diff --git a/api/files.html b/api/files.html
index 21039485..b5874659 100644
--- a/api/files.html
+++ b/api/files.html
@@ -896,7 +896,7 @@
Version:
- jsrsasign 10.8.4 x509 2.1.4 (2023-Apr-26)
+ jsrsasign 10.8.6 x509 2.1.6 (2023-Apr-26)
diff --git a/api/symbols/src/x509-1.1.js.html b/api/symbols/src/x509-1.1.js.html
index c5f91063..b2c1c1bc 100644
--- a/api/symbols/src/x509-1.1.js.html
+++ b/api/symbols/src/x509-1.1.js.html
@@ -5,7 +5,7 @@
.STRN {color: #393;}
.REGX {color: #339;}
.line {border-right: 1px dotted #666; color: #666; font-style: normal;}
- 1 /* x509-2.1.4.js (c) 2012-2023 Kenji Urushima | kjur.github.io/jsrsasign/license
+ 1 /* x509-2.1.6.js (c) 2012-2023 Kenji Urushima | kjur.github.io/jsrsasign/license
2 */
3 /*
4 * x509.js - X509 class to read subject public key from certificate.
@@ -23,7 +23,7 @@
16 * @fileOverview
17 * @name x509-1.1.js
18 * @author Kenji Urushima kenji.urushima@gmail.com
- 19 * @version jsrsasign 10.8.4 x509 2.1.4 (2023-Apr-26)
+ 19 * @version jsrsasign 10.8.6 x509 2.1.6 (2023-Apr-26)
20 * @since jsrsasign 1.x.x
21 * @license <a href="https://kjur.github.io/jsrsasign/license/">MIT License</a>
22 */
@@ -2606,1340 +2606,1342 @@
2599 if (critical) result.critical = true;
2600 try {
2601 var pASN1 = _ASN1HEX_parse(hExtV);
-2602 for (var i = 0; i < pASN1.seq.length; i++) {
-2603 var aASN1Attribute = pASN1.seq[i];
-2604 var attrType = aryval(aASN1Attribute, "0.oid");
-2605 var attrValue = aryval(aASN1Attribute, "1.set");
-2606 return { attr: attrType, array: attrValue };
-2607 }
-2608 result.array = aValue;
-2609 return result;
-2610 } catch(ex) {
-2611 throw new Error("malformed subjectDirectoryAttributes extension value");
-2612 }
-2613 }
-2614
-2615 // ===== BEGIN X500Name related =====================================
-2616 /*
-2617 * convert ASN.1 parsed object to attrTypeAndValue assoc array<br/>
-2618 * @name _convATV
-2619 * @param p associative array of parsed attrTypeAndValue object
-2620 * @return attrTypeAndValue associative array
-2621 * @since jsrsasign 10.5.12 x509 2.0.14
-2622 * @example
-2623 * _convATV({seq: [...]} &rarr: {type:"C",value:"JP",ds:"prn"}
-2624 */
-2625 var _convATV = function(p) {
-2626 var result = {};
-2627 try {
-2628 var name = p.seq[0].oid;
-2629 var oid = KJUR.asn1.x509.OID.name2oid(name);
-2630 result.type = KJUR.asn1.x509.OID.oid2atype(oid);
-2631 var item1 = p.seq[1];
-2632 if (item1.utf8str != undefined) {
-2633 result.ds = "utf8";
-2634 result.value = item1.utf8str.str;
-2635 } else if (item1.numstr != undefined) {
-2636 result.ds = "num";
-2637 result.value = item1.numstr.str;
-2638 } else if (item1.telstr != undefined) {
-2639 result.ds = "tel";
-2640 result.value = item1.telstr.str;
-2641 } else if (item1.prnstr != undefined) {
-2642 result.ds = "prn";
-2643 result.value = item1.prnstr.str;
-2644 } else if (item1.ia5str != undefined) {
-2645 result.ds = "ia5";
-2646 result.value = item1.ia5str.str;
-2647 } else if (item1.visstr != undefined) {
-2648 result.ds = "vis";
-2649 result.value = item1.visstr.str;
-2650 } else if (item1.bmpstr != undefined) {
-2651 result.ds = "bmp";
-2652 result.value = item1.bmpstr.str;
-2653 } else {
-2654 throw "error";
-2655 }
-2656 return result;
-2657 } catch(ex) {
-2658 throw new Erorr("improper ASN.1 parsed AttrTypeAndValue");
-2659 }
-2660 };
-2661
-2662 /*
-2663 * convert ASN.1 parsed object to RDN array<br/>
-2664 * @name _convRDN
-2665 * @param p associative array of parsed RDN object
-2666 * @return RDN array
-2667 * @since jsrsasign 10.5.12 x509 2.0.14
-2668 * @example
-2669 * _convRDN({set: [...]} &rarr: [{type:"C",value:"JP",ds:"prn"}]
-2670 */
-2671 var _convRDN = function(p) {
-2672 try {
-2673 return p.set.map(function(pATV){return _convATV(pATV)});
-2674 } catch(ex) {
-2675 throw new Error("improper ASN.1 parsed RDN: " + ex);
-2676 }
-2677 };
-2678
-2679 /*
-2680 * convert ASN.1 parsed object to X500Name array<br/>
-2681 * @name _convX500Name
-2682 * @param p associative array of parsed X500Name array object
-2683 * @return RDN array
-2684 * @since jsrsasign 10.5.12 x509 2.0.14
-2685 * @example
-2686 * _convX500Name({seq: [...]} &rarr: [[{type:"C",value:"JP",ds:"prn"}]]
-2687 */
-2688 var _convX500Name = function(p) {
-2689 try {
-2690 return p.seq.map(function(pRDN){return _convRDN(pRDN)});
-2691 } catch(ex) {
-2692 throw new Error("improper ASN.1 parsed X500Name: " + ex);
-2693 }
-2694 };
-2695
-2696 this.getX500NameRule = function(aDN) {
-2697 var isPRNRule = true;
-2698 var isUTF8Rule = true;
-2699 var isMixedRule = false;
-2700 var logfull = "";
-2701 var logcheck = "";
-2702 var lasttag = null;
-2703
-2704 var a = [];
-2705 for (var i = 0; i < aDN.length; i++) {
-2706 var aRDN = aDN[i];
-2707 for (var j = 0; j < aRDN.length; j++) {
-2708 a.push(aRDN[j]);
-2709 }
-2710 }
-2711
-2712 for (var i = 0; i < a.length; i++) {
-2713 var item = a[i];
-2714 var tag = item.ds;
-2715 var value = item.value;
-2716 var type = item.type;
-2717 logfull += ":" + tag;
-2718
-2719 if (tag != "prn" && tag != "utf8" && tag != "ia5") {
-2720 return "mixed";
-2721 }
-2722 if (tag == "ia5") {
-2723 if (type != "CN") {
-2724 return "mixed";
-2725 } else {
-2726 if (! KJUR.lang.String.isMail(value)) {
-2727 return "mixed";
-2728 } else {
-2729 continue;
-2730 }
-2731 }
-2732 }
-2733 if (type == "C") {
-2734 if (tag == "prn") {
-2735 continue;
-2736 } else {
-2737 return "mixed";
-2738 }
-2739 }
-2740 logcheck += ":" + tag;
-2741 if (lasttag == null) {
-2742 lasttag = tag;
-2743 } else {
-2744 if (lasttag !== tag) return "mixed";
-2745 }
-2746 }
-2747 if (lasttag == null) {
-2748 return "prn";
-2749 } else {
-2750 return lasttag;
-2751 }
-2752 };
-2753
-2754 /**
-2755 * get AttributeTypeAndValue ASN.1 structure parameter as JSON object<br/>
-2756 * @name getAttrTypeAndValue
-2757 * @memberOf X509#
-2758 * @function
-2759 * @param {String} h hexadecimal string of AttributeTypeAndValue
-2760 * @return {Object} JSON object of AttributeTypeAndValue parameters
-2761 * @since jsrsasign 9.0.0 x509 2.0.0
-2762 * @see X509#getX500Name
-2763 * @see X509#getRDN
-2764 * @description
-2765 * This method will get AttributeTypeAndValue parameters defined in
-2766 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.4">
-2767 * RFC 5280 4.1.2.4</a>.
-2768 * <pre>
-2769 * AttributeTypeAndValue ::= SEQUENCE {
-2770 * type AttributeType,
-2771 * value AttributeValue }
-2772 * AttributeType ::= OBJECT IDENTIFIER
-2773 * AttributeValue ::= ANY -- DEFINED BY AttributeType
-2774 * </pre>
-2775 * <ul>
-2776 * <li>{String}type - AttributeType name or OID(ex. C,O,CN)</li>
-2777 * <li>{String}value - raw string of ASN.1 value of AttributeValue</li>
-2778 * <li>{String}ds - DirectoryString type of AttributeValue</li>
-2779 * </ul>
-2780 * "ds" has one of following value:
-2781 * <ul>
-2782 * <li>utf8 - (0x0c) UTF8String</li>
-2783 * <li>num - (0x12) NumericString</li>
-2784 * <li>prn - (0x13) PrintableString</li>
-2785 * <li>tel - (0x14) TeletexString</li>
-2786 * <li>ia5 - (0x16) IA5String</li>
-2787 * <li>vis - (0x1a) VisibleString</li>
-2788 * <li>bmp - (0x1e) BMPString</li>
-2789 * </ul>
-2790 * @example
-2791 * x = new X509();
-2792 * x.getAttrTypeAndValue("30...") →
-2793 * {type:"CN",value:"john.smith@example.com",ds:"ia5"} or
-2794 * {type:"O",value:"Sample Corp.",ds:"prn"}
-2795 */
-2796 // unv - (0x1c??) UniversalString ... for future
-2797 this.getAttrTypeAndValue = function(h) {
-2798 var p = _ASN1HEX_parse(h);
-2799 return _convATV(p);
-2800 };
-2801
-2802 /**
-2803 * get RelativeDistinguishedName ASN.1 structure parameter array<br/>
-2804 * @name getRDN
-2805 * @memberOf X509#
-2806 * @function
-2807 * @param {String} h hexadecimal string of RDN
-2808 * @return {Array} array of AttrTypeAndValue parameters
-2809 * @since jsrsasign 9.0.0 x509 2.0.0
-2810 * @see X509#getX500Name
-2811 * @see X509#getRDN
-2812 * @see X509#getAttrTypeAndValue
-2813 * @description
-2814 * This method will get RelativeDistinguishedName parameters defined in
-2815 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.4">
-2816 * RFC 5280 4.1.2.4</a>.
-2817 * <pre>
-2818 * RelativeDistinguishedName ::=
-2819 * SET SIZE (1..MAX) OF AttributeTypeAndValue
-2820 * </pre>
-2821 * @example
-2822 * x = new X509();
-2823 * x.getRDN("31...") →
-2824 * [{type:"C",value:"US",ds:"prn"}] or
-2825 * [{type:"O",value:"Sample Corp.",ds:"prn"}] or
-2826 * [{type:"CN",value:"john.smith@example.com",ds:"ia5"}]
-2827 */
-2828 this.getRDN = function(h) {
-2829 var p = _ASN1HEX_parse(h);
-2830 return _convRDN(p);
-2831 };
-2832
-2833 /**
-2834 * get X.500 Name ASN.1 structure parameter array<br/>
-2835 * @name getX500NameArray
-2836 * @memberOf X509#
-2837 * @function
-2838 * @param {String} h hexadecimal string of Name
-2839 * @return {Array} array of RDN parameter array
-2840 * @since jsrsasign 10.0.6 x509 2.0.9
-2841 * @see X509#getX500Name
-2842 * @see X509#getRDN
-2843 * @see X509#getAttrTypeAndValue
-2844 * @description
-2845 * This method will get Name parameter defined in
-2846 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.4">
-2847 * RFC 5280 4.1.2.4</a>.
-2848 * <pre>
-2849 * Name ::= CHOICE { -- only one possibility for now --
-2850 * rdnSequence RDNSequence }
-2851 * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
-2852 * </pre>
-2853 * @example
-2854 * x = new X509();
-2855 * x.getX500NameArray("30...") →
-2856 * [[{type:"C",value:"US",ds:"prn"}],
-2857 * [{type:"O",value:"Sample Corp.",ds:"utf8"}],
-2858 * [{type:"CN",value:"john.smith@example.com",ds:"ia5"}]]
-2859 */
-2860 this.getX500NameArray = function(h) {
-2861 var p = _ASN1HEX_parse(h);
-2862 return _convX500Name(p);
-2863 };
-2864
-2865 /**
-2866 * get Name ASN.1 structure parameter array<br/>
-2867 * @name getX500Name
-2868 * @memberOf X509#
-2869 * @function
-2870 * @param {String} h hexadecimal string of Name
-2871 * @param {boolean} flagCanon flag to conclude canonicalized name (DEFAULT false)
-2872 * @param {boolean} flagHex flag to conclude hexadecimal string (DEFAULT false)
-2873 * @return {Array} array of RDN parameter array
-2874 * @since jsrsasign 9.0.0 x509 2.0.0
-2875 * @see X509#getX500NameArray
-2876 * @see X509#getRDN
-2877 * @see X509#getAttrTypeAndValue
-2878 * @see X509#c14nRDNArray
-2879 * @see KJUR.asn1.x509.X500Name
-2880 * @see KJUR.asn1.x509.GeneralName
-2881 * @see KJUR.asn1.x509.GeneralNames
-2882 *
-2883 * @description
-2884 * This method will get Name parameter defined in
-2885 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.4">
-2886 * RFC 5280 4.1.2.4</a>.
-2887 * <pre>
-2888 * Name ::= CHOICE { -- only one possibility for now --
-2889 * rdnSequence RDNSequence }
-2890 * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
-2891 * </pre>
-2892 * <br>
-2893 * NOTE: From jsrsasign 10.6.0, flagHex and flagCanon has been
-2894 * supported to conclude a canonicalized name for caseIgnoreMatch
-2895 * desribed in <a href="https://tools.ietf.org/html/rfc4518">
-2896 * RFC 4518</a>.
-2897 *
-2898 * @example
-2899 * x = new X509();
-2900 * x.getX500Name("30...") →
-2901 * { array: [
-2902 * [{type:"C",value:"US",ds:"prn"}],
-2903 * [{type:"O",value:"Sample Corp.",ds:"utf8"}],
-2904 * [{type:"CN",value:"john.smith@example.com",ds:"ia5"}]
-2905 * ],
-2906 * str: "/C=US/O=Sample Corp./CN=john.smith@example.com",
-2907 * hex: "30..." }
-2908 *
-2909 * x.getX500Name("30...", true) →
-2910 * { array: [
-2911 * [{type:"C",value:"US",ds:"prn"}],
-2912 * [{type:"O",value:"Sample Corp.",ds:"utf8"}]
-2913 * ],
-2914 * str: "/C=US/O=Sample Corp.",
-2915 * canon: "/c=us/o=sample corp.",
-2916 * hex: "30..." }
-2917 */
-2918 this.getX500Name = function(h, flagCanon, flagHex) {
-2919 var a = this.getX500NameArray(h);
-2920 var s = this.dnarraytostr(a);
-2921 var result = { str: s };
-2922
-2923 result.array = a;
-2924 if (flagHex == true) result.hex = h;
-2925 if (flagCanon == true) result.canon = this.c14nRDNArray(a);
-2926 return result;
-2927 };
-2928
-2929 // ===== END X500Name related =====================================
+2602 var aValue = [];
+2603 for (var i = 0; i < pASN1.seq.length; i++) {
+2604 var aASN1Attribute = pASN1.seq[i];
+2605 var attrType = aryval(aASN1Attribute, "seq.0.oid");
+2606 var attrValue = aryval(aASN1Attribute, "seq.1.set");
+2607 if (attrType == undefined || attrValue == undefined) throw "error";
+2608 aValue.push({ attr: attrType, array: attrValue });
+2609 }
+2610 result.array = aValue;
+2611 return result;
+2612 } catch(ex) {
+2613 throw new Error("malformed subjectDirectoryAttributes extension value");
+2614 }
+2615 }
+2616
+2617 // ===== BEGIN X500Name related =====================================
+2618 /*
+2619 * convert ASN.1 parsed object to attrTypeAndValue assoc array<br/>
+2620 * @name _convATV
+2621 * @param p associative array of parsed attrTypeAndValue object
+2622 * @return attrTypeAndValue associative array
+2623 * @since jsrsasign 10.5.12 x509 2.0.14
+2624 * @example
+2625 * _convATV({seq: [...]} &rarr: {type:"C",value:"JP",ds:"prn"}
+2626 */
+2627 var _convATV = function(p) {
+2628 var result = {};
+2629 try {
+2630 var name = p.seq[0].oid;
+2631 var oid = KJUR.asn1.x509.OID.name2oid(name);
+2632 result.type = KJUR.asn1.x509.OID.oid2atype(oid);
+2633 var item1 = p.seq[1];
+2634 if (item1.utf8str != undefined) {
+2635 result.ds = "utf8";
+2636 result.value = item1.utf8str.str;
+2637 } else if (item1.numstr != undefined) {
+2638 result.ds = "num";
+2639 result.value = item1.numstr.str;
+2640 } else if (item1.telstr != undefined) {
+2641 result.ds = "tel";
+2642 result.value = item1.telstr.str;
+2643 } else if (item1.prnstr != undefined) {
+2644 result.ds = "prn";
+2645 result.value = item1.prnstr.str;
+2646 } else if (item1.ia5str != undefined) {
+2647 result.ds = "ia5";
+2648 result.value = item1.ia5str.str;
+2649 } else if (item1.visstr != undefined) {
+2650 result.ds = "vis";
+2651 result.value = item1.visstr.str;
+2652 } else if (item1.bmpstr != undefined) {
+2653 result.ds = "bmp";
+2654 result.value = item1.bmpstr.str;
+2655 } else {
+2656 throw "error";
+2657 }
+2658 return result;
+2659 } catch(ex) {
+2660 throw new Erorr("improper ASN.1 parsed AttrTypeAndValue");
+2661 }
+2662 };
+2663
+2664 /*
+2665 * convert ASN.1 parsed object to RDN array<br/>
+2666 * @name _convRDN
+2667 * @param p associative array of parsed RDN object
+2668 * @return RDN array
+2669 * @since jsrsasign 10.5.12 x509 2.0.14
+2670 * @example
+2671 * _convRDN({set: [...]} &rarr: [{type:"C",value:"JP",ds:"prn"}]
+2672 */
+2673 var _convRDN = function(p) {
+2674 try {
+2675 return p.set.map(function(pATV){return _convATV(pATV)});
+2676 } catch(ex) {
+2677 throw new Error("improper ASN.1 parsed RDN: " + ex);
+2678 }
+2679 };
+2680
+2681 /*
+2682 * convert ASN.1 parsed object to X500Name array<br/>
+2683 * @name _convX500Name
+2684 * @param p associative array of parsed X500Name array object
+2685 * @return RDN array
+2686 * @since jsrsasign 10.5.12 x509 2.0.14
+2687 * @example
+2688 * _convX500Name({seq: [...]} &rarr: [[{type:"C",value:"JP",ds:"prn"}]]
+2689 */
+2690 var _convX500Name = function(p) {
+2691 try {
+2692 return p.seq.map(function(pRDN){return _convRDN(pRDN)});
+2693 } catch(ex) {
+2694 throw new Error("improper ASN.1 parsed X500Name: " + ex);
+2695 }
+2696 };
+2697
+2698 this.getX500NameRule = function(aDN) {
+2699 var isPRNRule = true;
+2700 var isUTF8Rule = true;
+2701 var isMixedRule = false;
+2702 var logfull = "";
+2703 var logcheck = "";
+2704 var lasttag = null;
+2705
+2706 var a = [];
+2707 for (var i = 0; i < aDN.length; i++) {
+2708 var aRDN = aDN[i];
+2709 for (var j = 0; j < aRDN.length; j++) {
+2710 a.push(aRDN[j]);
+2711 }
+2712 }
+2713
+2714 for (var i = 0; i < a.length; i++) {
+2715 var item = a[i];
+2716 var tag = item.ds;
+2717 var value = item.value;
+2718 var type = item.type;
+2719 logfull += ":" + tag;
+2720
+2721 if (tag != "prn" && tag != "utf8" && tag != "ia5") {
+2722 return "mixed";
+2723 }
+2724 if (tag == "ia5") {
+2725 if (type != "CN") {
+2726 return "mixed";
+2727 } else {
+2728 if (! KJUR.lang.String.isMail(value)) {
+2729 return "mixed";
+2730 } else {
+2731 continue;
+2732 }
+2733 }
+2734 }
+2735 if (type == "C") {
+2736 if (tag == "prn") {
+2737 continue;
+2738 } else {
+2739 return "mixed";
+2740 }
+2741 }
+2742 logcheck += ":" + tag;
+2743 if (lasttag == null) {
+2744 lasttag = tag;
+2745 } else {
+2746 if (lasttag !== tag) return "mixed";
+2747 }
+2748 }
+2749 if (lasttag == null) {
+2750 return "prn";
+2751 } else {
+2752 return lasttag;
+2753 }
+2754 };
+2755
+2756 /**
+2757 * get AttributeTypeAndValue ASN.1 structure parameter as JSON object<br/>
+2758 * @name getAttrTypeAndValue
+2759 * @memberOf X509#
+2760 * @function
+2761 * @param {String} h hexadecimal string of AttributeTypeAndValue
+2762 * @return {Object} JSON object of AttributeTypeAndValue parameters
+2763 * @since jsrsasign 9.0.0 x509 2.0.0
+2764 * @see X509#getX500Name
+2765 * @see X509#getRDN
+2766 * @description
+2767 * This method will get AttributeTypeAndValue parameters defined in
+2768 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.4">
+2769 * RFC 5280 4.1.2.4</a>.
+2770 * <pre>
+2771 * AttributeTypeAndValue ::= SEQUENCE {
+2772 * type AttributeType,
+2773 * value AttributeValue }
+2774 * AttributeType ::= OBJECT IDENTIFIER
+2775 * AttributeValue ::= ANY -- DEFINED BY AttributeType
+2776 * </pre>
+2777 * <ul>
+2778 * <li>{String}type - AttributeType name or OID(ex. C,O,CN)</li>
+2779 * <li>{String}value - raw string of ASN.1 value of AttributeValue</li>
+2780 * <li>{String}ds - DirectoryString type of AttributeValue</li>
+2781 * </ul>
+2782 * "ds" has one of following value:
+2783 * <ul>
+2784 * <li>utf8 - (0x0c) UTF8String</li>
+2785 * <li>num - (0x12) NumericString</li>
+2786 * <li>prn - (0x13) PrintableString</li>
+2787 * <li>tel - (0x14) TeletexString</li>
+2788 * <li>ia5 - (0x16) IA5String</li>
+2789 * <li>vis - (0x1a) VisibleString</li>
+2790 * <li>bmp - (0x1e) BMPString</li>
+2791 * </ul>
+2792 * @example
+2793 * x = new X509();
+2794 * x.getAttrTypeAndValue("30...") →
+2795 * {type:"CN",value:"john.smith@example.com",ds:"ia5"} or
+2796 * {type:"O",value:"Sample Corp.",ds:"prn"}
+2797 */
+2798 // unv - (0x1c??) UniversalString ... for future
+2799 this.getAttrTypeAndValue = function(h) {
+2800 var p = _ASN1HEX_parse(h);
+2801 return _convATV(p);
+2802 };
+2803
+2804 /**
+2805 * get RelativeDistinguishedName ASN.1 structure parameter array<br/>
+2806 * @name getRDN
+2807 * @memberOf X509#
+2808 * @function
+2809 * @param {String} h hexadecimal string of RDN
+2810 * @return {Array} array of AttrTypeAndValue parameters
+2811 * @since jsrsasign 9.0.0 x509 2.0.0
+2812 * @see X509#getX500Name
+2813 * @see X509#getRDN
+2814 * @see X509#getAttrTypeAndValue
+2815 * @description
+2816 * This method will get RelativeDistinguishedName parameters defined in
+2817 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.4">
+2818 * RFC 5280 4.1.2.4</a>.
+2819 * <pre>
+2820 * RelativeDistinguishedName ::=
+2821 * SET SIZE (1..MAX) OF AttributeTypeAndValue
+2822 * </pre>
+2823 * @example
+2824 * x = new X509();
+2825 * x.getRDN("31...") →
+2826 * [{type:"C",value:"US",ds:"prn"}] or
+2827 * [{type:"O",value:"Sample Corp.",ds:"prn"}] or
+2828 * [{type:"CN",value:"john.smith@example.com",ds:"ia5"}]
+2829 */
+2830 this.getRDN = function(h) {
+2831 var p = _ASN1HEX_parse(h);
+2832 return _convRDN(p);
+2833 };
+2834
+2835 /**
+2836 * get X.500 Name ASN.1 structure parameter array<br/>
+2837 * @name getX500NameArray
+2838 * @memberOf X509#
+2839 * @function
+2840 * @param {String} h hexadecimal string of Name
+2841 * @return {Array} array of RDN parameter array
+2842 * @since jsrsasign 10.0.6 x509 2.0.9
+2843 * @see X509#getX500Name
+2844 * @see X509#getRDN
+2845 * @see X509#getAttrTypeAndValue
+2846 * @description
+2847 * This method will get Name parameter defined in
+2848 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.4">
+2849 * RFC 5280 4.1.2.4</a>.
+2850 * <pre>
+2851 * Name ::= CHOICE { -- only one possibility for now --
+2852 * rdnSequence RDNSequence }
+2853 * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
+2854 * </pre>
+2855 * @example
+2856 * x = new X509();
+2857 * x.getX500NameArray("30...") →
+2858 * [[{type:"C",value:"US",ds:"prn"}],
+2859 * [{type:"O",value:"Sample Corp.",ds:"utf8"}],
+2860 * [{type:"CN",value:"john.smith@example.com",ds:"ia5"}]]
+2861 */
+2862 this.getX500NameArray = function(h) {
+2863 var p = _ASN1HEX_parse(h);
+2864 return _convX500Name(p);
+2865 };
+2866
+2867 /**
+2868 * get Name ASN.1 structure parameter array<br/>
+2869 * @name getX500Name
+2870 * @memberOf X509#
+2871 * @function
+2872 * @param {String} h hexadecimal string of Name
+2873 * @param {boolean} flagCanon flag to conclude canonicalized name (DEFAULT false)
+2874 * @param {boolean} flagHex flag to conclude hexadecimal string (DEFAULT false)
+2875 * @return {Array} array of RDN parameter array
+2876 * @since jsrsasign 9.0.0 x509 2.0.0
+2877 * @see X509#getX500NameArray
+2878 * @see X509#getRDN
+2879 * @see X509#getAttrTypeAndValue
+2880 * @see X509#c14nRDNArray
+2881 * @see KJUR.asn1.x509.X500Name
+2882 * @see KJUR.asn1.x509.GeneralName
+2883 * @see KJUR.asn1.x509.GeneralNames
+2884 *
+2885 * @description
+2886 * This method will get Name parameter defined in
+2887 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.4">
+2888 * RFC 5280 4.1.2.4</a>.
+2889 * <pre>
+2890 * Name ::= CHOICE { -- only one possibility for now --
+2891 * rdnSequence RDNSequence }
+2892 * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
+2893 * </pre>
+2894 * <br>
+2895 * NOTE: From jsrsasign 10.6.0, flagHex and flagCanon has been
+2896 * supported to conclude a canonicalized name for caseIgnoreMatch
+2897 * desribed in <a href="https://tools.ietf.org/html/rfc4518">
+2898 * RFC 4518</a>.
+2899 *
+2900 * @example
+2901 * x = new X509();
+2902 * x.getX500Name("30...") →
+2903 * { array: [
+2904 * [{type:"C",value:"US",ds:"prn"}],
+2905 * [{type:"O",value:"Sample Corp.",ds:"utf8"}],
+2906 * [{type:"CN",value:"john.smith@example.com",ds:"ia5"}]
+2907 * ],
+2908 * str: "/C=US/O=Sample Corp./CN=john.smith@example.com",
+2909 * hex: "30..." }
+2910 *
+2911 * x.getX500Name("30...", true) →
+2912 * { array: [
+2913 * [{type:"C",value:"US",ds:"prn"}],
+2914 * [{type:"O",value:"Sample Corp.",ds:"utf8"}]
+2915 * ],
+2916 * str: "/C=US/O=Sample Corp.",
+2917 * canon: "/c=us/o=sample corp.",
+2918 * hex: "30..." }
+2919 */
+2920 this.getX500Name = function(h, flagCanon, flagHex) {
+2921 var a = this.getX500NameArray(h);
+2922 var s = this.dnarraytostr(a);
+2923 var result = { str: s };
+2924
+2925 result.array = a;
+2926 if (flagHex == true) result.hex = h;
+2927 if (flagCanon == true) result.canon = this.c14nRDNArray(a);
+2928 return result;
+2929 };
2930
-2931 // ===== BEGIN read certificate =====================================
-2932 /**
-2933 * read PEM formatted X.509 certificate from string.<br/>
-2934 * @name readCertPEM
-2935 * @memberOf X509#
-2936 * @function
-2937 * @param {String} sCertPEM string for PEM formatted X.509 certificate
-2938 * @example
-2939 * x = new X509();
-2940 * x.readCertPEM(sCertPEM); // read certificate
-2941 */
-2942 this.readCertPEM = function(sCertPEM) {
-2943 this.readCertHex(_pemtohex(sCertPEM));
-2944 };
-2945
-2946 /**
-2947 * read a hexadecimal string of X.509 certificate<br/>
-2948 * @name readCertHex
-2949 * @memberOf X509#
-2950 * @function
-2951 * @param {String} sCertHex hexadecimal string of X.509 certificate
-2952 * @since jsrsasign 7.1.4 x509 1.1.13
-2953 * @description
-2954 * NOTE: {@link X509#parseExt} will called internally since jsrsasign 7.2.0.
-2955 * @example
-2956 * x = new X509();
-2957 * x.readCertHex("3082..."); // read certificate
-2958 */
-2959 this.readCertHex = function(sCertHex) {
-2960 this.hex = sCertHex;
-2961 this.getVersion(); // set version parameter
-2962
-2963 try {
-2964 _getIdxbyList(this.hex, 0, [0, 7], "a3"); // has [3] v3ext
-2965 this.parseExt();
-2966 } catch(ex) {};
-2967 };
-2968
-2969 // ===== END read certificate =====================================
+2931 // ===== END X500Name related =====================================
+2932
+2933 // ===== BEGIN read certificate =====================================
+2934 /**
+2935 * read PEM formatted X.509 certificate from string.<br/>
+2936 * @name readCertPEM
+2937 * @memberOf X509#
+2938 * @function
+2939 * @param {String} sCertPEM string for PEM formatted X.509 certificate
+2940 * @example
+2941 * x = new X509();
+2942 * x.readCertPEM(sCertPEM); // read certificate
+2943 */
+2944 this.readCertPEM = function(sCertPEM) {
+2945 this.readCertHex(_pemtohex(sCertPEM));
+2946 };
+2947
+2948 /**
+2949 * read a hexadecimal string of X.509 certificate<br/>
+2950 * @name readCertHex
+2951 * @memberOf X509#
+2952 * @function
+2953 * @param {String} sCertHex hexadecimal string of X.509 certificate
+2954 * @since jsrsasign 7.1.4 x509 1.1.13
+2955 * @description
+2956 * NOTE: {@link X509#parseExt} will called internally since jsrsasign 7.2.0.
+2957 * @example
+2958 * x = new X509();
+2959 * x.readCertHex("3082..."); // read certificate
+2960 */
+2961 this.readCertHex = function(sCertHex) {
+2962 this.hex = sCertHex;
+2963 this.getVersion(); // set version parameter
+2964
+2965 try {
+2966 _getIdxbyList(this.hex, 0, [0, 7], "a3"); // has [3] v3ext
+2967 this.parseExt();
+2968 } catch(ex) {};
+2969 };
2970
-2971 /**
-2972 * get JSON object of certificate parameters<br/>
-2973 * @name getParam
-2974 * @memberOf X509#
-2975 * @function
-2976 * @param {Object} option optional setting for return object
-2977 * @return {Object} JSON object of certificate parameters
-2978 * @since jsrsasign 9.0.0 x509 2.0.0
-2979 * @see KJUR.asn1.x509.X509Util.newCertPEM
-2980 *
-2981 * @description
-2982 * This method returns a JSON object of the certificate
-2983 * parameters. Return value can be passed to
-2984 * {@link KJUR.asn1.x509.X509Util.newCertPEM}.
-2985 * <br/>
-2986 * NOTE1: From jsrsasign 10.5.16, optional argument can be applied.
-2987 * It can have following members:
-2988 * <ul>
-2989 * <li>tbshex - (boolean) tbshex member with hex value of
-2990 * tbsCertificate will be added if true (DEFAULT undefined)</li>
-2991 * <li>nodnarray - (boolean) array member for subject and
-2992 * issuer will be deleted to simplify it if true (DEFAULT undefined)<li>
-2993 * <li>dncanon - (boolean) add canon member to subject and issuer for DN StringPrep if true(DEFAULT undefined)</li>
-2994 * <li>dnhex - (boolean) add hex member to subject and issuer if true(DEFAULT undefined)</li>
-2995 * </ul>
-2996 * <br/>
-2997 * NOTE2: From jsrsasign 10.6.0, member "dncanon" and "dnhex" supported
-2998 * in the "option" argument.
-2999 *
-3000 * @example
-3001 * x = new X509();
-3002 * x.readCertPEM("-----BEGIN CERTIFICATE...");
-3003 * x.getParam() →
-3004 * {version:3,
-3005 * serial:{hex:"12ab"},
-3006 * sigalg:"SHA256withRSA",
-3007 * issuer: {array:[[{type:'CN',value:'CA1',ds:'prn'}]],str:"/O=CA1"},
-3008 * notbefore:"160403023700Z",
-3009 * notafter:"160702023700Z",
-3010 * subject: {array:[[{type:'CN',value:'Test1',ds:'prn'}]],str:"/CN=Test1"},
-3011 * sbjpubkey:"-----BEGIN PUBLIC KEY...",
-3012 * ext:[
-3013 * {extname:"keyUsage",critical:true,names:["digitalSignature"]},
-3014 * {extname:"basicConstraints",critical:true},
-3015 * {extname:"subjectKeyIdentifier",kid:{hex:"f2eb..."}},
-3016 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}},
-3017 * {extname:"authorityInfoAccess",array:[{ocsp:"http://ocsp.example.com/"}]},
-3018 * {extname:"certificatePolicies",array:[{policyoid:"2.23.140.1.2.1"}]}
-3019 * ],
-3020 * sighex:"0b76...8"
-3021 * };
-3022 *
-3023 * x.getParam({tbshex: true}) → { ... , tbshex: "30..." }
-3024 * x.getParam({nodnarray: true}) → {issuer: {str: "/C=JP"}, ...}
-3025 * x.getParam({dncanon: true}) → {... {issuer: {canon: "/c=jp/o=..."} ...} ...}
-3026 * x.getParam({dnhex: true}) → {... {issuer: {hex: "30..."} ...} ...}
-3027 */
-3028 this.getParam = function(option) {
-3029 var result = {};
-3030 if (option == undefined) option = {};
-3031
-3032 result.version = this.getVersion();
-3033 result.serial = {hex: this.getSerialNumberHex()};
-3034 result.sigalg = this.getSignatureAlgorithmField();
-3035 result.issuer = this.getIssuer(option.dncanon, option.dnhex);
-3036 result.notbefore = this.getNotBefore();
-3037 result.notafter = this.getNotAfter();
-3038 result.subject = this.getSubject(option.dncanon, option.dnhex);
-3039 result.sbjpubkey = hextopem(this.getPublicKeyHex(), "PUBLIC KEY");
-3040 if (this.aExtInfo != undefined &&
-3041 this.aExtInfo.length > 0) {
-3042 result.ext = this.getExtParamArray();
-3043 }
-3044 result.sighex = this.getSignatureValueHex();
-3045
-3046 // for options
-3047 if (option.tbshex == true) {
-3048 result.tbshex = _getTLVbyList(this.hex, 0, [0]);
-3049 }
-3050 if (option.nodnarray == true) {
-3051 delete result.issuer.array;
-3052 delete result.subject.array;
-3053 }
-3054
-3055 return result;
-3056 };
-3057
-3058 /**
-3059 * get array of certificate extension parameter JSON object<br/>
-3060 * @name getExtParamArray
-3061 * @memberOf X509#
-3062 * @function
-3063 * @param {String} hExtSeq hexadecimal string of SEQUENCE of Extension
-3064 * @return {Array} array of certificate extension parameter JSON object
-3065 * @since jsrsasign 9.0.0 x509 2.0.0
-3066 * @see KJUR.asn1.x509.X509Util.newCertPEM
-3067 * @see X509#getParam
-3068 * @see X509#getExtParam
-3069 * @see X509CRL#getParam
-3070 * @see KJUR.asn1.csr.CSRUtil.getParam
-3071 *
-3072 * @description
-3073 * This method returns an array of certificate extension
-3074 * parameters.
-3075 * <br/>
-3076 * NOTE: Argument "hExtSeq" have been supported since jsrsasign 9.1.1.
-3077 *
-3078 * @example
-3079 * x = new X509();
-3080 * x.readCertPEM("-----BEGIN CERTIFICATE...");
-3081 * x.getExtParamArray() →
-3082 * [ {extname:"keyUsage",critical:true,names:["digitalSignature"]},
-3083 * {extname:"basicConstraints",critical:true},
-3084 * {extname:"subjectKeyIdentifier",kid:{hex:"f2eb..."}},
-3085 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}},
-3086 * {extname:"authorityInfoAccess",array:[{ocsp:"http://ocsp.example.com/"}]},
-3087 * {extname:"certificatePolicies",array:[{policyoid:"2.23.140.1.2.1"}]}]
-3088 */
-3089 this.getExtParamArray = function(hExtSeq) {
-3090 if (hExtSeq == undefined) {
-3091 // for X.509v3 certificate
-3092 var idx1 = _getIdxbyListEx(this.hex, 0, [0, "[3]"]);
-3093 if (idx1 != -1) {
-3094 hExtSeq = _getTLVbyListEx(this.hex, 0, [0, "[3]", 0], "30");
-3095 }
-3096 }
-3097 var result = [];
-3098 var aIdx = _getChildIdx(hExtSeq, 0);
-3099
-3100 for (var i = 0; i < aIdx.length; i++) {
-3101 var hExt = _getTLV(hExtSeq, aIdx[i]);
-3102 var extParam = this.getExtParam(hExt);
-3103 if (extParam != null) result.push(extParam);
-3104 }
-3105
-3106 return result;
-3107 };
-3108
-3109 /**
-3110 * get a extension parameter JSON object<br/>
-3111 * @name getExtParam
-3112 * @memberOf X509#
-3113 * @function
-3114 * @param {String} hExt hexadecimal string of Extension
-3115 * @return {Array} Extension parameter JSON object
-3116 * @since jsrsasign 9.1.1 x509 2.0.1
-3117 * @see KJUR.asn1.x509.X509Util.newCertPEM
-3118 * @see X509#getParam
-3119 * @see X509#getExtParamArray
-3120 * @see X509CRL#getParam
-3121 * @see KJUR.asn1.csr.CSRUtil.getParam
-3122 *
-3123 * @description
-3124 * This method returns a extension parameters as JSON object.
-3125 *
-3126 * @example
-3127 * x = new X509();
-3128 * ...
-3129 * x.getExtParam("30...") →
-3130 * {extname:"keyUsage",critical:true,names:["digitalSignature"]}
-3131 */
-3132 this.getExtParam = function(hExt) {
-3133 var result = {};
-3134 var aIdx = _getChildIdx(hExt, 0);
-3135 var aIdxLen = aIdx.length;
-3136 if (aIdxLen != 2 && aIdxLen != 3)
-3137 throw new Error("wrong number elements in Extension: " +
-3138 aIdxLen + " " + hExt);
-3139
-3140 var oid = _hextooidstr(_getVbyList(hExt, 0, [0], "06"));
+2971 // ===== END read certificate =====================================
+2972
+2973 /**
+2974 * get JSON object of certificate parameters<br/>
+2975 * @name getParam
+2976 * @memberOf X509#
+2977 * @function
+2978 * @param {Object} option optional setting for return object
+2979 * @return {Object} JSON object of certificate parameters
+2980 * @since jsrsasign 9.0.0 x509 2.0.0
+2981 * @see KJUR.asn1.x509.X509Util.newCertPEM
+2982 *
+2983 * @description
+2984 * This method returns a JSON object of the certificate
+2985 * parameters. Return value can be passed to
+2986 * {@link KJUR.asn1.x509.X509Util.newCertPEM}.
+2987 * <br/>
+2988 * NOTE1: From jsrsasign 10.5.16, optional argument can be applied.
+2989 * It can have following members:
+2990 * <ul>
+2991 * <li>tbshex - (boolean) tbshex member with hex value of
+2992 * tbsCertificate will be added if true (DEFAULT undefined)</li>
+2993 * <li>nodnarray - (boolean) array member for subject and
+2994 * issuer will be deleted to simplify it if true (DEFAULT undefined)<li>
+2995 * <li>dncanon - (boolean) add canon member to subject and issuer for DN StringPrep if true(DEFAULT undefined)</li>
+2996 * <li>dnhex - (boolean) add hex member to subject and issuer if true(DEFAULT undefined)</li>
+2997 * </ul>
+2998 * <br/>
+2999 * NOTE2: From jsrsasign 10.6.0, member "dncanon" and "dnhex" supported
+3000 * in the "option" argument.
+3001 *
+3002 * @example
+3003 * x = new X509();
+3004 * x.readCertPEM("-----BEGIN CERTIFICATE...");
+3005 * x.getParam() →
+3006 * {version:3,
+3007 * serial:{hex:"12ab"},
+3008 * sigalg:"SHA256withRSA",
+3009 * issuer: {array:[[{type:'CN',value:'CA1',ds:'prn'}]],str:"/O=CA1"},
+3010 * notbefore:"160403023700Z",
+3011 * notafter:"160702023700Z",
+3012 * subject: {array:[[{type:'CN',value:'Test1',ds:'prn'}]],str:"/CN=Test1"},
+3013 * sbjpubkey:"-----BEGIN PUBLIC KEY...",
+3014 * ext:[
+3015 * {extname:"keyUsage",critical:true,names:["digitalSignature"]},
+3016 * {extname:"basicConstraints",critical:true},
+3017 * {extname:"subjectKeyIdentifier",kid:{hex:"f2eb..."}},
+3018 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}},
+3019 * {extname:"authorityInfoAccess",array:[{ocsp:"http://ocsp.example.com/"}]},
+3020 * {extname:"certificatePolicies",array:[{policyoid:"2.23.140.1.2.1"}]}
+3021 * ],
+3022 * sighex:"0b76...8"
+3023 * };
+3024 *
+3025 * x.getParam({tbshex: true}) → { ... , tbshex: "30..." }
+3026 * x.getParam({nodnarray: true}) → {issuer: {str: "/C=JP"}, ...}
+3027 * x.getParam({dncanon: true}) → {... {issuer: {canon: "/c=jp/o=..."} ...} ...}
+3028 * x.getParam({dnhex: true}) → {... {issuer: {hex: "30..."} ...} ...}
+3029 */
+3030 this.getParam = function(option) {
+3031 var result = {};
+3032 if (option == undefined) option = {};
+3033
+3034 result.version = this.getVersion();
+3035 result.serial = {hex: this.getSerialNumberHex()};
+3036 result.sigalg = this.getSignatureAlgorithmField();
+3037 result.issuer = this.getIssuer(option.dncanon, option.dnhex);
+3038 result.notbefore = this.getNotBefore();
+3039 result.notafter = this.getNotAfter();
+3040 result.subject = this.getSubject(option.dncanon, option.dnhex);
+3041 result.sbjpubkey = hextopem(this.getPublicKeyHex(), "PUBLIC KEY");
+3042 if (this.aExtInfo != undefined &&
+3043 this.aExtInfo.length > 0) {
+3044 result.ext = this.getExtParamArray();
+3045 }
+3046 result.sighex = this.getSignatureValueHex();
+3047
+3048 // for options
+3049 if (option.tbshex == true) {
+3050 result.tbshex = _getTLVbyList(this.hex, 0, [0]);
+3051 }
+3052 if (option.nodnarray == true) {
+3053 delete result.issuer.array;
+3054 delete result.subject.array;
+3055 }
+3056
+3057 return result;
+3058 };
+3059
+3060 /**
+3061 * get array of certificate extension parameter JSON object<br/>
+3062 * @name getExtParamArray
+3063 * @memberOf X509#
+3064 * @function
+3065 * @param {String} hExtSeq hexadecimal string of SEQUENCE of Extension
+3066 * @return {Array} array of certificate extension parameter JSON object
+3067 * @since jsrsasign 9.0.0 x509 2.0.0
+3068 * @see KJUR.asn1.x509.X509Util.newCertPEM
+3069 * @see X509#getParam
+3070 * @see X509#getExtParam
+3071 * @see X509CRL#getParam
+3072 * @see KJUR.asn1.csr.CSRUtil.getParam
+3073 *
+3074 * @description
+3075 * This method returns an array of certificate extension
+3076 * parameters.
+3077 * <br/>
+3078 * NOTE: Argument "hExtSeq" have been supported since jsrsasign 9.1.1.
+3079 *
+3080 * @example
+3081 * x = new X509();
+3082 * x.readCertPEM("-----BEGIN CERTIFICATE...");
+3083 * x.getExtParamArray() →
+3084 * [ {extname:"keyUsage",critical:true,names:["digitalSignature"]},
+3085 * {extname:"basicConstraints",critical:true},
+3086 * {extname:"subjectKeyIdentifier",kid:{hex:"f2eb..."}},
+3087 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}},
+3088 * {extname:"authorityInfoAccess",array:[{ocsp:"http://ocsp.example.com/"}]},
+3089 * {extname:"certificatePolicies",array:[{policyoid:"2.23.140.1.2.1"}]}]
+3090 */
+3091 this.getExtParamArray = function(hExtSeq) {
+3092 if (hExtSeq == undefined) {
+3093 // for X.509v3 certificate
+3094 var idx1 = _getIdxbyListEx(this.hex, 0, [0, "[3]"]);
+3095 if (idx1 != -1) {
+3096 hExtSeq = _getTLVbyListEx(this.hex, 0, [0, "[3]", 0], "30");
+3097 }
+3098 }
+3099 var result = [];
+3100 var aIdx = _getChildIdx(hExtSeq, 0);
+3101
+3102 for (var i = 0; i < aIdx.length; i++) {
+3103 var hExt = _getTLV(hExtSeq, aIdx[i]);
+3104 var extParam = this.getExtParam(hExt);
+3105 if (extParam != null) result.push(extParam);
+3106 }
+3107
+3108 return result;
+3109 };
+3110
+3111 /**
+3112 * get a extension parameter JSON object<br/>
+3113 * @name getExtParam
+3114 * @memberOf X509#
+3115 * @function
+3116 * @param {String} hExt hexadecimal string of Extension
+3117 * @return {Array} Extension parameter JSON object
+3118 * @since jsrsasign 9.1.1 x509 2.0.1
+3119 * @see KJUR.asn1.x509.X509Util.newCertPEM
+3120 * @see X509#getParam
+3121 * @see X509#getExtParamArray
+3122 * @see X509CRL#getParam
+3123 * @see KJUR.asn1.csr.CSRUtil.getParam
+3124 *
+3125 * @description
+3126 * This method returns a extension parameters as JSON object.
+3127 *
+3128 * @example
+3129 * x = new X509();
+3130 * ...
+3131 * x.getExtParam("30...") →
+3132 * {extname:"keyUsage",critical:true,names:["digitalSignature"]}
+3133 */
+3134 this.getExtParam = function(hExt) {
+3135 var result = {};
+3136 var aIdx = _getChildIdx(hExt, 0);
+3137 var aIdxLen = aIdx.length;
+3138 if (aIdxLen != 2 && aIdxLen != 3)
+3139 throw new Error("wrong number elements in Extension: " +
+3140 aIdxLen + " " + hExt);
3141
-3142 var critical = false;
-3143 if (aIdxLen == 3 && _getTLVbyList(hExt, 0, [1]) == "0101ff")
-3144 critical = true;
-3145
-3146 var hExtV = _getTLVbyList(hExt, 0, [aIdxLen - 1, 0]);
+3142 var oid = _hextooidstr(_getVbyList(hExt, 0, [0], "06"));
+3143
+3144 var critical = false;
+3145 if (aIdxLen == 3 && _getTLVbyList(hExt, 0, [1]) == "0101ff")
+3146 critical = true;
3147
-3148 var extParam = undefined;
-3149 if (oid == "2.5.29.14") {
-3150 extParam = this.getExtSubjectKeyIdentifier(hExtV, critical);
-3151 } else if (oid == "2.5.29.15") {
-3152 extParam = this.getExtKeyUsage(hExtV, critical);
-3153 } else if (oid == "2.5.29.17") {
-3154 extParam = this.getExtSubjectAltName(hExtV, critical);
-3155 } else if (oid == "2.5.29.18") {
-3156 extParam = this.getExtIssuerAltName(hExtV, critical);
-3157 } else if (oid == "2.5.29.19") {
-3158 extParam = this.getExtBasicConstraints(hExtV, critical);
-3159 } else if (oid == "2.5.29.30") {
-3160 extParam = this.getExtNameConstraints(hExtV, critical);
-3161 } else if (oid == "2.5.29.31") {
-3162 extParam = this.getExtCRLDistributionPoints(hExtV, critical);
-3163 } else if (oid == "2.5.29.32") {
-3164 extParam = this.getExtCertificatePolicies(hExtV, critical);
-3165 } else if (oid == "2.5.29.33") {
-3166 extParam = this.getExtPolicyMappings(hExtV, critical);
-3167 } else if (oid == "2.5.29.35") {
-3168 extParam = this.getExtAuthorityKeyIdentifier(hExtV, critical);
-3169 } else if (oid == "2.5.29.36") {
-3170 extParam = this.getExtPolicyConstraints(hExtV, critical);
-3171 } else if (oid == "2.5.29.37") {
-3172 extParam = this.getExtExtKeyUsage(hExtV, critical);
-3173 } else if (oid == "2.5.29.54") {
-3174 extParam = this.getExtInhibitAnyPolicy(hExtV, critical);
-3175 } else if (oid == "1.3.6.1.5.5.7.1.1") {
-3176 extParam = this.getExtAuthorityInfoAccess(hExtV, critical);
-3177 } else if (oid == "2.5.29.20") {
-3178 extParam = this.getExtCRLNumber(hExtV, critical);
-3179 } else if (oid == "2.5.29.21") {
-3180 extParam = this.getExtCRLReason(hExtV, critical);
-3181 } else if (oid == "2.5.29.9") {
-3182 extParam = this.getExtSubjectDirectoryAttributes(hExtV, critical);
-3183 } else if (oid == "1.3.6.1.5.5.7.48.1.2") {
-3184 extParam = this.getExtOcspNonce(hExtV, critical);
-3185 } else if (oid == "1.3.6.1.5.5.7.48.1.5") {
-3186 extParam = this.getExtOcspNoCheck(hExtV, critical);
-3187 } else if (oid == "1.2.840.113583.1.1.9.1") {
-3188 extParam = this.getExtAdobeTimeStamp(hExtV, critical);
-3189 } else if (X509.EXT_PARSER[oid] != undefined) {
-3190 extParam = X509.EXT_PARSER[oid](oid, critical, hExtV);
-3191 }
-3192 if (extParam != undefined) return extParam;
-3193
-3194 // for private or unsupported extension
-3195 var privateParam = { extname: oid, extn: hExtV };
-3196 try {
-3197 privateParam.extn = _ASN1HEX_parse(hExtV);
-3198 } catch(ex) {}
-3199 if (critical) privateParam.critical = true;
-3200 return privateParam;
-3201 };
-3202
-3203 /**
-3204 * find extension parameter in array<br/>
-3205 * @name findExt
-3206 * @memberOf X509#
-3207 * @function
-3208 * @param {Array} aExt array of extension parameters
-3209 * @param {String} extname extension name
-3210 * @return {Array} extension parameter in the array or null
-3211 * @since jsrsasign 10.0.3 x509 2.0.7
-3212 * @see X509#getParam
-3213 *
-3214 * @description
-3215 * This method returns an extension parameter for
-3216 * specified extension name in the array.
-3217 * This method is useful to update extension parameter value.
-3218 * When there is no such extension with the extname,
-3219 * this returns "null".
-3220 *
-3221 * @example
-3222 * // (1)
-3223 * x = new X509(CERTPEM);
-3224 * params = x.getParam();
-3225 * pSKID = x.findExt(params.ext, "subjectKeyIdentifier");
-3226 * pSKID.kid = "1234abced..."; // skid in the params is updated.
-3227 * // then params was updated
-3228 *
-3229 * // (2) another example
-3230 * aExt = [
-3231 * {extname:"keyUsage",critical:true,names:["digitalSignature"]},
-3232 * {extname:"basicConstraints",critical:true},
-3233 * {extname:"subjectKeyIdentifier",kid:{hex:"f2eb..."}},
-3234 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}},
-3235 * {extname:"authorityInfoAccess",array:[{ocsp:"http://ocsp.example.com/"}]},
-3236 * {extname:"certificatePolicies",array:[{policyoid:"2.23.140.1.2.1"}]}
-3237 * ];
-3238 * var x = new X509();
-3239 * x.findExt(aExt, "authorityKeyInfoAccess").array[0].ocsp = "http://aaa.com";
-3240 * pKU = x.findExt(aExt, "keyUsage");
-3241 * delete pKU["critical"]; // clear criticla flag
-3242 * pKU.names = ["keyCertSign", "cRLSign"];
-3243 * // then aExt was updated
-3244 */
-3245 this.findExt = function(aExt, extname) {
-3246 for (var i = 0; i < aExt.length; i++) {
-3247 if (aExt[i].extname == extname) return aExt[i];
-3248 }
-3249 return null;
-3250
-3251 };
+3148 var hExtV = _getTLVbyList(hExt, 0, [aIdxLen - 1, 0]);
+3149
+3150 var extParam = undefined;
+3151 if (oid == "2.5.29.14") {
+3152 extParam = this.getExtSubjectKeyIdentifier(hExtV, critical);
+3153 } else if (oid == "2.5.29.15") {
+3154 extParam = this.getExtKeyUsage(hExtV, critical);
+3155 } else if (oid == "2.5.29.17") {
+3156 extParam = this.getExtSubjectAltName(hExtV, critical);
+3157 } else if (oid == "2.5.29.18") {
+3158 extParam = this.getExtIssuerAltName(hExtV, critical);
+3159 } else if (oid == "2.5.29.19") {
+3160 extParam = this.getExtBasicConstraints(hExtV, critical);
+3161 } else if (oid == "2.5.29.30") {
+3162 extParam = this.getExtNameConstraints(hExtV, critical);
+3163 } else if (oid == "2.5.29.31") {
+3164 extParam = this.getExtCRLDistributionPoints(hExtV, critical);
+3165 } else if (oid == "2.5.29.32") {
+3166 extParam = this.getExtCertificatePolicies(hExtV, critical);
+3167 } else if (oid == "2.5.29.33") {
+3168 extParam = this.getExtPolicyMappings(hExtV, critical);
+3169 } else if (oid == "2.5.29.35") {
+3170 extParam = this.getExtAuthorityKeyIdentifier(hExtV, critical);
+3171 } else if (oid == "2.5.29.36") {
+3172 extParam = this.getExtPolicyConstraints(hExtV, critical);
+3173 } else if (oid == "2.5.29.37") {
+3174 extParam = this.getExtExtKeyUsage(hExtV, critical);
+3175 } else if (oid == "2.5.29.54") {
+3176 extParam = this.getExtInhibitAnyPolicy(hExtV, critical);
+3177 } else if (oid == "1.3.6.1.5.5.7.1.1") {
+3178 extParam = this.getExtAuthorityInfoAccess(hExtV, critical);
+3179 } else if (oid == "2.5.29.20") {
+3180 extParam = this.getExtCRLNumber(hExtV, critical);
+3181 } else if (oid == "2.5.29.21") {
+3182 extParam = this.getExtCRLReason(hExtV, critical);
+3183 } else if (oid == "2.5.29.9") {
+3184 extParam = this.getExtSubjectDirectoryAttributes(hExtV, critical);
+3185 } else if (oid == "1.3.6.1.5.5.7.48.1.2") {
+3186 extParam = this.getExtOcspNonce(hExtV, critical);
+3187 } else if (oid == "1.3.6.1.5.5.7.48.1.5") {
+3188 extParam = this.getExtOcspNoCheck(hExtV, critical);
+3189 } else if (oid == "1.2.840.113583.1.1.9.1") {
+3190 extParam = this.getExtAdobeTimeStamp(hExtV, critical);
+3191 } else if (X509.EXT_PARSER[oid] != undefined) {
+3192 extParam = X509.EXT_PARSER[oid](oid, critical, hExtV);
+3193 }
+3194 if (extParam != undefined) return extParam;
+3195
+3196 // for private or unsupported extension
+3197 var privateParam = { extname: oid, extn: hExtV };
+3198 try {
+3199 privateParam.extn = _ASN1HEX_parse(hExtV);
+3200 } catch(ex) {}
+3201 if (critical) privateParam.critical = true;
+3202 return privateParam;
+3203 };
+3204
+3205 /**
+3206 * find extension parameter in array<br/>
+3207 * @name findExt
+3208 * @memberOf X509#
+3209 * @function
+3210 * @param {Array} aExt array of extension parameters
+3211 * @param {String} extname extension name
+3212 * @return {Array} extension parameter in the array or null
+3213 * @since jsrsasign 10.0.3 x509 2.0.7
+3214 * @see X509#getParam
+3215 *
+3216 * @description
+3217 * This method returns an extension parameter for
+3218 * specified extension name in the array.
+3219 * This method is useful to update extension parameter value.
+3220 * When there is no such extension with the extname,
+3221 * this returns "null".
+3222 *
+3223 * @example
+3224 * // (1)
+3225 * x = new X509(CERTPEM);
+3226 * params = x.getParam();
+3227 * pSKID = x.findExt(params.ext, "subjectKeyIdentifier");
+3228 * pSKID.kid = "1234abced..."; // skid in the params is updated.
+3229 * // then params was updated
+3230 *
+3231 * // (2) another example
+3232 * aExt = [
+3233 * {extname:"keyUsage",critical:true,names:["digitalSignature"]},
+3234 * {extname:"basicConstraints",critical:true},
+3235 * {extname:"subjectKeyIdentifier",kid:{hex:"f2eb..."}},
+3236 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}},
+3237 * {extname:"authorityInfoAccess",array:[{ocsp:"http://ocsp.example.com/"}]},
+3238 * {extname:"certificatePolicies",array:[{policyoid:"2.23.140.1.2.1"}]}
+3239 * ];
+3240 * var x = new X509();
+3241 * x.findExt(aExt, "authorityKeyInfoAccess").array[0].ocsp = "http://aaa.com";
+3242 * pKU = x.findExt(aExt, "keyUsage");
+3243 * delete pKU["critical"]; // clear criticla flag
+3244 * pKU.names = ["keyCertSign", "cRLSign"];
+3245 * // then aExt was updated
+3246 */
+3247 this.findExt = function(aExt, extname) {
+3248 for (var i = 0; i < aExt.length; i++) {
+3249 if (aExt[i].extname == extname) return aExt[i];
+3250 }
+3251 return null;
3252
-3253 /**
-3254 * update CRLDistributionPoints Full URI in parameter<br/>
-3255 * @name updateCDPFullURI
-3256 * @memberOf X509#
-3257 * @function
-3258 * @param {Array} aExt array of extension parameters
-3259 * @param {String} newURI string of new uri
-3260 * @since jsrsasign 10.0.4 x509 2.0.8
-3261 * @see X509#findExt
-3262 * @see KJUR.asn1.x509.CRLDistributionPoints
-3263 *
-3264 * @description
-3265 * This method updates Full URI of CRLDistributionPoints extension
-3266 * in the extension parameter array if it exists.
-3267 *
-3268 * @example
-3269 * aExt = [
-3270 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}},
-3271 * {extname:"cRLDistributionPoints",
-3272 * array:[{dpname:{full:[{uri:"http://example.com/a.crl"}]}}]},
-3273 * ];
-3274 * x = new X509();
-3275 * x.updateCDPFullURI(aExt, "http://crl2.example.new/b.crl");
-3276 */
-3277 this.updateExtCDPFullURI = function(aExt, newURI) {
-3278 var pExt = this.findExt(aExt, "cRLDistributionPoints");
-3279 if (pExt == null) return;
-3280 if (pExt.array == undefined) return;
-3281 var aDP = pExt.array;
-3282 for (var i = 0; i < aDP.length; i++) {
-3283 if (aDP[i].dpname == undefined) continue;
-3284 if (aDP[i].dpname.full == undefined) continue;
-3285 var aURI = aDP[i].dpname.full;
-3286 for (var j = 0; j < aURI.length; j++) {
-3287 var pURI = aURI[i];
-3288 if (pURI.uri == undefined) continue;
-3289 pURI.uri = newURI;
-3290 }
-3291 }
-3292 };
-3293
-3294 /**
-3295 * update authorityInfoAccess ocsp in parameter<br/>
-3296 * @name updateAIAOCSP
-3297 * @memberOf X509#
-3298 * @function
-3299 * @param {Array} aExt array of extension parameters
-3300 * @param {String} newURI string of new uri
-3301 * @since jsrsasign 10.0.4 x509 2.0.8
-3302 * @see X509#findExt
-3303 * @see KJUR.asn1.x509.AuthorityInfoAccess
-3304 *
-3305 * @description
-3306 * This method updates "ocsp" accessMethod URI of
-3307 * AuthorityInfoAccess extension
-3308 * in the extension parameter array if it exists.
-3309 *
-3310 * @example
-3311 * aExt = [
-3312 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}},
-3313 * {extname:"authoriyInfoAccess",
-3314 * array:[
-3315 * {ocsp: "http://ocsp1.example.com"},
-3316 * {caissuer: "http://example.com/a.crt"}
-3317 * ]}
-3318 * ];
-3319 * x = new X509();
-3320 * x.updateAIAOCSP(aExt, "http://ocsp2.example.net");
-3321 */
-3322 this.updateExtAIAOCSP = function(aExt, newURI) {
-3323 var pExt = this.findExt(aExt, "authorityInfoAccess");
-3324 if (pExt == null) return;
-3325 if (pExt.array == undefined) return;
-3326 var a = pExt.array;
-3327 for (var i = 0; i < a.length; i++) {
-3328 if (a[i].ocsp != undefined) a[i].ocsp = newURI;
-3329 }
-3330 };
-3331
-3332 /**
-3333 * update authorityInfoAccess caIssuer in parameter<br/>
-3334 * @name updateAIACAIssuer
-3335 * @memberOf X509#
-3336 * @function
-3337 * @param {Array} aExt array of extension parameters
-3338 * @param {String} newURI string of new uri
-3339 * @since jsrsasign 10.0.4 x509 2.0.8
-3340 * @see X509#findExt
-3341 * @see KJUR.asn1.x509.AuthorityInfoAccess
-3342 *
-3343 * @description
-3344 * This method updates "caIssuer" accessMethod URI of
-3345 * AuthorityInfoAccess extension
-3346 * in the extension parameter array if it exists.
-3347 *
-3348 * @example
-3349 * aExt = [
-3350 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}},
-3351 * {extname:"authoriyInfoAccess",
-3352 * array:[
-3353 * {ocsp: "http://ocsp1.example.com"},
-3354 * {caissuer: "http://example.com/a.crt"}
-3355 * ]}
-3356 * ];
-3357 * x = new X509();
-3358 * x.updateAIACAIssuer(aExt, "http://example.net/b.crt");
-3359 */
-3360 this.updateExtAIACAIssuer = function(aExt, newURI) {
-3361 var pExt = this.findExt(aExt, "authorityInfoAccess");
-3362 if (pExt == null) return;
-3363 if (pExt.array == undefined) return;
-3364 var a = pExt.array;
-3365 for (var i = 0; i < a.length; i++) {
-3366 if (a[i].caissuer != undefined) a[i].caissuer = newURI;
-3367 }
-3368 };
-3369
-3370 /**
-3371 * convert array for X500 distinguish name to distinguish name string<br/>
-3372 * @name dnarraytostr
-3373 * @memberOf X509#
-3374 * @function
-3375 * @param {Array} aDN array for X500 distinguish name
-3376 * @return {String} distinguish name
-3377 * @since jsrsasign 10.0.6 x509 2.0.8
-3378 * @see X509#getX500Name
-3379 * @see X509#getX500NameArray
-3380 * @see KJUR.asn1.x509.X500Name
-3381 *
-3382 * @description
-3383 * This method converts from an array representation of
-3384 * X.500 distinguished name to X.500 name string.
-3385 * This supports multi-valued RDN.
-3386 *
-3387 * @example
-3388 * var x = new X509();
-3389 * x.dnarraytostr(
-3390 * [[{type:"C",value:"JP",ds:"prn"}],
-3391 * [{type:"O",value:"T1",ds:"prn"}]]) → "/C=JP/O=T1"
-3392 * x.dnarraytostr(
-3393 * [[{type:"C",value:"JP",ds:"prn"}],
-3394 * [{type:"O",value:"T1",ds:"prn"}
-3395 * {type:"CN",value:"Bob",ds:"prn"}]]) → "/C=JP/O=T1+CN=Bob"
-3396 */
-3397 this.dnarraytostr = function(aDN) {
-3398 function rdnarraytostr(aRDN) {
-3399 return aRDN.map(function(x){return atvtostr(x).replace(/\+/,"\\+");}).join("+");
-3400 };
-3401
-3402 function atvtostr(pATV) {
-3403 return pATV.type + "=" + pATV.value;
-3404 };
-3405
-3406 return "/" + aDN.map(function(x){return rdnarraytostr(x).replace(/\//, "\\/");}).join("/");
-3407 };
-3408
-3409 /**
-3410 * set canonicalized DN to a DN parameter<br/>
-3411 * @name setCanonicalizedDN
-3412 * @memberOf X509#
-3413 * @function
-3414 * @param {object} pDN DN parameter associative array
-3415 * @since jsrsasign 10.6.0 x509 2.1.0
-3416 *
-3417 * @description
-3418 * This method canonicalizes a DN string as following:
-3419 * <ul>
-3420 * <li>convert to lower case</li>
-3421 * <li>convert from all multiple spaces to a space</li>
-3422 * </ul>
-3423 *
-3424 * @example
-3425 * var x = new X509();
-3426 * var pDN = {
-3427 * array: [
-3428 * [{type:'C',value:'JP',ds:'prn'}],
-3429 * [{type:'O',value:'Test 1',ds:'prn'}] ],
-3430 * str: "/C=JP/O=Test 1" };
-3431 * x.setCanonicalizedDN(pDN);
-3432
-3433 * // pDN will become following
-3434 * pDN = {
-3435 * array: [
-3436 * [{type:'C',value:'JP',ds:'prn'}],
-3437 * [{type:'O',value:'Test 1',ds:'prn'}] ],
-3438 * str: "/C=JP/O=Test 1",
-3439 * canon: "/c=jp/o=test 1" };
-3440 */
-3441 this.setCanonicalizedDN = function(pDN) {
-3442 var aRDN;
-3443 if (pDN.str != undefined && pDN.array == undefined) {
-3444 var dDN = new KJUR.asn1.x509.X500Name({str: pDN.str});
-3445 var hDN = dDN.tohex();
-3446 aRDN = this.getX500NameArray(hDN);
-3447 } else {
-3448 aRDN = pDN.array;
-3449 }
-3450 if (pDN.canon == undefined) {
-3451 pDN.canon = this.c14nRDNArray(aRDN);
-3452 }
-3453 };
-3454
-3455 /**
-3456 * simple canonicalization(c14n) for RDN array<br/>
-3457 * @name c14nRDNArray
-3458 * @memberOf X509#
-3459 * @function
-3460 * @param {array} aRDN array of RDN parameters
-3461 * @return {string} canonicalized distinguish name (ex. "/c=jp/o=test ca")
-3462 * @since jsrsasign 10.6.0 x509 2.1.0
-3463 *
-3464 * @description
-3465 * This method canonicalizes a DN string according to
-3466 * <a href="https://datatracker.ietf.org/doc/html/rfc4518#appendix-B">
-3467 * "RFC 4518 StringPrep Appendix B Substring Matching"</a> as following:
-3468 * <ul>
-3469 * <li>convert to lower case</li>
-3470 * <li>convert from all sequence of spaces to a space</li>
-3471 * <li>remove leading and trailing spaces</li>
-3472 * </ul>
-3473 *
-3474 * @example
-3475 * var x = new X509();
-3476 * x.c14nRDNArray([
-3477 * [{type:"C", value:"JP", ds: "prn"}],
-3478 * [{type:"O", value:" Test 1234 ", ds: "utf8"}],
-3479 * [{type:"OU", value:"HR 45", ds: "utf8"}]
-3480 * ]) → "/c=jp/o=test 1234/ou=hr 45"
-3481 */
-3482 this.c14nRDNArray = function(aRDN) {
-3483 var a = [];
-3484 for (var i = 0; i < aRDN.length; i++) {
-3485 var aAVA = aRDN[i];
-3486 var a2 = [];
-3487 for (var j = 0; j < aAVA.length; j++) {
-3488 var pAVA = aAVA[j];
-3489 var value = pAVA.value;
-3490 value = value.replace(/^\s*/, '');
-3491 value = value.replace(/\s*$/, '');
-3492 value = value.replace(/\s+/g, ' ');
-3493 value = value.toLowerCase();
-3494 a2.push(pAVA.type.toLowerCase() + "=" + value);
-3495 }
-3496 a.push(a2.join("+"));
-3497 }
-3498 return "/" + a.join("/");
-3499 };
-3500
-3501 /**
-3502 * get certificate information as string.<br/>
-3503 * @name getInfo
-3504 * @memberOf X509#
-3505 * @function
-3506 * @return {String} certificate information string
-3507 * @since jsrsasign 5.0.10 x509 1.1.8
-3508 * @example
-3509 * x = new X509();
-3510 * x.readCertPEM(certPEM);
-3511 * console.log(x.getInfo());
-3512 * // this shows as following
-3513 * Basic Fields
-3514 * serial number: 02ac5c266a0b409b8f0b79f2ae462577
-3515 * signature algorithm: SHA1withRSA
-3516 * issuer: /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
-3517 * notBefore: 061110000000Z
-3518 * notAfter: 311110000000Z
-3519 * subject: /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
-3520 * subject public key info:
-3521 * key algorithm: RSA
-3522 * n=c6cce573e6fbd4bb...
-3523 * e=10001
-3524 * X509v3 Extensions:
-3525 * keyUsage CRITICAL:
-3526 * digitalSignature,keyCertSign,cRLSign
-3527 * basicConstraints CRITICAL:
-3528 * cA=true
-3529 * subjectKeyIdentifier :
-3530 * b13ec36903f8bf4701d498261a0802ef63642bc3
-3531 * authorityKeyIdentifier :
-3532 * kid=b13ec36903f8bf4701d498261a0802ef63642bc3
-3533 * signature algorithm: SHA1withRSA
-3534 * signature: 1c1a0697dcd79c9f...
-3535 */
-3536 this.getInfo = function() {
-3537 var _getSubjectAltNameStr = function(params) {
-3538 var s = "";
-3539 var indent = " ";
-3540 var NL = "\n";
-3541 var a = params.array;
-3542 for (var i = 0; i < a.length; i++) {
-3543 var pGN = a[i];
-3544 if (pGN.dn != undefined) s += indent + "dn: " + pGN.dn.str + NL;
-3545 if (pGN.ip != undefined) s += indent + "ip: " + pGN.ip + NL;
-3546 if (pGN.rfc822 != undefined) s += indent + "rfc822: " + pGN.rfc822 + NL;
-3547 if (pGN.dns != undefined) s += indent + "dns: " + pGN.dns + NL;
-3548 if (pGN.uri != undefined) s += indent + "uri: " + pGN.uri + NL;
-3549 if (pGN.other != undefined) {
-3550 var oidname = pGN.other.oid;
-3551 var value = JSON.stringify(pGN.other.value).replace(/\"/g, '');
-3552 s += indent + "other: " + oidname + "=" + value + NL;
-3553 }
-3554 }
-3555 s = s.replace(/\n$/, '');
-3556 return s;
-3557 };
-3558 var _getCertificatePoliciesStr = function(params) {
-3559 var s = "";
-3560 var a = params.array;
-3561 for (var i = 0; i < a.length; i++) {
-3562 var pi = a[i];
-3563 s += " policy oid: " + pi.policyoid + "\n";
-3564 if (pi.array === undefined) continue;
-3565 for (var j = 0; j < pi.array.length; j++) {
-3566 var pqi = pi.array[j];
-3567 if (pqi.cps !== undefined) {
-3568 s += " cps: " + pqi.cps + "\n";
-3569 }
-3570 }
-3571 }
-3572 return s;
-3573 };
-3574 var _getCRLDistributionPointsStr = function(params) {
-3575 var s = "";
-3576 var a = params.array;
-3577 for (var i = 0; i < a.length; i++) {
-3578 var dp = a[i];
-3579 try {
-3580 if (dp.dpname.full[0].uri !== undefined)
-3581 s += " " + dp.dpname.full[0].uri + "\n";
-3582 } catch(ex) {};
-3583 try {
-3584 if (dp.dname.full[0].dn.hex !== undefined)
-3585 s += " " + X509.hex2dn(dp.dpname.full[0].dn.hex) + "\n";
-3586 } catch(ex) {};
-3587 }
-3588 return s;
-3589 }
-3590 var _getAuthorityInfoAccessStr = function(params) {
-3591 var s = "";
-3592 var a = params.array;
-3593 for (var i = 0; i < a.length; i++) {
-3594 var ad = a[i];
-3595
-3596 if (ad.caissuer !== undefined)
-3597 s += " caissuer: " + ad.caissuer + "\n";
-3598 if (ad.ocsp !== undefined)
-3599 s += " ocsp: " + ad.ocsp + "\n";
-3600 }
-3601 return s;
-3602 };
-3603 var _X509 = X509;
-3604 var s, pubkey, aExt;
-3605 s = "Basic Fields\n";
-3606 s += " serial number: " + this.getSerialNumberHex() + "\n";
-3607 s += " signature algorithm: " + this.getSignatureAlgorithmField() + "\n";
-3608 s += " issuer: " + this.getIssuerString() + "\n";
-3609 s += " notBefore: " + this.getNotBefore() + "\n";
-3610 s += " notAfter: " + this.getNotAfter() + "\n";
-3611 s += " subject: " + this.getSubjectString() + "\n";
-3612 s += " subject public key info: " + "\n";
-3613
-3614 // subject public key info
-3615 pubkey = this.getPublicKey();
-3616 s += " key algorithm: " + pubkey.type + "\n";
-3617
-3618 if (pubkey.type === "RSA") {
-3619 s += " n=" + hextoposhex(pubkey.n.toString(16)).substr(0, 16) + "...\n";
-3620 s += " e=" + hextoposhex(pubkey.e.toString(16)) + "\n";
-3621 }
-3622
-3623 // X.509v3 Extensions
-3624 aExt = this.aExtInfo;
-3625
-3626 if (aExt !== undefined && aExt !== null) {
-3627 s += "X509v3 Extensions:\n";
-3628
-3629 for (var i = 0; i < aExt.length; i++) {
-3630 var info = aExt[i];
-3631
-3632 // show extension name and critical flag
-3633 var extName = KJUR.asn1.x509.OID.oid2name(info["oid"]);
-3634 if (extName === '') extName = info["oid"];
-3635
-3636 var critical = '';
-3637 if (info["critical"] === true) critical = "CRITICAL";
-3638
-3639 s += " " + extName + " " + critical + ":\n";
+3253 };
+3254
+3255 /**
+3256 * update CRLDistributionPoints Full URI in parameter<br/>
+3257 * @name updateCDPFullURI
+3258 * @memberOf X509#
+3259 * @function
+3260 * @param {Array} aExt array of extension parameters
+3261 * @param {String} newURI string of new uri
+3262 * @since jsrsasign 10.0.4 x509 2.0.8
+3263 * @see X509#findExt
+3264 * @see KJUR.asn1.x509.CRLDistributionPoints
+3265 *
+3266 * @description
+3267 * This method updates Full URI of CRLDistributionPoints extension
+3268 * in the extension parameter array if it exists.
+3269 *
+3270 * @example
+3271 * aExt = [
+3272 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}},
+3273 * {extname:"cRLDistributionPoints",
+3274 * array:[{dpname:{full:[{uri:"http://example.com/a.crl"}]}}]},
+3275 * ];
+3276 * x = new X509();
+3277 * x.updateCDPFullURI(aExt, "http://crl2.example.new/b.crl");
+3278 */
+3279 this.updateExtCDPFullURI = function(aExt, newURI) {
+3280 var pExt = this.findExt(aExt, "cRLDistributionPoints");
+3281 if (pExt == null) return;
+3282 if (pExt.array == undefined) return;
+3283 var aDP = pExt.array;
+3284 for (var i = 0; i < aDP.length; i++) {
+3285 if (aDP[i].dpname == undefined) continue;
+3286 if (aDP[i].dpname.full == undefined) continue;
+3287 var aURI = aDP[i].dpname.full;
+3288 for (var j = 0; j < aURI.length; j++) {
+3289 var pURI = aURI[i];
+3290 if (pURI.uri == undefined) continue;
+3291 pURI.uri = newURI;
+3292 }
+3293 }
+3294 };
+3295
+3296 /**
+3297 * update authorityInfoAccess ocsp in parameter<br/>
+3298 * @name updateAIAOCSP
+3299 * @memberOf X509#
+3300 * @function
+3301 * @param {Array} aExt array of extension parameters
+3302 * @param {String} newURI string of new uri
+3303 * @since jsrsasign 10.0.4 x509 2.0.8
+3304 * @see X509#findExt
+3305 * @see KJUR.asn1.x509.AuthorityInfoAccess
+3306 *
+3307 * @description
+3308 * This method updates "ocsp" accessMethod URI of
+3309 * AuthorityInfoAccess extension
+3310 * in the extension parameter array if it exists.
+3311 *
+3312 * @example
+3313 * aExt = [
+3314 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}},
+3315 * {extname:"authoriyInfoAccess",
+3316 * array:[
+3317 * {ocsp: "http://ocsp1.example.com"},
+3318 * {caissuer: "http://example.com/a.crt"}
+3319 * ]}
+3320 * ];
+3321 * x = new X509();
+3322 * x.updateAIAOCSP(aExt, "http://ocsp2.example.net");
+3323 */
+3324 this.updateExtAIAOCSP = function(aExt, newURI) {
+3325 var pExt = this.findExt(aExt, "authorityInfoAccess");
+3326 if (pExt == null) return;
+3327 if (pExt.array == undefined) return;
+3328 var a = pExt.array;
+3329 for (var i = 0; i < a.length; i++) {
+3330 if (a[i].ocsp != undefined) a[i].ocsp = newURI;
+3331 }
+3332 };
+3333
+3334 /**
+3335 * update authorityInfoAccess caIssuer in parameter<br/>
+3336 * @name updateAIACAIssuer
+3337 * @memberOf X509#
+3338 * @function
+3339 * @param {Array} aExt array of extension parameters
+3340 * @param {String} newURI string of new uri
+3341 * @since jsrsasign 10.0.4 x509 2.0.8
+3342 * @see X509#findExt
+3343 * @see KJUR.asn1.x509.AuthorityInfoAccess
+3344 *
+3345 * @description
+3346 * This method updates "caIssuer" accessMethod URI of
+3347 * AuthorityInfoAccess extension
+3348 * in the extension parameter array if it exists.
+3349 *
+3350 * @example
+3351 * aExt = [
+3352 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}},
+3353 * {extname:"authoriyInfoAccess",
+3354 * array:[
+3355 * {ocsp: "http://ocsp1.example.com"},
+3356 * {caissuer: "http://example.com/a.crt"}
+3357 * ]}
+3358 * ];
+3359 * x = new X509();
+3360 * x.updateAIACAIssuer(aExt, "http://example.net/b.crt");
+3361 */
+3362 this.updateExtAIACAIssuer = function(aExt, newURI) {
+3363 var pExt = this.findExt(aExt, "authorityInfoAccess");
+3364 if (pExt == null) return;
+3365 if (pExt.array == undefined) return;
+3366 var a = pExt.array;
+3367 for (var i = 0; i < a.length; i++) {
+3368 if (a[i].caissuer != undefined) a[i].caissuer = newURI;
+3369 }
+3370 };
+3371
+3372 /**
+3373 * convert array for X500 distinguish name to distinguish name string<br/>
+3374 * @name dnarraytostr
+3375 * @memberOf X509#
+3376 * @function
+3377 * @param {Array} aDN array for X500 distinguish name
+3378 * @return {String} distinguish name
+3379 * @since jsrsasign 10.0.6 x509 2.0.8
+3380 * @see X509#getX500Name
+3381 * @see X509#getX500NameArray
+3382 * @see KJUR.asn1.x509.X500Name
+3383 *
+3384 * @description
+3385 * This method converts from an array representation of
+3386 * X.500 distinguished name to X.500 name string.
+3387 * This supports multi-valued RDN.
+3388 *
+3389 * @example
+3390 * var x = new X509();
+3391 * x.dnarraytostr(
+3392 * [[{type:"C",value:"JP",ds:"prn"}],
+3393 * [{type:"O",value:"T1",ds:"prn"}]]) → "/C=JP/O=T1"
+3394 * x.dnarraytostr(
+3395 * [[{type:"C",value:"JP",ds:"prn"}],
+3396 * [{type:"O",value:"T1",ds:"prn"}
+3397 * {type:"CN",value:"Bob",ds:"prn"}]]) → "/C=JP/O=T1+CN=Bob"
+3398 */
+3399 this.dnarraytostr = function(aDN) {
+3400 function rdnarraytostr(aRDN) {
+3401 return aRDN.map(function(x){return atvtostr(x).replace(/\+/,"\\+");}).join("+");
+3402 };
+3403
+3404 function atvtostr(pATV) {
+3405 return pATV.type + "=" + pATV.value;
+3406 };
+3407
+3408 return "/" + aDN.map(function(x){return rdnarraytostr(x).replace(/\//, "\\/");}).join("/");
+3409 };
+3410
+3411 /**
+3412 * set canonicalized DN to a DN parameter<br/>
+3413 * @name setCanonicalizedDN
+3414 * @memberOf X509#
+3415 * @function
+3416 * @param {object} pDN DN parameter associative array
+3417 * @since jsrsasign 10.6.0 x509 2.1.0
+3418 *
+3419 * @description
+3420 * This method canonicalizes a DN string as following:
+3421 * <ul>
+3422 * <li>convert to lower case</li>
+3423 * <li>convert from all multiple spaces to a space</li>
+3424 * </ul>
+3425 *
+3426 * @example
+3427 * var x = new X509();
+3428 * var pDN = {
+3429 * array: [
+3430 * [{type:'C',value:'JP',ds:'prn'}],
+3431 * [{type:'O',value:'Test 1',ds:'prn'}] ],
+3432 * str: "/C=JP/O=Test 1" };
+3433 * x.setCanonicalizedDN(pDN);
+3434
+3435 * // pDN will become following
+3436 * pDN = {
+3437 * array: [
+3438 * [{type:'C',value:'JP',ds:'prn'}],
+3439 * [{type:'O',value:'Test 1',ds:'prn'}] ],
+3440 * str: "/C=JP/O=Test 1",
+3441 * canon: "/c=jp/o=test 1" };
+3442 */
+3443 this.setCanonicalizedDN = function(pDN) {
+3444 var aRDN;
+3445 if (pDN.str != undefined && pDN.array == undefined) {
+3446 var dDN = new KJUR.asn1.x509.X500Name({str: pDN.str});
+3447 var hDN = dDN.tohex();
+3448 aRDN = this.getX500NameArray(hDN);
+3449 } else {
+3450 aRDN = pDN.array;
+3451 }
+3452 if (pDN.canon == undefined) {
+3453 pDN.canon = this.c14nRDNArray(aRDN);
+3454 }
+3455 };
+3456
+3457 /**
+3458 * simple canonicalization(c14n) for RDN array<br/>
+3459 * @name c14nRDNArray
+3460 * @memberOf X509#
+3461 * @function
+3462 * @param {array} aRDN array of RDN parameters
+3463 * @return {string} canonicalized distinguish name (ex. "/c=jp/o=test ca")
+3464 * @since jsrsasign 10.6.0 x509 2.1.0
+3465 *
+3466 * @description
+3467 * This method canonicalizes a DN string according to
+3468 * <a href="https://datatracker.ietf.org/doc/html/rfc4518#appendix-B">
+3469 * "RFC 4518 StringPrep Appendix B Substring Matching"</a> as following:
+3470 * <ul>
+3471 * <li>convert to lower case</li>
+3472 * <li>convert from all sequence of spaces to a space</li>
+3473 * <li>remove leading and trailing spaces</li>
+3474 * </ul>
+3475 *
+3476 * @example
+3477 * var x = new X509();
+3478 * x.c14nRDNArray([
+3479 * [{type:"C", value:"JP", ds: "prn"}],
+3480 * [{type:"O", value:" Test 1234 ", ds: "utf8"}],
+3481 * [{type:"OU", value:"HR 45", ds: "utf8"}]
+3482 * ]) → "/c=jp/o=test 1234/ou=hr 45"
+3483 */
+3484 this.c14nRDNArray = function(aRDN) {
+3485 var a = [];
+3486 for (var i = 0; i < aRDN.length; i++) {
+3487 var aAVA = aRDN[i];
+3488 var a2 = [];
+3489 for (var j = 0; j < aAVA.length; j++) {
+3490 var pAVA = aAVA[j];
+3491 var value = pAVA.value;
+3492 value = value.replace(/^\s*/, '');
+3493 value = value.replace(/\s*$/, '');
+3494 value = value.replace(/\s+/g, ' ');
+3495 value = value.toLowerCase();
+3496 a2.push(pAVA.type.toLowerCase() + "=" + value);
+3497 }
+3498 a.push(a2.join("+"));
+3499 }
+3500 return "/" + a.join("/");
+3501 };
+3502
+3503 /**
+3504 * get certificate information as string.<br/>
+3505 * @name getInfo
+3506 * @memberOf X509#
+3507 * @function
+3508 * @return {String} certificate information string
+3509 * @since jsrsasign 5.0.10 x509 1.1.8
+3510 * @example
+3511 * x = new X509();
+3512 * x.readCertPEM(certPEM);
+3513 * console.log(x.getInfo());
+3514 * // this shows as following
+3515 * Basic Fields
+3516 * serial number: 02ac5c266a0b409b8f0b79f2ae462577
+3517 * signature algorithm: SHA1withRSA
+3518 * issuer: /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
+3519 * notBefore: 061110000000Z
+3520 * notAfter: 311110000000Z
+3521 * subject: /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
+3522 * subject public key info:
+3523 * key algorithm: RSA
+3524 * n=c6cce573e6fbd4bb...
+3525 * e=10001
+3526 * X509v3 Extensions:
+3527 * keyUsage CRITICAL:
+3528 * digitalSignature,keyCertSign,cRLSign
+3529 * basicConstraints CRITICAL:
+3530 * cA=true
+3531 * subjectKeyIdentifier :
+3532 * b13ec36903f8bf4701d498261a0802ef63642bc3
+3533 * authorityKeyIdentifier :
+3534 * kid=b13ec36903f8bf4701d498261a0802ef63642bc3
+3535 * signature algorithm: SHA1withRSA
+3536 * signature: 1c1a0697dcd79c9f...
+3537 */
+3538 this.getInfo = function() {
+3539 var _getSubjectAltNameStr = function(params) {
+3540 var s = "";
+3541 var indent = " ";
+3542 var NL = "\n";
+3543 var a = params.array;
+3544 for (var i = 0; i < a.length; i++) {
+3545 var pGN = a[i];
+3546 if (pGN.dn != undefined) s += indent + "dn: " + pGN.dn.str + NL;
+3547 if (pGN.ip != undefined) s += indent + "ip: " + pGN.ip + NL;
+3548 if (pGN.rfc822 != undefined) s += indent + "rfc822: " + pGN.rfc822 + NL;
+3549 if (pGN.dns != undefined) s += indent + "dns: " + pGN.dns + NL;
+3550 if (pGN.uri != undefined) s += indent + "uri: " + pGN.uri + NL;
+3551 if (pGN.other != undefined) {
+3552 var oidname = pGN.other.oid;
+3553 var value = JSON.stringify(pGN.other.value).replace(/\"/g, '');
+3554 s += indent + "other: " + oidname + "=" + value + NL;
+3555 }
+3556 }
+3557 s = s.replace(/\n$/, '');
+3558 return s;
+3559 };
+3560 var _getCertificatePoliciesStr = function(params) {
+3561 var s = "";
+3562 var a = params.array;
+3563 for (var i = 0; i < a.length; i++) {
+3564 var pi = a[i];
+3565 s += " policy oid: " + pi.policyoid + "\n";
+3566 if (pi.array === undefined) continue;
+3567 for (var j = 0; j < pi.array.length; j++) {
+3568 var pqi = pi.array[j];
+3569 if (pqi.cps !== undefined) {
+3570 s += " cps: " + pqi.cps + "\n";
+3571 }
+3572 }
+3573 }
+3574 return s;
+3575 };
+3576 var _getCRLDistributionPointsStr = function(params) {
+3577 var s = "";
+3578 var a = params.array;
+3579 for (var i = 0; i < a.length; i++) {
+3580 var dp = a[i];
+3581 try {
+3582 if (dp.dpname.full[0].uri !== undefined)
+3583 s += " " + dp.dpname.full[0].uri + "\n";
+3584 } catch(ex) {};
+3585 try {
+3586 if (dp.dname.full[0].dn.hex !== undefined)
+3587 s += " " + X509.hex2dn(dp.dpname.full[0].dn.hex) + "\n";
+3588 } catch(ex) {};
+3589 }
+3590 return s;
+3591 }
+3592 var _getAuthorityInfoAccessStr = function(params) {
+3593 var s = "";
+3594 var a = params.array;
+3595 for (var i = 0; i < a.length; i++) {
+3596 var ad = a[i];
+3597
+3598 if (ad.caissuer !== undefined)
+3599 s += " caissuer: " + ad.caissuer + "\n";
+3600 if (ad.ocsp !== undefined)
+3601 s += " ocsp: " + ad.ocsp + "\n";
+3602 }
+3603 return s;
+3604 };
+3605 var _X509 = X509;
+3606 var s, pubkey, aExt;
+3607 s = "Basic Fields\n";
+3608 s += " serial number: " + this.getSerialNumberHex() + "\n";
+3609 s += " signature algorithm: " + this.getSignatureAlgorithmField() + "\n";
+3610 s += " issuer: " + this.getIssuerString() + "\n";
+3611 s += " notBefore: " + this.getNotBefore() + "\n";
+3612 s += " notAfter: " + this.getNotAfter() + "\n";
+3613 s += " subject: " + this.getSubjectString() + "\n";
+3614 s += " subject public key info: " + "\n";
+3615
+3616 // subject public key info
+3617 pubkey = this.getPublicKey();
+3618 s += " key algorithm: " + pubkey.type + "\n";
+3619
+3620 if (pubkey.type === "RSA") {
+3621 s += " n=" + hextoposhex(pubkey.n.toString(16)).substr(0, 16) + "...\n";
+3622 s += " e=" + hextoposhex(pubkey.e.toString(16)) + "\n";
+3623 }
+3624
+3625 // X.509v3 Extensions
+3626 aExt = this.aExtInfo;
+3627
+3628 if (aExt !== undefined && aExt !== null) {
+3629 s += "X509v3 Extensions:\n";
+3630
+3631 for (var i = 0; i < aExt.length; i++) {
+3632 var info = aExt[i];
+3633
+3634 // show extension name and critical flag
+3635 var extName = KJUR.asn1.x509.OID.oid2name(info["oid"]);
+3636 if (extName === '') extName = info["oid"];
+3637
+3638 var critical = '';
+3639 if (info["critical"] === true) critical = "CRITICAL";
3640
-3641 // show extension value if supported
-3642 if (extName === "basicConstraints") {
-3643 var bc = this.getExtBasicConstraints();
-3644 if (bc.cA === undefined) {
-3645 s += " {}\n";
-3646 } else {
-3647 s += " cA=true";
-3648 if (bc.pathLen !== undefined)
-3649 s += ", pathLen=" + bc.pathLen;
-3650 s += "\n";
-3651 }
-3652 } else if (extName == "policyMappings") {
-3653 var a = this.getExtPolicyMappings().array;
-3654 var sMap = a.map(function(item){
-3655 var aPolicy = item;
-3656 return aPolicy[0] + ":" + aPolicy[1];
-3657 }).join(", ");
-3658 s += " " + sMap + "\n";
-3659 } else if (extName == "policyConstraints") {
-3660 var p = this.getExtPolicyConstraints();
-3661 s += " ";
-3662 if (p.reqexp != undefined) s += " reqexp=" + p.reqexp;
-3663 if (p.inhibit != undefined) s += " inhibit=" + p.inhibit;
-3664 s += "\n";
-3665 } else if (extName == "inhibitAnyPolicy") {
-3666 var p = this.getExtInhibitAnyPolicy();
-3667 s += " skip=" + p.skip + "\n";
-3668 } else if (extName == "keyUsage") {
-3669 s += " " + this.getExtKeyUsageString() + "\n";
-3670 } else if (extName == "subjectKeyIdentifier") {
-3671 s += " " + this.getExtSubjectKeyIdentifier().kid.hex + "\n";
-3672 } else if (extName == "authorityKeyIdentifier") {
-3673 var akid = this.getExtAuthorityKeyIdentifier();
-3674 if (akid.kid !== undefined)
-3675 s += " kid=" + akid.kid.hex + "\n";
-3676 } else if (extName == "extKeyUsage") {
-3677 var eku = this.getExtExtKeyUsage().array;
-3678 s += " " + eku.join(", ") + "\n";
-3679 } else if (extName == "subjectAltName") {
-3680 var san = _getSubjectAltNameStr(this.getExtSubjectAltName());
-3681 s += san + "\n";
-3682 } else if (extName == "cRLDistributionPoints") {
-3683 var cdp = this.getExtCRLDistributionPoints();
-3684 s += _getCRLDistributionPointsStr(cdp);
-3685 } else if (extName == "authorityInfoAccess") {
-3686 var aia = this.getExtAuthorityInfoAccess();
-3687 s += _getAuthorityInfoAccessStr(aia);
-3688 } else if (extName == "certificatePolicies") {
-3689 s += _getCertificatePoliciesStr(this.getExtCertificatePolicies());
-3690 }
-3691 }
-3692 }
-3693
-3694 s += "signature algorithm: " + this.getSignatureAlgorithmName() + "\n";
-3695 s += "signature: " + this.getSignatureValueHex().substr(0, 16) + "...\n";
-3696 return s;
-3697 };
-3698
-3699 if (typeof params == "string") {
-3700 if (params.indexOf("-----BEGIN") != -1) {
-3701 this.readCertPEM(params);
-3702 } else if (KJUR.lang.String.isHex(params)) {
-3703 this.readCertHex(params);
-3704 }
-3705 }
-3706 };
-3707 // ----- END of X509 class -----
-3708
-3709 /**
-3710 * additional definition for X.509 extension parsers<br/>
-3711 * @see X509.registExtParser
-3712 */
-3713 X509.EXT_PARSER = {
-3714 };
-3715
-3716 /**
-3717 * define X.509 extension parser for specified OID<br/>
-3718 * @name registExtParser
-3719 * @memberOf X509
-3720 * @function
-3721 * @param {string} oid extension OID string (ex. "1.2.3.4")
-3722 * @param {function} func registering func extension value parsing function
-3723 * @return unspecified
-3724 * @since jsrsasign 10.7.0 x509 2.1.2
-3725 *
-3726 * @description
-3727 * <p>
-3728 * This static method specifies a X.509 extension value parsing function
-3729 * for specified an extension OID.
-3730 * </p>
-3731 * <p>
-3732 * Extension parser function must have following three arguments:
-3733 * <ul>
-3734 * <li>{string} oid - OID for extension (ex. "1.2.3.4")</li>
-3735 * <li>{boolean} critical - critical flag of extension</li>
-3736 * <li>{string} hExtV - hexadecimal string of extension value</li>
-3737 * </ul>
-3738 * The funcition must return an associative array for the extension
-3739 * when hExtV can be parsed properly. Otherwise it must return
-3740 * value "undefined".
-3741 * </p>
-3742 *
-3743 * @example
-3744 * function _extparser1(oid, critical, hExtV) {
-3745 * try {
-3746 * var result = { extname: oid, value: ASN1HEX.parse(hExtV).utf8str.str };
-3747 * if (critical) result.critical = true;
-3748 * return result;
-3749 * } catch(ex) {
-3750 * return undefined;
-3751 * }
-3752 * }
-3753 * X509.registExtParser("1.2.3.4", _extparser1);
-3754 */
-3755 X509.registExtParser = function(oid, func) {
-3756 X509.EXT_PARSER[oid] = func;
-3757 };
-3758
-3759 /**
-3760 * get distinguished name string in OpenSSL online format from hexadecimal string of ASN.1 DER X.500 name<br/>
-3761 * @name hex2dn
-3762 * @memberOf X509
-3763 * @function
-3764 * @param {String} hex hexadecimal string of ASN.1 DER distinguished name
-3765 * @param {Integer} idx index of hexadecimal string (DEFAULT=0)
-3766 * @return {String} OpenSSL online format distinguished name
-3767 * @description
-3768 * This static method converts from a hexadecimal string of
-3769 * distinguished name (DN)
-3770 * specified by 'hex' and 'idx' to OpenSSL oneline string representation (ex. /C=US/O=a).
-3771 * @example
-3772 * X509.hex2dn("3031310b3...") → /C=US/O=a/CN=b2+OU=b1
-3773 */
-3774 X509.hex2dn = function(hex, idx) {
-3775 if (idx === undefined) idx = 0;
-3776 var x = new X509();
-3777 var hDN = ASN1HEX.getTLV(hex, idx);
-3778 var pDN = x.getX500Name(hex);
-3779 return pDN.str;
-3780 };
-3781
-3782 /**
-3783 * get relative distinguished name string in OpenSSL online format from hexadecimal string of ASN.1 DER RDN<br/>
-3784 * @name hex2rdn
-3785 * @memberOf X509
-3786 * @function
-3787 * @param {String} hex hexadecimal string of ASN.1 DER concludes relative distinguished name
-3788 * @param {Integer} idx index of hexadecimal string (DEFAULT=0)
-3789 * @return {String} OpenSSL online format relative distinguished name
-3790 * @description
-3791 * This static method converts from a hexadecimal string of
-3792 * relative distinguished name (RDN)
-3793 * specified by 'hex' and 'idx' to LDAP string representation (ex. O=test+CN=test).<br/>
-3794 * NOTE: Multi-valued RDN is supported since jsnrsasign 6.2.2 x509 1.1.10.
-3795 * @example
-3796 * X509.hex2rdn("310a3008060355040a0c0161") → O=a
-3797 * X509.hex2rdn("31143008060355040a0c01613008060355040a0c0162") → O=a+O=b
-3798 */
-3799 X509.hex2rdn = function(hex, idx) {
-3800 if (idx === undefined) idx = 0;
-3801 if (hex.substr(idx, 2) !== "31") throw new Error("malformed RDN");
-3802
-3803 var a = new Array();
+3641 s += " " + extName + " " + critical + ":\n";
+3642
+3643 // show extension value if supported
+3644 if (extName === "basicConstraints") {
+3645 var bc = this.getExtBasicConstraints();
+3646 if (bc.cA === undefined) {
+3647 s += " {}\n";
+3648 } else {
+3649 s += " cA=true";
+3650 if (bc.pathLen !== undefined)
+3651 s += ", pathLen=" + bc.pathLen;
+3652 s += "\n";
+3653 }
+3654 } else if (extName == "policyMappings") {
+3655 var a = this.getExtPolicyMappings().array;
+3656 var sMap = a.map(function(item){
+3657 var aPolicy = item;
+3658 return aPolicy[0] + ":" + aPolicy[1];
+3659 }).join(", ");
+3660 s += " " + sMap + "\n";
+3661 } else if (extName == "policyConstraints") {
+3662 var p = this.getExtPolicyConstraints();
+3663 s += " ";
+3664 if (p.reqexp != undefined) s += " reqexp=" + p.reqexp;
+3665 if (p.inhibit != undefined) s += " inhibit=" + p.inhibit;
+3666 s += "\n";
+3667 } else if (extName == "inhibitAnyPolicy") {
+3668 var p = this.getExtInhibitAnyPolicy();
+3669 s += " skip=" + p.skip + "\n";
+3670 } else if (extName == "keyUsage") {
+3671 s += " " + this.getExtKeyUsageString() + "\n";
+3672 } else if (extName == "subjectKeyIdentifier") {
+3673 s += " " + this.getExtSubjectKeyIdentifier().kid.hex + "\n";
+3674 } else if (extName == "authorityKeyIdentifier") {
+3675 var akid = this.getExtAuthorityKeyIdentifier();
+3676 if (akid.kid !== undefined)
+3677 s += " kid=" + akid.kid.hex + "\n";
+3678 } else if (extName == "extKeyUsage") {
+3679 var eku = this.getExtExtKeyUsage().array;
+3680 s += " " + eku.join(", ") + "\n";
+3681 } else if (extName == "subjectAltName") {
+3682 var san = _getSubjectAltNameStr(this.getExtSubjectAltName());
+3683 s += san + "\n";
+3684 } else if (extName == "cRLDistributionPoints") {
+3685 var cdp = this.getExtCRLDistributionPoints();
+3686 s += _getCRLDistributionPointsStr(cdp);
+3687 } else if (extName == "authorityInfoAccess") {
+3688 var aia = this.getExtAuthorityInfoAccess();
+3689 s += _getAuthorityInfoAccessStr(aia);
+3690 } else if (extName == "certificatePolicies") {
+3691 s += _getCertificatePoliciesStr(this.getExtCertificatePolicies());
+3692 }
+3693 }
+3694 }
+3695
+3696 s += "signature algorithm: " + this.getSignatureAlgorithmName() + "\n";
+3697 s += "signature: " + this.getSignatureValueHex().substr(0, 16) + "...\n";
+3698 return s;
+3699 };
+3700
+3701 if (typeof params == "string") {
+3702 if (params.indexOf("-----BEGIN") != -1) {
+3703 this.readCertPEM(params);
+3704 } else if (KJUR.lang.String.isHex(params)) {
+3705 this.readCertHex(params);
+3706 }
+3707 }
+3708 };
+3709 // ----- END of X509 class -----
+3710
+3711 /**
+3712 * additional definition for X.509 extension parsers<br/>
+3713 * @see X509.registExtParser
+3714 */
+3715 X509.EXT_PARSER = {
+3716 };
+3717
+3718 /**
+3719 * define X.509 extension parser for specified OID<br/>
+3720 * @name registExtParser
+3721 * @memberOf X509
+3722 * @function
+3723 * @param {string} oid extension OID string (ex. "1.2.3.4")
+3724 * @param {function} func registering func extension value parsing function
+3725 * @return unspecified
+3726 * @since jsrsasign 10.7.0 x509 2.1.2
+3727 *
+3728 * @description
+3729 * <p>
+3730 * This static method specifies a X.509 extension value parsing function
+3731 * for specified an extension OID.
+3732 * </p>
+3733 * <p>
+3734 * Extension parser function must have following three arguments:
+3735 * <ul>
+3736 * <li>{string} oid - OID for extension (ex. "1.2.3.4")</li>
+3737 * <li>{boolean} critical - critical flag of extension</li>
+3738 * <li>{string} hExtV - hexadecimal string of extension value</li>
+3739 * </ul>
+3740 * The funcition must return an associative array for the extension
+3741 * when hExtV can be parsed properly. Otherwise it must return
+3742 * value "undefined".
+3743 * </p>
+3744 *
+3745 * @example
+3746 * function _extparser1(oid, critical, hExtV) {
+3747 * try {
+3748 * var result = { extname: oid, value: ASN1HEX.parse(hExtV).utf8str.str };
+3749 * if (critical) result.critical = true;
+3750 * return result;
+3751 * } catch(ex) {
+3752 * return undefined;
+3753 * }
+3754 * }
+3755 * X509.registExtParser("1.2.3.4", _extparser1);
+3756 */
+3757 X509.registExtParser = function(oid, func) {
+3758 X509.EXT_PARSER[oid] = func;
+3759 };
+3760
+3761 /**
+3762 * get distinguished name string in OpenSSL online format from hexadecimal string of ASN.1 DER X.500 name<br/>
+3763 * @name hex2dn
+3764 * @memberOf X509
+3765 * @function
+3766 * @param {String} hex hexadecimal string of ASN.1 DER distinguished name
+3767 * @param {Integer} idx index of hexadecimal string (DEFAULT=0)
+3768 * @return {String} OpenSSL online format distinguished name
+3769 * @description
+3770 * This static method converts from a hexadecimal string of
+3771 * distinguished name (DN)
+3772 * specified by 'hex' and 'idx' to OpenSSL oneline string representation (ex. /C=US/O=a).
+3773 * @example
+3774 * X509.hex2dn("3031310b3...") → /C=US/O=a/CN=b2+OU=b1
+3775 */
+3776 X509.hex2dn = function(hex, idx) {
+3777 if (idx === undefined) idx = 0;
+3778 var x = new X509();
+3779 var hDN = ASN1HEX.getTLV(hex, idx);
+3780 var pDN = x.getX500Name(hex);
+3781 return pDN.str;
+3782 };
+3783
+3784 /**
+3785 * get relative distinguished name string in OpenSSL online format from hexadecimal string of ASN.1 DER RDN<br/>
+3786 * @name hex2rdn
+3787 * @memberOf X509
+3788 * @function
+3789 * @param {String} hex hexadecimal string of ASN.1 DER concludes relative distinguished name
+3790 * @param {Integer} idx index of hexadecimal string (DEFAULT=0)
+3791 * @return {String} OpenSSL online format relative distinguished name
+3792 * @description
+3793 * This static method converts from a hexadecimal string of
+3794 * relative distinguished name (RDN)
+3795 * specified by 'hex' and 'idx' to LDAP string representation (ex. O=test+CN=test).<br/>
+3796 * NOTE: Multi-valued RDN is supported since jsnrsasign 6.2.2 x509 1.1.10.
+3797 * @example
+3798 * X509.hex2rdn("310a3008060355040a0c0161") → O=a
+3799 * X509.hex2rdn("31143008060355040a0c01613008060355040a0c0162") → O=a+O=b
+3800 */
+3801 X509.hex2rdn = function(hex, idx) {
+3802 if (idx === undefined) idx = 0;
+3803 if (hex.substr(idx, 2) !== "31") throw new Error("malformed RDN");
3804
-3805 var aIdx = ASN1HEX.getChildIdx(hex, idx);
-3806 for (var i = 0; i < aIdx.length; i++) {
-3807 a.push(X509.hex2attrTypeValue(hex, aIdx[i]));
-3808 }
-3809
-3810 a = a.map(function(s) { return s.replace("+", "\\+"); });
-3811 return a.join("+");
-3812 };
-3813
-3814 /**
-3815 * get string from hexadecimal string of ASN.1 DER AttributeTypeAndValue<br/>
-3816 * @name hex2attrTypeValue
-3817 * @memberOf X509
-3818 * @function
-3819 * @param {String} hex hexadecimal string of ASN.1 DER concludes AttributeTypeAndValue
-3820 * @param {Integer} idx index of hexadecimal string (DEFAULT=0)
-3821 * @return {String} string representation of AttributeTypeAndValue (ex. C=US)
-3822 * @description
-3823 * This static method converts from a hexadecimal string of AttributeTypeAndValue
-3824 * specified by 'hex' and 'idx' to LDAP string representation (ex. C=US).
-3825 * @example
-3826 * X509.hex2attrTypeValue("3008060355040a0c0161") → O=a
-3827 * X509.hex2attrTypeValue("300806035504060c0161") → C=a
-3828 * X509.hex2attrTypeValue("...3008060355040a0c0161...", 128) → O=a
-3829 */
-3830 X509.hex2attrTypeValue = function(hex, idx) {
-3831 var _ASN1HEX = ASN1HEX;
-3832 var _getV = _ASN1HEX.getV;
-3833
-3834 if (idx === undefined) idx = 0;
-3835 if (hex.substr(idx, 2) !== "30")
-3836 throw new Error("malformed attribute type and value");
-3837
-3838 var aIdx = _ASN1HEX.getChildIdx(hex, idx);
-3839 if (aIdx.length !== 2 || hex.substr(aIdx[0], 2) !== "06")
-3840 "malformed attribute type and value";
-3841
-3842 var oidHex = _getV(hex, aIdx[0]);
-3843 var oidInt = KJUR.asn1.ASN1Util.oidHexToInt(oidHex);
-3844 var atype = KJUR.asn1.x509.OID.oid2atype(oidInt);
-3845
-3846 var hV = _getV(hex, aIdx[1]);
-3847 var rawV = hextorstr(hV);
-3848
-3849 return atype + "=" + rawV;
-3850 };
-3851
-3852 /**
-3853 * get RSA/DSA/ECDSA public key object from X.509 certificate hexadecimal string<br/>
-3854 * @name getPublicKeyFromCertHex
-3855 * @memberOf X509
-3856 * @function
-3857 * @param {String} h hexadecimal string of X.509 certificate for RSA/ECDSA/DSA public key
-3858 * @return returns RSAKey/KJUR.crypto.{ECDSA,DSA} object of public key
-3859 * @since jsrasign 7.1.0 x509 1.1.11
-3860 */
-3861 X509.getPublicKeyFromCertHex = function(h) {
-3862 var x = new X509();
-3863 x.readCertHex(h);
-3864 return x.getPublicKey();
-3865 };
-3866
-3867 /**
-3868 * get RSA/DSA/ECDSA public key object from PEM certificate string
-3869 * @name getPublicKeyFromCertPEM
-3870 * @memberOf X509
-3871 * @function
-3872 * @param {String} sCertPEM PEM formatted RSA/ECDSA/DSA X.509 certificate
-3873 * @return returns RSAKey/KJUR.crypto.{ECDSA,DSA} object of public key
-3874 * @since x509 1.1.1
-3875 * @description
-3876 * NOTE: DSA is also supported since x509 1.1.2.
-3877 */
-3878 X509.getPublicKeyFromCertPEM = function(sCertPEM) {
-3879 var x = new X509();
-3880 x.readCertPEM(sCertPEM);
-3881 return x.getPublicKey();
-3882 };
-3883
-3884 /**
-3885 * get public key information from PEM certificate
-3886 * @name getPublicKeyInfoPropOfCertPEM
-3887 * @memberOf X509
-3888 * @function
-3889 * @param {String} sCertPEM string of PEM formatted certificate
-3890 * @return {Hash} hash of information for public key
-3891 * @since x509 1.1.1
-3892 * @description
-3893 * Resulted associative array has following properties:<br/>
-3894 * <ul>
-3895 * <li>algoid - hexadecimal string of OID of asymmetric key algorithm</li>
-3896 * <li>algparam - hexadecimal string of OID of ECC curve name or null</li>
-3897 * <li>keyhex - hexadecimal string of key in the certificate</li>
-3898 * </ul>
-3899 * NOTE: X509v1 certificate is also supported since x509.js 1.1.9.
-3900 */
-3901 X509.getPublicKeyInfoPropOfCertPEM = function(sCertPEM) {
-3902 var _ASN1HEX = ASN1HEX;
-3903 var _getVbyList = _ASN1HEX.getVbyList;
-3904
-3905 var result = {};
-3906 var x, hSPKI, pubkey;
-3907 result.algparam = null;
-3908
-3909 x = new X509();
-3910 x.readCertPEM(sCertPEM);
-3911
-3912 hSPKI = x.getPublicKeyHex();
-3913 result.keyhex = _getVbyList(hSPKI, 0, [1], "03").substr(2);
-3914 result.algoid = _getVbyList(hSPKI, 0, [0, 0], "06");
-3915
-3916 if (result.algoid === "2a8648ce3d0201") { // ecPublicKey
-3917 result.algparam = _getVbyList(hSPKI, 0, [0, 1], "06");
-3918 };
-3919
-3920 return result;
-3921 };
-3922
-3923 /* ======================================================================
-3924 * Specific V3 Extensions
-3925 * ====================================================================== */
-3926
-3927 X509.KEYUSAGE_NAME = [
-3928 "digitalSignature",
-3929 "nonRepudiation",
-3930 "keyEncipherment",
-3931 "dataEncipherment",
-3932 "keyAgreement",
-3933 "keyCertSign",
-3934 "cRLSign",
-3935 "encipherOnly",
-3936 "decipherOnly"
-3937 ];
-3938