X.509 chain (CA-bit issuer test)

The basicConstraints-enforcing issuer test the framework's own certificate-chain walkers route through (b.tsa.verifyToken, b.mail.bimi VMC/CMC, b.mail.crypto.smime, b.mdoc, b.contentCredentials, b.auth.fido). It exists because node:crypto's X509Certificate.checkIssued() validates the issuer/subject DN match, the AKI/SKI linkage, and — only when a keyUsage extension is present — keyCertSign, but it does not enforce basicConstraints cA:TRUE. A leaf / end-entity certificate (cA:FALSE) that omits keyUsage is therefore wrongly accepted as a signing CA for the next certificate in the chain — the classic basicConstraints bypass (CVE-2002-0862 class). Every in-tree walker routes its issuer test through these helpers so the cA enforcement can never be forgotten in one walker but present in another.

Exposed so a consumer validating an X.509 chain outside a TLS handshake — an operator-uploaded CA bundle, a non-handshake PQ-signed certificate — has the same hardened, fail-closed test instead of being pushed toward the raw checkIssued() path this module exists to prevent. Both helpers fail closed: any malformed input or unsupported key type returns false rather than throwing.

b.x509Chain.isCaCert(cert) #

True only when cert asserts basicConstraints cA:TRUE. node's X509Certificate exposes .ca (a boolean); a certificate with no basicConstraints extension or with cA:FALSE returns false. A missing cert or a non-boolean .ca (parse failure / unsupported runtime) fails closed to false.

var crypto = require("crypto");
var ca = new crypto.X509Certificate(caPem);
b.x509Chain.isCaCert(ca);   // → true only if basicConstraints cA:TRUE

b.x509Chain.issuerValidlyIssued(issuer, subject) #

True when issuer validly issued subject AND is itself a CA: the DN / AKI-SKI / keyUsage linkage (checkIssued), the cryptographic signature (verify), and basicConstraints cA:TRUE (isCaCert). The cA check runs first so a non-CA certificate is rejected before the expensive signature verification. Any exception (malformed cert, unsupported key type) fails closed to false.

var crypto = require("crypto");
var issuer  = new crypto.X509Certificate(issuerPem);
var subject = new crypto.X509Certificate(leafPem);
b.x509Chain.issuerValidlyIssued(issuer, subject);   // → boolean

Last updated 2026-08-08T16:39:49.652Z by seeder.