@noz-ele/edgca 0.5.1 → 0.5.2

package/README.md

@@ -7,7 +7,7 @@ EdgCA is a small TypeScript library for issuing mTLS client certificates and doc
 ## Features
 
 - **WebCrypto-only, zero runtime dependencies.** All cryptographic operations go through `globalThis.crypto.subtle`. The same code runs on Cloudflare Workers, Node.js 20+, and modern browsers without polyfills or bundler shims.
-- **Lightweight.** v0.5.1 — tarball **44.8 kB** · unpacked **165.5 kB** · 73 files. No transitive dependencies; the CLI uses only `node:util.parseArgs`. (Re-measured on every release.)
+- **Lightweight.** v0.5.2 — tarball **45.2 kB** · unpacked **167.3 kB** · 73 files. No transitive dependencies; the CLI uses only `node:util.parseArgs`. (Re-measured on every release.)
 - **CA hierarchy (two-level).** Create a self-signed root CA and, optionally, issue an intermediate CA from it. Three or more levels of intermediates are intentionally out of scope.
 - **PFX (PKCS#12) bundling.** Wrap a cert + private key (and optional chain) into a password-protected `.pfx` / `.p12` for OS keystore import (Win11+, macOS 15+, iOS/iPadOS 18+, modern Linux). Algorithm-agnostic — accepts arbitrary PKCS#8 DER bytes (ECDSA, RSA, Ed25519, …).
 - **mTLS client certificate issuance.** Issue a leaf with internal key generation, or from a caller-managed key via the CSR path below.

package/dist/parser.d.ts

@@ -12,6 +12,7 @@ export interface ParsedCertificate {
     subjectKeyIdentifier?: Uint8Array;
     authorityKeyIdentifier?: Uint8Array;
 }
+export declare function extractCertificateSpkiDer(der: Uint8Array): Uint8Array;
 export declare function parseCertificateDer(der: Uint8Array): Promise<ParsedCertificate>;
 export declare function assertIssuerSubjectMatches(issuer: ParsedCertificate, issued: ParsedCertificate): void;
 //# sourceMappingURL=parser.d.ts.map

package/dist/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,UAAU,CAAC;IAChB,iBAAiB,EAAE,UAAU,CAAC;IAC9B,YAAY,EAAE,UAAU,CAAC;IACzB,aAAa,EAAE,UAAU,CAAC;IAC1B,cAAc,EAAE,UAAU,CAAC;IAC3B,uBAAuB,EAAE,UAAU,CAAC;IACpC,SAAS,EAAE,SAAS,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,OAAO,CAAC;IACrB,oBAAoB,CAAC,EAAE,UAAU,CAAC;IAClC,sBAAsB,CAAC,EAAE,UAAU,CAAC;CACrC;AAED,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkErF;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAIrG"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,UAAU,CAAC;IAChB,iBAAiB,EAAE,UAAU,CAAC;IAC9B,YAAY,EAAE,UAAU,CAAC;IACzB,aAAa,EAAE,UAAU,CAAC;IAC1B,cAAc,EAAE,UAAU,CAAC;IAC3B,uBAAuB,EAAE,UAAU,CAAC;IACpC,SAAS,EAAE,SAAS,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,OAAO,CAAC;IACrB,oBAAoB,CAAC,EAAE,UAAU,CAAC;IAClC,sBAAsB,CAAC,EAAE,UAAU,CAAC;CACrC;AAQD,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CA+BrE;AAED,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkErF;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAIrG"}

package/dist/parser.js

@@ -2,6 +2,44 @@ import { bytesEqual } from "./bytes.js";
 import { decodeInteger, decodeOid, readChildren, readElement, readSequenceChildren, TAG } from "./der.js";
 import { importPublicKeySpki } from "./crypto.js";
 import { OID } from "./oids.js";
+// Read just the SubjectPublicKeyInfo DER from a v3 X.509 certificate without
+// importing the public key. Used by exportPkcs12, which needs the SPKI for
+// localKeyId computation (SHA-1 of the BIT STRING value) regardless of the
+// inner key algorithm. parseCertificateDer below additionally imports the
+// SPKI as an ECDSA CryptoKey for the issuance/verify paths; that import is
+// EC-only and must not be on the pkcs12 path.
+export function extractCertificateSpkiDer(der) {
+    const certificate = readElement(der);
+    if (certificate.tag !== TAG.SEQUENCE || certificate.end !== der.length) {
+        throw new Error("Invalid certificate DER");
+    }
+    const [tbsCertificate] = readSequenceChildren(certificate);
+    if (!tbsCertificate) {
+        throw new Error("Invalid certificate structure");
+    }
+    const tbsChildren = readSequenceChildren(tbsCertificate);
+    const versionTag = tbsChildren[0];
+    if (!versionTag || versionTag.tag !== 0xa0) {
+        throw new Error("Unsupported X.509 version (only v3 is supported)");
+    }
+    const versionInner = readElement(versionTag.value);
+    if (versionInner.tag !== TAG.INTEGER || decodeInteger(versionInner.value) !== 2n) {
+        throw new Error("Unsupported X.509 version (only v3 is supported)");
+    }
+    // tbsCertificate (v3) layout:
+    //   [0] version [0] EXPLICIT INTEGER 2
+    //   [1] serialNumber
+    //   [2] signature (AlgorithmIdentifier)
+    //   [3] issuer
+    //   [4] validity
+    //   [5] subject
+    //   [6] subjectPublicKeyInfo
+    const subjectPublicKeyInfo = tbsChildren[6];
+    if (!subjectPublicKeyInfo || subjectPublicKeyInfo.tag !== TAG.SEQUENCE) {
+        throw new Error("Invalid certificate: missing subjectPublicKeyInfo");
+    }
+    return subjectPublicKeyInfo.raw;
+}
 export async function parseCertificateDer(der) {
     const certificate = readElement(der);
     if (certificate.tag !== TAG.SEQUENCE || certificate.end !== der.length) {

package/dist/pkcs12.js

@@ -2,7 +2,7 @@ import { arrayBufferFromBytes, concatBytes, randomBytes } from "./bytes.js";
 import { digestSha256, keyIdentifierFromSpki } from "./crypto.js";
 import { contextPrimitive, der, explicit, integer, nullValue, octetString, oid, sequence, set } from "./der.js";
 import { OID } from "./oids.js";
-import { parseCertificateDer } from "./parser.js";
+import { extractCertificateSpkiDer } from "./parser.js";
 const DEFAULT_PBKDF2_ITERATIONS = 600_000;
 const DEFAULT_MAC_ITERATIONS = 100_000;
 const SALT_LENGTH = 16;
@@ -14,8 +14,8 @@ export async function exportPkcs12(input) {
     const iterations = input.iterations ?? DEFAULT_PBKDF2_ITERATIONS;
     const macIterations = input.macIterations ?? DEFAULT_MAC_ITERATIONS;
     validateInput(input, iterations, macIterations);
-    const parsedLeaf = await parseCertificateDer(input.certDer);
-    const localKeyId = await keyIdentifierFromSpki(parsedLeaf.subjectPublicKeyInfoDer);
+    const spkiDer = extractCertificateSpkiDer(input.certDer);
+    const localKeyId = await keyIdentifierFromSpki(spkiDer);
     const friendlyNameAttr = input.friendlyName !== undefined && input.friendlyName.length > 0
         ? buildFriendlyNameAttr(input.friendlyName)
         : undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noz-ele/edgca",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "A small Cloudflare Workers-friendly toolkit for issuing self-managed CA and mTLS client certificates.",
   "type": "module",
   "license": "MIT",