@super-protocol/sdk-js 3.13.0-beta.0 → 3.13.0-beta.3

package/dist/mjs/certificates/helper.js

@@ -7,6 +7,13 @@ import { createMemoryCache } from '../utils/cache/memory.js';
 import { OCSPHelper } from './ocsp.js';
 import { CRLHelper } from './crl.js';
 import './setup-crypto.js';
+import { OID_CUSTOM_EXTENSION_CHALLENGE_CERTIFICATE_ID, OID_CUSTOM_EXTENSION_CHALLENGE_COMMON_ID, OID_CUSTOM_EXTENSION_CHALLENGE_ID, OID_CUSTOM_EXTENSION_NVIDIA_INFO_GPU, } from '@super-protocol/pki-common';
+const oidsForOcspCheck = [
+    OID_CUSTOM_EXTENSION_CHALLENGE_ID,
+    OID_CUSTOM_EXTENSION_CHALLENGE_COMMON_ID,
+    OID_CUSTOM_EXTENSION_NVIDIA_INFO_GPU,
+    OID_CUSTOM_EXTENSION_CHALLENGE_CERTIFICATE_ID,
+];
 export class CertificatesHelper {
     static downloadedCertificateCache = createMemoryCache();
     static derToPem(data, type = 'CERTIFICATE') {
@@ -47,6 +54,9 @@ export class CertificatesHelper {
             ca: toPemChain(splitCerts[1]),
         };
     }
+    static getIssuerBySubject(cert, certs) {
+        return certs.find((potentialIssuer) => cert.issuer.isEqual(potentialIssuer.subject));
+    }
     static pemChainToDer(certsPem) {
         const certs = CertificatesHelper.splitPemCerts(certsPem);
         return certs.map((certPem) => CertificatesHelper.pemToDer(certPem));
@@ -68,22 +78,26 @@ export class CertificatesHelper {
         });
         return responseData;
     }
+    static buildChain(leaf, potentialIssuers) {
+        const chain = [leaf];
+        let currentCert = leaf;
+        do {
+            currentCert = potentialIssuers.find((potentialIssuer) => currentCert?.issuer.isEqual(potentialIssuer.subject) &&
+                !currentCert.subject.isEqual(currentCert.issuer));
+            if (currentCert) {
+                chain.push(currentCert);
+            }
+        } while (currentCert);
+        return chain;
+    }
     static sortCertsFromLeafToRoot(certsPem) {
-        const allCerts = CertificatesHelper.toPkiCerts(certsPem);
+        const allCerts = typeof certsPem === 'string' || certsPem.every((cert) => typeof cert === 'string')
+            ? CertificatesHelper.toPkiCerts(certsPem)
+            : certsPem;
         const leafs = allCerts.filter((certToCheck) => !allCerts.some((certsToCheckWith) => certToCheck.subject.isEqual(certsToCheckWith.issuer)));
-        const buildChain = (leaf) => {
-            const chain = [leaf];
-            let currentCert = leaf;
-            do {
-                currentCert = allCerts.find((potentialIssuer) => currentCert?.issuer.isEqual(potentialIssuer.subject) &&
-                    !currentCert.subject.isEqual(currentCert.issuer));
-                if (currentCert) {
-                    chain.push(currentCert);
-                }
-            } while (currentCert);
-            return chain;
-        };
-        const chains = leafs.map(buildChain).sort((one, two) => two.length - one.length);
+        const chains = leafs
+            .map((leaf) => CertificatesHelper.buildChain(leaf, allCerts))
+            .sort((one, two) => two.length - one.length);
         return chains.flat();
     }
     static getCertPublicKeyAlgorithm(certPem) {
@@ -105,7 +119,7 @@ export class CertificatesHelper {
             const crls = offline ? [] : await CRLHelper.getCRLFromCerts(sortedCerts);
             const ocspBaseResponses = offline
                 ? []
-                : await OCSPHelper.getOCSPResponseFromCerts(sortedCerts, ca);
+                : await OCSPHelper.getOCSPResponseFromCerts(sortedCerts, ca, oidsForOcspCheck);
             const chainEngine = new pkijs.CertificateChainValidationEngine({
                 certs: sortedCerts,
                 trustedCerts: ca,
@@ -148,4 +162,4 @@ export class CertificatesHelper {
         return certsArray.map((certPem) => pkijs.Certificate.fromBER(CertificatesHelper.pemToDer(certPem)));
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2NlcnRpZmljYXRlcy9oZWxwZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxDQUFDLE1BQU0sUUFBUSxDQUFDO0FBQ3ZCLE9BQU8sS0FBSyxNQUFNLE9BQU8sQ0FBQztBQUMxQixPQUFPLEtBQUssTUFBTSxZQUFZLENBQUM7QUFDL0IsT0FBTyxLQUFLLEtBQUssTUFBTSxPQUFPLENBQUM7QUFDL0IsT0FBTyxFQUFFLHdCQUF3QixFQUFFLGVBQWUsRUFBRSxNQUFNLGdCQUFnQixDQUFDO0FBQzNFLE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxNQUFNLDBCQUEwQixDQUFDO0FBRTdELE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxXQUFXLENBQUM7QUFDdkMsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLFVBQVUsQ0FBQztBQUNyQyxPQUFPLG1CQUFtQixDQUFDO0FBRTNCLE1BQU0sT0FBTyxrQkFBa0I7SUFDckIsTUFBTSxDQUFDLDBCQUEwQixHQUFHLGlCQUFpQixFQUFFLENBQUM7SUFFaEUsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFpQixFQUFFLE9BQWUsYUFBYTtRQUM3RCxPQUFPLEtBQUssQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDO1lBQ3RCLGFBQWEsRUFBRSxJQUFJO1lBQ25CLE9BQU8sRUFBRSxJQUFJO1lBQ2IsT0FBTyxFQUFFLEVBQUU7WUFDWCxRQUFRLEVBQUUsSUFBSTtZQUNkLElBQUk7WUFDSixJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1NBQzNDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxNQUFNLENBQUMsUUFBUSxDQUFDLE9BQWU7UUFDN0IsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ3BFLENBQUM7SUFFRCxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQWE7UUFDaEMsTUFBTSxRQUFRLEdBQUcsaUVBQWlFLENBQUM7UUFDbkYsT0FBTyxLQUFLLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUNyQyxDQUFDO0lBRUQsTUFBTSxDQUFDLFNBQVMsQ0FBQyxPQUFlO1FBQzlCLE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxHQUFHLENBQUMsa0JBQWtCLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDbkQsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLFNBQVMsQ0FBQyxJQUFJLEtBQUssWUFBWSxDQUFDO1lBQ2pGLEVBQUUsS0FBZSxDQUFDO0lBQ3RCLENBQUM7SUFFRCxNQUFNLENBQUMsaUJBQWlCLENBQUMsU0FBcUMsRUFBRSxHQUFXO1FBQ3pFLE1BQU0sSUFBSSxHQUNSLE9BQU8sU0FBUyxLQUFLLFFBQVE7WUFDM0IsQ0FBQyxDQUFDLEtBQUssQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUNuRSxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ2hCLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxVQUFVLEVBQUUsSUFBSSxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxHQUFHLENBQUMsTUFBTSxLQUFLLEdBQUcsQ0FBQyxDQUFDO1FBQ3JFLE9BQU8sU0FBUyxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBRUQsTUFBTSxDQUFDLGtCQUFrQixDQUFDLFFBQWdCO1FBQ3hDLE1BQU0sS0FBSyxHQUFHLGtCQUFrQixDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUN0RCxNQUFNLFVBQVUsR0FBRyxDQUFDLENBQUMsU0FBUyxDQUFDLEtBQUssRUFBRSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUVwRixNQUFNLFVBQVUsR0FBRyxDQUFDLEtBQTBCLEVBQVUsRUFBRSxDQUN4RCxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7UUFFdkYsT0FBTztZQUNMLEtBQUssRUFBRSxVQUFVLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ2hDLEVBQUUsRUFBRSxVQUFVLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDO1NBQzlCLENBQUM7SUFDSixDQUFDO0lBRUQsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFnQjtRQUNuQyxNQUFNLEtBQUssR0FBRyxrQkFBa0IsQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLENBQUM7UUFFekQsT0FBTyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUN0RSxDQUFDO0lBRUQsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFzQjtRQUN6QyxPQUFPLFFBQVE7YUFDWixHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQzthQUNoRCxJQUFJLENBQUMsRUFBRSxDQUFDO2FBQ1IsSUFBSSxFQUFFLENBQUM7SUFDWixDQUFDO0lBRUQsTUFBTSxDQUFDLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxHQUFXO1FBQzVDLE1BQU0sWUFBWSxHQUFHLE1BQU0sa0JBQWtCLENBQUMsMEJBQTBCLENBQUMsSUFBSSxDQUMzRSxHQUFHLEVBQ0gsS0FBSyxJQUFJLEVBQUU7WUFDVCxNQUFNLFFBQVEsR0FBRyxNQUFNLEtBQUssQ0FBQyxHQUFHLEVBQUU7Z0JBQ2hDLFlBQVksRUFBRSxhQUFhO2FBQzVCLENBQUMsQ0FBQztZQUNILE9BQU8sUUFBUSxFQUFFLElBQUksQ0FBQztRQUN4QixDQUFDLEVBQ0Q7WUFDRSxHQUFHLEVBQUUsQ0FBQyxHQUFHLEVBQUUsR0FBRyxJQUFJLEVBQUUsT0FBTztTQUM1QixDQUNGLENBQUM7UUFFRixPQUFPLFlBQVksQ0FBQztJQUN0QixDQUFDO0lBRUQsTUFBTSxDQUFDLHVCQUF1QixDQUFDLFFBQTJCO1FBQ3hELE1BQU0sUUFBUSxHQUFHLGtCQUFrQixDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUV6RCxNQUFNLEtBQUssR0FBRyxRQUFRLENBQUMsTUFBTSxDQUMzQixDQUFDLFdBQVcsRUFBRSxFQUFFLENBQ2QsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsZ0JBQWdCLEVBQUUsRUFBRSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQzdGLENBQUM7UUFFRixNQUFNLFVBQVUsR0FBRyxDQUFDLElBQXVCLEVBQXVCLEVBQUU7WUFDbEUsTUFBTSxLQUFLLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUNyQixJQUFJLFdBQVcsR0FBa0MsSUFBSSxDQUFDO1lBRXRELEdBQUcsQ0FBQztnQkFDRixXQUFXLEdBQUcsUUFBUSxDQUFDLElBQUksQ0FDekIsQ0FBQyxlQUFlLEVBQUUsRUFBRSxDQUNsQixXQUFXLEVBQUUsTUFBTSxDQUFDLE9BQU8sQ0FBQyxlQUFlLENBQUMsT0FBTyxDQUFDO29CQUNwRCxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FDbkQsQ0FBQztnQkFFRixJQUFJLFdBQVcsRUFBRSxDQUFDO29CQUNoQixLQUFLLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxDQUFDO2dCQUMxQixDQUFDO1lBQ0gsQ0FBQyxRQUFRLFdBQVcsRUFBRTtZQUV0QixPQUFPLEtBQUssQ0FBQztRQUNmLENBQUMsQ0FBQztRQUVGLE1BQU0sTUFBTSxHQUFHLEtBQUssQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxFQUFFLENBQUMsR0FBRyxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDakYsT0FBTyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDdkIsQ0FBQztJQUVELE1BQU0sQ0FBQyx5QkFBeUIsQ0FBQyxPQUFlO1FBQzlDLE1BQU0sSUFBSSxHQUFHLElBQUksZUFBZSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzFDLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDakMsT0FBTyxTQUFTLENBQUMsU0FBeUIsQ0FBQztJQUM3QyxDQUFDO0lBRUQsTUFBTSxDQUFDLHdCQUF3QixDQUFDLE1BQWM7UUFDNUMsTUFBTSxHQUFHLEdBQUcsSUFBSSx3QkFBd0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNqRCxNQUFNLFNBQVMsR0FBRyxHQUFHLENBQUMsU0FBUyxDQUFDO1FBQ2hDLE9BQU8sU0FBUyxDQUFDLFNBQXlCLENBQUM7SUFDN0MsQ0FBQztJQUVELE1BQU0sQ0FBQyxLQUFLLENBQUMsaUJBQWlCLENBQzVCLFFBQTJCLEVBQzNCLEtBQXdCLEVBQ3hCLFVBQWlDLEVBQUU7UUFFbkMsTUFBTSxFQUFFLE9BQU8sRUFBRSxHQUFHLE9BQU8sQ0FBQztRQUU1Qix5RkFBeUY7UUFDekYsTUFBTSxXQUFXLEdBQUcsa0JBQWtCLENBQUMsdUJBQXVCLENBQUMsUUFBUSxDQUFDLENBQUMsT0FBTyxFQUFFLENBQUM7UUFFbkYsTUFBTSxFQUFFLEdBQUcsa0JBQWtCLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBRWhELElBQUksQ0FBQztZQUNILE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxNQUFNLFNBQVMsQ0FBQyxlQUFlLENBQUMsV0FBVyxDQUFDLENBQUM7WUFDekUsTUFBTSxpQkFBaUIsR0FBRyxPQUFPO2dCQUMvQixDQUFDLENBQUMsRUFBRTtnQkFDSixDQUFDLENBQUMsTUFBTSxVQUFVLENBQUMsd0JBQXdCLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1lBRS9ELE1BQU0sV0FBVyxHQUFHLElBQUksS0FBSyxDQUFDLGdDQUFnQyxDQUFDO2dCQUM3RCxLQUFLLEVBQUUsV0FBVztnQkFDbEIsWUFBWSxFQUFFLEVBQUU7Z0JBQ2hCLEtBQUssRUFBRSxpQkFBaUI7Z0JBQ3hCLElBQUk7YUFDTCxDQUFDLENBQUM7WUFFSCxNQUFNLFlBQVksR0FBRyxNQUFNLFdBQVcsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNoRCxJQUFJLENBQUMsWUFBWSxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUN6QixPQUFPO29CQUNMLE9BQU8sRUFBRSxLQUFLO29CQUNkLFlBQVksRUFBRSxZQUFZLENBQUMsYUFBYTtpQkFDekMsQ0FBQztZQUNKLENBQUM7WUFFRDs7Ozs7Ozs7ZUFRRztZQUNILE1BQU0sa0JBQWtCLEdBQUcsV0FBVyxDQUFDLEtBQUssQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQ3BELFlBQVksQ0FBQyxlQUFlLEVBQUUsSUFBSSxDQUFDLENBQUMsWUFBWSxFQUFFLEVBQUUsQ0FDbEQsWUFBWSxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxDQUNyRCxDQUNGLENBQUM7WUFDRixJQUFJLENBQUMsa0JBQWtCLEVBQUUsQ0FBQztnQkFDeEIsTUFBTSxJQUFJLEtBQUssQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO1lBQ2pFLENBQUM7WUFFRCxPQUFPO2dCQUNMLE9BQU8sRUFBRSxJQUFJO2FBQ2QsQ0FBQztRQUNKLENBQUM7UUFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO1lBQ2IsT0FBTztnQkFDTCxPQUFPLEVBQUUsS0FBSztnQkFDZCxZQUFZLEVBQUcsR0FBYSxDQUFDLE9BQU87YUFDckMsQ0FBQztRQUNKLENBQUM7SUFDSCxDQUFDO0lBRU8sTUFBTSxDQUFDLFVBQVUsQ0FBQyxLQUF3QjtRQUNoRCxNQUFNLFVBQVUsR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLGtCQUFrQixDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMxRixPQUFPLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUNoQyxLQUFLLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FDaEUsQ0FBQztJQUNKLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2NlcnRpZmljYXRlcy9oZWxwZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxDQUFDLE1BQU0sUUFBUSxDQUFDO0FBQ3ZCLE9BQU8sS0FBSyxNQUFNLE9BQU8sQ0FBQztBQUMxQixPQUFPLEtBQUssTUFBTSxZQUFZLENBQUM7QUFDL0IsT0FBTyxLQUFLLEtBQUssTUFBTSxPQUFPLENBQUM7QUFDL0IsT0FBTyxFQUFFLHdCQUF3QixFQUFFLGVBQWUsRUFBRSxNQUFNLGdCQUFnQixDQUFDO0FBQzNFLE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxNQUFNLDBCQUEwQixDQUFDO0FBRTdELE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxXQUFXLENBQUM7QUFDdkMsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLFVBQVUsQ0FBQztBQUNyQyxPQUFPLG1CQUFtQixDQUFDO0FBQzNCLE9BQU8sRUFDTCw2Q0FBNkMsRUFDN0Msd0NBQXdDLEVBQ3hDLGlDQUFpQyxFQUNqQyxvQ0FBb0MsR0FDckMsTUFBTSw0QkFBNEIsQ0FBQztBQUVwQyxNQUFNLGdCQUFnQixHQUFHO0lBQ3ZCLGlDQUFpQztJQUNqQyx3Q0FBd0M7SUFDeEMsb0NBQW9DO0lBQ3BDLDZDQUE2QztDQUM5QyxDQUFDO0FBRUYsTUFBTSxPQUFPLGtCQUFrQjtJQUNyQixNQUFNLENBQUMsMEJBQTBCLEdBQUcsaUJBQWlCLEVBQUUsQ0FBQztJQUVoRSxNQUFNLENBQUMsUUFBUSxDQUFDLElBQWlCLEVBQUUsT0FBZSxhQUFhO1FBQzdELE9BQU8sS0FBSyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUM7WUFDdEIsYUFBYSxFQUFFLElBQUk7WUFDbkIsT0FBTyxFQUFFLElBQUk7WUFDYixPQUFPLEVBQUUsRUFBRTtZQUNYLFFBQVEsRUFBRSxJQUFJO1lBQ2QsSUFBSTtZQUNKLElBQUksRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7U0FDM0MsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELE1BQU0sQ0FBQyxRQUFRLENBQUMsT0FBZTtRQUM3QixPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUVELE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBYTtRQUNoQyxNQUFNLFFBQVEsR0FBRyxpRUFBaUUsQ0FBQztRQUNuRixPQUFPLEtBQUssQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ3JDLENBQUM7SUFFRCxNQUFNLENBQUMsU0FBUyxDQUFDLE9BQWU7UUFDOUIsTUFBTSxJQUFJLEdBQUcsS0FBSyxDQUFDLEdBQUcsQ0FBQyxrQkFBa0IsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNuRCxPQUFPLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUMsU0FBUyxDQUFDLElBQUksS0FBSyxZQUFZLENBQUM7WUFDakYsRUFBRSxLQUFlLENBQUM7SUFDdEIsQ0FBQztJQUVELE1BQU0sQ0FBQyxpQkFBaUIsQ0FBQyxTQUFxQyxFQUFFLEdBQVc7UUFDekUsTUFBTSxJQUFJLEdBQ1IsT0FBTyxTQUFTLEtBQUssUUFBUTtZQUMzQixDQUFDLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsa0JBQWtCLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ25FLENBQUMsQ0FBQyxTQUFTLENBQUM7UUFDaEIsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEtBQUssR0FBRyxDQUFDLENBQUM7UUFDckUsT0FBTyxTQUFTLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFFRCxNQUFNLENBQUMsa0JBQWtCLENBQUMsUUFBZ0I7UUFDeEMsTUFBTSxLQUFLLEdBQUcsa0JBQWtCLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3RELE1BQU0sVUFBVSxHQUFHLENBQUMsQ0FBQyxTQUFTLENBQUMsS0FBSyxFQUFFLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO1FBRXBGLE1BQU0sVUFBVSxHQUFHLENBQUMsS0FBMEIsRUFBVSxFQUFFLENBQ3hELEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUV2RixPQUFPO1lBQ0wsS0FBSyxFQUFFLFVBQVUsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDaEMsRUFBRSxFQUFFLFVBQVUsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUM7U0FDOUIsQ0FBQztJQUNKLENBQUM7SUFFRCxNQUFNLENBQUMsa0JBQWtCLENBQ3ZCLElBQXVCLEVBQ3ZCLEtBQTBCO1FBRTFCLE9BQU8sS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLGVBQWUsRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDdkYsQ0FBQztJQUVELE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBZ0I7UUFDbkMsTUFBTSxLQUFLLEdBQUcsa0JBQWtCLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBRXpELE9BQU8sS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsa0JBQWtCLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDdEUsQ0FBQztJQUVELE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBc0I7UUFDekMsT0FBTyxRQUFRO2FBQ1osR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUM7YUFDaEQsSUFBSSxDQUFDLEVBQUUsQ0FBQzthQUNSLElBQUksRUFBRSxDQUFDO0lBQ1osQ0FBQztJQUVELE1BQU0sQ0FBQyxLQUFLLENBQUMscUJBQXFCLENBQUMsR0FBVztRQUM1QyxNQUFNLFlBQVksR0FBRyxNQUFNLGtCQUFrQixDQUFDLDBCQUEwQixDQUFDLElBQUksQ0FDM0UsR0FBRyxFQUNILEtBQUssSUFBSSxFQUFFO1lBQ1QsTUFBTSxRQUFRLEdBQUcsTUFBTSxLQUFLLENBQUMsR0FBRyxFQUFFO2dCQUNoQyxZQUFZLEVBQUUsYUFBYTthQUM1QixDQUFDLENBQUM7WUFDSCxPQUFPLFFBQVEsRUFBRSxJQUFJLENBQUM7UUFDeEIsQ0FBQyxFQUNEO1lBQ0UsR0FBRyxFQUFFLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSSxFQUFFLE9BQU87U0FDNUIsQ0FDRixDQUFDO1FBRUYsT0FBTyxZQUFZLENBQUM7SUFDdEIsQ0FBQztJQUVELE1BQU0sQ0FBQyxVQUFVLENBQ2YsSUFBdUIsRUFDdkIsZ0JBQXFDO1FBRXJDLE1BQU0sS0FBSyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDckIsSUFBSSxXQUFXLEdBQWtDLElBQUksQ0FBQztRQUV0RCxHQUFHLENBQUM7WUFDRixXQUFXLEdBQUcsZ0JBQWdCLENBQUMsSUFBSSxDQUNqQyxDQUFDLGVBQWUsRUFBRSxFQUFFLENBQ2xCLFdBQVcsRUFBRSxNQUFNLENBQUMsT0FBTyxDQUFDLGVBQWUsQ0FBQyxPQUFPLENBQUM7Z0JBQ3BELENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FBQyxDQUNuRCxDQUFDO1lBRUYsSUFBSSxXQUFXLEVBQUUsQ0FBQztnQkFDaEIsS0FBSyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQztZQUMxQixDQUFDO1FBQ0gsQ0FBQyxRQUFRLFdBQVcsRUFBRTtRQUV0QixPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFFRCxNQUFNLENBQUMsdUJBQXVCLENBQzVCLFFBQWlEO1FBRWpELE1BQU0sUUFBUSxHQUNaLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxPQUFPLElBQUksS0FBSyxRQUFRLENBQUM7WUFDaEYsQ0FBQyxDQUFDLGtCQUFrQixDQUFDLFVBQVUsQ0FBQyxRQUE2QixDQUFDO1lBQzlELENBQUMsQ0FBRSxRQUFnQyxDQUFDO1FBRXhDLE1BQU0sS0FBSyxHQUFHLFFBQVEsQ0FBQyxNQUFNLENBQzNCLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FDZCxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxnQkFBZ0IsRUFBRSxFQUFFLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FDN0YsQ0FBQztRQUVGLE1BQU0sTUFBTSxHQUFHLEtBQUs7YUFDakIsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxrQkFBa0IsQ0FBQyxVQUFVLENBQUMsSUFBSSxFQUFFLFFBQVEsQ0FBQyxDQUFDO2FBQzVELElBQUksQ0FBQyxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsRUFBRSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEdBQUcsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQy9DLE9BQU8sTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ3ZCLENBQUM7SUFFRCxNQUFNLENBQUMseUJBQXlCLENBQUMsT0FBZTtRQUM5QyxNQUFNLElBQUksR0FBRyxJQUFJLGVBQWUsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUMxQyxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQ2pDLE9BQU8sU0FBUyxDQUFDLFNBQXlCLENBQUM7SUFDN0MsQ0FBQztJQUVELE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxNQUFjO1FBQzVDLE1BQU0sR0FBRyxHQUFHLElBQUksd0JBQXdCLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDakQsTUFBTSxTQUFTLEdBQUcsR0FBRyxDQUFDLFNBQVMsQ0FBQztRQUNoQyxPQUFPLFNBQVMsQ0FBQyxTQUF5QixDQUFDO0lBQzdDLENBQUM7SUFFRCxNQUFNLENBQUMsS0FBSyxDQUFDLGlCQUFpQixDQUM1QixRQUEyQixFQUMzQixLQUF3QixFQUN4QixVQUFpQyxFQUFFO1FBRW5DLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxPQUFPLENBQUM7UUFFNUIseUZBQXlGO1FBQ3pGLE1BQU0sV0FBVyxHQUFHLGtCQUFrQixDQUFDLHVCQUF1QixDQUFDLFFBQVEsQ0FBQyxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBRW5GLE1BQU0sRUFBRSxHQUFHLGtCQUFrQixDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUVoRCxJQUFJLENBQUM7WUFDSCxNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsTUFBTSxTQUFTLENBQUMsZUFBZSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1lBQ3pFLE1BQU0saUJBQWlCLEdBQUcsT0FBTztnQkFDL0IsQ0FBQyxDQUFDLEVBQUU7Z0JBQ0osQ0FBQyxDQUFDLE1BQU0sVUFBVSxDQUFDLHdCQUF3QixDQUFDLFdBQVcsRUFBRSxFQUFFLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQztZQUVqRixNQUFNLFdBQVcsR0FBRyxJQUFJLEtBQUssQ0FBQyxnQ0FBZ0MsQ0FBQztnQkFDN0QsS0FBSyxFQUFFLFdBQVc7Z0JBQ2xCLFlBQVksRUFBRSxFQUFFO2dCQUNoQixLQUFLLEVBQUUsaUJBQWlCO2dCQUN4QixJQUFJO2FBQ0wsQ0FBQyxDQUFDO1lBRUgsTUFBTSxZQUFZLEdBQUcsTUFBTSxXQUFXLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDaEQsSUFBSSxDQUFDLFlBQVksQ0FBQyxNQUFNLEVBQUUsQ0FBQztnQkFDekIsT0FBTztvQkFDTCxPQUFPLEVBQUUsS0FBSztvQkFDZCxZQUFZLEVBQUUsWUFBWSxDQUFDLGFBQWE7aUJBQ3pDLENBQUM7WUFDSixDQUFDO1lBRUQ7Ozs7Ozs7O2VBUUc7WUFDSCxNQUFNLGtCQUFrQixHQUFHLFdBQVcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUNwRCxZQUFZLENBQUMsZUFBZSxFQUFFLElBQUksQ0FBQyxDQUFDLFlBQVksRUFBRSxFQUFFLENBQ2xELFlBQVksQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsQ0FDckQsQ0FDRixDQUFDO1lBQ0YsSUFBSSxDQUFDLGtCQUFrQixFQUFFLENBQUM7Z0JBQ3hCLE1BQU0sSUFBSSxLQUFLLENBQUMsNkNBQTZDLENBQUMsQ0FBQztZQUNqRSxDQUFDO1lBRUQsT0FBTztnQkFDTCxPQUFPLEVBQUUsSUFBSTthQUNkLENBQUM7UUFDSixDQUFDO1FBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztZQUNiLE9BQU87Z0JBQ0wsT0FBTyxFQUFFLEtBQUs7Z0JBQ2QsWUFBWSxFQUFHLEdBQWEsQ0FBQyxPQUFPO2FBQ3JDLENBQUM7UUFDSixDQUFDO0lBQ0gsQ0FBQztJQUVELE1BQU0sQ0FBQyxVQUFVLENBQUMsS0FBd0I7UUFDeEMsTUFBTSxVQUFVLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxrQkFBa0IsQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDMUYsT0FBTyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FDaEMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsa0JBQWtCLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQ2hFLENBQUM7SUFDSixDQUFDIn0=

package/dist/mjs/certificates/ocsp.d.ts

@@ -1,9 +1,14 @@
 import * as pkijs from 'pkijs';
+import { GenerateOcspResponseParams, ParsedOcspRequest } from '../index.js';
 export declare class OCSPHelper {
-    static getOCSPResponseFromCerts(certs: pkijs.Certificate[], ca: pkijs.Certificate[]): Promise<pkijs.BasicOCSPResponse[]>;
+    static getOCSPResponseFromCerts(certs: pkijs.Certificate[], ca: pkijs.Certificate[], oidsToCheck?: string[]): Promise<pkijs.BasicOCSPResponse[]>;
+    static generateOCSPResponse(params: GenerateOcspResponseParams): Promise<ArrayBuffer>;
+    static parseOCSPRequest(ocspRequestBinary: ArrayBuffer): ParsedOcspRequest;
+    private static canCertSignOCSPResponse;
     private static getOCSPRequestData;
     private static getOCSPResponse;
     private static sendOCSPRequest;
     private static getNonceForRequest;
     private static getNonceFromResponse;
+    private static getCertExtensionsToCheck;
 }

package/dist/mjs/certificates/ocsp.js

@@ -1,26 +1,142 @@
+import _ from 'lodash';
+import forge from 'node-forge';
 import * as pkijs from 'pkijs';
 import * as asn1js from 'asn1js';
 import axios from 'axios';
+import { CertID, OCSPRequest, Request, TBSRequest } from '@peculiar/asn1-ocsp';
+import { OctetString, AsnSerializer, AsnParser } from '@peculiar/asn1-schema';
+import { AlgorithmIdentifier, Extensions, Extension } from '@peculiar/asn1-x509';
 import { OID_AUTHORITY_INFORMATION_ACCESS_EXTENSION, OID_OCSP_ACCESS_METHOD, OID_OCSP_ISSUER_ACCESS_METHOD, } from '../constants.js';
 import { CertificatesHelper } from './helper.js';
-import { constants, helpers } from '../index.js';
+import { CryptoKeysTransformer, OcspCertStatus, constants, helpers, } from '../index.js';
+import { ExtendedKeyUsage } from '@peculiar/x509';
+const DEFAULT_REVOCATION_DATE = new Date('1970-01-01T00:00:00Z');
 export class OCSPHelper {
-    static async getOCSPResponseFromCerts(certs, ca) {
+    static async getOCSPResponseFromCerts(certs, ca, oidsToCheck = []) {
         const ocspRequestsData = certs
             .map(OCSPHelper.getOCSPRequestData)
             .filter(Boolean);
         if (!ocspRequestsData.length) {
             return [];
         }
-        const ocspResponseResults = await Promise.allSettled(ocspRequestsData.map((ocspReqData) => OCSPHelper.getOCSPResponse(ocspReqData, ca)));
+        const groupByOcspUrl = _.groupBy(ocspRequestsData, 'ocspUrl');
+        const getOcspResponseParams = Object.entries(groupByOcspUrl).map(([ocspUrl, certParams]) => ({
+            ocspUrl,
+            certsWithIssuer: certParams.map(({ cert, issuerCertUrl }) => ({
+                cert,
+                issuerCertUrl,
+                issuerCert: CertificatesHelper.getIssuerBySubject(cert, [...certs, ...ca]),
+            })),
+            ca,
+            oidsToCheck,
+        }));
+        const ocspResponseResults = await Promise.allSettled(getOcspResponseParams.map((params) => OCSPHelper.getOCSPResponse(params)));
         const rejectedOCSPResponses = ocspResponseResults
             .filter(helpers.isRejected)
             .map((result) => result.reason);
         if (rejectedOCSPResponses.length) {
-            throw new Error(`Can't get OCSP responses for some certificates (reasons=${rejectedOCSPResponses.join(';\n')})`);
+            throw new Error(`Can't get valid OCSP responses for some of certificates (reasons=${rejectedOCSPResponses.join(';\n')})`);
         }
         return ocspResponseResults.filter(helpers.isFulfilled).map((result) => result.value);
     }
+    static async generateOCSPResponse(params) {
+        const ocspBasicResp = new pkijs.BasicOCSPResponse();
+        const { issuerPem: issuerCertPem, caCertsPem, certs, privateKey, nonce } = params;
+        const { certs: issuerCertsPem } = CertificatesHelper.extractCAFromChain(`${issuerCertPem}\n${caCertsPem || ''}`);
+        const issuerCert = CertificatesHelper.toPkiCerts(issuerCertPem)[0];
+        ocspBasicResp.tbsResponseData.responderID = issuerCert.subject;
+        ocspBasicResp.tbsResponseData.producedAt = new Date();
+        ocspBasicResp.certs = CertificatesHelper.toPkiCerts(issuerCertsPem);
+        for (const certData of certs) {
+            const { serialNumber, status, issuerKeyHash, issuerNameHash, hashAlgorithm, revocationDate } = certData;
+            const certID = new pkijs.CertID({
+                hashAlgorithm: new pkijs.AlgorithmIdentifier({
+                    algorithmId: hashAlgorithm,
+                    algorithmParams: new asn1js.Null(),
+                }),
+                issuerNameHash: new asn1js.OctetString({ valueHex: issuerNameHash }),
+                issuerKeyHash: new asn1js.OctetString({ valueHex: issuerKeyHash }),
+                serialNumber: new asn1js.Integer({ valueHex: serialNumber }),
+            });
+            const response = new pkijs.SingleResponse({
+                certID,
+            });
+            switch (status) {
+                case OcspCertStatus.OK:
+                case OcspCertStatus.Unknown:
+                    response.certStatus = new asn1js.Primitive({
+                        idBlock: {
+                            tagClass: 3,
+                            tagNumber: status,
+                        },
+                    });
+                    break;
+                case OcspCertStatus.Revoked:
+                    response.certStatus = new asn1js.Constructed({
+                        idBlock: {
+                            tagClass: 3,
+                            tagNumber: status,
+                            isConstructed: true,
+                        },
+                        value: [
+                            new asn1js.GeneralizedTime({
+                                valueDate: revocationDate || DEFAULT_REVOCATION_DATE,
+                            }),
+                        ],
+                    });
+                    break;
+                default:
+                    throw new Error(`Unknown OCSP certificate status: ${status}`);
+            }
+            response.thisUpdate = new Date();
+            ocspBasicResp.tbsResponseData.responses.push(response);
+        }
+        if (nonce) {
+            ocspBasicResp.tbsResponseData.responseExtensions = [
+                new pkijs.Extension({
+                    extnID: constants.OID_OCSP_NONCE,
+                    extnValue: new asn1js.OctetString({ valueHex: nonce }).toBER(),
+                }),
+            ];
+        }
+        const privateCryptoKey = await CryptoKeysTransformer.pkcs8PemToCryptoKey(privateKey);
+        await ocspBasicResp.sign(privateCryptoKey, 'SHA-256');
+        const ocspBasicRespRaw = ocspBasicResp.toSchema().toBER(false);
+        const ocspResp = new pkijs.OCSPResponse({
+            responseStatus: new asn1js.Enumerated({ value: 0 }), // success
+            responseBytes: new pkijs.ResponseBytes({
+                responseType: pkijs.id_PKIX_OCSP_Basic,
+                response: new asn1js.OctetString({ valueHex: ocspBasicRespRaw }),
+            }),
+        });
+        return ocspResp.toSchema().toBER();
+    }
+    static parseOCSPRequest(ocspRequestBinary) {
+        const ocspRequest = AsnParser.parse(ocspRequestBinary, OCSPRequest);
+        const certRequests = ocspRequest.tbsRequest.requestList.map((request) => {
+            const reqCert = {
+                hashAlgorithm: request.reqCert.hashAlgorithm.algorithm,
+                issuerNameHash: Buffer.from(request.reqCert.issuerNameHash.buffer),
+                issuerKeyHash: Buffer.from(request.reqCert.issuerKeyHash.buffer),
+                serialNumber: request.reqCert.serialNumber,
+            };
+            const extensionsToCheck = request.singleRequestExtensions?.map((ext) => ({
+                oid: ext.extnID,
+                value: Buffer.from(ext.extnValue.buffer),
+            })) || [];
+            return { ...reqCert, extensionsToCheck };
+        });
+        const nonceExtension = ocspRequest.tbsRequest.requestExtensions?.find((ext) => ext.extnID === constants.OID_OCSP_NONCE);
+        const nonce = nonceExtension && nonceExtension.extnValue.buffer;
+        return { certRequests, nonce };
+    }
+    static canCertSignOCSPResponse(cert) {
+        const extKeysUsage = cert.extensions?.find((ext) => ext.extnID === forge.pki.oids['extKeyUsage']);
+        if (!extKeysUsage) {
+            return false;
+        }
+        return Boolean(extKeysUsage.parsedValue.keyPurposes.find((usage) => usage === ExtendedKeyUsage.ocspSigning));
+    }
     static getOCSPRequestData(cert) {
         const authorityExtension = CertificatesHelper.getExtensionValue(cert, OID_AUTHORITY_INFORMATION_ACCESS_EXTENSION);
         if (!authorityExtension) {
@@ -29,42 +145,92 @@ export class OCSPHelper {
         const extensionValue = pkijs.ExtensionValueFactory.fromBER(OID_AUTHORITY_INFORMATION_ACCESS_EXTENSION, authorityExtension);
         const ocspUrl = extensionValue.accessDescriptions.find((desc) => desc.accessMethod === OID_OCSP_ACCESS_METHOD)?.accessLocation.value;
         const issuerCertUrl = extensionValue.accessDescriptions.find((desc) => desc.accessMethod === OID_OCSP_ISSUER_ACCESS_METHOD)?.accessLocation.value;
-        if (!ocspUrl || !issuerCertUrl) {
-            // TODO: throw error?
+        if (!ocspUrl) {
             return;
         }
         return { ocspUrl, issuerCertUrl, cert };
     }
-    static async getOCSPResponse(data, ca) {
-        const { ocspUrl, issuerCertUrl, cert } = data;
-        const issuerCertRaw = await CertificatesHelper.downloadCertWithCache(issuerCertUrl);
-        const issuerCertificate = pkijs.Certificate.fromBER(issuerCertRaw);
-        const ocspReq = new pkijs.OCSPRequest();
-        await ocspReq.createForCertificate(cert, {
-            hashAlgorithm: 'SHA-256',
-            issuerCertificate,
-        });
+    static async getOCSPResponse(params) {
+        const { ocspUrl, certsWithIssuer, ca, oidsToCheck } = params;
+        const requestList = [];
+        const issuerCertificates = [];
+        const addIssuerCertIfNotExists = (cert) => {
+            if (!issuerCertificates.some((c) => c.subject.isEqual(cert.subject))) {
+                issuerCertificates.push(cert);
+            }
+        };
+        for (const { cert, issuerCert: issuerCertFromParams, issuerCertUrl } of certsWithIssuer) {
+            let issuerCertificate = issuerCertFromParams;
+            if (!issuerCertificate && issuerCertUrl) {
+                const issuerCertRaw = await CertificatesHelper.downloadCertWithCache(issuerCertUrl);
+                issuerCertificate = pkijs.Certificate.fromBER(issuerCertRaw);
+            }
+            if (!issuerCertificate) {
+                throw new Error(`No issuer certificate found for OCSP request for ${cert.subject}`);
+            }
+            addIssuerCertIfNotExists(issuerCertificate);
+            addIssuerCertIfNotExists(cert);
+            const certID = new pkijs.CertID();
+            await certID.createForCertificate(cert, {
+                hashAlgorithm: 'SHA-256',
+                issuerCertificate,
+            });
+            const request = new Request({
+                reqCert: new CertID({
+                    hashAlgorithm: new AlgorithmIdentifier({
+                        algorithm: certID.hashAlgorithm.algorithmId,
+                    }),
+                    issuerNameHash: new OctetString().fromASN(certID.issuerNameHash),
+                    issuerKeyHash: new OctetString().fromASN(certID.issuerKeyHash),
+                    serialNumber: certID.serialNumber.valueBlock.valueHex,
+                }),
+            });
+            const extensionsToCheck = OCSPHelper.getCertExtensionsToCheck(cert, oidsToCheck);
+            if (extensionsToCheck.length) {
+                request.singleRequestExtensions = new Extensions(extensionsToCheck.map((ext) => new Extension({ extnID: ext.oid, extnValue: new OctetString(ext.value) })));
+            }
+            requestList.push(request);
+        }
         const reqNonce = OCSPHelper.getNonceForRequest();
-        ocspReq.tbsRequest.requestExtensions = [
-            new pkijs.Extension({
-                extnID: constants.OID_OCSP_NONCE,
-                extnValue: new asn1js.OctetString({ valueHex: reqNonce.buffer }).toBER(),
+        const ocspReq = new OCSPRequest({
+            tbsRequest: new TBSRequest({
+                requestList,
+                requestExtensions: new Extensions([
+                    new Extension({
+                        extnID: constants.OID_OCSP_NONCE,
+                        extnValue: new OctetString(reqNonce),
+                    }),
+                ]),
             }),
-        ];
+        });
         const ocspBasicResp = await OCSPHelper.sendOCSPRequest(ocspUrl, ocspReq);
         const respNonce = await OCSPHelper.getNonceFromResponse(ocspBasicResp);
         if (respNonce && Buffer.compare(reqNonce, respNonce) !== 0) {
             throw new Error(`OCSP nonces from request and response do not match`);
         }
-        const trustedCerts = [];
-        if (!ocspBasicResp.certs) {
-            ocspBasicResp.certs = [issuerCertificate];
-            trustedCerts.push(...ca);
+        if (!ocspBasicResp.certs?.length) {
+            ocspBasicResp.certs = issuerCertificates;
         }
-        else {
-            trustedCerts.push(issuerCertificate);
+        const signers = ocspBasicResp.certs.filter((cert) => cert.subject.isEqual(ocspBasicResp.tbsResponseData.responderID));
+        if (!signers.length) {
+            throw new Error('No OCSP signer certificate found');
+        }
+        if (signers.length > 1) {
+            throw new Error('Prohibited attempt to replace OCSP signer');
+        }
+        const signerChain = CertificatesHelper.buildChain(signers[0], [
+            ...ocspBasicResp.certs,
+            ...issuerCertificates,
+        ]);
+        ocspBasicResp.certs = signerChain;
+        const isValid = await ocspBasicResp.verify({ trustedCerts: ca });
+        if (!isValid) {
+            throw new Error('OCSP response verification failed');
+        }
+        const isSignerValid = OCSPHelper.canCertSignOCSPResponse(signers[0]);
+        if (!isSignerValid) {
+            throw new Error('OCSP signer certificate does not have the OCSP signing extended key usage');
         }
-        await ocspBasicResp.verify({ trustedCerts });
         return ocspBasicResp;
     }
     static async sendOCSPRequest(ocspUrl, ocspReq) {
@@ -74,7 +240,7 @@ export class OCSPHelper {
                 'Content-Type': 'application/ocsp-request',
             },
             responseType: 'arraybuffer',
-            data: ocspReq.toSchema(true).toBER(),
+            data: AsnSerializer.serialize(ocspReq),
         });
         const ocspRespSimpl = pkijs.OCSPResponse.fromBER(ocspResponse.data);
         if (!ocspRespSimpl.responseBytes) {
@@ -88,7 +254,15 @@ export class OCSPHelper {
     }
     static getNonceFromResponse(ocspBasicResp) {
         const nonceExtension = ocspBasicResp.tbsResponseData?.responseExtensions?.find((extension) => extension.extnID === constants.OID_OCSP_NONCE);
-        return nonceExtension?.extnValue.valueBlock.valueHexView;
+        return nonceExtension && Buffer.from(nonceExtension.parsedValue.valueBlock.valueHex);
+    }
+    static getCertExtensionsToCheck(cert, oidsToCheck) {
+        return oidsToCheck
+            .map((oid) => {
+            const value = CertificatesHelper.getExtensionValue(cert, oid);
+            return { oid, value };
+        })
+            .filter((ext) => Boolean(ext.value));
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib2NzcC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9jZXJ0aWZpY2F0ZXMvb2NzcC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssS0FBSyxNQUFNLE9BQU8sQ0FBQztBQUMvQixPQUFPLEtBQUssTUFBTSxNQUFNLFFBQVEsQ0FBQztBQUNqQyxPQUFPLEtBQUssTUFBTSxPQUFPLENBQUM7QUFDMUIsT0FBTyxFQUNMLDBDQUEwQyxFQUMxQyxzQkFBc0IsRUFDdEIsNkJBQTZCLEdBQzlCLE1BQU0saUJBQWlCLENBQUM7QUFDekIsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sYUFBYSxDQUFDO0FBQ2pELE9BQU8sRUFBRSxTQUFTLEVBQUUsT0FBTyxFQUFFLE1BQU0sYUFBYSxDQUFDO0FBSWpELE1BQU0sT0FBTyxVQUFVO0lBQ3JCLE1BQU0sQ0FBQyxLQUFLLENBQUMsd0JBQXdCLENBQ25DLEtBQTBCLEVBQzFCLEVBQXVCO1FBRXZCLE1BQU0sZ0JBQWdCLEdBQUcsS0FBSzthQUMzQixHQUFHLENBQUMsVUFBVSxDQUFDLGtCQUFrQixDQUFDO2FBQ2xDLE1BQU0sQ0FBQyxPQUFPLENBQXNCLENBQUM7UUFFeEMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQzdCLE9BQU8sRUFBRSxDQUFDO1FBQ1osQ0FBQztRQUVELE1BQU0sbUJBQW1CLEdBQUcsTUFBTSxPQUFPLENBQUMsVUFBVSxDQUNsRCxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDLFVBQVUsQ0FBQyxlQUFlLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQ25GLENBQUM7UUFFRixNQUFNLHFCQUFxQixHQUFHLG1CQUFtQjthQUM5QyxNQUFNLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQzthQUMxQixHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNsQyxJQUFJLHFCQUFxQixDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ2pDLE1BQU0sSUFBSSxLQUFLLENBQ2IsMkRBQTJELHFCQUFxQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUNoRyxDQUFDO1FBQ0osQ0FBQztRQUVELE9BQU8sbUJBQW1CLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBRU8sTUFBTSxDQUFDLGtCQUFrQixDQUFDLElBQXVCO1FBQ3ZELE1BQU0sa0JBQWtCLEdBQUcsa0JBQWtCLENBQUMsaUJBQWlCLENBQzdELElBQUksRUFDSiwwQ0FBMEMsQ0FDM0MsQ0FBQztRQUNGLElBQUksQ0FBQyxrQkFBa0IsRUFBRSxDQUFDO1lBQ3hCLE9BQU87UUFDVCxDQUFDO1FBRUQsTUFBTSxjQUFjLEdBQUcsS0FBSyxDQUFDLHFCQUFxQixDQUFDLE9BQU8sQ0FDeEQsMENBQTBDLEVBQzFDLGtCQUFrQixDQUNFLENBQUM7UUFFdkIsTUFBTSxPQUFPLEdBQUcsY0FBYyxDQUFDLGtCQUFrQixDQUFDLElBQUksQ0FDcEQsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxZQUFZLEtBQUssc0JBQXNCLENBQ3ZELEVBQUUsY0FBYyxDQUFDLEtBQUssQ0FBQztRQUV4QixNQUFNLGFBQWEsR0FBRyxjQUFjLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUMxRCxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLFlBQVksS0FBSyw2QkFBNkIsQ0FDOUQsRUFBRSxjQUFjLENBQUMsS0FBSyxDQUFDO1FBRXhCLElBQUksQ0FBQyxPQUFPLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUMvQixxQkFBcUI7WUFDckIsT0FBTztRQUNULENBQUM7UUFFRCxPQUFPLEVBQUUsT0FBTyxFQUFFLGFBQWEsRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUMxQyxDQUFDO0lBRU8sTUFBTSxDQUFDLEtBQUssQ0FBQyxlQUFlLENBQ2xDLElBQXFCLEVBQ3JCLEVBQXVCO1FBRXZCLE1BQU0sRUFBRSxPQUFPLEVBQUUsYUFBYSxFQUFFLElBQUksRUFBRSxHQUFHLElBQUksQ0FBQztRQUM5QyxNQUFNLGFBQWEsR0FBRyxNQUFNLGtCQUFrQixDQUFDLHFCQUFxQixDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQ3BGLE1BQU0saUJBQWlCLEdBQUcsS0FBSyxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDbkUsTUFBTSxPQUFPLEdBQUcsSUFBSSxLQUFLLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDeEMsTUFBTSxPQUFPLENBQUMsb0JBQW9CLENBQUMsSUFBSSxFQUFFO1lBQ3ZDLGFBQWEsRUFBRSxTQUFTO1lBQ3hCLGlCQUFpQjtTQUNsQixDQUFDLENBQUM7UUFDSCxNQUFNLFFBQVEsR0FBRyxVQUFVLENBQUMsa0JBQWtCLEVBQUUsQ0FBQztRQUNqRCxPQUFPLENBQUMsVUFBVSxDQUFDLGlCQUFpQixHQUFHO1lBQ3JDLElBQUksS0FBSyxDQUFDLFNBQVMsQ0FBQztnQkFDbEIsTUFBTSxFQUFFLFNBQVMsQ0FBQyxjQUFjO2dCQUNoQyxTQUFTLEVBQUUsSUFBSSxNQUFNLENBQUMsV0FBVyxDQUFDLEVBQUUsUUFBUSxFQUFFLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLEtBQUssRUFBRTthQUN6RSxDQUFDO1NBQ0gsQ0FBQztRQUVGLE1BQU0sYUFBYSxHQUFHLE1BQU0sVUFBVSxDQUFDLGVBQWUsQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFFekUsTUFBTSxTQUFTLEdBQUcsTUFBTSxVQUFVLENBQUMsb0JBQW9CLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDdkUsSUFBSSxTQUFTLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDM0QsTUFBTSxJQUFJLEtBQUssQ0FBQyxvREFBb0QsQ0FBQyxDQUFDO1FBQ3hFLENBQUM7UUFFRCxNQUFNLFlBQVksR0FBd0IsRUFBRSxDQUFDO1FBQzdDLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDekIsYUFBYSxDQUFDLEtBQUssR0FBRyxDQUFDLGlCQUFpQixDQUFDLENBQUM7WUFDMUMsWUFBWSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO1FBQzNCLENBQUM7YUFBTSxDQUFDO1lBQ04sWUFBWSxDQUFDLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBQ3ZDLENBQUM7UUFFRCxNQUFNLGFBQWEsQ0FBQyxNQUFNLENBQUMsRUFBRSxZQUFZLEVBQUUsQ0FBQyxDQUFDO1FBQzdDLE9BQU8sYUFBYSxDQUFDO0lBQ3ZCLENBQUM7SUFFTyxNQUFNLENBQUMsS0FBSyxDQUFDLGVBQWUsQ0FDbEMsT0FBZSxFQUNmLE9BQTBCO1FBRTFCLE1BQU0sWUFBWSxHQUFHLE1BQU0sS0FBSyxDQUFDLE9BQU8sRUFBRTtZQUN4QyxNQUFNLEVBQUUsTUFBTTtZQUNkLE9BQU8sRUFBRTtnQkFDUCxjQUFjLEVBQUUsMEJBQTBCO2FBQzNDO1lBQ0QsWUFBWSxFQUFFLGFBQWE7WUFDM0IsSUFBSSxFQUFFLE9BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsS0FBSyxFQUFFO1NBQ3JDLENBQUMsQ0FBQztRQUVILE1BQU0sYUFBYSxHQUFHLEtBQUssQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNwRSxJQUFJLENBQUMsYUFBYSxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQ2pDLE1BQU0sSUFBSSxLQUFLLENBQUMsOERBQThELENBQUMsQ0FBQztRQUNsRixDQUFDO1FBRUQsTUFBTSxhQUFhLEdBQUcsS0FBSyxDQUFDLGlCQUFpQixDQUFDLE9BQU8sQ0FDbkQsYUFBYSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FDN0QsQ0FBQztRQUVGLE9BQU8sYUFBYSxDQUFDO0lBQ3ZCLENBQUM7SUFFTyxNQUFNLENBQUMsa0JBQWtCO1FBQy9CLE9BQU8sS0FBSyxDQUFDLGVBQWUsQ0FBQyxJQUFJLFVBQVUsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQ25ELENBQUM7SUFFTyxNQUFNLENBQUMsb0JBQW9CLENBQ2pDLGFBQXNDO1FBRXRDLE1BQU0sY0FBYyxHQUFHLGFBQWEsQ0FBQyxlQUFlLEVBQUUsa0JBQWtCLEVBQUUsSUFBSSxDQUM1RSxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUMsU0FBUyxDQUFDLE1BQU0sS0FBSyxTQUFTLENBQUMsY0FBYyxDQUM3RCxDQUFDO1FBQ0YsT0FBTyxjQUFjLEVBQUUsU0FBUyxDQUFDLFVBQVUsQ0FBQyxZQUFZLENBQUM7SUFDM0QsQ0FBQztDQUNGIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib2NzcC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9jZXJ0aWZpY2F0ZXMvb2NzcC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLENBQUMsTUFBTSxRQUFRLENBQUM7QUFDdkIsT0FBTyxLQUFLLE1BQU0sWUFBWSxDQUFDO0FBQy9CLE9BQU8sS0FBSyxLQUFLLE1BQU0sT0FBTyxDQUFDO0FBQy9CLE9BQU8sS0FBSyxNQUFNLE1BQU0sUUFBUSxDQUFDO0FBQ2pDLE9BQU8sS0FBSyxNQUFNLE9BQU8sQ0FBQztBQUMxQixPQUFPLEVBQUUsTUFBTSxFQUFFLFdBQVcsRUFBRSxPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDL0UsT0FBTyxFQUFFLFdBQVcsRUFBRSxhQUFhLEVBQUUsU0FBUyxFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFDOUUsT0FBTyxFQUFFLG1CQUFtQixFQUFFLFVBQVUsRUFBRSxTQUFTLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUNqRixPQUFPLEVBQ0wsMENBQTBDLEVBQzFDLHNCQUFzQixFQUN0Qiw2QkFBNkIsR0FDOUIsTUFBTSxpQkFBaUIsQ0FBQztBQUN6QixPQUFPLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFDakQsT0FBTyxFQUNMLHFCQUFxQixFQUdyQixjQUFjLEVBRWQsU0FBUyxFQUNULE9BQU8sR0FDUixNQUFNLGFBQWEsQ0FBQztBQUNyQixPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxnQkFBZ0IsQ0FBQztBQWVsRCxNQUFNLHVCQUF1QixHQUFHLElBQUksSUFBSSxDQUFDLHNCQUFzQixDQUFDLENBQUM7QUFFakUsTUFBTSxPQUFPLFVBQVU7SUFDckIsTUFBTSxDQUFDLEtBQUssQ0FBQyx3QkFBd0IsQ0FDbkMsS0FBMEIsRUFDMUIsRUFBdUIsRUFDdkIsY0FBd0IsRUFBRTtRQUUxQixNQUFNLGdCQUFnQixHQUFHLEtBQUs7YUFDM0IsR0FBRyxDQUFDLFVBQVUsQ0FBQyxrQkFBa0IsQ0FBQzthQUNsQyxNQUFNLENBQUMsT0FBTyxDQUFzQixDQUFDO1FBQ3hDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUM3QixPQUFPLEVBQUUsQ0FBQztRQUNaLENBQUM7UUFFRCxNQUFNLGNBQWMsR0FBRyxDQUFDLENBQUMsT0FBTyxDQUFDLGdCQUFnQixFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQzlELE1BQU0scUJBQXFCLEdBQTRCLE1BQU0sQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLENBQUMsR0FBRyxDQUN2RixDQUFDLENBQUMsT0FBTyxFQUFFLFVBQVUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1lBQzFCLE9BQU87WUFDUCxlQUFlLEVBQUUsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLGFBQWEsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDO2dCQUM1RCxJQUFJO2dCQUNKLGFBQWE7Z0JBQ2IsVUFBVSxFQUFFLGtCQUFrQixDQUFDLGtCQUFrQixDQUFDLElBQUksRUFBRSxDQUFDLEdBQUcsS0FBSyxFQUFFLEdBQUcsRUFBRSxDQUFDLENBQUM7YUFDM0UsQ0FBQyxDQUFDO1lBQ0gsRUFBRTtZQUNGLFdBQVc7U0FDWixDQUFDLENBQ0gsQ0FBQztRQUVGLE1BQU0sbUJBQW1CLEdBQUcsTUFBTSxPQUFPLENBQUMsVUFBVSxDQUNsRCxxQkFBcUIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLFVBQVUsQ0FBQyxlQUFlLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FDMUUsQ0FBQztRQUVGLE1BQU0scUJBQXFCLEdBQUcsbUJBQW1CO2FBQzlDLE1BQU0sQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDO2FBQzFCLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ2xDLElBQUkscUJBQXFCLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDakMsTUFBTSxJQUFJLEtBQUssQ0FDYixvRUFBb0UscUJBQXFCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQ3pHLENBQUM7UUFDSixDQUFDO1FBRUQsT0FBTyxtQkFBbUIsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3ZGLENBQUM7SUFFRCxNQUFNLENBQUMsS0FBSyxDQUFDLG9CQUFvQixDQUFDLE1BQWtDO1FBQ2xFLE1BQU0sYUFBYSxHQUFHLElBQUksS0FBSyxDQUFDLGlCQUFpQixFQUFFLENBQUM7UUFDcEQsTUFBTSxFQUFFLFNBQVMsRUFBRSxhQUFhLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUUsS0FBSyxFQUFFLEdBQUcsTUFBTSxDQUFDO1FBQ2xGLE1BQU0sRUFBRSxLQUFLLEVBQUUsY0FBYyxFQUFFLEdBQUcsa0JBQWtCLENBQUMsa0JBQWtCLENBQ3JFLEdBQUcsYUFBYSxLQUFLLFVBQVUsSUFBSSxFQUFFLEVBQUUsQ0FDeEMsQ0FBQztRQUNGLE1BQU0sVUFBVSxHQUFHLGtCQUFrQixDQUFDLFVBQVUsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUVuRSxhQUFhLENBQUMsZUFBZSxDQUFDLFdBQVcsR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDO1FBQy9ELGFBQWEsQ0FBQyxlQUFlLENBQUMsVUFBVSxHQUFHLElBQUksSUFBSSxFQUFFLENBQUM7UUFDdEQsYUFBYSxDQUFDLEtBQUssR0FBRyxrQkFBa0IsQ0FBQyxVQUFVLENBQUMsY0FBYyxDQUFDLENBQUM7UUFFcEUsS0FBSyxNQUFNLFFBQVEsSUFBSSxLQUFLLEVBQUUsQ0FBQztZQUM3QixNQUFNLEVBQUUsWUFBWSxFQUFFLE1BQU0sRUFBRSxhQUFhLEVBQUUsY0FBYyxFQUFFLGFBQWEsRUFBRSxjQUFjLEVBQUUsR0FDMUYsUUFBUSxDQUFDO1lBQ1gsTUFBTSxNQUFNLEdBQUcsSUFBSSxLQUFLLENBQUMsTUFBTSxDQUFDO2dCQUM5QixhQUFhLEVBQUUsSUFBSSxLQUFLLENBQUMsbUJBQW1CLENBQUM7b0JBQzNDLFdBQVcsRUFBRSxhQUFhO29CQUMxQixlQUFlLEVBQUUsSUFBSSxNQUFNLENBQUMsSUFBSSxFQUFFO2lCQUNuQyxDQUFDO2dCQUNGLGNBQWMsRUFBRSxJQUFJLE1BQU0sQ0FBQyxXQUFXLENBQUMsRUFBRSxRQUFRLEVBQUUsY0FBYyxFQUFFLENBQUM7Z0JBQ3BFLGFBQWEsRUFBRSxJQUFJLE1BQU0sQ0FBQyxXQUFXLENBQUMsRUFBRSxRQUFRLEVBQUUsYUFBYSxFQUFFLENBQUM7Z0JBQ2xFLFlBQVksRUFBRSxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsRUFBRSxRQUFRLEVBQUUsWUFBWSxFQUFFLENBQUM7YUFDN0QsQ0FBQyxDQUFDO1lBRUgsTUFBTSxRQUFRLEdBQUcsSUFBSSxLQUFLLENBQUMsY0FBYyxDQUFDO2dCQUN4QyxNQUFNO2FBQ1AsQ0FBQyxDQUFDO1lBRUgsUUFBUSxNQUFNLEVBQUUsQ0FBQztnQkFDZixLQUFLLGNBQWMsQ0FBQyxFQUFFLENBQUM7Z0JBQ3ZCLEtBQUssY0FBYyxDQUFDLE9BQU87b0JBQ3pCLFFBQVEsQ0FBQyxVQUFVLEdBQUcsSUFBSSxNQUFNLENBQUMsU0FBUyxDQUFDO3dCQUN6QyxPQUFPLEVBQUU7NEJBQ1AsUUFBUSxFQUFFLENBQUM7NEJBQ1gsU0FBUyxFQUFFLE1BQU07eUJBQ2xCO3FCQUNGLENBQUMsQ0FBQztvQkFDSCxNQUFNO2dCQUNSLEtBQUssY0FBYyxDQUFDLE9BQU87b0JBQ3pCLFFBQVEsQ0FBQyxVQUFVLEdBQUcsSUFBSSxNQUFNLENBQUMsV0FBVyxDQUFDO3dCQUMzQyxPQUFPLEVBQUU7NEJBQ1AsUUFBUSxFQUFFLENBQUM7NEJBQ1gsU0FBUyxFQUFFLE1BQU07NEJBQ2pCLGFBQWEsRUFBRSxJQUFJO3lCQUNwQjt3QkFDRCxLQUFLLEVBQUU7NEJBQ0wsSUFBSSxNQUFNLENBQUMsZUFBZSxDQUFDO2dDQUN6QixTQUFTLEVBQUUsY0FBYyxJQUFJLHVCQUF1Qjs2QkFDckQsQ0FBQzt5QkFDSDtxQkFDRixDQUFDLENBQUM7b0JBQ0gsTUFBTTtnQkFDUjtvQkFDRSxNQUFNLElBQUksS0FBSyxDQUFDLG9DQUFvQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO1lBQ2xFLENBQUM7WUFFRCxRQUFRLENBQUMsVUFBVSxHQUFHLElBQUksSUFBSSxFQUFFLENBQUM7WUFDakMsYUFBYSxDQUFDLGVBQWUsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3pELENBQUM7UUFFRCxJQUFJLEtBQUssRUFBRSxDQUFDO1lBQ1YsYUFBYSxDQUFDLGVBQWUsQ0FBQyxrQkFBa0IsR0FBRztnQkFDakQsSUFBSSxLQUFLLENBQUMsU0FBUyxDQUFDO29CQUNsQixNQUFNLEVBQUUsU0FBUyxDQUFDLGNBQWM7b0JBQ2hDLFNBQVMsRUFBRSxJQUFJLE1BQU0sQ0FBQyxXQUFXLENBQUMsRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQyxLQUFLLEVBQUU7aUJBQy9ELENBQUM7YUFDSCxDQUFDO1FBQ0osQ0FBQztRQUVELE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSxxQkFBcUIsQ0FBQyxtQkFBbUIsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUNyRixNQUFNLGFBQWEsQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFFdEQsTUFBTSxnQkFBZ0IsR0FBRyxhQUFhLENBQUMsUUFBUSxFQUFFLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBRS9ELE1BQU0sUUFBUSxHQUFHLElBQUksS0FBSyxDQUFDLFlBQVksQ0FBQztZQUN0QyxjQUFjLEVBQUUsSUFBSSxNQUFNLENBQUMsVUFBVSxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsRUFBRSxDQUFDLEVBQUUsVUFBVTtZQUMvRCxhQUFhLEVBQUUsSUFBSSxLQUFLLENBQUMsYUFBYSxDQUFDO2dCQUNyQyxZQUFZLEVBQUUsS0FBSyxDQUFDLGtCQUFrQjtnQkFDdEMsUUFBUSxFQUFFLElBQUksTUFBTSxDQUFDLFdBQVcsQ0FBQyxFQUFFLFFBQVEsRUFBRSxnQkFBZ0IsRUFBRSxDQUFDO2FBQ2pFLENBQUM7U0FDSCxDQUFDLENBQUM7UUFFSCxPQUFPLFFBQVEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUNyQyxDQUFDO0lBRUQsTUFBTSxDQUFDLGdCQUFnQixDQUFDLGlCQUE4QjtRQUNwRCxNQUFNLFdBQVcsR0FBRyxTQUFTLENBQUMsS0FBSyxDQUFDLGlCQUFpQixFQUFFLFdBQVcsQ0FBQyxDQUFDO1FBQ3BFLE1BQU0sWUFBWSxHQUFHLFdBQVcsQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFO1lBQ3RFLE1BQU0sT0FBTyxHQUFHO2dCQUNkLGFBQWEsRUFBRSxPQUFPLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxTQUFTO2dCQUN0RCxjQUFjLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLGNBQWMsQ0FBQyxNQUFNLENBQUM7Z0JBQ2xFLGFBQWEsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQztnQkFDaEUsWUFBWSxFQUFFLE9BQU8sQ0FBQyxPQUFPLENBQUMsWUFBWTthQUMzQyxDQUFDO1lBRUYsTUFBTSxpQkFBaUIsR0FDckIsT0FBTyxDQUFDLHVCQUF1QixFQUFFLEdBQUcsQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQztnQkFDN0MsR0FBRyxFQUFFLEdBQUcsQ0FBQyxNQUFNO2dCQUNmLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDO2FBQ3pDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUVaLE9BQU8sRUFBRSxHQUFHLE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxDQUFDO1FBQzNDLENBQUMsQ0FBQyxDQUFDO1FBRUgsTUFBTSxjQUFjLEdBQUcsV0FBVyxDQUFDLFVBQVUsQ0FBQyxpQkFBaUIsRUFBRSxJQUFJLENBQ25FLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxHQUFHLENBQUMsTUFBTSxLQUFLLFNBQVMsQ0FBQyxjQUFjLENBQ2pELENBQUM7UUFDRixNQUFNLEtBQUssR0FBRyxjQUFjLElBQUksY0FBYyxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUM7UUFFaEUsT0FBTyxFQUFFLFlBQVksRUFBRSxLQUFLLEVBQUUsQ0FBQztJQUNqQyxDQUFDO0lBRU8sTUFBTSxDQUFDLHVCQUF1QixDQUFDLElBQXVCO1FBQzVELE1BQU0sWUFBWSxHQUFHLElBQUksQ0FBQyxVQUFVLEVBQUUsSUFBSSxDQUN4QyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsR0FBRyxDQUFDLE1BQU0sS0FBSyxLQUFLLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FDdEQsQ0FBQztRQUNGLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUNsQixPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFFRCxPQUFPLE9BQU8sQ0FDWixZQUFZLENBQUMsV0FBVyxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQ3ZDLENBQUMsS0FBYSxFQUFFLEVBQUUsQ0FBQyxLQUFLLEtBQUssZ0JBQWdCLENBQUMsV0FBVyxDQUMxRCxDQUNGLENBQUM7SUFDSixDQUFDO0lBRU8sTUFBTSxDQUFDLGtCQUFrQixDQUFDLElBQXVCO1FBQ3ZELE1BQU0sa0JBQWtCLEdBQUcsa0JBQWtCLENBQUMsaUJBQWlCLENBQzdELElBQUksRUFDSiwwQ0FBMEMsQ0FDM0MsQ0FBQztRQUNGLElBQUksQ0FBQyxrQkFBa0IsRUFBRSxDQUFDO1lBQ3hCLE9BQU87UUFDVCxDQUFDO1FBRUQsTUFBTSxjQUFjLEdBQUcsS0FBSyxDQUFDLHFCQUFxQixDQUFDLE9BQU8sQ0FDeEQsMENBQTBDLEVBQzFDLGtCQUFrQixDQUNFLENBQUM7UUFFdkIsTUFBTSxPQUFPLEdBQUcsY0FBYyxDQUFDLGtCQUFrQixDQUFDLElBQUksQ0FDcEQsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxZQUFZLEtBQUssc0JBQXNCLENBQ3ZELEVBQUUsY0FBYyxDQUFDLEtBQUssQ0FBQztRQUV4QixNQUFNLGFBQWEsR0FBRyxjQUFjLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUMxRCxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLFlBQVksS0FBSyw2QkFBNkIsQ0FDOUQsRUFBRSxjQUFjLENBQUMsS0FBSyxDQUFDO1FBRXhCLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNiLE9BQU87UUFDVCxDQUFDO1FBRUQsT0FBTyxFQUFFLE9BQU8sRUFBRSxhQUFhLEVBQUUsSUFBSSxFQUFFLENBQUM7SUFDMUMsQ0FBQztJQUVPLE1BQU0sQ0FBQyxLQUFLLENBQUMsZUFBZSxDQUNsQyxNQUE2QjtRQUU3QixNQUFNLEVBQUUsT0FBTyxFQUFFLGVBQWUsRUFBRSxFQUFFLEVBQUUsV0FBVyxFQUFFLEdBQUcsTUFBTSxDQUFDO1FBQzdELE1BQU0sV0FBVyxHQUFjLEVBQUUsQ0FBQztRQUNsQyxNQUFNLGtCQUFrQixHQUF3QixFQUFFLENBQUM7UUFFbkQsTUFBTSx3QkFBd0IsR0FBRyxDQUFDLElBQXVCLEVBQVEsRUFBRTtZQUNqRSxJQUFJLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsRUFBRSxDQUFDO2dCQUNyRSxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDaEMsQ0FBQztRQUNILENBQUMsQ0FBQztRQUNGLEtBQUssTUFBTSxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsb0JBQW9CLEVBQUUsYUFBYSxFQUFFLElBQUksZUFBZSxFQUFFLENBQUM7WUFDeEYsSUFBSSxpQkFBaUIsR0FBRyxvQkFBb0IsQ0FBQztZQUM3QyxJQUFJLENBQUMsaUJBQWlCLElBQUksYUFBYSxFQUFFLENBQUM7Z0JBQ3hDLE1BQU0sYUFBYSxHQUFHLE1BQU0sa0JBQWtCLENBQUMscUJBQXFCLENBQUMsYUFBYSxDQUFDLENBQUM7Z0JBQ3BGLGlCQUFpQixHQUFHLEtBQUssQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1lBQy9ELENBQUM7WUFDRCxJQUFJLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztnQkFDdkIsTUFBTSxJQUFJLEtBQUssQ0FBQyxvREFBb0QsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUM7WUFDdEYsQ0FBQztZQUVELHdCQUF3QixDQUFDLGlCQUFpQixDQUFDLENBQUM7WUFDNUMsd0JBQXdCLENBQUMsSUFBSSxDQUFDLENBQUM7WUFFL0IsTUFBTSxNQUFNLEdBQUcsSUFBSSxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDbEMsTUFBTSxNQUFNLENBQUMsb0JBQW9CLENBQUMsSUFBSSxFQUFFO2dCQUN0QyxhQUFhLEVBQUUsU0FBUztnQkFDeEIsaUJBQWlCO2FBQ2xCLENBQUMsQ0FBQztZQUVILE1BQU0sT0FBTyxHQUFHLElBQUksT0FBTyxDQUFDO2dCQUMxQixPQUFPLEVBQUUsSUFBSSxNQUFNLENBQUM7b0JBQ2xCLGFBQWEsRUFBRSxJQUFJLG1CQUFtQixDQUFDO3dCQUNyQyxTQUFTLEVBQUUsTUFBTSxDQUFDLGFBQWEsQ0FBQyxXQUFXO3FCQUM1QyxDQUFDO29CQUNGLGNBQWMsRUFBRSxJQUFJLFdBQVcsRUFBRSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsY0FBYyxDQUFDO29CQUNoRSxhQUFhLEVBQUUsSUFBSSxXQUFXLEVBQUUsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQztvQkFDOUQsWUFBWSxFQUFFLE1BQU0sQ0FBQyxZQUFZLENBQUMsVUFBVSxDQUFDLFFBQVE7aUJBQ3RELENBQUM7YUFDSCxDQUFDLENBQUM7WUFFSCxNQUFNLGlCQUFpQixHQUFHLFVBQVUsQ0FBQyx3QkFBd0IsQ0FBQyxJQUFJLEVBQUUsV0FBVyxDQUFDLENBQUM7WUFDakYsSUFBSSxpQkFBaUIsQ0FBQyxNQUFNLEVBQUUsQ0FBQztnQkFDN0IsT0FBTyxDQUFDLHVCQUF1QixHQUFHLElBQUksVUFBVSxDQUM5QyxpQkFBaUIsQ0FBQyxHQUFHLENBQ25CLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxJQUFJLFNBQVMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxHQUFHLENBQUMsR0FBRyxFQUFFLFNBQVMsRUFBRSxJQUFJLFdBQVcsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUNuRixDQUNGLENBQUM7WUFDSixDQUFDO1lBRUQsV0FBVyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUM1QixDQUFDO1FBRUQsTUFBTSxRQUFRLEdBQUcsVUFBVSxDQUFDLGtCQUFrQixFQUFFLENBQUM7UUFDakQsTUFBTSxPQUFPLEdBQUcsSUFBSSxXQUFXLENBQUM7WUFDOUIsVUFBVSxFQUFFLElBQUksVUFBVSxDQUFDO2dCQUN6QixXQUFXO2dCQUNYLGlCQUFpQixFQUFFLElBQUksVUFBVSxDQUFDO29CQUNoQyxJQUFJLFNBQVMsQ0FBQzt3QkFDWixNQUFNLEVBQUUsU0FBUyxDQUFDLGNBQWM7d0JBQ2hDLFNBQVMsRUFBRSxJQUFJLFdBQVcsQ0FBQyxRQUFRLENBQUM7cUJBQ3JDLENBQUM7aUJBQ0gsQ0FBQzthQUNILENBQUM7U0FDSCxDQUFDLENBQUM7UUFFSCxNQUFNLGFBQWEsR0FBRyxNQUFNLFVBQVUsQ0FBQyxlQUFlLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBRXpFLE1BQU0sU0FBUyxHQUFHLE1BQU0sVUFBVSxDQUFDLG9CQUFvQixDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQ3ZFLElBQUksU0FBUyxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxFQUFFLFNBQVMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzNELE1BQU0sSUFBSSxLQUFLLENBQUMsb0RBQW9ELENBQUMsQ0FBQztRQUN4RSxDQUFDO1FBRUQsSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLENBQUM7WUFDakMsYUFBYSxDQUFDLEtBQUssR0FBRyxrQkFBa0IsQ0FBQztRQUMzQyxDQUFDO1FBRUQsTUFBTSxPQUFPLEdBQUcsYUFBYSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUNsRCxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsZUFBZSxDQUFDLFdBQVcsQ0FBQyxDQUNoRSxDQUFDO1FBQ0YsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNwQixNQUFNLElBQUksS0FBSyxDQUFDLGtDQUFrQyxDQUFDLENBQUM7UUFDdEQsQ0FBQztRQUNELElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLDJDQUEyQyxDQUFDLENBQUM7UUFDL0QsQ0FBQztRQUVELE1BQU0sV0FBVyxHQUFHLGtCQUFrQixDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLEVBQUU7WUFDNUQsR0FBRyxhQUFhLENBQUMsS0FBSztZQUN0QixHQUFHLGtCQUFrQjtTQUN0QixDQUFDLENBQUM7UUFDSCxhQUFhLENBQUMsS0FBSyxHQUFHLFdBQVcsQ0FBQztRQUNsQyxNQUFNLE9BQU8sR0FBRyxNQUFNLGFBQWEsQ0FBQyxNQUFNLENBQUMsRUFBRSxZQUFZLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUNqRSxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDYixNQUFNLElBQUksS0FBSyxDQUFDLG1DQUFtQyxDQUFDLENBQUM7UUFDdkQsQ0FBQztRQUVELE1BQU0sYUFBYSxHQUFHLFVBQVUsQ0FBQyx1QkFBdUIsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNyRSxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7WUFDbkIsTUFBTSxJQUFJLEtBQUssQ0FBQywyRUFBMkUsQ0FBQyxDQUFDO1FBQy9GLENBQUM7UUFFRCxPQUFPLGFBQWEsQ0FBQztJQUN2QixDQUFDO0lBRU8sTUFBTSxDQUFDLEtBQUssQ0FBQyxlQUFlLENBQ2xDLE9BQWUsRUFDZixPQUFvQjtRQUVwQixNQUFNLFlBQVksR0FBRyxNQUFNLEtBQUssQ0FBQyxPQUFPLEVBQUU7WUFDeEMsTUFBTSxFQUFFLE1BQU07WUFDZCxPQUFPLEVBQUU7Z0JBQ1AsY0FBYyxFQUFFLDBCQUEwQjthQUMzQztZQUNELFlBQVksRUFBRSxhQUFhO1lBQzNCLElBQUksRUFBRSxhQUFhLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQztTQUN2QyxDQUFDLENBQUM7UUFFSCxNQUFNLGFBQWEsR0FBRyxLQUFLLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDcEUsSUFBSSxDQUFDLGFBQWEsQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUNqQyxNQUFNLElBQUksS0FBSyxDQUFDLDhEQUE4RCxDQUFDLENBQUM7UUFDbEYsQ0FBQztRQUVELE1BQU0sYUFBYSxHQUFHLEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxPQUFPLENBQ25ELGFBQWEsQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxZQUFZLENBQzdELENBQUM7UUFFRixPQUFPLGFBQWEsQ0FBQztJQUN2QixDQUFDO0lBRU8sTUFBTSxDQUFDLGtCQUFrQjtRQUMvQixPQUFPLEtBQUssQ0FBQyxlQUFlLENBQUMsSUFBSSxVQUFVLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBRU8sTUFBTSxDQUFDLG9CQUFvQixDQUFDLGFBQXNDO1FBQ3hFLE1BQU0sY0FBYyxHQUFHLGFBQWEsQ0FBQyxlQUFlLEVBQUUsa0JBQWtCLEVBQUUsSUFBSSxDQUM1RSxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUMsU0FBUyxDQUFDLE1BQU0sS0FBSyxTQUFTLENBQUMsY0FBYyxDQUM3RCxDQUFDO1FBQ0YsT0FBTyxjQUFjLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBRU8sTUFBTSxDQUFDLHdCQUF3QixDQUNyQyxJQUF1QixFQUN2QixXQUFxQjtRQUVyQixPQUFPLFdBQVc7YUFDZixHQUFHLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRTtZQUNYLE1BQU0sS0FBSyxHQUFHLGtCQUFrQixDQUFDLGlCQUFpQixDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsQ0FBQztZQUU5RCxPQUFPLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRSxDQUFDO1FBQ3hCLENBQUMsQ0FBQzthQUNELE1BQU0sQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBc0IsQ0FBQztJQUM5RCxDQUFDO0NBQ0YifQ==

package/dist/mjs/certificates/testing-generate.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/mjs/certificates/testing-generate.js

@@ -0,0 +1,110 @@
+import { OID_CUSTOM_EXTENSION_CHALLENGE_ID } from '@super-protocol/pki-common';
+import { CertificateGenerator } from './generator.js';
+import { CertificatesHelper } from './helper.js';
+import fs from 'fs';
+import { CryptoKeysTransformer } from '../utils/CryptoKeysTransformer.js';
+import { OID_CUSTOM_EXTENSION_USER_DATA } from '../constants.js';
+// const signatureAlgorithm: SignatureAlgorithm = 'ECDSA-P-256-SHA256';
+const signatureAlgorithm = 'ECDSA-secp256k1-SHA256';
+void (async () => {
+    const orderCertPem = await fs.promises.readFile('order_cert.crt', 'utf8');
+    const mrEnclave = CertificatesHelper.getExtensionValue(orderCertPem, OID_CUSTOM_EXTENSION_CHALLENGE_ID);
+    const userDataHashFromCert = CertificatesHelper.getExtensionValue(orderCertPem, OID_CUSTOM_EXTENSION_USER_DATA);
+    const rootSubject = {
+        country: 'US',
+        stateName: 'California',
+        localityName: 'San Francisco',
+        organization: 'Super Protocol',
+        organizationalUnit: 'Development',
+        commonName: 'Root CA',
+    };
+    const subroot1 = {
+        country: 'US',
+        stateName: 'California',
+        localityName: 'San Francisco',
+        organization: 'Super Protocol',
+        organizationalUnit: 'Development',
+        commonName: 'Subroot1 CA',
+    };
+    const subroot2 = {
+        country: 'US',
+        stateName: 'California',
+        localityName: 'San Francisco',
+        organization: 'Super Protocol',
+        organizationalUnit: 'Development',
+        commonName: 'Subroot Level 2 CA',
+    };
+    const rootCertKeys = await CertificateGenerator.generateKeys(signatureAlgorithm);
+    const rootPrivatePem = await CryptoKeysTransformer.cryptoKeyToPkcs8Pem(rootCertKeys.privateKey);
+    const rootPublicPem = await CryptoKeysTransformer.cryptoKeyToSpkiPem(rootCertKeys.publicKey);
+    const rootCertParams = {
+        subject: rootSubject,
+        issuer: rootSubject,
+        notAfter: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000), // 1 year
+        ca: true,
+        dnsNames: ['sp.superprotocol.io', 'superprotocol.io', '127.0.0.1'],
+        publicKey: rootPublicPem,
+        privateKey: rootPrivatePem,
+    };
+    const rootCert = await CertificateGenerator.generateCert(rootCertParams);
+    const alg = CertificatesHelper.getCertPublicKeyAlgorithm(rootCert);
+    alg;
+    const subroot1Keys = await CertificateGenerator.generateKeys(signatureAlgorithm);
+    const subroot1CertParams = {
+        subject: subroot1,
+        issuer: rootSubject,
+        privateKey: rootCertKeys.privateKey,
+        notAfter: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000), // 1 year
+        ca: true,
+        dnsNames: ['sp.superprotocol.io', 'superprotocol.io'],
+        customExtensions: [
+            {
+                oid: OID_CUSTOM_EXTENSION_USER_DATA,
+                value: userDataHashFromCert,
+            },
+            {
+                oid: '1.3.6.1.3.8888.1.1',
+                value: Buffer.from('tdx', 'utf8'),
+            },
+            {
+                oid: '1.3.6.1.3.8888.1.2',
+                value: mrEnclave,
+            },
+        ],
+        publicKey: subroot1Keys.publicKey,
+    };
+    const subroot1Cert = await CertificateGenerator.generateCert(subroot1CertParams);
+    const subroot2Keys = await CertificateGenerator.generateKeys(signatureAlgorithm);
+    const subrootLevel2CertParams = {
+        subject: subroot2,
+        issuer: subroot1,
+        privateKey: subroot1Keys.privateKey,
+        notAfter: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000), // 1 year
+        ca: false,
+        dnsNames: ['sp.superprotocol.io', 'superprotocol.io'],
+        customExtensions: [
+            {
+                oid: OID_CUSTOM_EXTENSION_CHALLENGE_ID,
+                value: Buffer.from('tdx', 'utf8'),
+            },
+            {
+                oid: '1.3.6.1.3.8888.1.2',
+                value: mrEnclave,
+            },
+        ],
+        publicKey: subroot2Keys.publicKey,
+    };
+    const subrootLevel2Cert = await CertificateGenerator.generateCert(subrootLevel2CertParams);
+    // const rootCertPem = CertificatesHelper.derToPem(rootCert.certificate.toSchema().toBER());
+    // const subroot1CertPem = CertificatesHelper.derToPem(subroot1Cert.certificate.toSchema().toBER());
+    // const subrootLevel2CertPem = CertificatesHelper.derToPem(
+    //   subrootLevel2Cert.certificate.toSchema().toBER(),
+    // );
+    const certsPem = [subrootLevel2Cert, subroot1Cert];
+    const validateResult = await CertificatesHelper.validateCertChain(certsPem, rootCert);
+    console.log(JSON.stringify(validateResult, null, 2));
+    await fs.promises.writeFile(`pkijsCert-root-${signatureAlgorithm}.crt`, rootCert, 'utf8');
+    await fs.promises.writeFile(`pkijsCert-subroot1-${signatureAlgorithm}.crt`, subroot1Cert, 'utf8');
+    await fs.promises.writeFile(`pkijsCert-subroot2-${signatureAlgorithm}.crt`, subrootLevel2Cert, 'utf8');
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGVzdGluZy1nZW5lcmF0ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9jZXJ0aWZpY2F0ZXMvdGVzdGluZy1nZW5lcmF0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsaUNBQWlDLEVBQUUsTUFBTSw0QkFBNEIsQ0FBQztBQUMvRSxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSxnQkFBZ0IsQ0FBQztBQUN0RCxPQUFPLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFFakQsT0FBTyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQ3BCLE9BQU8sRUFBRSxxQkFBcUIsRUFBRSxNQUFNLG1DQUFtQyxDQUFDO0FBQzFFLE9BQU8sRUFBRSw4QkFBOEIsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBRWpFLHVFQUF1RTtBQUN2RSxNQUFNLGtCQUFrQixHQUF1Qix3QkFBd0IsQ0FBQztBQUV4RSxLQUFLLENBQUMsS0FBSyxJQUFJLEVBQUU7SUFDZixNQUFNLFlBQVksR0FBRyxNQUFNLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLGdCQUFnQixFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzFFLE1BQU0sU0FBUyxHQUFHLGtCQUFrQixDQUFDLGlCQUFpQixDQUNwRCxZQUFZLEVBQ1osaUNBQWlDLENBQ2xDLENBQUM7SUFFRixNQUFNLG9CQUFvQixHQUFHLGtCQUFrQixDQUFDLGlCQUFpQixDQUMvRCxZQUFZLEVBQ1osOEJBQThCLENBQy9CLENBQUM7SUFFRixNQUFNLFdBQVcsR0FBRztRQUNsQixPQUFPLEVBQUUsSUFBSTtRQUNiLFNBQVMsRUFBRSxZQUFZO1FBQ3ZCLFlBQVksRUFBRSxlQUFlO1FBQzdCLFlBQVksRUFBRSxnQkFBZ0I7UUFDOUIsa0JBQWtCLEVBQUUsYUFBYTtRQUNqQyxVQUFVLEVBQUUsU0FBUztLQUN0QixDQUFDO0lBRUYsTUFBTSxRQUFRLEdBQUc7UUFDZixPQUFPLEVBQUUsSUFBSTtRQUNiLFNBQVMsRUFBRSxZQUFZO1FBQ3ZCLFlBQVksRUFBRSxlQUFlO1FBQzdCLFlBQVksRUFBRSxnQkFBZ0I7UUFDOUIsa0JBQWtCLEVBQUUsYUFBYTtRQUNqQyxVQUFVLEVBQUUsYUFBYTtLQUMxQixDQUFDO0lBRUYsTUFBTSxRQUFRLEdBQUc7UUFDZixPQUFPLEVBQUUsSUFBSTtRQUNiLFNBQVMsRUFBRSxZQUFZO1FBQ3ZCLFlBQVksRUFBRSxlQUFlO1FBQzdCLFlBQVksRUFBRSxnQkFBZ0I7UUFDOUIsa0JBQWtCLEVBQUUsYUFBYTtRQUNqQyxVQUFVLEVBQUUsb0JBQW9CO0tBQ2pDLENBQUM7SUFFRixNQUFNLFlBQVksR0FBRyxNQUFNLG9CQUFvQixDQUFDLFlBQVksQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0lBQ2pGLE1BQU0sY0FBYyxHQUFHLE1BQU0scUJBQXFCLENBQUMsbUJBQW1CLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ2hHLE1BQU0sYUFBYSxHQUFHLE1BQU0scUJBQXFCLENBQUMsa0JBQWtCLENBQUMsWUFBWSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQzdGLE1BQU0sY0FBYyxHQUF1QjtRQUN6QyxPQUFPLEVBQUUsV0FBVztRQUNwQixNQUFNLEVBQUUsV0FBVztRQUNuQixRQUFRLEVBQUUsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLEdBQUcsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxJQUFJLENBQUMsRUFBRSxTQUFTO1FBQ3JFLEVBQUUsRUFBRSxJQUFJO1FBQ1IsUUFBUSxFQUFFLENBQUMscUJBQXFCLEVBQUUsa0JBQWtCLEVBQUUsV0FBVyxDQUFDO1FBQ2xFLFNBQVMsRUFBRSxhQUFhO1FBQ3hCLFVBQVUsRUFBRSxjQUFjO0tBQzNCLENBQUM7SUFDRixNQUFNLFFBQVEsR0FBRyxNQUFNLG9CQUFvQixDQUFDLFlBQVksQ0FBQyxjQUFjLENBQUMsQ0FBQztJQUV6RSxNQUFNLEdBQUcsR0FBRyxrQkFBa0IsQ0FBQyx5QkFBeUIsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNuRSxHQUFHLENBQUM7SUFFSixNQUFNLFlBQVksR0FBRyxNQUFNLG9CQUFvQixDQUFDLFlBQVksQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0lBQ2pGLE1BQU0sa0JBQWtCLEdBQXVCO1FBQzdDLE9BQU8sRUFBRSxRQUFRO1FBQ2pCLE1BQU0sRUFBRSxXQUFXO1FBQ25CLFVBQVUsRUFBRSxZQUFZLENBQUMsVUFBVTtRQUNuQyxRQUFRLEVBQUUsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLEdBQUcsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxJQUFJLENBQUMsRUFBRSxTQUFTO1FBQ3JFLEVBQUUsRUFBRSxJQUFJO1FBQ1IsUUFBUSxFQUFFLENBQUMscUJBQXFCLEVBQUUsa0JBQWtCLENBQUM7UUFDckQsZ0JBQWdCLEVBQUU7WUFDaEI7Z0JBQ0UsR0FBRyxFQUFFLDhCQUE4QjtnQkFDbkMsS0FBSyxFQUFFLG9CQUFxQjthQUM3QjtZQUNEO2dCQUNFLEdBQUcsRUFBRSxvQkFBb0I7Z0JBQ3pCLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUM7YUFDbEM7WUFDRDtnQkFDRSxHQUFHLEVBQUUsb0JBQW9CO2dCQUN6QixLQUFLLEVBQUUsU0FBVTthQUNsQjtTQUNGO1FBQ0QsU0FBUyxFQUFFLFlBQVksQ0FBQyxTQUFTO0tBQ2xDLENBQUM7SUFDRixNQUFNLFlBQVksR0FBRyxNQUFNLG9CQUFvQixDQUFDLFlBQVksQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0lBRWpGLE1BQU0sWUFBWSxHQUFHLE1BQU0sb0JBQW9CLENBQUMsWUFBWSxDQUFDLGtCQUFrQixDQUFDLENBQUM7SUFDakYsTUFBTSx1QkFBdUIsR0FBdUI7UUFDbEQsT0FBTyxFQUFFLFFBQVE7UUFDakIsTUFBTSxFQUFFLFFBQVE7UUFDaEIsVUFBVSxFQUFFLFlBQVksQ0FBQyxVQUFVO1FBQ25DLFFBQVEsRUFBRSxJQUFJLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsR0FBRyxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQyxFQUFFLFNBQVM7UUFDckUsRUFBRSxFQUFFLEtBQUs7UUFDVCxRQUFRLEVBQUUsQ0FBQyxxQkFBcUIsRUFBRSxrQkFBa0IsQ0FBQztRQUNyRCxnQkFBZ0IsRUFBRTtZQUNoQjtnQkFDRSxHQUFHLEVBQUUsaUNBQWlDO2dCQUN0QyxLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDO2FBQ2xDO1lBQ0Q7Z0JBQ0UsR0FBRyxFQUFFLG9CQUFvQjtnQkFDekIsS0FBSyxFQUFFLFNBQVU7YUFDbEI7U0FDRjtRQUNELFNBQVMsRUFBRSxZQUFZLENBQUMsU0FBUztLQUNsQyxDQUFDO0lBQ0YsTUFBTSxpQkFBaUIsR0FBRyxNQUFNLG9CQUFvQixDQUFDLFlBQVksQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDO0lBRTNGLDRGQUE0RjtJQUM1RixvR0FBb0c7SUFDcEcsNERBQTREO0lBQzVELHNEQUFzRDtJQUN0RCxLQUFLO0lBRUwsTUFBTSxRQUFRLEdBQUcsQ0FBQyxpQkFBaUIsRUFBRSxZQUFZLENBQUMsQ0FBQztJQUVuRCxNQUFNLGNBQWMsR0FBRyxNQUFNLGtCQUFrQixDQUFDLGlCQUFpQixDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUN0RixPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsY0FBYyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBRXJELE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsa0JBQWtCLGtCQUFrQixNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzFGLE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsc0JBQXNCLGtCQUFrQixNQUFNLEVBQUUsWUFBWSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ2xHLE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQ3pCLHNCQUFzQixrQkFBa0IsTUFBTSxFQUM5QyxpQkFBaUIsRUFDakIsTUFBTSxDQUNQLENBQUM7QUFDSixDQUFDLENBQUMsRUFBRSxDQUFDIn0=

package/dist/mjs/certificates/types.d.ts

@@ -40,6 +40,10 @@ export type GenerateCertParams = PemOrCryptoKeys & {
     dnsNames?: string[];
     ca?: boolean;
     ocspSigning?: boolean;
+    ocspExtension?: {
+        ocspUrl: string;
+        issuerCertUrl?: string;
+    };
     customExtensions?: CustomExtension[];
 };
 export type GenerateCsrParams = PemOrCryptoKeys & {
@@ -54,7 +58,7 @@ export type ParsedCsr = {
     dnsNames?: string[];
 };
 export type ParsedCert = {
-    serialNumber: string;
+    serialNumberHex: string;
     publicKey: CryptoKey;
     subject: string;
     issuer: string;
@@ -79,3 +83,29 @@ export type CertBinaryItem = {
     oid?: string;
     value: Uint8Array;
 };
+export type OcspCertData = {
+    issuerNameHash: ArrayBuffer;
+    issuerKeyHash: ArrayBuffer;
+    serialNumber: ArrayBuffer;
+    extensionsToCheck: CustomExtension[];
+    hashAlgorithm: string;
+};
+export type ParsedOcspRequest = {
+    certRequests: OcspCertData[];
+    nonce?: ArrayBuffer;
+};
+export declare enum OcspCertStatus {
+    OK = 0,
+    Revoked = 1,
+    Unknown = 2
+}
+export type GenerateOcspResponseParams = {
+    issuerPem: string;
+    caCertsPem?: string;
+    certs: Array<Omit<OcspCertData, 'extensionsToCheck'> & {
+        status: OcspCertStatus;
+        revocationDate?: Date;
+    }>;
+    privateKey: string;
+    nonce?: ArrayBuffer;
+};

package/dist/mjs/certificates/types.js

@@ -1,2 +1,7 @@
-export {};
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvY2VydGlmaWNhdGVzL3R5cGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==
+export var OcspCertStatus;
+(function (OcspCertStatus) {
+    OcspCertStatus[OcspCertStatus["OK"] = 0] = "OK";
+    OcspCertStatus[OcspCertStatus["Revoked"] = 1] = "Revoked";
+    OcspCertStatus[OcspCertStatus["Unknown"] = 2] = "Unknown";
+})(OcspCertStatus || (OcspCertStatus = {}));
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvY2VydGlmaWNhdGVzL3R5cGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQWdIQSxNQUFNLENBQU4sSUFBWSxjQUlYO0FBSkQsV0FBWSxjQUFjO0lBQ3hCLCtDQUFNLENBQUE7SUFDTix5REFBVyxDQUFBO0lBQ1gseURBQVcsQ0FBQTtBQUNiLENBQUMsRUFKVyxjQUFjLEtBQWQsY0FBYyxRQUl6QiJ9