Skip to main content

X509ChainBuilder

Represents a chain-building engine for X509Certificate certificates

Example​

const chain = new x509.X509ChainBuilder({
  certificates: [
    new x509.X509Certificate(raw1),
    new x509.X509Certificate(raw2),
    // ...
    new x509.X509Certificate(rawN),
  ],
});

const cert = x509.X509Certificate(raw);
const items = await chain.build(cert);

Constructors​

Constructor​

new X509ChainBuilder(params?): X509ChainBuilder

Parameters​

params?​

X509ChainBuilderParams = {}

Returns​

X509ChainBuilder

Properties​

certificates​

certificates: X509Certificate[] = []

defaultLimits​

readonly static defaultLimits: Readonly<Required<X509ChainSearchLimits>>

Frozen defaults for buildToAnchor(); existing build() calls do not use these limits.

Methods​

build()​

build(cert, crypto?): Promise<X509Certificates>

Parameters​

cert​

X509Certificate

crypto?​

Crypto = ...

Returns​

Promise<X509Certificates>

buildToAnchor()​

buildToAnchor(cert, params, crypto?): Promise<X509Certificates>

Finds a signature-verified path from cert to any explicitly trusted anchor, including both endpoints. Searches alternative branches in deterministic depth-first order: anchors, AKI/SKI matches, then other same-name issuers, with complete DER as the tie-breaker. Identifiers are hints, not hard constraints. Determinism applies to the DER path; DER-identical objects are represented by the first instance added. Issuer names must have equal subject/issuer string representations; full X.500 name matching is not performed. Does not validate dates, CA constraints, usage, policies, or revocation. Partial paths are never returned.

Parameters​

cert​

X509Certificate

Starting certificate

params​

X509ChainBuildToAnchorParams

Trusted endpoints, resource limits, and optional cooperative cancellation

crypto?​

Crypto = ...

WebCrypto provider. Default is from CryptoProvider

Returns​

Promise<X509Certificates>

Throws​

X509ChainBuildError when no confirmed path is found or a limit prevents completion

Throws​

TypeError for missing, empty, or malformed anchors; RangeError for invalid limits

Throws​

The signal's reason on cancellation. An in-flight WebCrypto operation is not interrupted.