    if (!input.privateKey.extractable) {
-        throw new Error("privateKey must be extractable");
-    }
-    if (input.privateKey.algorithm.name !== "ECDSA") {
-        throw new Error("privateKey must be an ECDSA key");
+    if (!(input.privateKey instanceof Uint8Array) || input.privateKey.length === 0) {
+        throw new Error("privateKey must be a non-empty Uint8Array of PKCS#8 DER bytes");
     }
     if (!Number.isInteger(iterations) || iterations < 1) {
         throw new Error("iterations must be a positive integer");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noz-ele/edgca",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "A small Cloudflare Workers-friendly toolkit for issuing self-managed CA and mTLS client certificates.",
   "type": "module",
   "license": "MIT",