VerifyCertificateChainInput

Input for verifyCertificateChain. Combines path-building, validation, and identity options.

interface VerifyCertificateChainInput extends PolicyValidationInput, InitialNameConstraintsInput {
	readonly policy?: PolicyValidationInput;
	readonly nameConstraints?: InitialNameConstraintsInput;
	readonly leaf: CertificateSource;
	readonly intermediates?: readonly CertificateSource[];
	readonly roots: readonly CertificateSource[];
	readonly trustAnchors?: readonly TrustAnchor[];
	readonly at?: Date;
	readonly purpose?: VerifyPurpose;
	readonly serviceIdentity?: ServiceIdentityInput;
	readonly allowSelfSignedLeaf?: boolean;
	readonly revocation?: ChainRevocationInput;
}

Properties

• readonly policy?: PolicyValidationInput — Nested policy validation overrides.
• readonly nameConstraints?: InitialNameConstraintsInput — Nested name constraint overrides.
• readonly leaf: CertificateSource — End-entity certificate to verify.
• readonly intermediates?: readonly CertificateSource[] — Intermediate CA certificates available for path building.
• readonly roots: readonly CertificateSource[] — Trusted root CA certificates.
• readonly trustAnchors?: readonly TrustAnchor[] — Bare trust anchors to try when no root certificate matches.
• readonly at?: Date — Validation time. Defaults to new Date().
• readonly purpose?: VerifyPurpose — Leaf purpose constraint to enforce during validation.
• readonly serviceIdentity?: ServiceIdentityInput — DNS/IP/URI/SRV identity to match against the leaf's SAN.
• readonly allowSelfSignedLeaf?: boolean — When true, allows a self-signed leaf. Defaults to false.
• readonly revocation?: ChainRevocationInput — Optional revocation checking.