Class CertificateList

X.509 Certificate Revocation List (CRL) implementation.

A CRL is a time-stamped list identifying revoked certificates that is signed by a CA. CRLs are used to check if a certificate has been revoked before relying on it. Each CRL has a validity period and contains information about when the next update will be available.

Asn

CertificateList ::= SEQUENCE { tbsCertList TBSCertList, signatureAlgorithm AlgorithmIdentifier, signatureValue BIT STRING }

Example

// Create an empty CRL
const crl = await CertificateList.createEmpty({
    issuer: caName,
    privateKey: caPrivateKey,
    signatureAlgorithmParams: { type: 'RSASSA_PKCS1_v1_5', params: { hash: 'SHA-256' } }
})

// Load CRL from PEM
const crlFromPem = CertificateList.fromPem(pemString)

// Fetch CRL from URL
const crlFromUrl = await CertificateList.fetch('http://example.com/ca.crl')

// Check if certificate is revoked
const isRevoked = crl.tbsCertList.isRevoked(certificate.tbsCertificate.serialNumber)

See

RFC 5280 Section 5 - CRL and CRL Extensions Profile

Hierarchy (View Summary)

PkiBase<CertificateList>
- CertificateList

Index

Constructors

constructor

new CertificateList(
    options: {
        signatureAlgorithm: AlgorithmIdentifier;
        signatureValue: Uint8Array<ArrayBufferLike> | BitString;
        tbsCertList: TBSCertList;
    },
): CertificateList
Creates a new CertificateList instance.
Parameters
- options: {
      signatureAlgorithm: AlgorithmIdentifier;
      signatureValue: Uint8Array<ArrayBufferLike> | BitString;
      tbsCertList: TBSCertList;
  }
  Configuration object
  - signatureAlgorithm: AlgorithmIdentifier
    The signature algorithm
  - signatureValue: Uint8Array<ArrayBufferLike> | BitString
    The signature bytes or BitString
  - tbsCertList: TBSCertList
    The TBS certificate list
Returns CertificateList
Example
```
const crl = new CertificateList({
    tbsCertList,
    signatureAlgorithm,
    signatureValue: signatureBytes
})
```
Overrides PkiBase.constructor
- Defined in packages/pki-lite/src/x509/CertificateList.ts:78

Properties

signatureAlgorithm

signatureAlgorithm: AlgorithmIdentifier

Algorithm used to sign the CRL

signatureValue

signatureValue: BitString

Digital signature over the TBS CRL

tbsCertList

tbsCertList: TBSCertList

The TBS (To Be Signed) portion of the CRL containing the revocation list

Accessors

pemHeader

get pemHeader(): string
Gets the PEM header for CRL encoding.

Returns string
The PEM header string
Overrides PkiBase.pemHeader
- Defined in packages/pki-lite/src/x509/CertificateList.ts:96

pkiType

get pkiType(): string
Gets the PKI type name for this object (typically the class name). Used for PEM headers and debugging output.

Returns string
Inherited from PkiBase.pkiType
- Defined in packages/pki-lite/src/core/PkiBase.ts:52

Methods

equals

equals(other: PkiBase<any>): boolean
Compares this PKI object with another for equality. Two objects are considered equal if their DER encodings are identical.
Parameters
- other: PkiBase<any>
  The other PKI object to compare with
Returns boolean
true if the objects are equal, false otherwise
Inherited from PkiBase.equals
- Defined in packages/pki-lite/src/core/PkiBase.ts:122

parseAs

parseAs<T>(type: ParseableAsn1<T>): T
Parses this object as a different PKI type. Useful for converting between related PKI structures.
Type Parameters
- T
  The target type to parse as
Parameters
- type: ParseableAsn1<T>
  The target type constructor with parsing capabilities
Returns T
A new instance of the target type
Inherited from PkiBase.parseAs
- Defined in packages/pki-lite/src/core/PkiBase.ts:134

toAsn1

toAsn1(): Asn1BaseBlock
Converts the CRL to its ASN.1 representation.

Returns Asn1BaseBlock
ASN.1 structure representing the CRL
Example
```
const asn1 = crl.toAsn1()
const der = asn1.toBER(false) // Convert to DER encoding
```
Overrides PkiBase.toAsn1
- Defined in packages/pki-lite/src/x509/CertificateList.ts:185

toDer

toDer(): Uint8Array
Converts this PKI object to DER (Distinguished Encoding Rules) format.

Returns Uint8Array
The DER-encoded bytes of this object
Inherited from PkiBase.toDer
- Defined in packages/pki-lite/src/core/PkiBase.ts:100

toHumanString

toHumanString(): string
Returns a human-readable string representation of this object. By default, returns the same as toString(), but subclasses can override for more user-friendly output.

Returns string
A human-readable string representation
Inherited from PkiBase.toHumanString
- Defined in packages/pki-lite/src/core/PkiBase.ts:90

toJSON

toJSON(): ToJson<T>
Converts this object to a JSON representation.

Returns ToJson<T>
A JSON-serializable representation of this object
Inherited from PkiBase.toJSON
- Defined in packages/pki-lite/src/core/PkiBase.ts:69

toPem

toPem(): string
Converts this PKI object to PEM (Privacy-Enhanced Mail) format.

Returns string
A PEM-encoded string with appropriate headers
Inherited from PkiBase.toPem
- Defined in packages/pki-lite/src/core/PkiBase.ts:109

toString

toString(): string
Returns a string representation of this PKI object. Includes the type name and ASN.1 structure.

Returns string
A string representation for debugging
Inherited from PkiBase.toString
- Defined in packages/pki-lite/src/core/PkiBase.ts:79

`Static`createEmpty

createEmpty(
    options: {
        issuer: RDNSequence;
        privateKey: PrivateKeyInfo;
        signatureAlgorithmParams?: AsymmetricEncryptionAlgorithmParams;
    },
): Promise<CertificateList>
Creates an empty CRL with no revoked certificates.

This method is useful for initializing a new CRL or for testing purposes. The created CRL will have a validity period of 30 days by default.
Parameters
- options: {
      issuer: RDNSequence;
      privateKey: PrivateKeyInfo;
      signatureAlgorithmParams?: AsymmetricEncryptionAlgorithmParams;
  }
  Configuration for the empty CRL
  - issuer: RDNSequence
    The name of the CA issuing the CRL
  - privateKey: PrivateKeyInfo
    The CA's private key for signing
  - OptionalsignatureAlgorithmParams?: AsymmetricEncryptionAlgorithmParams
    Optional signature algorithm, defaults to RSA-SHA256
Returns Promise<CertificateList>
Promise resolving to the created empty CRL
Example
```
const emptyCrl = await CertificateList.createEmpty({
    issuer: new Name({ commonName: 'Test CA' }),
    privateKey: caPrivateKey,
    signatureAlgorithmParams: {
        type: 'RSASSA_PKCS1_v1_5',
        params: { hash: 'SHA-384' }
    }
})

// CRL is valid for 30 days from creation
console.log(emptyCrl.tbsCertList.thisUpdate) // Current time
console.log(emptyCrl.tbsCertList.nextUpdate) // 30 days later
```
- Defined in packages/pki-lite/src/x509/CertificateList.ts:128

`Static`fetch

fetch(url: string): Promise<CertificateList>
Fetches a CRL from a URL and parses it.

This is commonly used to retrieve CRLs from Certificate Distribution Points specified in X.509 certificates.
Parameters
- url: string
  The URL to fetch the CRL from
Returns Promise<CertificateList>
Promise resolving to the fetched and parsed CRL
Throws
Error if the HTTP request fails or CRL parsing fails
Example
```
// Fetch CRL from a CA's distribution point
const crl = await CertificateList.fetch('http://crl.example.com/ca.crl')

// Check certificate status
const serialNumber = certificate.tbsCertificate.serialNumber
if (crl.tbsCertList.isRevoked(serialNumber)) {
    console.log('Certificate is revoked')
}
```
- Defined in packages/pki-lite/src/x509/CertificateList.ts:322

`Static`fromAsn1

fromAsn1(asn1: Asn1BaseBlock): CertificateList
Creates a CertificateList from an ASN.1 structure.

Parses the ASN.1 SEQUENCE structure and extracts the TBS certificate list, signature algorithm, and signature value components.
Parameters
- asn1: Asn1BaseBlock
  The ASN.1 structure to parse
Returns CertificateList
The parsed CertificateList object
Throws
Asn1ParseError if the ASN.1 structure is invalid
Example
```
const asn1 = derToAsn1(crlBytes)
const crl = CertificateList.fromAsn1(asn1)
```
- Defined in packages/pki-lite/src/x509/CertificateList.ts:212

`Static`fromDer

fromDer(der: Uint8Array): CertificateList
Creates a CertificateList from DER-encoded bytes.
Parameters
- der: Uint8Array
  The DER-encoded CRL bytes
Returns CertificateList
The parsed CertificateList
Throws
Error if DER parsing fails
Example
```
const crl = CertificateList.fromDer(crlBytes)
```
- Defined in packages/pki-lite/src/x509/CertificateList.ts:274

`Static`fromPem

fromPem(pem: string): CertificateList
Creates a CertificateList from PEM-encoded text.
Parameters
- pem: string
  The PEM-encoded CRL string
Returns CertificateList
The parsed CertificateList
Throws
Error if PEM parsing fails
Example
```
const pemCrl = `
-----BEGIN X509 CRL-----
MIIBzDCBtQIBATANBgkqhkiG9w0BAQsFADBeMQswCQYDVQQGEwJVUzELMAkGA1UE
...
-----END X509 CRL-----`

const crl = CertificateList.fromPem(pemCrl)
```
- Defined in packages/pki-lite/src/x509/CertificateList.ts:296

Class CertificateList

Asn

Example

See

Hierarchy (View Summary)

Index

Constructors

Properties

Accessors

Methods

Constructors

constructor

Parameters

signatureAlgorithm: AlgorithmIdentifier

signatureValue: Uint8Array<ArrayBufferLike> | BitString

tbsCertList: TBSCertList

Returns CertificateList

Example

Properties

signatureAlgorithm

signatureValue

tbsCertList

Accessors

pemHeader

Returns string

pkiType

Returns string

Methods

equals

Parameters

Returns boolean

parseAs

Type Parameters

Parameters

Returns T

toAsn1

Returns Asn1BaseBlock

Example

toDer

Returns Uint8Array

toHumanString

Returns string

toJSON

Returns ToJson<T>

toPem

Returns string

toString

Returns string

StaticcreateEmpty

Parameters

issuer: RDNSequence

privateKey: PrivateKeyInfo

OptionalsignatureAlgorithmParams?: AsymmetricEncryptionAlgorithmParams

Returns Promise<CertificateList>

Example

Staticfetch

Parameters

Returns Promise<CertificateList>

Throws

Example

StaticfromAsn1

Parameters

Returns CertificateList

Throws

Example

StaticfromDer

Parameters

Returns CertificateList

Throws

Example

StaticfromPem

Parameters

Returns CertificateList

Throws

Example

Settings

On This Page

`Static`createEmpty

`Optional`signatureAlgorithmParams?: AsymmetricEncryptionAlgorithmParams

`Static`fetch

`Static`fromAsn1

`Static`fromDer

`Static`fromPem