@simplewebauthn/server 14.0.1 → 14.0.2

package/esm/errors/index.d.ts

@@ -13,5 +13,5 @@ export declare class SimpleWebAuthnError extends Error {
 export declare class PQCNotSupportedError extends SimpleWebAuthnError {
     constructor(alg: COSEALG);
 }
-export type SimpleWebAuthnErrorCode = 'RUNTIME_NO_PQC_SUPPORT';
+export type SimpleWebAuthnErrorCode = 'RUNTIME_NO_PQC_SUPPORT' | 'CERTIFICATE_PATH_VERIFICATION_FAILED';
 //# sourceMappingURL=index.d.ts.map

package/esm/errors/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAGlD;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,IAAI,EAAE,uBAAuB,CAAC;gBAElB,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACpC,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,uBAAuB,CAAC;QAC9B,KAAK,CAAC,EAAE,KAAK,CAAC;KACf;CAKF;AAED,qBAAa,oBAAqB,SAAQ,mBAAmB;gBAC/C,GAAG,EAAE,OAAO;CAKzB;AAED,MAAM,MAAM,uBAAuB,GAAG,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAGlD;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,IAAI,EAAE,uBAAuB,CAAC;gBAElB,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACpC,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,uBAAuB,CAAC;QAC9B,KAAK,CAAC,EAAE,KAAK,CAAC;KACf;CAKF;AAED,qBAAa,oBAAqB,SAAQ,mBAAmB;gBAC/C,GAAG,EAAE,OAAO;CAKzB;AAED,MAAM,MAAM,uBAAuB,GAC/B,wBAAwB,GACxB,sCAAsC,CAAC"}

package/esm/helpers/isCertRevoked.d.ts

@@ -6,5 +6,5 @@ import { type X509Certificate } from '@peculiar/x509';
  *
  * CRL certificate structure referenced from https://tools.ietf.org/html/rfc5280#page-117
  */
-export declare function isCertRevoked(cert: X509Certificate): Promise<boolean>;
+export declare function isCertRevoked(certificate: X509Certificate, issuer?: X509Certificate): Promise<boolean>;
 //# sourceMappingURL=isCertRevoked.d.ts.map

package/esm/helpers/isCertRevoked.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isCertRevoked.d.ts","sourceRoot":"","sources":["../../src/helpers/isCertRevoked.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAIL,KAAK,eAAe,EAErB,MAAM,gBAAgB,CAAC;AAexB;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAkG3E"}
+{"version":3,"file":"isCertRevoked.d.ts","sourceRoot":"","sources":["../../src/helpers/isCertRevoked.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAIL,KAAK,eAAe,EAErB,MAAM,gBAAgB,CAAC;AAexB;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,eAAe,EAC5B,MAAM,CAAC,EAAE,eAAe,GACvB,OAAO,CAAC,OAAO,CAAC,CA0HlB"}

package/esm/helpers/isCertRevoked.js

@@ -8,90 +8,110 @@ const cacheRevokedCerts = {};
  *
  * CRL certificate structure referenced from https://tools.ietf.org/html/rfc5280#page-117
  */
-export async function isCertRevoked(cert) {
-    const { extensions } = cert;
+export async function isCertRevoked(certificate, issuer) {
+    if (!issuer) {
+        // We don't have a public key to verify any CRL signature so don't bother continuing
+        return false;
+    }
+    const { extensions } = certificate;
     if (!extensions) {
         return false;
     }
-    let extAuthorityKeyID;
-    let extSubjectKeyID;
-    let extCRLDistributionPoints;
-    extensions.forEach((ext) => {
-        if (ext instanceof AuthorityKeyIdentifierExtension) {
-            extAuthorityKeyID = ext;
-        }
-        else if (ext instanceof SubjectKeyIdentifierExtension) {
-            extSubjectKeyID = ext;
-        }
-        else if (ext instanceof CRLDistributionPointsExtension) {
-            extCRLDistributionPoints = ext;
-        }
+    const extCRLDistributionPoints = extensions.find((ext) => ext instanceof CRLDistributionPointsExtension);
+    // Get all CRL URLs from within the certificate
+    const crlURLs = [];
+    extCRLDistributionPoints?.distributionPoints?.forEach((dPoint) => {
+        dPoint.distributionPoint?.fullName?.forEach((fullName) => {
+            if (fullName.uniformResourceIdentifier) {
+                crlURLs.push(fullName.uniformResourceIdentifier);
+            }
+        });
     });
-    // Check to see if we've got cached info for the cert's CA
-    let keyIdentifier = undefined;
-    if (extAuthorityKeyID && extAuthorityKeyID.keyId) {
-        keyIdentifier = extAuthorityKeyID.keyId;
+    // If no URL(s) is provided then we have nothing to check
+    if (!(crlURLs.length > 0)) {
+        return false;
     }
-    else if (extSubjectKeyID) {
-        /**
-         * We might be dealing with a self-signed root certificate. Check the
-         * Subject key Identifier extension next.
-         */
-        keyIdentifier = extSubjectKeyID.keyId;
+    // Get the issuer's key identifier for part of the cache key and to check against the
+    // certificate's and CRL's AuthorityKeyIdentifier extension
+    const { keyIdentifier: issuerKeyIdentifier, fromExtension: issuerKeyIdentifierFromExtension, } = await getIssuerKeyIdentifier(issuer);
+    const certificateExtAuthorityKeyID = certificate.extensions.find((ext) => ext instanceof AuthorityKeyIdentifierExtension);
+    // When present, assert that certificates's AuthorityKeyIdentifier mirrors
+    // the issuer's SubjectKeyIdentifier
+    if (issuerKeyIdentifierFromExtension &&
+        certificateExtAuthorityKeyID?.keyId &&
+        certificateExtAuthorityKeyID.keyId !== issuerKeyIdentifier) {
+        throw new Error(`Certificate's AuthorityKeyIdentifier did not match issuer's SubjectKeyIdentifier "${issuerKeyIdentifier}"`);
     }
-    if (keyIdentifier) {
-        const cached = cacheRevokedCerts[keyIdentifier];
+    for (const crlURL of crlURLs) {
+        // Key off of issuer public key and CRL URL in case multiple CRLs are specified
+        const cacheKey = `${issuerKeyIdentifier}|${crlURL}`;
+        const cached = cacheRevokedCerts[cacheKey];
         if (cached) {
             const now = new Date();
             // If there's a nextUpdate then make sure we're before it
             if (!cached.nextUpdate || cached.nextUpdate > now) {
-                return cached.revokedCerts.indexOf(cert.serialNumber) >= 0;
+                return cached.revokedCerts.indexOf(certificate.serialNumber) >= 0;
             }
         }
-    }
-    const crlURL = extCRLDistributionPoints?.distributionPoints?.[0].distributionPoint?.fullName?.[0]
-        .uniformResourceIdentifier;
-    // If no URL is provided then we have nothing to check
-    if (!crlURL) {
-        return false;
-    }
-    // Download and read the CRL
-    let certListBytes;
-    try {
-        const respCRL = await fetch(crlURL);
-        certListBytes = await respCRL.arrayBuffer();
-    }
-    catch (_err) {
-        return false;
-    }
-    let data;
-    try {
-        data = new X509Crl(certListBytes);
-    }
-    catch (_err) {
-        // Something was malformed with the CRL, so pass
-        return false;
-    }
-    const newCached = {
-        revokedCerts: [],
-        nextUpdate: undefined,
-    };
-    // nextUpdate
-    if (data.nextUpdate) {
-        newCached.nextUpdate = data.nextUpdate;
-    }
-    // revokedCertificates
-    const revokedCerts = data.entries;
-    if (revokedCerts) {
-        for (const cert of revokedCerts) {
-            const revokedHex = cert.serialNumber;
-            newCached.revokedCerts.push(revokedHex);
+        // Download and read the CRL
+        let crlBytes;
+        try {
+            const respCRL = await fetch(crlURL);
+            crlBytes = await respCRL.arrayBuffer();
+        }
+        catch (_err) {
+            // Some kind of network error occurred so try the next URL
+            continue;
+        }
+        let certCRL;
+        try {
+            certCRL = new X509Crl(crlBytes);
+        }
+        catch (_err) {
+            // Something was malformed with the CRL so try the next URL
+            continue;
+        }
+        const certCRLVerified = await certCRL.verify({ publicKey: issuer.publicKey });
+        if (!certCRLVerified) {
+            throw new Error(`CRL from ${crlURL} failed signature verification against issuer "${issuer.subject}"`);
         }
-        // Cache the results
-        if (keyIdentifier) {
-            cacheRevokedCerts[keyIdentifier] = newCached;
+        // When present, assert that the CRL's AuthorityKeyIdentifier mirrors
+        // the issuer's SubjectKeyIdentifier
+        const crlAKI = certCRL.getExtension(AuthorityKeyIdentifierExtension);
+        if (issuerKeyIdentifierFromExtension &&
+            crlAKI?.keyId &&
+            crlAKI.keyId !== issuerKeyIdentifier) {
+            throw new Error(`CRL from ${crlURL} contained an AuthorityKeyIdentifier that did not match issuer's SubjectKeyIdentifier "${issuerKeyIdentifier}"`);
+        }
+        // Cache the CRL only if a nextUpdate has been provided
+        if (certCRL.nextUpdate) {
+            cacheRevokedCerts[cacheKey] = {
+                revokedCerts: certCRL.entries.map((entry) => entry.serialNumber),
+                nextUpdate: certCRL.nextUpdate,
+            };
+        }
+        // Finally, check entries for revocation status
+        const revoked = certCRL.findRevoked(certificate);
+        if (revoked) {
+            return true;
         }
-        return newCached.revokedCerts.indexOf(cert.serialNumber) >= 0;
     }
     return false;
 }
+/**
+ * Determine a unique key ID for the issuer certificate, based either on its
+ * SubjectKeyIdentifierExtension or by generating the same value using the issuer's public key
+ */
+async function getIssuerKeyIdentifier(issuer) {
+    const issuerSKI = issuer.extensions?.find((ext) => ext instanceof SubjectKeyIdentifierExtension);
+    if (issuerSKI?.keyId) {
+        return { keyIdentifier: issuerSKI.keyId, fromExtension: true };
+    }
+    /**
+     * The issuer carries no SubjectKeyIdentifier extension, so derive one from its public key
+     * (RFC 5280, method 1). This is good enough to keep unrelated CAs from colliding when computing
+     * the revocation cache key, but it's not authoritative enough to reject a certificate over.
+     */
+    const computed = await SubjectKeyIdentifierExtension.create(issuer.publicKey);
+    return { keyIdentifier: computed.keyId, fromExtension: false };
+}

package/esm/helpers/validateCertificatePath.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAK1B;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAqIlB"}
+{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAM1B;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAiLlB"}

package/esm/helpers/validateCertificatePath.js

@@ -1,6 +1,7 @@
 import 'reflect-metadata';
 import { X509Certificate, X509ChainBuilder } from '@peculiar/x509';
 import { isCertRevoked } from './isCertRevoked.js';
+import { SimpleWebAuthnError } from '../errors/index.js';
 /**
  * Traverse an array of PEM certificates and ensure they form a proper chain
  * @param x5cCertsPEM Typically the result of `x5c.map(convertASN1toPEM)`
@@ -11,48 +12,25 @@ export async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = [])
         // We have no trust anchors to chain back to, so skip path validation
         return true;
     }
-    // Prepare to work with x5c certs
-    const x5cCertsParsed = x5cCertsPEM.map((certPEM) => new X509Certificate(certPEM));
-    // Check for any expired or temporally invalid certs in x5c
-    for (let i = 0; i < x5cCertsParsed.length; i++) {
-        const cert = x5cCertsParsed[i];
-        const certPEM = x5cCertsPEM[i];
-        try {
-            await assertCertNotRevoked(cert);
-        }
-        catch (_err) {
-            throw new Error(`Found revoked certificate in x5c:\n${certPEM}`);
-        }
-        try {
-            assertCertIsWithinValidTimeWindow(cert.notBefore, cert.notAfter);
-        }
-        catch (_err) {
-            throw new Error(`Found certificate out of validity period in x5c:\n${certPEM}`);
-        }
-    }
     // Prepare to work with trust anchor certs
     const trustAnchorsParsed = trustAnchorsPEM.map((certPEM) => {
         try {
             return new X509Certificate(certPEM);
         }
         catch (err) {
-            const _err = err;
-            throw new Error(`Could not parse trust anchor certificate:\n${certPEM}`, { cause: _err });
+            throw new SimpleWebAuthnError({
+                message: `Could not parse trust anchor certificate:\n${certPEM}`,
+                code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+                cause: err,
+            });
         }
     });
-    // Filter out any expired or temporally invalid trust anchors certs
+    // Filter out any temporally invalid trust anchors certs
     const validTrustAnchors = [];
     for (let i = 0; i < trustAnchorsParsed.length; i++) {
         const cert = trustAnchorsParsed[i];
         try {
-            await assertCertNotRevoked(cert);
-        }
-        catch (_err) {
-            // Continue processing the other certs
-            continue;
-        }
-        try {
-            assertCertIsWithinValidTimeWindow(cert.notBefore, cert.notAfter);
+            assertCertIsWithinValidTimeWindow(cert);
         }
         catch (_err) {
             // Continue processing the other certs
@@ -61,22 +39,31 @@ export async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = [])
         validTrustAnchors.push(cert);
     }
     if (validTrustAnchors.length === 0) {
-        throw new Error('No specified trust anchor was valid for verifying x5c');
+        throw new SimpleWebAuthnError({
+            message: 'No specified trust anchor was valid for verifying x5c',
+            code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+        });
+    }
+    // Prepare to work with x5c certs
+    const x5cCertsParsed = x5cCertsPEM.map((certPEM) => new X509Certificate(certPEM));
+    // Break apart x5c into leaf + intermediates
+    const x5cLeafCert = x5cCertsParsed[0];
+    let x5cIntermediates = [];
+    if (x5cCertsParsed.length > 1) {
+        x5cIntermediates = x5cCertsParsed.slice(1);
     }
     // Try to verify x5c with each valid trust anchor
     let invalidCertificateChain = true;
+    let validatedChain = undefined;
     for (const anchor of validTrustAnchors) {
         try {
             const x5cWithTrustAnchor = x5cCertsParsed.concat([anchor]);
             const numUniqueCerts = new Set(x5cWithTrustAnchor.map((cert) => cert.toString('pem'))).size;
             if (numUniqueCerts !== x5cWithTrustAnchor.length) {
-                throw new Error('Invalid certificate path: found duplicate certificates');
-            }
-            // Break apart x5c to try and build a valid cert chain
-            const x5cLeafCert = x5cCertsParsed[0];
-            let x5cIntermediates = [];
-            if (x5cCertsParsed.length > 1) {
-                x5cIntermediates = x5cCertsParsed.slice(1);
+                throw new SimpleWebAuthnError({
+                    message: 'Invalid certificate path: found duplicate certificates',
+                    code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+                });
             }
             // Order of certs doesn't matter here but for readability
             const chainBuilder = new X509ChainBuilder({ certificates: [...x5cIntermediates, anchor] });
@@ -110,27 +97,87 @@ export async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = [])
                 // Invalid cert chain, try the next trust anchor
                 continue;
             }
-            // If we successfully validated a path then there's no need to continue. Reset any existing
-            // errors that were thrown by earlier trust anchors
+            if (certBeforeLastSignedByAnchor) {
+                /**
+                 * Swap out the last cert in the chain with the anchor that we've already verified
+                 * chains to the second-to-last certificate. This makes it easier to verify the chain
+                 * as a standard certificate chain.
+                 */
+                chain[chain.length - 1] = anchor;
+            }
+            // We successfully validated a chain so there's no need to continue
             invalidCertificateChain = false;
+            validatedChain = chain;
             break;
         }
         catch (err) {
-            throw new Error('Unexpected error while validating certificate path', { cause: err });
+            throw new SimpleWebAuthnError({
+                message: 'Unexpected error while validating certificate path',
+                code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+                cause: err,
+            });
         }
     }
+    if (validatedChain) {
+        // Check for any temporally invalid or expired certs in the chain
+        for (let i = 0; i < validatedChain.length; i++) {
+            const cert = validatedChain[i];
+            try {
+                assertCertIsWithinValidTimeWindow(cert);
+            }
+            catch (_err) {
+                throw new SimpleWebAuthnError({
+                    message: `Found certificate out of validity period:\n${cert.toString()}`,
+                    code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+                });
+            }
+            /**
+             * Checking revocation is very expensive so do it only at the end when we're certain a cert
+             * is otherwise valid
+             */
+            let issuerCert = undefined;
+            if (i < validatedChain.length - 1) {
+                // Issuer cert is simply the next cert in the chain
+                issuerCert = validatedChain[i + 1];
+            }
+            else {
+                // `cert` is the anchor. Only try to verify its revocation status if it's a root certificate
+                if (await cert.isSelfSigned()) {
+                    issuerCert = cert;
+                }
+            }
+            try {
+                await assertCertNotRevoked(cert, issuerCert);
+            }
+            catch (err) {
+                throw new SimpleWebAuthnError({
+                    message: `The following certificate failed revocation status check\n${cert.toString()}`,
+                    code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+                    cause: err,
+                });
+            }
+        }
+    }
+    else {
+        invalidCertificateChain = true;
+    }
     // We tried multiple trust anchors and none of them worked
     if (invalidCertificateChain) {
-        throw new InvalidCertificatePath();
+        throw new SimpleWebAuthnError({
+            message: 'x5c could not be chained to any specified trust anchor',
+            code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+        });
     }
     return true;
 }
 /**
  * Check if the certificate is revoked or not. If it is, raise an error
+ *
+ * @throws Error - Wrap this in a SimpleWebAuthnError so RPs can identify issues here
  */
-async function assertCertNotRevoked(certificate) {
+async function assertCertNotRevoked(certificate, issuerCert) {
     // Check for certificate revocation
-    const subjectCertRevoked = await isCertRevoked(certificate);
+    const subjectCertRevoked = await isCertRevoked(certificate, issuerCert);
     if (subjectCertRevoked) {
         throw new Error('Found revoked certificate in certificate path');
     }
@@ -138,16 +185,10 @@ async function assertCertNotRevoked(certificate) {
 /**
  * Require the cert to be within its notBefore and notAfter time window
  */
-function assertCertIsWithinValidTimeWindow(certNotBefore, certNotAfter) {
+function assertCertIsWithinValidTimeWindow(certificate) {
+    const { notBefore: certNotBefore, notAfter: certNotAfter } = certificate;
     const now = new Date(Date.now());
     if (certNotBefore > now || certNotAfter < now) {
         throw new Error('Certificate is not yet valid or expired');
     }
 }
-class InvalidCertificatePath extends Error {
-    constructor() {
-        const message = 'x5c could not be chained to any specified trust anchor';
-        super(message);
-        this.name = 'InvalidX5CChain';
-    }
-}

package/esm/metadata/verifyAttestationWithMetadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyAttestationWithMetadata.d.ts","sourceRoot":"","sources":["../../src/metadata/verifyAttestationWithMetadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAIhE,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,OAAO,EAEZ,OAAO,EAER,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;GAGG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,SAAS,EACT,mBAAmB,EACnB,GAAG,EACH,uBAAuB,GACxB,EAAE;IACD,SAAS,EAAE,iBAAiB,CAAC;IAC7B,mBAAmB,EAAE,WAAW,CAAC;IACjC,GAAG,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAAC;IACvC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,GAAG,OAAO,CAAC,OAAO,CAAC,CAoJnB;AAED,KAAK,QAAQ,GAAG;IACd,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE;KAAG,GAAG,IAAI,OAAO,GAAG,QAAQ;CAe9D,CAAC"}
+{"version":3,"file":"verifyAttestationWithMetadata.d.ts","sourceRoot":"","sources":["../../src/metadata/verifyAttestationWithMetadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAIhE,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,OAAO,EAEZ,OAAO,EAER,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;GAGG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,SAAS,EACT,mBAAmB,EACnB,GAAG,EACH,uBAAuB,GACxB,EAAE;IACD,SAAS,EAAE,iBAAiB,CAAC;IAC7B,mBAAmB,EAAE,WAAW,CAAC;IACjC,GAAG,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAAC;IACvC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,GAAG,OAAO,CAAC,OAAO,CAAC,CA6InB;AAED,KAAK,QAAQ,GAAG;IACd,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE;KAAG,GAAG,IAAI,OAAO,GAAG,QAAQ;CAe9D,CAAC"}

package/esm/metadata/verifyAttestationWithMetadata.js

@@ -106,13 +106,7 @@ export async function verifyAttestationWithMetadata({ statement, credentialPubli
         authenticatorIsSelfReferencing = true;
     }
     if (!authenticatorIsSelfReferencing) {
-        try {
-            await validateCertificatePath(authenticatorCerts, statementRootCerts);
-        }
-        catch (err) {
-            const _err = err;
-            throw new Error(`Could not validate certificate path with any metadata root certificates: ${_err.message}`);
-        }
+        await validateCertificatePath(authenticatorCerts, statementRootCerts);
     }
     return true;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simplewebauthn/server",
-  "version": "14.0.1",
+  "version": "14.0.2",
   "description": "SimpleWebAuthn for Servers",
   "keywords": [
     "typescript",

package/script/errors/index.d.ts

@@ -13,5 +13,5 @@ export declare class SimpleWebAuthnError extends Error {
 export declare class PQCNotSupportedError extends SimpleWebAuthnError {
     constructor(alg: COSEALG);
 }
-export type SimpleWebAuthnErrorCode = 'RUNTIME_NO_PQC_SUPPORT';
+export type SimpleWebAuthnErrorCode = 'RUNTIME_NO_PQC_SUPPORT' | 'CERTIFICATE_PATH_VERIFICATION_FAILED';
 //# sourceMappingURL=index.d.ts.map

package/script/errors/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAGlD;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,IAAI,EAAE,uBAAuB,CAAC;gBAElB,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACpC,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,uBAAuB,CAAC;QAC9B,KAAK,CAAC,EAAE,KAAK,CAAC;KACf;CAKF;AAED,qBAAa,oBAAqB,SAAQ,mBAAmB;gBAC/C,GAAG,EAAE,OAAO;CAKzB;AAED,MAAM,MAAM,uBAAuB,GAAG,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAGlD;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,IAAI,EAAE,uBAAuB,CAAC;gBAElB,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACpC,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,uBAAuB,CAAC;QAC9B,KAAK,CAAC,EAAE,KAAK,CAAC;KACf;CAKF;AAED,qBAAa,oBAAqB,SAAQ,mBAAmB;gBAC/C,GAAG,EAAE,OAAO;CAKzB;AAED,MAAM,MAAM,uBAAuB,GAC/B,wBAAwB,GACxB,sCAAsC,CAAC"}

package/script/helpers/isCertRevoked.d.ts

@@ -6,5 +6,5 @@ import { type X509Certificate } from '@peculiar/x509';
  *
  * CRL certificate structure referenced from https://tools.ietf.org/html/rfc5280#page-117
  */
-export declare function isCertRevoked(cert: X509Certificate): Promise<boolean>;
+export declare function isCertRevoked(certificate: X509Certificate, issuer?: X509Certificate): Promise<boolean>;
 //# sourceMappingURL=isCertRevoked.d.ts.map

package/script/helpers/isCertRevoked.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isCertRevoked.d.ts","sourceRoot":"","sources":["../../src/helpers/isCertRevoked.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAIL,KAAK,eAAe,EAErB,MAAM,gBAAgB,CAAC;AAexB;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAkG3E"}
+{"version":3,"file":"isCertRevoked.d.ts","sourceRoot":"","sources":["../../src/helpers/isCertRevoked.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAIL,KAAK,eAAe,EAErB,MAAM,gBAAgB,CAAC;AAexB;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,eAAe,EAC5B,MAAM,CAAC,EAAE,eAAe,GACvB,OAAO,CAAC,OAAO,CAAC,CA0HlB"}

package/script/helpers/isCertRevoked.js

@@ -11,90 +11,110 @@ const cacheRevokedCerts = {};
  *
  * CRL certificate structure referenced from https://tools.ietf.org/html/rfc5280#page-117
  */
-async function isCertRevoked(cert) {
-    const { extensions } = cert;
+async function isCertRevoked(certificate, issuer) {
+    if (!issuer) {
+        // We don't have a public key to verify any CRL signature so don't bother continuing
+        return false;
+    }
+    const { extensions } = certificate;
     if (!extensions) {
         return false;
     }
-    let extAuthorityKeyID;
-    let extSubjectKeyID;
-    let extCRLDistributionPoints;
-    extensions.forEach((ext) => {
-        if (ext instanceof x509_1.AuthorityKeyIdentifierExtension) {
-            extAuthorityKeyID = ext;
-        }
-        else if (ext instanceof x509_1.SubjectKeyIdentifierExtension) {
-            extSubjectKeyID = ext;
-        }
-        else if (ext instanceof x509_1.CRLDistributionPointsExtension) {
-            extCRLDistributionPoints = ext;
-        }
+    const extCRLDistributionPoints = extensions.find((ext) => ext instanceof x509_1.CRLDistributionPointsExtension);
+    // Get all CRL URLs from within the certificate
+    const crlURLs = [];
+    extCRLDistributionPoints?.distributionPoints?.forEach((dPoint) => {
+        dPoint.distributionPoint?.fullName?.forEach((fullName) => {
+            if (fullName.uniformResourceIdentifier) {
+                crlURLs.push(fullName.uniformResourceIdentifier);
+            }
+        });
     });
-    // Check to see if we've got cached info for the cert's CA
-    let keyIdentifier = undefined;
-    if (extAuthorityKeyID && extAuthorityKeyID.keyId) {
-        keyIdentifier = extAuthorityKeyID.keyId;
+    // If no URL(s) is provided then we have nothing to check
+    if (!(crlURLs.length > 0)) {
+        return false;
     }
-    else if (extSubjectKeyID) {
-        /**
-         * We might be dealing with a self-signed root certificate. Check the
-         * Subject key Identifier extension next.
-         */
-        keyIdentifier = extSubjectKeyID.keyId;
+    // Get the issuer's key identifier for part of the cache key and to check against the
+    // certificate's and CRL's AuthorityKeyIdentifier extension
+    const { keyIdentifier: issuerKeyIdentifier, fromExtension: issuerKeyIdentifierFromExtension, } = await getIssuerKeyIdentifier(issuer);
+    const certificateExtAuthorityKeyID = certificate.extensions.find((ext) => ext instanceof x509_1.AuthorityKeyIdentifierExtension);
+    // When present, assert that certificates's AuthorityKeyIdentifier mirrors
+    // the issuer's SubjectKeyIdentifier
+    if (issuerKeyIdentifierFromExtension &&
+        certificateExtAuthorityKeyID?.keyId &&
+        certificateExtAuthorityKeyID.keyId !== issuerKeyIdentifier) {
+        throw new Error(`Certificate's AuthorityKeyIdentifier did not match issuer's SubjectKeyIdentifier "${issuerKeyIdentifier}"`);
     }
-    if (keyIdentifier) {
-        const cached = cacheRevokedCerts[keyIdentifier];
+    for (const crlURL of crlURLs) {
+        // Key off of issuer public key and CRL URL in case multiple CRLs are specified
+        const cacheKey = `${issuerKeyIdentifier}|${crlURL}`;
+        const cached = cacheRevokedCerts[cacheKey];
         if (cached) {
             const now = new Date();
             // If there's a nextUpdate then make sure we're before it
             if (!cached.nextUpdate || cached.nextUpdate > now) {
-                return cached.revokedCerts.indexOf(cert.serialNumber) >= 0;
+                return cached.revokedCerts.indexOf(certificate.serialNumber) >= 0;
             }
         }
-    }
-    const crlURL = extCRLDistributionPoints?.distributionPoints?.[0].distributionPoint?.fullName?.[0]
-        .uniformResourceIdentifier;
-    // If no URL is provided then we have nothing to check
-    if (!crlURL) {
-        return false;
-    }
-    // Download and read the CRL
-    let certListBytes;
-    try {
-        const respCRL = await (0, fetch_js_1.fetch)(crlURL);
-        certListBytes = await respCRL.arrayBuffer();
-    }
-    catch (_err) {
-        return false;
-    }
-    let data;
-    try {
-        data = new x509_1.X509Crl(certListBytes);
-    }
-    catch (_err) {
-        // Something was malformed with the CRL, so pass
-        return false;
-    }
-    const newCached = {
-        revokedCerts: [],
-        nextUpdate: undefined,
-    };
-    // nextUpdate
-    if (data.nextUpdate) {
-        newCached.nextUpdate = data.nextUpdate;
-    }
-    // revokedCertificates
-    const revokedCerts = data.entries;
-    if (revokedCerts) {
-        for (const cert of revokedCerts) {
-            const revokedHex = cert.serialNumber;
-            newCached.revokedCerts.push(revokedHex);
+        // Download and read the CRL
+        let crlBytes;
+        try {
+            const respCRL = await (0, fetch_js_1.fetch)(crlURL);
+            crlBytes = await respCRL.arrayBuffer();
+        }
+        catch (_err) {
+            // Some kind of network error occurred so try the next URL
+            continue;
+        }
+        let certCRL;
+        try {
+            certCRL = new x509_1.X509Crl(crlBytes);
+        }
+        catch (_err) {
+            // Something was malformed with the CRL so try the next URL
+            continue;
+        }
+        const certCRLVerified = await certCRL.verify({ publicKey: issuer.publicKey });
+        if (!certCRLVerified) {
+            throw new Error(`CRL from ${crlURL} failed signature verification against issuer "${issuer.subject}"`);
         }
-        // Cache the results
-        if (keyIdentifier) {
-            cacheRevokedCerts[keyIdentifier] = newCached;
+        // When present, assert that the CRL's AuthorityKeyIdentifier mirrors
+        // the issuer's SubjectKeyIdentifier
+        const crlAKI = certCRL.getExtension(x509_1.AuthorityKeyIdentifierExtension);
+        if (issuerKeyIdentifierFromExtension &&
+            crlAKI?.keyId &&
+            crlAKI.keyId !== issuerKeyIdentifier) {
+            throw new Error(`CRL from ${crlURL} contained an AuthorityKeyIdentifier that did not match issuer's SubjectKeyIdentifier "${issuerKeyIdentifier}"`);
+        }
+        // Cache the CRL only if a nextUpdate has been provided
+        if (certCRL.nextUpdate) {
+            cacheRevokedCerts[cacheKey] = {
+                revokedCerts: certCRL.entries.map((entry) => entry.serialNumber),
+                nextUpdate: certCRL.nextUpdate,
+            };
+        }
+        // Finally, check entries for revocation status
+        const revoked = certCRL.findRevoked(certificate);
+        if (revoked) {
+            return true;
         }
-        return newCached.revokedCerts.indexOf(cert.serialNumber) >= 0;
     }
     return false;
 }
+/**
+ * Determine a unique key ID for the issuer certificate, based either on its
+ * SubjectKeyIdentifierExtension or by generating the same value using the issuer's public key
+ */
+async function getIssuerKeyIdentifier(issuer) {
+    const issuerSKI = issuer.extensions?.find((ext) => ext instanceof x509_1.SubjectKeyIdentifierExtension);
+    if (issuerSKI?.keyId) {
+        return { keyIdentifier: issuerSKI.keyId, fromExtension: true };
+    }
+    /**
+     * The issuer carries no SubjectKeyIdentifier extension, so derive one from its public key
+     * (RFC 5280, method 1). This is good enough to keep unrelated CAs from colliding when computing
+     * the revocation cache key, but it's not authoritative enough to reject a certificate over.
+     */
+    const computed = await x509_1.SubjectKeyIdentifierExtension.create(issuer.publicKey);
+    return { keyIdentifier: computed.keyId, fromExtension: false };
+}

package/script/helpers/validateCertificatePath.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAK1B;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAqIlB"}
+{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAM1B;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAiLlB"}

package/script/helpers/validateCertificatePath.js

@@ -4,6 +4,7 @@ exports.validateCertificatePath = validateCertificatePath;
 require("reflect-metadata");
 const x509_1 = require("@peculiar/x509");
 const isCertRevoked_js_1 = require("./isCertRevoked.js");
+const index_js_1 = require("../errors/index.js");
 /**
  * Traverse an array of PEM certificates and ensure they form a proper chain
  * @param x5cCertsPEM Typically the result of `x5c.map(convertASN1toPEM)`
@@ -14,48 +15,25 @@ async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = []) {
         // We have no trust anchors to chain back to, so skip path validation
         return true;
     }
-    // Prepare to work with x5c certs
-    const x5cCertsParsed = x5cCertsPEM.map((certPEM) => new x509_1.X509Certificate(certPEM));
-    // Check for any expired or temporally invalid certs in x5c
-    for (let i = 0; i < x5cCertsParsed.length; i++) {
-        const cert = x5cCertsParsed[i];
-        const certPEM = x5cCertsPEM[i];
-        try {
-            await assertCertNotRevoked(cert);
-        }
-        catch (_err) {
-            throw new Error(`Found revoked certificate in x5c:\n${certPEM}`);
-        }
-        try {
-            assertCertIsWithinValidTimeWindow(cert.notBefore, cert.notAfter);
-        }
-        catch (_err) {
-            throw new Error(`Found certificate out of validity period in x5c:\n${certPEM}`);
-        }
-    }
     // Prepare to work with trust anchor certs
     const trustAnchorsParsed = trustAnchorsPEM.map((certPEM) => {
         try {
             return new x509_1.X509Certificate(certPEM);
         }
         catch (err) {
-            const _err = err;
-            throw new Error(`Could not parse trust anchor certificate:\n${certPEM}`, { cause: _err });
+            throw new index_js_1.SimpleWebAuthnError({
+                message: `Could not parse trust anchor certificate:\n${certPEM}`,
+                code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+                cause: err,
+            });
         }
     });
-    // Filter out any expired or temporally invalid trust anchors certs
+    // Filter out any temporally invalid trust anchors certs
     const validTrustAnchors = [];
     for (let i = 0; i < trustAnchorsParsed.length; i++) {
         const cert = trustAnchorsParsed[i];
         try {
-            await assertCertNotRevoked(cert);
-        }
-        catch (_err) {
-            // Continue processing the other certs
-            continue;
-        }
-        try {
-            assertCertIsWithinValidTimeWindow(cert.notBefore, cert.notAfter);
+            assertCertIsWithinValidTimeWindow(cert);
         }
         catch (_err) {
             // Continue processing the other certs
@@ -64,22 +42,31 @@ async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = []) {
         validTrustAnchors.push(cert);
     }
     if (validTrustAnchors.length === 0) {
-        throw new Error('No specified trust anchor was valid for verifying x5c');
+        throw new index_js_1.SimpleWebAuthnError({
+            message: 'No specified trust anchor was valid for verifying x5c',
+            code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+        });
+    }
+    // Prepare to work with x5c certs
+    const x5cCertsParsed = x5cCertsPEM.map((certPEM) => new x509_1.X509Certificate(certPEM));
+    // Break apart x5c into leaf + intermediates
+    const x5cLeafCert = x5cCertsParsed[0];
+    let x5cIntermediates = [];
+    if (x5cCertsParsed.length > 1) {
+        x5cIntermediates = x5cCertsParsed.slice(1);
     }
     // Try to verify x5c with each valid trust anchor
     let invalidCertificateChain = true;
+    let validatedChain = undefined;
     for (const anchor of validTrustAnchors) {
         try {
             const x5cWithTrustAnchor = x5cCertsParsed.concat([anchor]);
             const numUniqueCerts = new Set(x5cWithTrustAnchor.map((cert) => cert.toString('pem'))).size;
             if (numUniqueCerts !== x5cWithTrustAnchor.length) {
-                throw new Error('Invalid certificate path: found duplicate certificates');
-            }
-            // Break apart x5c to try and build a valid cert chain
-            const x5cLeafCert = x5cCertsParsed[0];
-            let x5cIntermediates = [];
-            if (x5cCertsParsed.length > 1) {
-                x5cIntermediates = x5cCertsParsed.slice(1);
+                throw new index_js_1.SimpleWebAuthnError({
+                    message: 'Invalid certificate path: found duplicate certificates',
+                    code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+                });
             }
             // Order of certs doesn't matter here but for readability
             const chainBuilder = new x509_1.X509ChainBuilder({ certificates: [...x5cIntermediates, anchor] });
@@ -113,27 +100,87 @@ async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = []) {
                 // Invalid cert chain, try the next trust anchor
                 continue;
             }
-            // If we successfully validated a path then there's no need to continue. Reset any existing
-            // errors that were thrown by earlier trust anchors
+            if (certBeforeLastSignedByAnchor) {
+                /**
+                 * Swap out the last cert in the chain with the anchor that we've already verified
+                 * chains to the second-to-last certificate. This makes it easier to verify the chain
+                 * as a standard certificate chain.
+                 */
+                chain[chain.length - 1] = anchor;
+            }
+            // We successfully validated a chain so there's no need to continue
             invalidCertificateChain = false;
+            validatedChain = chain;
             break;
         }
         catch (err) {
-            throw new Error('Unexpected error while validating certificate path', { cause: err });
+            throw new index_js_1.SimpleWebAuthnError({
+                message: 'Unexpected error while validating certificate path',
+                code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+                cause: err,
+            });
         }
     }
+    if (validatedChain) {
+        // Check for any temporally invalid or expired certs in the chain
+        for (let i = 0; i < validatedChain.length; i++) {
+            const cert = validatedChain[i];
+            try {
+                assertCertIsWithinValidTimeWindow(cert);
+            }
+            catch (_err) {
+                throw new index_js_1.SimpleWebAuthnError({
+                    message: `Found certificate out of validity period:\n${cert.toString()}`,
+                    code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+                });
+            }
+            /**
+             * Checking revocation is very expensive so do it only at the end when we're certain a cert
+             * is otherwise valid
+             */
+            let issuerCert = undefined;
+            if (i < validatedChain.length - 1) {
+                // Issuer cert is simply the next cert in the chain
+                issuerCert = validatedChain[i + 1];
+            }
+            else {
+                // `cert` is the anchor. Only try to verify its revocation status if it's a root certificate
+                if (await cert.isSelfSigned()) {
+                    issuerCert = cert;
+                }
+            }
+            try {
+                await assertCertNotRevoked(cert, issuerCert);
+            }
+            catch (err) {
+                throw new index_js_1.SimpleWebAuthnError({
+                    message: `The following certificate failed revocation status check\n${cert.toString()}`,
+                    code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+                    cause: err,
+                });
+            }
+        }
+    }
+    else {
+        invalidCertificateChain = true;
+    }
     // We tried multiple trust anchors and none of them worked
     if (invalidCertificateChain) {
-        throw new InvalidCertificatePath();
+        throw new index_js_1.SimpleWebAuthnError({
+            message: 'x5c could not be chained to any specified trust anchor',
+            code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+        });
     }
     return true;
 }
 /**
  * Check if the certificate is revoked or not. If it is, raise an error
+ *
+ * @throws Error - Wrap this in a SimpleWebAuthnError so RPs can identify issues here
  */
-async function assertCertNotRevoked(certificate) {
+async function assertCertNotRevoked(certificate, issuerCert) {
     // Check for certificate revocation
-    const subjectCertRevoked = await (0, isCertRevoked_js_1.isCertRevoked)(certificate);
+    const subjectCertRevoked = await (0, isCertRevoked_js_1.isCertRevoked)(certificate, issuerCert);
     if (subjectCertRevoked) {
         throw new Error('Found revoked certificate in certificate path');
     }
@@ -141,16 +188,10 @@ async function assertCertNotRevoked(certificate) {
 /**
  * Require the cert to be within its notBefore and notAfter time window
  */
-function assertCertIsWithinValidTimeWindow(certNotBefore, certNotAfter) {
+function assertCertIsWithinValidTimeWindow(certificate) {
+    const { notBefore: certNotBefore, notAfter: certNotAfter } = certificate;
     const now = new Date(Date.now());
     if (certNotBefore > now || certNotAfter < now) {
         throw new Error('Certificate is not yet valid or expired');
     }
 }
-class InvalidCertificatePath extends Error {
-    constructor() {
-        const message = 'x5c could not be chained to any specified trust anchor';
-        super(message);
-        this.name = 'InvalidX5CChain';
-    }
-}

package/script/metadata/verifyAttestationWithMetadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyAttestationWithMetadata.d.ts","sourceRoot":"","sources":["../../src/metadata/verifyAttestationWithMetadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAIhE,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,OAAO,EAEZ,OAAO,EAER,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;GAGG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,SAAS,EACT,mBAAmB,EACnB,GAAG,EACH,uBAAuB,GACxB,EAAE;IACD,SAAS,EAAE,iBAAiB,CAAC;IAC7B,mBAAmB,EAAE,WAAW,CAAC;IACjC,GAAG,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAAC;IACvC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,GAAG,OAAO,CAAC,OAAO,CAAC,CAoJnB;AAED,KAAK,QAAQ,GAAG;IACd,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE;KAAG,GAAG,IAAI,OAAO,GAAG,QAAQ;CAe9D,CAAC"}
+{"version":3,"file":"verifyAttestationWithMetadata.d.ts","sourceRoot":"","sources":["../../src/metadata/verifyAttestationWithMetadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAIhE,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,OAAO,EAEZ,OAAO,EAER,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;GAGG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,SAAS,EACT,mBAAmB,EACnB,GAAG,EACH,uBAAuB,GACxB,EAAE;IACD,SAAS,EAAE,iBAAiB,CAAC;IAC7B,mBAAmB,EAAE,WAAW,CAAC;IACjC,GAAG,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAAC;IACvC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,GAAG,OAAO,CAAC,OAAO,CAAC,CA6InB;AAED,KAAK,QAAQ,GAAG;IACd,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE;KAAG,GAAG,IAAI,OAAO,GAAG,QAAQ;CAe9D,CAAC"}

package/script/metadata/verifyAttestationWithMetadata.js

@@ -110,13 +110,7 @@ async function verifyAttestationWithMetadata({ statement, credentialPublicKey, x
         authenticatorIsSelfReferencing = true;
     }
     if (!authenticatorIsSelfReferencing) {
-        try {
-            await (0, validateCertificatePath_js_1.validateCertificatePath)(authenticatorCerts, statementRootCerts);
-        }
-        catch (err) {
-            const _err = err;
-            throw new Error(`Could not validate certificate path with any metadata root certificates: ${_err.message}`);
-        }
+        await (0, validateCertificatePath_js_1.validateCertificatePath)(authenticatorCerts, statementRootCerts);
     }
     return true;
 }