diff --git a/api/symbols/KJUR.asn1.x509.html b/api/symbols/KJUR.asn1.x509.html
index 459aa44c..ea5e4cb7 100644
--- a/api/symbols/KJUR.asn1.x509.html
+++ b/api/symbols/KJUR.asn1.x509.html
@@ -724,6 +724,7 @@ SUPPORTED EXTENSIONS
KJUR.asn1.x509.OCSPNoCheck
KJUR.asn1.x509.AdobeTimeStamp
KJUR.asn1.x509.SubjectDirectoryAttributes
+KJUR.asn1.x509.PrivateExtension
NOTE1: Please ignore method summary and document of this namespace. This caused by a bug of jsdoc2.
NOTE2: SubjectAltName and IssuerAltName supported since
diff --git a/api/symbols/src/asn1x509-1.0.js.html b/api/symbols/src/asn1x509-1.0.js.html
index d0c12a80..335c3dec 100644
--- a/api/symbols/src/asn1x509-1.0.js.html
+++ b/api/symbols/src/asn1x509-1.0.js.html
@@ -97,4246 +97,4247 @@
90 * <li>{@link KJUR.asn1.x509.OCSPNoCheck}</li>
91 * <li>{@link KJUR.asn1.x509.AdobeTimeStamp}</li>
92 * <li>{@link KJUR.asn1.x509.SubjectDirectoryAttributes}</li>
- 93 * </ul>
- 94 * NOTE1: Please ignore method summary and document of this namespace. This caused by a bug of jsdoc2.<br/>
- 95 * NOTE2: SubjectAltName and IssuerAltName supported since
- 96 * jsrsasign 6.2.3 asn1x509 1.0.19.<br/>
- 97 * NOTE3: CeritifcatePolicies supported supported since
- 98 * jsrsasign 8.0.23 asn1x509 1.1.12<br/>
- 99 * @name KJUR.asn1.x509
-100 * @namespace
-101 */
-102 if (typeof KJUR.asn1.x509 == "undefined" || !KJUR.asn1.x509) KJUR.asn1.x509 = {};
-103
-104 // === BEGIN Certificate ===================================================
-105
-106 /**
-107 * X.509 Certificate class to sign and generate hex encoded certificate
-108 * @name KJUR.asn1.x509.Certificate
-109 * @class X.509 Certificate class to sign and generate hex encoded certificate
-110 * @property {Array} params JSON object of parameters
-111 * @param {Array} params JSON object for Certificate parameters
-112 * @extends KJUR.asn1.ASN1Object
-113 * @description
-114 * <br/>
-115 * This class provides Certificate ASN.1 class structure
-116 * defined in
-117 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1">
-118 * RFC 5280 4.1</a>.
-119 * <pre>
-120 * Certificate ::= SEQUENCE {
-121 * tbsCertificate TBSCertificate,
-122 * signatureAlgorithm AlgorithmIdentifier,
-123 * signatureValue BIT STRING }
-124 * </pre>
-125 * Parameter "params" JSON object can be
-126 * the same as {@link KJUR.asn1.x509.TBSCertificate}.
-127 * Then they are used to generate TBSCertificate.
-128 * Additionally just for Certificate, following parameters can be used:
-129 * <ul>
-130 * <li>{TBSCertfificate}tbsobj -
-131 * specifies {@link KJUR.asn1.x509.TBSCertificate}
-132 * object to be signed if needed.
-133 * When this isn't specified,
-134 * this will be set from other parametes of TBSCertificate.</li>
-135 * <li>{Object}cakey (OPTION) - specifies certificate signing private key.
-136 * Parameter "cakey" or "sighex" shall be specified. Following
-137 * values can be specified:
-138 * <ul>
-139 * <li>PKCS#1/5 or PKCS#8 PEM string of private key</li>
-140 * <li>RSAKey/DSA/ECDSA key object. {@link KEYUTIL.getKey} is useful
-141 * to generate a key object.</li>
-142 * </ul>
-143 * </li>
-144 * <li>{String}sighex (OPTION) - hexadecimal string of signature value
-145 * (i.e. ASN.1 value(V) of signatureValue BIT STRING without
-146 * unused bits)</li>
-147 * </ul>
-148 * CAUTION: APIs of this class have been totally updated without
-149 * backward compatibility since jsrsasign 9.0.0.<br/>
-150 * NOTE1: 'params' can be omitted.<br/>
-151 * NOTE2: DSA/ECDSA is also supported for CA signging key from asn1x509 1.0.6.
-152 * @example
-153 * var cert = new KJUR.asn1.x509.Certificate({
-154 * version: 3,
-155 * serial: {hex: "1234..."},
-156 * sigalg: "SHA256withRSAandMGF1",
-157 * ...
-158 * sighex: "1d3f..." // sign() method won't be called
-159 * });
-160 *
-161 * // sighex will by calculated by signing with cakey
-162 * var cert = new KJUR.asn1.x509.Certificate({
-163 * version: 3,
-164 * serial: {hex: "2345..."},
-165 * sigalg: "SHA256withRSA",
-166 * ...
-167 * cakey: "-----BEGIN PRIVATE KEY..."
-168 * });
-169 *
-170 * // use TBSCertificate object to sign
-171 * var cert = new KJUR.asn1.x509.Certificate({
-172 * tbsobj: <<OBJ>>,
-173 * sigalg: "SHA256withRSA",
-174 * cakey: "-----BEGIN PRIVATE KEY..."
-175 * });
-176 */
-177 KJUR.asn1.x509.Certificate = function(params) {
-178 KJUR.asn1.x509.Certificate.superclass.constructor.call(this);
-179 var _KJUR = KJUR,
-180 _KJUR_asn1 = _KJUR.asn1,
-181 _DERBitString = _KJUR_asn1.DERBitString,
-182 _DERSequence = _KJUR_asn1.DERSequence,
-183 _KJUR_asn1_x509 = _KJUR_asn1.x509,
-184 _TBSCertificate = _KJUR_asn1_x509.TBSCertificate,
-185 _AlgorithmIdentifier = _KJUR_asn1_x509.AlgorithmIdentifier;
-186
-187 this.params = undefined;
-188
-189 /**
-190 * set parameter<br/>
-191 * @name setByParam
-192 * @memberOf KJUR.asn1.x509.Certificate#
-193 * @function
-194 * @param params {Array} JSON object of certificate parameters
-195 * @since jsrsasign 9.0.0 asn1hex 2.0.0
-196 * @description
-197 * This method will set parameter
-198 * {@link KJUR.asn1.x509.Certificate#params}
-199 * to this object.
-200 * @example
-201 * cert = new KJUR.asn1.x509.Certificate();
-202 * cert.setByParam({
-203 * version: 3,
-204 * serial: {hex: "1234..."},
-205 * ...
-206 * });
-207 */
-208 this.setByParam = function(params) {
-209 this.params = params;
-210 };
-211
-212 /**
-213 * sign certificate<br/>
-214 * @name sign
-215 * @memberOf KJUR.asn1.x509.Certificate#
-216 * @function
-217 * @description
-218 * This method signs TBSCertificate with a specified
-219 * private key and algorithm by
-220 * this.params.cakey and this.params.sigalg parameter.
-221 * @example
-222 * cert = new KJUR.asn1.x509.Certificate({...});
-223 * cert.sign()
-224 */
-225 this.sign = function() {
-226 var params = this.params;
-227
-228 var sigalg = params.sigalg;
-229 if (params.sigalg.name != undefined)
-230 sigalg = params.sigalg.name;
-231
-232 var hTBS = params.tbsobj.getEncodedHex();
-233 var sig = new KJUR.crypto.Signature({alg: sigalg});
-234 sig.init(params.cakey);
-235 sig.updateHex(hTBS);
-236 params.sighex = sig.sign();
-237 };
-238
-239 /**
-240 * get PEM formatted certificate string after signed
-241 * @name getPEM
-242 * @memberOf KJUR.asn1.x509.Certificate#
-243 * @function
-244 * @return PEM formatted string of certificate
-245 * @since jsrsasign 9.0.0 asn1hex 2.0.0
-246 * @description
-247 * This method returns a string of PEM formatted
-248 * certificate.
-249 * @example
-250 * cert = new KJUR.asn1.x509.Certificate({...});
-251 * cert.getPEM() →
-252 * "-----BEGIN CERTIFICATE-----\r\n..."
-253 */
-254 this.getPEM = function() {
-255 return hextopem(this.getEncodedHex(), "CERTIFICATE");
-256 };
-257
-258 this.getEncodedHex = function() {
-259 var params = this.params;
-260
-261 if (params.tbsobj == undefined || params.tbsobj == null) {
-262 params.tbsobj = new _TBSCertificate(params);
-263 }
-264
-265 if (params.sighex == undefined && params.cakey != undefined) {
-266 this.sign();
-267 }
-268
-269 if (params.sighex == undefined) {
-270 throw new Error("sighex or cakey parameter not defined");
-271 }
-272
-273 var a = [];
-274 a.push(params.tbsobj);
-275 a.push(new _AlgorithmIdentifier({name: params.sigalg}));
-276 a.push(new _DERBitString({hex: "00" + params.sighex}));
-277 var seq = new _DERSequence({array: a});
-278 return seq.getEncodedHex();
-279 };
-280
-281 if (params != undefined) this.params = params;
-282 };
-283 YAHOO.lang.extend(KJUR.asn1.x509.Certificate, KJUR.asn1.ASN1Object);
-284
-285 /**
-286 * ASN.1 TBSCertificate structure class<br/>
-287 * @name KJUR.asn1.x509.TBSCertificate
-288 * @class ASN.1 TBSCertificate structure class
-289 * @property {Array} params JSON object of parameters
-290 * @param {Array} params JSON object of TBSCertificate parameters
-291 * @extends KJUR.asn1.ASN1Object
-292 * @see KJUR.asn1.x509.Certificate
-293 *
-294 * @description
-295 * <br/>
-296 * NOTE: TBSCertificate class is updated without backward
-297 * compatibility from jsrsasign 9.0.0 asn1x509 2.0.0.
-298 * Most of methods are removed and parameters can be set
-299 * by JSON object.
-300 *
-301 * @example
-302 * new TBSCertificate({
-303 * version: 3, // this can be omitted, the default is 3.
-304 * serial: {hex: "1234..."}, // DERInteger parameter
-305 * sigalg: "SHA256withRSA",
-306 * issuer: {array:[[{type:'O',value:'Test',ds:'prn'}]]}, // X500Name parameter
-307 * notbefore: "151231235959Z", // string, passed to Time
-308 * notafter: "251231235959Z", // string, passed to Time
-309 * subject: {array:[[{type:'O',value:'Test',ds:'prn'}]]}, // X500Name parameter
-310 * sbjpubkey: "-----BEGIN...", // KEYUTIL.getKey pubkey parameter
-311 * // As for extension parameters, please see extension class
-312 * // All extension parameters need to have "extname" parameter additionaly.
-313 * ext:[{
-314 * extname:"keyUsage",critical:true,
-315 * names:["digitalSignature","keyEncipherment"]
-316 * },{
-317 * extname:"cRLDistributionPoints",
-318 * array:[{dpname:{full:[{uri:"http://example.com/a1.crl"}]}}]
-319 * }, ...]
-320 * })
-321 *
-322 * var tbsc = new TBSCertificate();
-323 * tbsc.setByParam({version:3,serial:{hex:'1234...'},...});
-324 */
-325 KJUR.asn1.x509.TBSCertificate = function(params) {
-326 KJUR.asn1.x509.TBSCertificate.superclass.constructor.call(this);
-327 var _KJUR = KJUR,
-328 _KJUR_asn1 = _KJUR.asn1,
-329 _KJUR_asn1_x509 = _KJUR_asn1.x509,
-330 _DERTaggedObject = _KJUR_asn1.DERTaggedObject,
-331 _DERInteger = _KJUR_asn1.DERInteger,
-332 _DERSequence = _KJUR_asn1.DERSequence,
-333 _AlgorithmIdentifier = _KJUR_asn1_x509.AlgorithmIdentifier,
-334 _Time = _KJUR_asn1_x509.Time,
-335 _X500Name = _KJUR_asn1_x509.X500Name,
-336 _Extensions = _KJUR_asn1_x509.Extensions,
-337 _SubjectPublicKeyInfo = _KJUR_asn1_x509.SubjectPublicKeyInfo;
-338
-339 this.params = null;
-340
-341 /**
-342 * get array of ASN.1 object for extensions<br/>
-343 * @name setByParam
-344 * @memberOf KJUR.asn1.x509.TBSCertificate#
-345 * @function
-346 * @param {Array} JSON object of TBSCertificate parameters
-347 * @example
-348 * tbsc = new KJUR.asn1.x509.TBSCertificate();
-349 * tbsc.setByParam({version:3, serial:{hex:'1234...'},...});
-350 */
-351 this.setByParam = function(params) {
-352 this.params = params;
-353 };
-354
-355 this.getEncodedHex = function() {
-356 var a = [];
-357 var params = this.params;
-358
-359 // X.509v3 default if params.version not defined
-360 if (params.version != undefined || params.version != 1) {
-361 var version = 2;
-362 if (params.version != undefined) version = params.version - 1;
-363 var obj =
-364 new _DERTaggedObject({obj: new _DERInteger({'int': version})})
-365 a.push(obj);
-366 }
-367
-368 a.push(new _DERInteger(params.serial));
-369 a.push(new _AlgorithmIdentifier({name: params.sigalg}));
-370 a.push(new _X500Name(params.issuer));
-371 a.push(new _DERSequence({array:[new _Time(params.notbefore),
-372 new _Time(params.notafter)]}));
-373 a.push(new _X500Name(params.subject));
-374 a.push(new _SubjectPublicKeyInfo(KEYUTIL.getKey(params.sbjpubkey)));
-375 if (params.ext !== undefined && params.ext.length > 0) {
-376 a.push(new _DERTaggedObject({tag: "a3",
-377 obj: new _Extensions(params.ext)}));
-378 }
-379
-380 var seq = new KJUR.asn1.DERSequence({array: a});
-381 return seq.getEncodedHex();
-382 };
-383
-384 if (params !== undefined) this.setByParam(params);
-385 };
-386 YAHOO.lang.extend(KJUR.asn1.x509.TBSCertificate, KJUR.asn1.ASN1Object);
-387
-388 /**
-389 * Extensions ASN.1 structure class<br/>
-390 * @name KJUR.asn1.x509.Extensions
-391 * @class Extensions ASN.1 structure class
-392 * @param {Array} aParam array of JSON extension parameter
-393 * @extends KJUR.asn1.ASN1Object
-394 * @since jsrsasign 9.1.0 asn1x509 2.1.0
-395 * @see KJUR.asn1.x509.TBSCertificate
-396 * @see KJUR.asn1.x509.TBSCertList
-397 * @see KJUR.asn1.csr.CertificationRequestInfo
-398 * @see KJUR.asn1.x509.PrivateExtension
-399 *
-400 * @description
-401 * This class represents
-402 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1">
-403 * Extensions defined in RFC 5280 4.1</a> and
-404 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.9">
-405 * 4.1.2.9</a>.
-406 * <pre>
-407 * Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
-408 * </pre>
-409 * NOTE: From jsrsasign 9.1.1, private extension or
-410 * undefined extension have been supported by
-411 * {@link KJUR.asn1.x509.PrivateExtension}.
-412 *
-413 * @example
-414 * o = new KJUR.asn1.x509.Extensions([
-415 * {extname:"keyUsage",critical:true,names:["digitalSignature"]},
-416 * {extname:"subjectAltName",array:[{dns:"example.com"}]},
-417 * {extname:"1.2.3.4",extn:{prnstr:"aa"}} // private extension
-418 * ]);
-419 * o.getEncodedHex() → "30..."
-420 */
-421 KJUR.asn1.x509.Extensions = function(aParam) {
-422 KJUR.asn1.x509.Extensions.superclass.constructor.call(this);
-423 var _KJUR = KJUR,
-424 _KJUR_asn1 = _KJUR.asn1,
-425 _DERSequence = _KJUR_asn1.DERSequence,
-426 _KJUR_asn1_x509 = _KJUR_asn1.x509;
-427 this.aParam = [];
-428
-429 this.setByParam = function(aParam) { this.aParam = aParam; }
-430
-431 this.getEncodedHex = function() {
-432 var a = [];
-433 for (var i = 0; i < this.aParam.length; i++) {
-434 var param = this.aParam[i];
-435 var extname = param.extname;
-436 var obj = null;
-437
-438 if (param.extn != undefined) {
-439 obj = new _KJUR_asn1_x509.PrivateExtension(param);
-440 } else if (extname == "subjectKeyIdentifier") {
-441 obj = new _KJUR_asn1_x509.SubjectKeyIdentifier(param);
-442 } else if (extname == "keyUsage") {
-443 obj = new _KJUR_asn1_x509.KeyUsage(param);
-444 } else if (extname == "subjectAltName") {
-445 obj = new _KJUR_asn1_x509.SubjectAltName(param);
-446 } else if (extname == "issuerAltName") {
-447 obj = new _KJUR_asn1_x509.IssuerAltName(param);
-448 } else if (extname == "basicConstraints") {
-449 obj = new _KJUR_asn1_x509.BasicConstraints(param);
-450 } else if (extname == "cRLDistributionPoints") {
-451 obj = new _KJUR_asn1_x509.CRLDistributionPoints(param);
-452 } else if (extname == "certificatePolicies") {
-453 obj = new _KJUR_asn1_x509.CertificatePolicies(param);
-454 } else if (extname == "authorityKeyIdentifier") {
-455 obj = new _KJUR_asn1_x509.AuthorityKeyIdentifier(param);
-456 } else if (extname == "extKeyUsage") {
-457 obj = new _KJUR_asn1_x509.ExtKeyUsage(param);
-458 } else if (extname == "authorityInfoAccess") {
-459 obj = new _KJUR_asn1_x509.AuthorityInfoAccess(param);
-460 } else if (extname == "cRLNumber") {
-461 obj = new _KJUR_asn1_x509.CRLNumber(param);
-462 } else if (extname == "cRLReason") {
-463 obj = new _KJUR_asn1_x509.CRLReason(param);
-464 } else if (extname == "ocspNonce") {
-465 obj = new _KJUR_asn1_x509.OCSPNonce(param);
-466 } else if (extname == "ocspNoCheck") {
-467 obj = new _KJUR_asn1_x509.OCSPNoCheck(param);
-468 } else if (extname == "adobeTimeStamp") {
-469 obj = new _KJUR_asn1_x509.AdobeTimeStamp(param);
-470 } else if (extname == "subjectDirectoryAttributes") {
-471 obj = new _KJUR_asn1_x509.SubjectDirectoryAttributes(param);
-472 } else {
-473 throw new Error("extension not supported:"
-474 + JSON.stringify(param));
-475 }
-476 if (obj != null) a.push(obj);
-477 }
-478
-479 var seq = new _DERSequence({array: a});
-480 return seq.getEncodedHex();
-481 };
-482
-483 if (aParam != undefined) this.setByParam(aParam);
-484 };
-485 YAHOO.lang.extend(KJUR.asn1.x509.Extensions, KJUR.asn1.ASN1Object);
-486
+ 93 * <li>{@link KJUR.asn1.x509.PrivateExtension}</li>
+ 94 * </ul>
+ 95 * NOTE1: Please ignore method summary and document of this namespace. This caused by a bug of jsdoc2.<br/>
+ 96 * NOTE2: SubjectAltName and IssuerAltName supported since
+ 97 * jsrsasign 6.2.3 asn1x509 1.0.19.<br/>
+ 98 * NOTE3: CeritifcatePolicies supported supported since
+ 99 * jsrsasign 8.0.23 asn1x509 1.1.12<br/>
+100 * @name KJUR.asn1.x509
+101 * @namespace
+102 */
+103 if (typeof KJUR.asn1.x509 == "undefined" || !KJUR.asn1.x509) KJUR.asn1.x509 = {};
+104
+105 // === BEGIN Certificate ===================================================
+106
+107 /**
+108 * X.509 Certificate class to sign and generate hex encoded certificate
+109 * @name KJUR.asn1.x509.Certificate
+110 * @class X.509 Certificate class to sign and generate hex encoded certificate
+111 * @property {Array} params JSON object of parameters
+112 * @param {Array} params JSON object for Certificate parameters
+113 * @extends KJUR.asn1.ASN1Object
+114 * @description
+115 * <br/>
+116 * This class provides Certificate ASN.1 class structure
+117 * defined in
+118 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1">
+119 * RFC 5280 4.1</a>.
+120 * <pre>
+121 * Certificate ::= SEQUENCE {
+122 * tbsCertificate TBSCertificate,
+123 * signatureAlgorithm AlgorithmIdentifier,
+124 * signatureValue BIT STRING }
+125 * </pre>
+126 * Parameter "params" JSON object can be
+127 * the same as {@link KJUR.asn1.x509.TBSCertificate}.
+128 * Then they are used to generate TBSCertificate.
+129 * Additionally just for Certificate, following parameters can be used:
+130 * <ul>
+131 * <li>{TBSCertfificate}tbsobj -
+132 * specifies {@link KJUR.asn1.x509.TBSCertificate}
+133 * object to be signed if needed.
+134 * When this isn't specified,
+135 * this will be set from other parametes of TBSCertificate.</li>
+136 * <li>{Object}cakey (OPTION) - specifies certificate signing private key.
+137 * Parameter "cakey" or "sighex" shall be specified. Following
+138 * values can be specified:
+139 * <ul>
+140 * <li>PKCS#1/5 or PKCS#8 PEM string of private key</li>
+141 * <li>RSAKey/DSA/ECDSA key object. {@link KEYUTIL.getKey} is useful
+142 * to generate a key object.</li>
+143 * </ul>
+144 * </li>
+145 * <li>{String}sighex (OPTION) - hexadecimal string of signature value
+146 * (i.e. ASN.1 value(V) of signatureValue BIT STRING without
+147 * unused bits)</li>
+148 * </ul>
+149 * CAUTION: APIs of this class have been totally updated without
+150 * backward compatibility since jsrsasign 9.0.0.<br/>
+151 * NOTE1: 'params' can be omitted.<br/>
+152 * NOTE2: DSA/ECDSA is also supported for CA signging key from asn1x509 1.0.6.
+153 * @example
+154 * var cert = new KJUR.asn1.x509.Certificate({
+155 * version: 3,
+156 * serial: {hex: "1234..."},
+157 * sigalg: "SHA256withRSAandMGF1",
+158 * ...
+159 * sighex: "1d3f..." // sign() method won't be called
+160 * });
+161 *
+162 * // sighex will by calculated by signing with cakey
+163 * var cert = new KJUR.asn1.x509.Certificate({
+164 * version: 3,
+165 * serial: {hex: "2345..."},
+166 * sigalg: "SHA256withRSA",
+167 * ...
+168 * cakey: "-----BEGIN PRIVATE KEY..."
+169 * });
+170 *
+171 * // use TBSCertificate object to sign
+172 * var cert = new KJUR.asn1.x509.Certificate({
+173 * tbsobj: <<OBJ>>,
+174 * sigalg: "SHA256withRSA",
+175 * cakey: "-----BEGIN PRIVATE KEY..."
+176 * });
+177 */
+178 KJUR.asn1.x509.Certificate = function(params) {
+179 KJUR.asn1.x509.Certificate.superclass.constructor.call(this);
+180 var _KJUR = KJUR,
+181 _KJUR_asn1 = _KJUR.asn1,
+182 _DERBitString = _KJUR_asn1.DERBitString,
+183 _DERSequence = _KJUR_asn1.DERSequence,
+184 _KJUR_asn1_x509 = _KJUR_asn1.x509,
+185 _TBSCertificate = _KJUR_asn1_x509.TBSCertificate,
+186 _AlgorithmIdentifier = _KJUR_asn1_x509.AlgorithmIdentifier;
+187
+188 this.params = undefined;
+189
+190 /**
+191 * set parameter<br/>
+192 * @name setByParam
+193 * @memberOf KJUR.asn1.x509.Certificate#
+194 * @function
+195 * @param params {Array} JSON object of certificate parameters
+196 * @since jsrsasign 9.0.0 asn1hex 2.0.0
+197 * @description
+198 * This method will set parameter
+199 * {@link KJUR.asn1.x509.Certificate#params}
+200 * to this object.
+201 * @example
+202 * cert = new KJUR.asn1.x509.Certificate();
+203 * cert.setByParam({
+204 * version: 3,
+205 * serial: {hex: "1234..."},
+206 * ...
+207 * });
+208 */
+209 this.setByParam = function(params) {
+210 this.params = params;
+211 };
+212
+213 /**
+214 * sign certificate<br/>
+215 * @name sign
+216 * @memberOf KJUR.asn1.x509.Certificate#
+217 * @function
+218 * @description
+219 * This method signs TBSCertificate with a specified
+220 * private key and algorithm by
+221 * this.params.cakey and this.params.sigalg parameter.
+222 * @example
+223 * cert = new KJUR.asn1.x509.Certificate({...});
+224 * cert.sign()
+225 */
+226 this.sign = function() {
+227 var params = this.params;
+228
+229 var sigalg = params.sigalg;
+230 if (params.sigalg.name != undefined)
+231 sigalg = params.sigalg.name;
+232
+233 var hTBS = params.tbsobj.getEncodedHex();
+234 var sig = new KJUR.crypto.Signature({alg: sigalg});
+235 sig.init(params.cakey);
+236 sig.updateHex(hTBS);
+237 params.sighex = sig.sign();
+238 };
+239
+240 /**
+241 * get PEM formatted certificate string after signed
+242 * @name getPEM
+243 * @memberOf KJUR.asn1.x509.Certificate#
+244 * @function
+245 * @return PEM formatted string of certificate
+246 * @since jsrsasign 9.0.0 asn1hex 2.0.0
+247 * @description
+248 * This method returns a string of PEM formatted
+249 * certificate.
+250 * @example
+251 * cert = new KJUR.asn1.x509.Certificate({...});
+252 * cert.getPEM() →
+253 * "-----BEGIN CERTIFICATE-----\r\n..."
+254 */
+255 this.getPEM = function() {
+256 return hextopem(this.getEncodedHex(), "CERTIFICATE");
+257 };
+258
+259 this.getEncodedHex = function() {
+260 var params = this.params;
+261
+262 if (params.tbsobj == undefined || params.tbsobj == null) {
+263 params.tbsobj = new _TBSCertificate(params);
+264 }
+265
+266 if (params.sighex == undefined && params.cakey != undefined) {
+267 this.sign();
+268 }
+269
+270 if (params.sighex == undefined) {
+271 throw new Error("sighex or cakey parameter not defined");
+272 }
+273
+274 var a = [];
+275 a.push(params.tbsobj);
+276 a.push(new _AlgorithmIdentifier({name: params.sigalg}));
+277 a.push(new _DERBitString({hex: "00" + params.sighex}));
+278 var seq = new _DERSequence({array: a});
+279 return seq.getEncodedHex();
+280 };
+281
+282 if (params != undefined) this.params = params;
+283 };
+284 YAHOO.lang.extend(KJUR.asn1.x509.Certificate, KJUR.asn1.ASN1Object);
+285
+286 /**
+287 * ASN.1 TBSCertificate structure class<br/>
+288 * @name KJUR.asn1.x509.TBSCertificate
+289 * @class ASN.1 TBSCertificate structure class
+290 * @property {Array} params JSON object of parameters
+291 * @param {Array} params JSON object of TBSCertificate parameters
+292 * @extends KJUR.asn1.ASN1Object
+293 * @see KJUR.asn1.x509.Certificate
+294 *
+295 * @description
+296 * <br/>
+297 * NOTE: TBSCertificate class is updated without backward
+298 * compatibility from jsrsasign 9.0.0 asn1x509 2.0.0.
+299 * Most of methods are removed and parameters can be set
+300 * by JSON object.
+301 *
+302 * @example
+303 * new TBSCertificate({
+304 * version: 3, // this can be omitted, the default is 3.
+305 * serial: {hex: "1234..."}, // DERInteger parameter
+306 * sigalg: "SHA256withRSA",
+307 * issuer: {array:[[{type:'O',value:'Test',ds:'prn'}]]}, // X500Name parameter
+308 * notbefore: "151231235959Z", // string, passed to Time
+309 * notafter: "251231235959Z", // string, passed to Time
+310 * subject: {array:[[{type:'O',value:'Test',ds:'prn'}]]}, // X500Name parameter
+311 * sbjpubkey: "-----BEGIN...", // KEYUTIL.getKey pubkey parameter
+312 * // As for extension parameters, please see extension class
+313 * // All extension parameters need to have "extname" parameter additionaly.
+314 * ext:[{
+315 * extname:"keyUsage",critical:true,
+316 * names:["digitalSignature","keyEncipherment"]
+317 * },{
+318 * extname:"cRLDistributionPoints",
+319 * array:[{dpname:{full:[{uri:"http://example.com/a1.crl"}]}}]
+320 * }, ...]
+321 * })
+322 *
+323 * var tbsc = new TBSCertificate();
+324 * tbsc.setByParam({version:3,serial:{hex:'1234...'},...});
+325 */
+326 KJUR.asn1.x509.TBSCertificate = function(params) {
+327 KJUR.asn1.x509.TBSCertificate.superclass.constructor.call(this);
+328 var _KJUR = KJUR,
+329 _KJUR_asn1 = _KJUR.asn1,
+330 _KJUR_asn1_x509 = _KJUR_asn1.x509,
+331 _DERTaggedObject = _KJUR_asn1.DERTaggedObject,
+332 _DERInteger = _KJUR_asn1.DERInteger,
+333 _DERSequence = _KJUR_asn1.DERSequence,
+334 _AlgorithmIdentifier = _KJUR_asn1_x509.AlgorithmIdentifier,
+335 _Time = _KJUR_asn1_x509.Time,
+336 _X500Name = _KJUR_asn1_x509.X500Name,
+337 _Extensions = _KJUR_asn1_x509.Extensions,
+338 _SubjectPublicKeyInfo = _KJUR_asn1_x509.SubjectPublicKeyInfo;
+339
+340 this.params = null;
+341
+342 /**
+343 * get array of ASN.1 object for extensions<br/>
+344 * @name setByParam
+345 * @memberOf KJUR.asn1.x509.TBSCertificate#
+346 * @function
+347 * @param {Array} JSON object of TBSCertificate parameters
+348 * @example
+349 * tbsc = new KJUR.asn1.x509.TBSCertificate();
+350 * tbsc.setByParam({version:3, serial:{hex:'1234...'},...});
+351 */
+352 this.setByParam = function(params) {
+353 this.params = params;
+354 };
+355
+356 this.getEncodedHex = function() {
+357 var a = [];
+358 var params = this.params;
+359
+360 // X.509v3 default if params.version not defined
+361 if (params.version != undefined || params.version != 1) {
+362 var version = 2;
+363 if (params.version != undefined) version = params.version - 1;
+364 var obj =
+365 new _DERTaggedObject({obj: new _DERInteger({'int': version})})
+366 a.push(obj);
+367 }
+368
+369 a.push(new _DERInteger(params.serial));
+370 a.push(new _AlgorithmIdentifier({name: params.sigalg}));
+371 a.push(new _X500Name(params.issuer));
+372 a.push(new _DERSequence({array:[new _Time(params.notbefore),
+373 new _Time(params.notafter)]}));
+374 a.push(new _X500Name(params.subject));
+375 a.push(new _SubjectPublicKeyInfo(KEYUTIL.getKey(params.sbjpubkey)));
+376 if (params.ext !== undefined && params.ext.length > 0) {
+377 a.push(new _DERTaggedObject({tag: "a3",
+378 obj: new _Extensions(params.ext)}));
+379 }
+380
+381 var seq = new KJUR.asn1.DERSequence({array: a});
+382 return seq.getEncodedHex();
+383 };
+384
+385 if (params !== undefined) this.setByParam(params);
+386 };
+387 YAHOO.lang.extend(KJUR.asn1.x509.TBSCertificate, KJUR.asn1.ASN1Object);
+388
+389 /**
+390 * Extensions ASN.1 structure class<br/>
+391 * @name KJUR.asn1.x509.Extensions
+392 * @class Extensions ASN.1 structure class
+393 * @param {Array} aParam array of JSON extension parameter
+394 * @extends KJUR.asn1.ASN1Object
+395 * @since jsrsasign 9.1.0 asn1x509 2.1.0
+396 * @see KJUR.asn1.x509.TBSCertificate
+397 * @see KJUR.asn1.x509.TBSCertList
+398 * @see KJUR.asn1.csr.CertificationRequestInfo
+399 * @see KJUR.asn1.x509.PrivateExtension
+400 *
+401 * @description
+402 * This class represents
+403 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1">
+404 * Extensions defined in RFC 5280 4.1</a> and
+405 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.9">
+406 * 4.1.2.9</a>.
+407 * <pre>
+408 * Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
+409 * </pre>
+410 * NOTE: From jsrsasign 9.1.1, private extension or
+411 * undefined extension have been supported by
+412 * {@link KJUR.asn1.x509.PrivateExtension}.
+413 *
+414 * @example
+415 * o = new KJUR.asn1.x509.Extensions([
+416 * {extname:"keyUsage",critical:true,names:["digitalSignature"]},
+417 * {extname:"subjectAltName",array:[{dns:"example.com"}]},
+418 * {extname:"1.2.3.4",extn:{prnstr:"aa"}} // private extension
+419 * ]);
+420 * o.getEncodedHex() → "30..."
+421 */
+422 KJUR.asn1.x509.Extensions = function(aParam) {
+423 KJUR.asn1.x509.Extensions.superclass.constructor.call(this);
+424 var _KJUR = KJUR,
+425 _KJUR_asn1 = _KJUR.asn1,
+426 _DERSequence = _KJUR_asn1.DERSequence,
+427 _KJUR_asn1_x509 = _KJUR_asn1.x509;
+428 this.aParam = [];
+429
+430 this.setByParam = function(aParam) { this.aParam = aParam; }
+431
+432 this.getEncodedHex = function() {
+433 var a = [];
+434 for (var i = 0; i < this.aParam.length; i++) {
+435 var param = this.aParam[i];
+436 var extname = param.extname;
+437 var obj = null;
+438
+439 if (param.extn != undefined) {
+440 obj = new _KJUR_asn1_x509.PrivateExtension(param);
+441 } else if (extname == "subjectKeyIdentifier") {
+442 obj = new _KJUR_asn1_x509.SubjectKeyIdentifier(param);
+443 } else if (extname == "keyUsage") {
+444 obj = new _KJUR_asn1_x509.KeyUsage(param);
+445 } else if (extname == "subjectAltName") {
+446 obj = new _KJUR_asn1_x509.SubjectAltName(param);
+447 } else if (extname == "issuerAltName") {
+448 obj = new _KJUR_asn1_x509.IssuerAltName(param);
+449 } else if (extname == "basicConstraints") {
+450 obj = new _KJUR_asn1_x509.BasicConstraints(param);
+451 } else if (extname == "cRLDistributionPoints") {
+452 obj = new _KJUR_asn1_x509.CRLDistributionPoints(param);
+453 } else if (extname == "certificatePolicies") {
+454 obj = new _KJUR_asn1_x509.CertificatePolicies(param);
+455 } else if (extname == "authorityKeyIdentifier") {
+456 obj = new _KJUR_asn1_x509.AuthorityKeyIdentifier(param);
+457 } else if (extname == "extKeyUsage") {
+458 obj = new _KJUR_asn1_x509.ExtKeyUsage(param);
+459 } else if (extname == "authorityInfoAccess") {
+460 obj = new _KJUR_asn1_x509.AuthorityInfoAccess(param);
+461 } else if (extname == "cRLNumber") {
+462 obj = new _KJUR_asn1_x509.CRLNumber(param);
+463 } else if (extname == "cRLReason") {
+464 obj = new _KJUR_asn1_x509.CRLReason(param);
+465 } else if (extname == "ocspNonce") {
+466 obj = new _KJUR_asn1_x509.OCSPNonce(param);
+467 } else if (extname == "ocspNoCheck") {
+468 obj = new _KJUR_asn1_x509.OCSPNoCheck(param);
+469 } else if (extname == "adobeTimeStamp") {
+470 obj = new _KJUR_asn1_x509.AdobeTimeStamp(param);
+471 } else if (extname == "subjectDirectoryAttributes") {
+472 obj = new _KJUR_asn1_x509.SubjectDirectoryAttributes(param);
+473 } else {
+474 throw new Error("extension not supported:"
+475 + JSON.stringify(param));
+476 }
+477 if (obj != null) a.push(obj);
+478 }
+479
+480 var seq = new _DERSequence({array: a});
+481 return seq.getEncodedHex();
+482 };
+483
+484 if (aParam != undefined) this.setByParam(aParam);
+485 };
+486 YAHOO.lang.extend(KJUR.asn1.x509.Extensions, KJUR.asn1.ASN1Object);
487
-488 // === END TBSCertificate ===================================================
-489
-490 // === BEGIN X.509v3 Extensions Related =======================================
-491
-492 /**
-493 * base Extension ASN.1 structure class
-494 * @name KJUR.asn1.x509.Extension
-495 * @class base Extension ASN.1 structure class
-496 * @param {Array} params associative array of parameters (ex. {'critical': true})
-497 * @extends KJUR.asn1.ASN1Object
-498 * @description
-499 * <pre>
-500 * Extension ::= SEQUENCE {
-501 * extnID OBJECT IDENTIFIER,
-502 * critical BOOLEAN DEFAULT FALSE,
-503 * extnValue OCTET STRING }
-504 * </pre>
-505 * @example
-506 */
-507 KJUR.asn1.x509.Extension = function(params) {
-508 KJUR.asn1.x509.Extension.superclass.constructor.call(this);
-509 var asn1ExtnValue = null,
-510 _KJUR = KJUR,
-511 _KJUR_asn1 = _KJUR.asn1,
-512 _DERObjectIdentifier = _KJUR_asn1.DERObjectIdentifier,
-513 _DEROctetString = _KJUR_asn1.DEROctetString,
-514 _DERBitString = _KJUR_asn1.DERBitString,
-515 _DERBoolean = _KJUR_asn1.DERBoolean,
-516 _DERSequence = _KJUR_asn1.DERSequence;
-517
-518 this.getEncodedHex = function() {
-519 var asn1Oid = new _DERObjectIdentifier({'oid': this.oid});
-520 var asn1EncapExtnValue =
-521 new _DEROctetString({'hex': this.getExtnValueHex()});
-522
-523 var asn1Array = new Array();
-524 asn1Array.push(asn1Oid);
-525 if (this.critical) asn1Array.push(new _DERBoolean());
-526 asn1Array.push(asn1EncapExtnValue);
-527
-528 var asn1Seq = new _DERSequence({'array': asn1Array});
-529 return asn1Seq.getEncodedHex();
-530 };
-531
-532 this.critical = false;
-533 if (params !== undefined) {
-534 if (params.critical !== undefined) {
-535 this.critical = params.critical;
-536 }
-537 }
-538 };
-539 YAHOO.lang.extend(KJUR.asn1.x509.Extension, KJUR.asn1.ASN1Object);
-540
-541 /**
-542 * KeyUsage ASN.1 structure class
-543 * @name KJUR.asn1.x509.KeyUsage
-544 * @class KeyUsage ASN.1 structure class
-545 * @param {Array} params associative array of parameters (ex. {'bin': '11', 'critical': true})
-546 * @extends KJUR.asn1.x509.Extension
-547 * @description
-548 * This class is for <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.3" target="_blank">KeyUsage</a> X.509v3 extension.
-549 * <pre>
-550 * id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 }
-551 * KeyUsage ::= BIT STRING {
-552 * digitalSignature (0),
-553 * nonRepudiation (1),
-554 * keyEncipherment (2),
-555 * dataEncipherment (3),
-556 * keyAgreement (4),
-557 * keyCertSign (5),
-558 * cRLSign (6),
-559 * encipherOnly (7),
-560 * decipherOnly (8) }
-561 * </pre><br/>
-562 * NOTE: 'names' parameter is supprted since jsrsasign 8.0.14.
-563 * @example
-564 * o = new KJUR.asn1.x509.KeyUsage({bin: "11"});
-565 * o = new KJUR.asn1.x509.KeyUsage({critical: true, bin: "11"});
-566 * o = new KJUR.asn1.x509.KeyUsage({names: ['digitalSignature', 'keyAgreement']});
-567 */
-568 KJUR.asn1.x509.KeyUsage = function(params) {
-569 KJUR.asn1.x509.KeyUsage.superclass.constructor.call(this, params);
-570 var _KEYUSAGE_NAME = X509.KEYUSAGE_NAME;
-571
-572 this.getExtnValueHex = function() {
-573 return this.asn1ExtnValue.getEncodedHex();
-574 };
-575
-576 this.oid = "2.5.29.15";
-577 if (params !== undefined) {
-578 if (params.bin !== undefined) {
-579 this.asn1ExtnValue = new KJUR.asn1.DERBitString(params);
-580 }
-581 if (params.names !== undefined &&
-582 params.names.length !== undefined) {
-583 var names = params.names;
-584 var s = "000000000";
-585 for (var i = 0; i < names.length; i++) {
-586 for (var j = 0; j < _KEYUSAGE_NAME.length; j++) {
-587 if (names[i] === _KEYUSAGE_NAME[j]) {
-588 s = s.substring(0, j) + '1' +
-589 s.substring(j + 1, s.length);
-590 }
-591 }
-592 }
-593 this.asn1ExtnValue = new KJUR.asn1.DERBitString({bin: s});
-594 }
-595 }
-596 };
-597 YAHOO.lang.extend(KJUR.asn1.x509.KeyUsage, KJUR.asn1.x509.Extension);
-598
-599 /**
-600 * BasicConstraints ASN.1 structure class
-601 * @name KJUR.asn1.x509.BasicConstraints
-602 * @class BasicConstraints ASN.1 structure class
-603 * @param {Array} params JSON object for parameters (ex. {cA:true,critical:true})
-604 * @extends KJUR.asn1.x509.Extension
-605 * @see {@link X509#getExtBasicConstraints}
-606 * @description
-607 * This class represents
-608 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.9">
-609 * BasicConstraints extension defined in RFC 5280 4.2.1.9</a>.
-610 * <pre>
-611 * id-ce-basicConstraints OBJECT IDENTIFIER ::= { id-ce 19 }
-612 * BasicConstraints ::= SEQUENCE {
-613 * cA BOOLEAN DEFAULT FALSE,
-614 * pathLenConstraint INTEGER (0..MAX) OPTIONAL }
-615 * </pre>
-616 * Its constructor can have following parameters:
-617 * <ul>
-618 * <li>{Boolean}cA - cA flag</li>
-619 * <li>{Integer}pathLen - pathLen field value</li>
-620 * <li>{Boolean}critical - critical flag</li>
-621 * </ul>
-622 * @example
-623 * new KJUR.asn1.x509.BasicConstraints({
-624 * cA: true,
-625 * pathLen: 3,
-626 * critical: true
-627 * })
-628 */
-629 KJUR.asn1.x509.BasicConstraints = function(params) {
-630 KJUR.asn1.x509.BasicConstraints.superclass.constructor.call(this, params);
-631 var _KJUR_asn1 = KJUR.asn1,
-632 _DERBoolean = _KJUR_asn1.DERBoolean,
-633 _DERInteger = _KJUR_asn1.DERInteger,
-634 _DERSequence = _KJUR_asn1.DERSequence;
-635
-636 var cA = false;
-637 var pathLen = -1;
-638
-639 this.getExtnValueHex = function() {
-640 var asn1Array = new Array();
-641 if (this.cA) asn1Array.push(new _DERBoolean());
-642 if (this.pathLen > -1)
-643 asn1Array.push(new _DERInteger({'int': this.pathLen}));
-644 var asn1Seq = new _DERSequence({'array': asn1Array});
-645 this.asn1ExtnValue = asn1Seq;
-646 return this.asn1ExtnValue.getEncodedHex();
-647 };
-648
-649 this.oid = "2.5.29.19";
-650 this.cA = false;
-651 this.pathLen = -1;
-652 if (params !== undefined) {
-653 if (params.cA !== undefined) {
-654 this.cA = params.cA;
-655 }
-656 if (params.pathLen !== undefined) {
-657 this.pathLen = params.pathLen;
-658 }
-659 }
-660 };
-661 YAHOO.lang.extend(KJUR.asn1.x509.BasicConstraints, KJUR.asn1.x509.Extension);
-662
-663 /**
-664 * CRLDistributionPoints ASN.1 structure class
-665 * @name KJUR.asn1.x509.CRLDistributionPoints
-666 * @class CRLDistributionPoints ASN.1 structure class
-667 * @param {Array} params associative array of parameters (ex. {'uri': 'http://a.com/', 'critical': true})
-668 * @extends KJUR.asn1.x509.Extension
-669 * @see {@link X509#getExtCRLDistributionPoints}
-670 * @see {@link KJUR.asn1.x509.DistributionPoint}
-671 * @see {@link KJUR.asn1.x509.GeneralNames}
-672 * @description
-673 * This class represents
-674 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.13">
-675 * CRLDistributionPoints extension defined in RFC 5280 4.2.1.13</a>.
-676 * <pre>
-677 * id-ce-cRLDistributionPoints OBJECT IDENTIFIER ::= { id-ce 31 }
-678 * CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
-679 * DistributionPoint ::= SEQUENCE {
-680 * distributionPoint [0] DistributionPointName OPTIONAL,
-681 * reasons [1] ReasonFlags OPTIONAL,
-682 * cRLIssuer [2] GeneralNames OPTIONAL }
-683 * DistributionPointName ::= CHOICE {
-684 * fullName [0] GeneralNames,
-685 * nameRelativeToCRLIssuer [1] RelativeDistinguishedName }
-686 * </pre>
-687 * Constructor can have following parameter:
-688 * <ul>
-689 * <li>{Array}array - array of {@link KJUR.asn1.x509.DistributionPoint} parameter</li>
-690 * <li>{Boolean}critical - critical flag</li>
-691 * </ul>
-692 * @example
-693 * new KJUR.asn1.x509.CRLDistributionPoints({
-694 * array: [{fulluri: "http://aaa.com/"}, {fulluri: "ldap://aaa.com/"}],
-695 * critical: true
-696 * })
-697 */
-698 KJUR.asn1.x509.CRLDistributionPoints = function(params) {
-699 KJUR.asn1.x509.CRLDistributionPoints.superclass.constructor.call(this, params);
-700 var _KJUR = KJUR,
-701 _KJUR_asn1 = _KJUR.asn1,
-702 _KJUR_asn1_x509 = _KJUR_asn1.x509;
-703
-704 this.getExtnValueHex = function() {
-705 return this.asn1ExtnValue.getEncodedHex();
-706 };
-707
-708 this.setByDPArray = function(dpArray) {
-709 var asn1Array = [];
-710 for (var i = 0; i < dpArray.length; i++) {
-711 if (dpArray[i] instanceof KJUR.asn1.ASN1Object) {
-712 asn1Array.push(dpArray[i]);
-713 } else {
-714 var dp = new _KJUR_asn1_x509.DistributionPoint(dpArray[i]);
-715 asn1Array.push(dp);
-716 }
-717 }
-718 this.asn1ExtnValue = new _KJUR_asn1.DERSequence({'array': asn1Array});
-719 };
-720
-721 this.setByOneURI = function(uri) {
-722 var dp1 = new _KJUR_asn1_x509.DistributionPoint({fulluri: uri});
-723 this.setByDPArray([dp1]);
-724 };
-725
-726 this.oid = "2.5.29.31";
-727 if (params !== undefined) {
-728 if (params.array !== undefined) {
-729 this.setByDPArray(params.array);
-730 } else if (params.uri !== undefined) {
-731 this.setByOneURI(params.uri);
-732 }
-733 }
-734 };
-735 YAHOO.lang.extend(KJUR.asn1.x509.CRLDistributionPoints, KJUR.asn1.x509.Extension);
-736
-737 /**
-738 * DistributionPoint ASN.1 structure class<br/>
-739 * @name KJUR.asn1.x509.DistributionPoint
-740 * @class DistributionPoint ASN.1 structure class
-741 * @param {Array} params JSON object of parameters (OPTIONAL)
-742 * @extends KJUR.asn1.ASN1Object
-743 * @see {@link KJUR.asn1.x509.CRLDistributionPoints}
-744 * @see {@link KJUR.asn1.x509.DistributionPointName}
-745 * @see {@link KJUR.asn1.x509.GeneralNames}
-746 * @see {@link X509#getDistributionPoint}
-747 * @description
-748 * This class represents
-749 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.13">
-750 * DistributionPoint defined in RFC 5280 4.2.1.13</a>.
-751 * <pre>
-752 * DistributionPoint ::= SEQUENCE {
-753 * distributionPoint [0] DistributionPointName OPTIONAL,
-754 * reasons [1] ReasonFlags OPTIONAL,
-755 * cRLIssuer [2] GeneralNames OPTIONAL }
-756 * </pre>
-757 * Constructor can have following parameter:
-758 * <ul>
-759 * <li>{String}fulluri - uri string for fullName uri. This has the same meaning for '{dpname: {full: [{uri: "..."]}}'.</li>
-760 * <li>{Array}dpname - JSON object for {@link KJUR.asn1.x509.DistributionPointName} parameters</li>
-761 * <li>{DistrubutionPoint}dpobj - {@link KJUR.asn1.x509.DistributionPointName} object (DEPRECATED)</li>
-762 * </ul>
-763 * <br/>
-764 * NOTE1: Parameter "fulluri" and "dpname" supported
-765 * since jsrsasign 9.0.0 asn1x509 2.0.0.
-766 * <br/>
-767 * NOTE2: The "reasons" and "cRLIssuer" fields are currently
-768 * not supported.
-769 * @example
-770 * new KJUR.asn1.x509.DistributionPoint(
-771 * {fulluri: "http://example.com/crl1.crl"})
-772 * new KJUR.asn1.x509.DistributionPoint(
-773 * {dpname: {full: [{uri: "http://example.com/crl1.crl"}]}})
-774 * new KJUR.asn1.x509.DistributionPoint(
-775 * {dpobj: new DistributionPoint(...)})
-776 */
-777 KJUR.asn1.x509.DistributionPoint = function(params) {
-778 KJUR.asn1.x509.DistributionPoint.superclass.constructor.call(this);
-779 var asn1DP = null,
-780 _KJUR = KJUR,
-781 _KJUR_asn1 = _KJUR.asn1,
-782 _DistributionPointName = _KJUR_asn1.x509.DistributionPointName;
-783
-784 this.getEncodedHex = function() {
-785 var seq = new _KJUR_asn1.DERSequence();
-786 if (this.asn1DP != null) {
-787 var o1 = new _KJUR_asn1.DERTaggedObject({'explicit': true,
-788 'tag': 'a0',
-789 'obj': this.asn1DP});
-790 seq.appendASN1Object(o1);
-791 }
-792 this.hTLV = seq.getEncodedHex();
-793 return this.hTLV;
-794 };
-795
-796 if (params !== undefined) {
-797 if (params.dpobj !== undefined) {
-798 this.asn1DP = params.dpobj;
-799 } else if (params.dpname !== undefined) {
-800 this.asn1DP = new _DistributionPointName(params.dpname);
-801 } else if (params.fulluri !== undefined) {
-802 this.asn1DP = new _DistributionPointName({full: [{uri: params.fulluri}]});
-803 }
-804 }
-805 };
-806 YAHOO.lang.extend(KJUR.asn1.x509.DistributionPoint, KJUR.asn1.ASN1Object);
-807
-808 /**
-809 * DistributionPointName ASN.1 structure class<br/>
-810 * @name KJUR.asn1.x509.DistributionPointName
-811 * @class DistributionPointName ASN.1 structure class
-812 * @param {Array} params JSON object of parameters or GeneralNames object
-813 * @extends KJUR.asn1.ASN1Object
-814 * @see {@link KJUR.asn1.x509.CRLDistributionPoints}
-815 * @see {@link KJUR.asn1.x509.DistributionPoint}
-816 * @see {@link KJUR.asn1.x509.GeneralNames}
-817 * @see {@link X509#getDistributionPointName}
-818 * @description
-819 * This class represents
-820 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.13">
-821 * DistributionPointName defined in RFC 5280 4.2.1.13</a>.
-822 * <pre>
-823 * DistributionPointName ::= CHOICE {
-824 * fullName [0] GeneralNames,
-825 * nameRelativeToCRLIssuer [1] RelativeDistinguishedName }
-826 * </pre>
-827 * Constructor can have following parameter:
-828 * <ul>
-829 * <li>{String}full - JSON object parameter of {@link KJUR.asn1.x509.GeneralNames} for 'fullName' field</li>
-830 * <li>{GeneralNames} - {@link KJUR.asn1.x509.GeneralNames} object for 'fullName'</li>
-831 * </ul>
-832 * NOTE1: 'full' parameter have been suppored since jsrsasign 9.0.0 asn1x509 2.0.0.
-833 * <br>
-834 * NOTE2: The 'nameRelativeToCRLIssuer' field is currently not supported.
-835 * @example
-836 * new KJUR.asn1.x509.DistributionPointName({full: <<GeneralNamesParameter>>})
-837 * new KJUR.asn1.x509.DistributionPointName({full: [{uri: <<CDPURI>>}]})
-838 * new KJUR.asn1.x509.DistributionPointName({full: [{dn: <<DN Parameter>>}]}
-839 * new KJUR.asn1.x509.DistributionPointName({full: [{uri: "http://example.com/root.crl"}]})
-840 * new KJUR.asn1.x509.DistributionPointName({full: [{dn {str: "/C=US/O=Test"}}]})
-841 * new KJUR.asn1.x509.DistributionPointName(new GeneralNames(...))
-842 */
-843 KJUR.asn1.x509.DistributionPointName = function(params) {
-844 KJUR.asn1.x509.DistributionPointName.superclass.constructor.call(this);
-845 var asn1Obj = null,
-846 type = null,
-847 tag = null,
-848 asn1V = null,
-849 _KJUR = KJUR,
-850 _KJUR_asn1 = _KJUR.asn1,
-851 _DERTaggedObject = _KJUR_asn1.DERTaggedObject;
-852
-853 this.getEncodedHex = function() {
-854 if (this.type != "full")
-855 throw new Error("currently type shall be 'full': " + this.type);
-856 this.asn1Obj = new _DERTaggedObject({'explicit': false,
-857 'tag': this.tag,
-858 'obj': this.asn1V});
-859 this.hTLV = this.asn1Obj.getEncodedHex();
-860 return this.hTLV;
-861 };
-862
-863 if (params !== undefined) {
-864 if (_KJUR_asn1.x509.GeneralNames.prototype.isPrototypeOf(params)) {
-865 this.type = "full";
-866 this.tag = "a0";
-867 this.asn1V = params;
-868 } else if (params.full !== undefined) {
-869 this.type = "full";
-870 this.tag = "a0";
-871 this.asn1V = new _KJUR_asn1.x509.GeneralNames(params.full);
-872 } else {
-873 throw new Error("This class supports GeneralNames only as argument");
-874 }
-875 }
-876 };
-877 YAHOO.lang.extend(KJUR.asn1.x509.DistributionPointName, KJUR.asn1.ASN1Object);
-878
-879 /**
-880 * CertificatePolicies ASN.1 structure class
-881 * @name KJUR.asn1.x509.CertificatePolicies
-882 * @class CertificatePolicies ASN.1 structure class
-883 * @param {Array} params associative array of parameters
-884 * @extends KJUR.asn1.x509.Extension
-885 * @since jsrsasign 8.0.23 asn1x509 1.1.12
-886 * @see KJUR.asn1.x509.CertificatePolicies
-887 * @see KJUR.asn1.x509.PolicyInformation
-888 * @see KJUR.asn1.x509.PolicyQualifierInfo
-889 * @see KJUR.asn1.x509.UserNotice
-890 * @see KJUR.asn1.x509.NoticeReference
-891 * @see KJUR.asn1.x509.DisplayText
-892 * @description
-893 * This class represents
-894 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.4">
-895 * CertificatePolicies extension defined in RFC 5280 4.2.1.4</a>.
-896 * <pre>
-897 * id-ce-certificatePolicies OBJECT IDENTIFIER ::= { id-ce 32 }
-898 * CertificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
-899 * </pre>
-900 * Its constructor can have following parameters:
-901 * <ul>
-902 * <li>array - array of {@link KJUR.asn1.x509.PolicyInformation} parameter</li>
-903 * <li>critical - boolean: critical flag</li>
-904 * </ul>
-905 * NOTE: Returned JSON value format have been changed without
-906 * backward compatibility since jsrsasign 9.0.0 asn1x509 2.0.0.
-907 * @example
-908 * e1 = new KJUR.asn1.x509.CertificatePolicies({
-909 * array: [
-910 * { policyoid: "1.2.3.4.5",
-911 * array: [
-912 * { cps: "https://example.com/repository" },
-913 * { unotice: {
-914 * noticeref: { // CA SHOULD NOT use this by RFC
-915 * org: {type: "ia5", str: "Sample Org"},
-916 * noticenum: [{int: 5}, {hex: "01af"}]
-917 * },
-918 * exptext: {type: "ia5", str: "Sample Policy"}
-919 * }}
-920 * ]
-921 * }
-922 * ],
-923 * critical: true
-924 * });
-925 */
-926 KJUR.asn1.x509.CertificatePolicies = function(params) {
-927 KJUR.asn1.x509.CertificatePolicies.superclass.constructor.call(this, params);
-928 var _KJUR = KJUR,
-929 _KJUR_asn1 = _KJUR.asn1,
-930 _KJUR_asn1_x509 = _KJUR_asn1.x509,
-931 _DERSequence = _KJUR_asn1.DERSequence,
-932 _PolicyInformation = _KJUR_asn1_x509.PolicyInformation;
-933
-934 this.params = null;
-935
-936 this.getExtnValueHex = function() {
-937 var aPI = [];
-938 for (var i = 0; i < this.params.array.length; i++) {
-939 aPI.push(new _PolicyInformation(this.params.array[i]));
-940 }
-941 var seq = new _DERSequence({array: aPI});
-942 this.asn1ExtnValue = seq;
-943 return this.asn1ExtnValue.getEncodedHex();
-944 };
-945
-946 this.oid = "2.5.29.32";
-947 if (params !== undefined) {
-948 this.params = params;
-949 }
-950 };
-951 YAHOO.lang.extend(KJUR.asn1.x509.CertificatePolicies, KJUR.asn1.x509.Extension);
-952
-953 // ===== BEGIN CertificatePolicies related classes =====
-954 /**
-955 * PolicyInformation ASN.1 structure class
-956 * @name KJUR.asn1.x509.PolicyInformation
-957 * @class PolicyInformation ASN.1 structure class
-958 * @param {Array} params JSON object of parameters
-959 * @extends KJUR.asn1.ASN1Object
-960 * @since jsrsasign 8.0.23 asn1x509 1.1.12
-961 * @see KJUR.asn1.x509.CertificatePolicies
-962 * @see KJUR.asn1.x509.PolicyInformation
-963 * @see KJUR.asn1.x509.PolicyQualifierInfo
-964 * @see KJUR.asn1.x509.UserNotice
-965 * @see KJUR.asn1.x509.NoticeReference
-966 * @see KJUR.asn1.x509.DisplayText
-967 * @description
-968 * This class represents
-969 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.4">
-970 * PolicyInformation defined in RFC 5280 4.2.1.4</a>.
-971 * <pre>
-972 * PolicyInformation ::= SEQUENCE {
-973 * policyIdentifier CertPolicyId,
-974 * policyQualifiers SEQUENCE SIZE (1..MAX) OF
-975 * PolicyQualifierInfo OPTIONAL }
-976 * CertPolicyId ::= OBJECT IDENTIFIER
-977 * Its constructor can have following parameters:
-978 * <ul>
-979 * <li>{String}policyoid - policy OID (ex. "1.2.3.4.5")</li>
-980 * <li>{Object}array - array of {@link KJUR.asn1.x509.PolicyQualifierInfo}
-981 * parameters (OPTIONAL)</li>
-982 * </ul>
-983 * @example
-984 * new KJUR.asn1.x509.PolicyInformation({
-985 * policyoid: "1.2.3.4.5",
-986 * array: [
-987 * { cps: "https://example.com/repository" },
-988 * { unotice: {
-989 * noticeref: { // CA SHOULD NOT use this by RFC
-990 * org: {type: "ia5", str: "Sample Org"},
-991 * noticenum: [{int: 5}, {hex: "01af"}]
-992 * },
-993 * exptext: {type: "ia5", str: "Sample Policy"}
-994 * }}
-995 * ]
-996 * })
-997 */
-998 KJUR.asn1.x509.PolicyInformation = function(params) {
-999 KJUR.asn1.x509.PolicyInformation.superclass.constructor.call(this,
-1000 params);
-1001 var _KJUR_asn1 = KJUR.asn1,
-1002 _DERSequence = _KJUR_asn1.DERSequence,
-1003 _DERObjectIdentifier = _KJUR_asn1.DERObjectIdentifier,
-1004 _PolicyQualifierInfo = _KJUR_asn1.x509.PolicyQualifierInfo;
-1005
-1006 this.params = null;
-1007
-1008 this.getEncodedHex = function() {
-1009 if (this.params.policyoid === undefined &&
-1010 this.params.array === undefined)
-1011 throw new Error("parameter oid and array missing");
-1012
-1013 // policy oid
-1014 var a = [new _DERObjectIdentifier(this.params.policyoid)];
-1015
-1016 // array of ASN1Object of PolicyQualifierInfo
-1017 if (this.params.array !== undefined) {
-1018 var aPQI = [];
-1019 for (var i = 0; i < this.params.array.length; i++) {
-1020 aPQI.push(new _PolicyQualifierInfo(this.params.array[i]));
-1021 }
-1022 if (aPQI.length > 0) {
-1023 a.push(new _DERSequence({array: aPQI}));
-1024 }
-1025 }
-1026
-1027 var seq = new _DERSequence({array: a});
-1028 return seq.getEncodedHex();
-1029 };
-1030
-1031 if (params !== undefined) {
-1032 this.params = params;
-1033 }
-1034 };
-1035 YAHOO.lang.extend(KJUR.asn1.x509.PolicyInformation, KJUR.asn1.ASN1Object);
-1036
-1037 /**
-1038 * PolicyQualifierInfo ASN.1 structure class
-1039 * @name KJUR.asn1.x509.PolicyQualifierInfo
-1040 * @class PolicyQualifierInfo ASN.1 structure class
-1041 * @param {Array} params associative array of parameters
-1042 * @extends KJUR.asn1.ASN1Object
-1043 * @since jsrsasign 8.0.23 asn1x509 1.1.12
-1044 * @description
-1045 * This class represents
-1046 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.4">
-1047 * PolicyQualifierInfo defined in RFC 5280 4.2.1.4</a>.
-1048 * <pre>
-1049 * PolicyQualifierInfo ::= SEQUENCE {
-1050 * policyQualifierId PolicyQualifierId,
-1051 * qualifier ANY DEFINED BY policyQualifierId }
-1052 * PolicyQualifierId ::= OBJECT IDENTIFIER ( id-qt-cps | id-qt-unotice )
-1053 * CPSuri ::= IA5String
-1054 * </pre>
-1055 * Its constructor can have one of following two parameters:
-1056 * <ul>
-1057 * <li>{String}cps - URI string for CPS</li>
-1058 * <li>{Object}unotice - {@link KJUR.asn1.x509.UserNotice} parameter</li>
-1059 * </ul>
-1060 * @example
-1061 * new PolicyQualifierInfo({
-1062 * cps: "https://example.com/repository/cps"
-1063 * })
-1064 *
-1065 * new PolicyQualifierInfo({
-1066 * unotice: {
-1067 * noticeref: { // CA SHOULD NOT use this by RFC
-1068 * org: {type: "bmp", str: "Sample Org"},
-1069 * noticenum: [{int: 3}, {hex: "01af"}]
-1070 * },
-1071 * exptext: {type: "ia5", str: "Sample Policy"}
-1072 * }
-1073 * })
-1074 */
-1075 KJUR.asn1.x509.PolicyQualifierInfo = function(params) {
-1076 KJUR.asn1.x509.PolicyQualifierInfo.superclass.constructor.call(this,
-1077 params);
-1078 var _KJUR_asn1 = KJUR.asn1,
-1079 _DERSequence = _KJUR_asn1.DERSequence,
-1080 _DERIA5String = _KJUR_asn1.DERIA5String,
-1081 _DERObjectIdentifier = _KJUR_asn1.DERObjectIdentifier,
-1082 _UserNotice = _KJUR_asn1.x509.UserNotice;
-1083
-1084 this.params = null;
-1085
-1086 this.getEncodedHex = function() {
-1087 if (this.params.cps !== undefined) {
-1088 var seq = new _DERSequence({array: [
-1089 new _DERObjectIdentifier({oid: '1.3.6.1.5.5.7.2.1'}),
-1090 new _DERIA5String({str: this.params.cps})
-1091 ]});
-1092 return seq.getEncodedHex();
-1093 }
-1094 if (this.params.unotice != undefined) {
-1095 var seq = new _DERSequence({array: [
-1096 new _DERObjectIdentifier({oid: '1.3.6.1.5.5.7.2.2'}),
-1097 new _UserNotice(this.params.unotice)
-1098 ]});
-1099 return seq.getEncodedHex();
-1100 }
-1101 };
-1102
-1103 if (params !== undefined) {
-1104 this.params = params;
-1105 }
-1106 };
-1107 YAHOO.lang.extend(KJUR.asn1.x509.PolicyQualifierInfo, KJUR.asn1.ASN1Object);
-1108
+488
+489 // === END TBSCertificate ===================================================
+490
+491 // === BEGIN X.509v3 Extensions Related =======================================
+492
+493 /**
+494 * base Extension ASN.1 structure class
+495 * @name KJUR.asn1.x509.Extension
+496 * @class base Extension ASN.1 structure class
+497 * @param {Array} params associative array of parameters (ex. {'critical': true})
+498 * @extends KJUR.asn1.ASN1Object
+499 * @description
+500 * <pre>
+501 * Extension ::= SEQUENCE {
+502 * extnID OBJECT IDENTIFIER,
+503 * critical BOOLEAN DEFAULT FALSE,
+504 * extnValue OCTET STRING }
+505 * </pre>
+506 * @example
+507 */
+508 KJUR.asn1.x509.Extension = function(params) {
+509 KJUR.asn1.x509.Extension.superclass.constructor.call(this);
+510 var asn1ExtnValue = null,
+511 _KJUR = KJUR,
+512 _KJUR_asn1 = _KJUR.asn1,
+513 _DERObjectIdentifier = _KJUR_asn1.DERObjectIdentifier,
+514 _DEROctetString = _KJUR_asn1.DEROctetString,
+515 _DERBitString = _KJUR_asn1.DERBitString,
+516 _DERBoolean = _KJUR_asn1.DERBoolean,
+517 _DERSequence = _KJUR_asn1.DERSequence;
+518
+519 this.getEncodedHex = function() {
+520 var asn1Oid = new _DERObjectIdentifier({'oid': this.oid});
+521 var asn1EncapExtnValue =
+522 new _DEROctetString({'hex': this.getExtnValueHex()});
+523
+524 var asn1Array = new Array();
+525 asn1Array.push(asn1Oid);
+526 if (this.critical) asn1Array.push(new _DERBoolean());
+527 asn1Array.push(asn1EncapExtnValue);
+528
+529 var asn1Seq = new _DERSequence({'array': asn1Array});
+530 return asn1Seq.getEncodedHex();
+531 };
+532
+533 this.critical = false;
+534 if (params !== undefined) {
+535 if (params.critical !== undefined) {
+536 this.critical = params.critical;
+537 }
+538 }
+539 };
+540 YAHOO.lang.extend(KJUR.asn1.x509.Extension, KJUR.asn1.ASN1Object);
+541
+542 /**
+543 * KeyUsage ASN.1 structure class
+544 * @name KJUR.asn1.x509.KeyUsage
+545 * @class KeyUsage ASN.1 structure class
+546 * @param {Array} params associative array of parameters (ex. {'bin': '11', 'critical': true})
+547 * @extends KJUR.asn1.x509.Extension
+548 * @description
+549 * This class is for <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.3" target="_blank">KeyUsage</a> X.509v3 extension.
+550 * <pre>
+551 * id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 }
+552 * KeyUsage ::= BIT STRING {
+553 * digitalSignature (0),
+554 * nonRepudiation (1),
+555 * keyEncipherment (2),
+556 * dataEncipherment (3),
+557 * keyAgreement (4),
+558 * keyCertSign (5),
+559 * cRLSign (6),
+560 * encipherOnly (7),
+561 * decipherOnly (8) }
+562 * </pre><br/>
+563 * NOTE: 'names' parameter is supprted since jsrsasign 8.0.14.
+564 * @example
+565 * o = new KJUR.asn1.x509.KeyUsage({bin: "11"});
+566 * o = new KJUR.asn1.x509.KeyUsage({critical: true, bin: "11"});
+567 * o = new KJUR.asn1.x509.KeyUsage({names: ['digitalSignature', 'keyAgreement']});
+568 */
+569 KJUR.asn1.x509.KeyUsage = function(params) {
+570 KJUR.asn1.x509.KeyUsage.superclass.constructor.call(this, params);
+571 var _KEYUSAGE_NAME = X509.KEYUSAGE_NAME;
+572
+573 this.getExtnValueHex = function() {
+574 return this.asn1ExtnValue.getEncodedHex();
+575 };
+576
+577 this.oid = "2.5.29.15";
+578 if (params !== undefined) {
+579 if (params.bin !== undefined) {
+580 this.asn1ExtnValue = new KJUR.asn1.DERBitString(params);
+581 }
+582 if (params.names !== undefined &&
+583 params.names.length !== undefined) {
+584 var names = params.names;
+585 var s = "000000000";
+586 for (var i = 0; i < names.length; i++) {
+587 for (var j = 0; j < _KEYUSAGE_NAME.length; j++) {
+588 if (names[i] === _KEYUSAGE_NAME[j]) {
+589 s = s.substring(0, j) + '1' +
+590 s.substring(j + 1, s.length);
+591 }
+592 }
+593 }
+594 this.asn1ExtnValue = new KJUR.asn1.DERBitString({bin: s});
+595 }
+596 }
+597 };
+598 YAHOO.lang.extend(KJUR.asn1.x509.KeyUsage, KJUR.asn1.x509.Extension);
+599
+600 /**
+601 * BasicConstraints ASN.1 structure class
+602 * @name KJUR.asn1.x509.BasicConstraints
+603 * @class BasicConstraints ASN.1 structure class
+604 * @param {Array} params JSON object for parameters (ex. {cA:true,critical:true})
+605 * @extends KJUR.asn1.x509.Extension
+606 * @see {@link X509#getExtBasicConstraints}
+607 * @description
+608 * This class represents
+609 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.9">
+610 * BasicConstraints extension defined in RFC 5280 4.2.1.9</a>.
+611 * <pre>
+612 * id-ce-basicConstraints OBJECT IDENTIFIER ::= { id-ce 19 }
+613 * BasicConstraints ::= SEQUENCE {
+614 * cA BOOLEAN DEFAULT FALSE,
+615 * pathLenConstraint INTEGER (0..MAX) OPTIONAL }
+616 * </pre>
+617 * Its constructor can have following parameters:
+618 * <ul>
+619 * <li>{Boolean}cA - cA flag</li>
+620 * <li>{Integer}pathLen - pathLen field value</li>
+621 * <li>{Boolean}critical - critical flag</li>
+622 * </ul>
+623 * @example
+624 * new KJUR.asn1.x509.BasicConstraints({
+625 * cA: true,
+626 * pathLen: 3,
+627 * critical: true
+628 * })
+629 */
+630 KJUR.asn1.x509.BasicConstraints = function(params) {
+631 KJUR.asn1.x509.BasicConstraints.superclass.constructor.call(this, params);
+632 var _KJUR_asn1 = KJUR.asn1,
+633 _DERBoolean = _KJUR_asn1.DERBoolean,
+634 _DERInteger = _KJUR_asn1.DERInteger,
+635 _DERSequence = _KJUR_asn1.DERSequence;
+636
+637 var cA = false;
+638 var pathLen = -1;
+639
+640 this.getExtnValueHex = function() {
+641 var asn1Array = new Array();
+642 if (this.cA) asn1Array.push(new _DERBoolean());
+643 if (this.pathLen > -1)
+644 asn1Array.push(new _DERInteger({'int': this.pathLen}));
+645 var asn1Seq = new _DERSequence({'array': asn1Array});
+646 this.asn1ExtnValue = asn1Seq;
+647 return this.asn1ExtnValue.getEncodedHex();
+648 };
+649
+650 this.oid = "2.5.29.19";
+651 this.cA = false;
+652 this.pathLen = -1;
+653 if (params !== undefined) {
+654 if (params.cA !== undefined) {
+655 this.cA = params.cA;
+656 }
+657 if (params.pathLen !== undefined) {
+658 this.pathLen = params.pathLen;
+659 }
+660 }
+661 };
+662 YAHOO.lang.extend(KJUR.asn1.x509.BasicConstraints, KJUR.asn1.x509.Extension);
+663
+664 /**
+665 * CRLDistributionPoints ASN.1 structure class
+666 * @name KJUR.asn1.x509.CRLDistributionPoints
+667 * @class CRLDistributionPoints ASN.1 structure class
+668 * @param {Array} params associative array of parameters (ex. {'uri': 'http://a.com/', 'critical': true})
+669 * @extends KJUR.asn1.x509.Extension
+670 * @see {@link X509#getExtCRLDistributionPoints}
+671 * @see {@link KJUR.asn1.x509.DistributionPoint}
+672 * @see {@link KJUR.asn1.x509.GeneralNames}
+673 * @description
+674 * This class represents
+675 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.13">
+676 * CRLDistributionPoints extension defined in RFC 5280 4.2.1.13</a>.
+677 * <pre>
+678 * id-ce-cRLDistributionPoints OBJECT IDENTIFIER ::= { id-ce 31 }
+679 * CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
+680 * DistributionPoint ::= SEQUENCE {
+681 * distributionPoint [0] DistributionPointName OPTIONAL,
+682 * reasons [1] ReasonFlags OPTIONAL,
+683 * cRLIssuer [2] GeneralNames OPTIONAL }
+684 * DistributionPointName ::= CHOICE {
+685 * fullName [0] GeneralNames,
+686 * nameRelativeToCRLIssuer [1] RelativeDistinguishedName }
+687 * </pre>
+688 * Constructor can have following parameter:
+689 * <ul>
+690 * <li>{Array}array - array of {@link KJUR.asn1.x509.DistributionPoint} parameter</li>
+691 * <li>{Boolean}critical - critical flag</li>
+692 * </ul>
+693 * @example
+694 * new KJUR.asn1.x509.CRLDistributionPoints({
+695 * array: [{fulluri: "http://aaa.com/"}, {fulluri: "ldap://aaa.com/"}],
+696 * critical: true
+697 * })
+698 */
+699 KJUR.asn1.x509.CRLDistributionPoints = function(params) {
+700 KJUR.asn1.x509.CRLDistributionPoints.superclass.constructor.call(this, params);
+701 var _KJUR = KJUR,
+702 _KJUR_asn1 = _KJUR.asn1,
+703 _KJUR_asn1_x509 = _KJUR_asn1.x509;
+704
+705 this.getExtnValueHex = function() {
+706 return this.asn1ExtnValue.getEncodedHex();
+707 };
+708
+709 this.setByDPArray = function(dpArray) {
+710 var asn1Array = [];
+711 for (var i = 0; i < dpArray.length; i++) {
+712 if (dpArray[i] instanceof KJUR.asn1.ASN1Object) {
+713 asn1Array.push(dpArray[i]);
+714 } else {
+715 var dp = new _KJUR_asn1_x509.DistributionPoint(dpArray[i]);
+716 asn1Array.push(dp);
+717 }
+718 }
+719 this.asn1ExtnValue = new _KJUR_asn1.DERSequence({'array': asn1Array});
+720 };
+721
+722 this.setByOneURI = function(uri) {
+723 var dp1 = new _KJUR_asn1_x509.DistributionPoint({fulluri: uri});
+724 this.setByDPArray([dp1]);
+725 };
+726
+727 this.oid = "2.5.29.31";
+728 if (params !== undefined) {
+729 if (params.array !== undefined) {
+730 this.setByDPArray(params.array);
+731 } else if (params.uri !== undefined) {
+732 this.setByOneURI(params.uri);
+733 }
+734 }
+735 };
+736 YAHOO.lang.extend(KJUR.asn1.x509.CRLDistributionPoints, KJUR.asn1.x509.Extension);
+737
+738 /**
+739 * DistributionPoint ASN.1 structure class<br/>
+740 * @name KJUR.asn1.x509.DistributionPoint
+741 * @class DistributionPoint ASN.1 structure class
+742 * @param {Array} params JSON object of parameters (OPTIONAL)
+743 * @extends KJUR.asn1.ASN1Object
+744 * @see {@link KJUR.asn1.x509.CRLDistributionPoints}
+745 * @see {@link KJUR.asn1.x509.DistributionPointName}
+746 * @see {@link KJUR.asn1.x509.GeneralNames}
+747 * @see {@link X509#getDistributionPoint}
+748 * @description
+749 * This class represents
+750 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.13">
+751 * DistributionPoint defined in RFC 5280 4.2.1.13</a>.
+752 * <pre>
+753 * DistributionPoint ::= SEQUENCE {
+754 * distributionPoint [0] DistributionPointName OPTIONAL,
+755 * reasons [1] ReasonFlags OPTIONAL,
+756 * cRLIssuer [2] GeneralNames OPTIONAL }
+757 * </pre>
+758 * Constructor can have following parameter:
+759 * <ul>
+760 * <li>{String}fulluri - uri string for fullName uri. This has the same meaning for '{dpname: {full: [{uri: "..."]}}'.</li>
+761 * <li>{Array}dpname - JSON object for {@link KJUR.asn1.x509.DistributionPointName} parameters</li>
+762 * <li>{DistrubutionPoint}dpobj - {@link KJUR.asn1.x509.DistributionPointName} object (DEPRECATED)</li>
+763 * </ul>
+764 * <br/>
+765 * NOTE1: Parameter "fulluri" and "dpname" supported
+766 * since jsrsasign 9.0.0 asn1x509 2.0.0.
+767 * <br/>
+768 * NOTE2: The "reasons" and "cRLIssuer" fields are currently
+769 * not supported.
+770 * @example
+771 * new KJUR.asn1.x509.DistributionPoint(
+772 * {fulluri: "http://example.com/crl1.crl"})
+773 * new KJUR.asn1.x509.DistributionPoint(
+774 * {dpname: {full: [{uri: "http://example.com/crl1.crl"}]}})
+775 * new KJUR.asn1.x509.DistributionPoint(
+776 * {dpobj: new DistributionPoint(...)})
+777 */
+778 KJUR.asn1.x509.DistributionPoint = function(params) {
+779 KJUR.asn1.x509.DistributionPoint.superclass.constructor.call(this);
+780 var asn1DP = null,
+781 _KJUR = KJUR,
+782 _KJUR_asn1 = _KJUR.asn1,
+783 _DistributionPointName = _KJUR_asn1.x509.DistributionPointName;
+784
+785 this.getEncodedHex = function() {
+786 var seq = new _KJUR_asn1.DERSequence();
+787 if (this.asn1DP != null) {
+788 var o1 = new _KJUR_asn1.DERTaggedObject({'explicit': true,
+789 'tag': 'a0',
+790 'obj': this.asn1DP});
+791 seq.appendASN1Object(o1);
+792 }
+793 this.hTLV = seq.getEncodedHex();
+794 return this.hTLV;
+795 };
+796
+797 if (params !== undefined) {
+798 if (params.dpobj !== undefined) {
+799 this.asn1DP = params.dpobj;
+800 } else if (params.dpname !== undefined) {
+801 this.asn1DP = new _DistributionPointName(params.dpname);
+802 } else if (params.fulluri !== undefined) {
+803 this.asn1DP = new _DistributionPointName({full: [{uri: params.fulluri}]});
+804 }
+805 }
+806 };
+807 YAHOO.lang.extend(KJUR.asn1.x509.DistributionPoint, KJUR.asn1.ASN1Object);
+808
+809 /**
+810 * DistributionPointName ASN.1 structure class<br/>
+811 * @name KJUR.asn1.x509.DistributionPointName
+812 * @class DistributionPointName ASN.1 structure class
+813 * @param {Array} params JSON object of parameters or GeneralNames object
+814 * @extends KJUR.asn1.ASN1Object
+815 * @see {@link KJUR.asn1.x509.CRLDistributionPoints}
+816 * @see {@link KJUR.asn1.x509.DistributionPoint}
+817 * @see {@link KJUR.asn1.x509.GeneralNames}
+818 * @see {@link X509#getDistributionPointName}
+819 * @description
+820 * This class represents
+821 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.13">
+822 * DistributionPointName defined in RFC 5280 4.2.1.13</a>.
+823 * <pre>
+824 * DistributionPointName ::= CHOICE {
+825 * fullName [0] GeneralNames,
+826 * nameRelativeToCRLIssuer [1] RelativeDistinguishedName }
+827 * </pre>
+828 * Constructor can have following parameter:
+829 * <ul>
+830 * <li>{String}full - JSON object parameter of {@link KJUR.asn1.x509.GeneralNames} for 'fullName' field</li>
+831 * <li>{GeneralNames} - {@link KJUR.asn1.x509.GeneralNames} object for 'fullName'</li>
+832 * </ul>
+833 * NOTE1: 'full' parameter have been suppored since jsrsasign 9.0.0 asn1x509 2.0.0.
+834 * <br>
+835 * NOTE2: The 'nameRelativeToCRLIssuer' field is currently not supported.
+836 * @example
+837 * new KJUR.asn1.x509.DistributionPointName({full: <<GeneralNamesParameter>>})
+838 * new KJUR.asn1.x509.DistributionPointName({full: [{uri: <<CDPURI>>}]})
+839 * new KJUR.asn1.x509.DistributionPointName({full: [{dn: <<DN Parameter>>}]}
+840 * new KJUR.asn1.x509.DistributionPointName({full: [{uri: "http://example.com/root.crl"}]})
+841 * new KJUR.asn1.x509.DistributionPointName({full: [{dn {str: "/C=US/O=Test"}}]})
+842 * new KJUR.asn1.x509.DistributionPointName(new GeneralNames(...))
+843 */
+844 KJUR.asn1.x509.DistributionPointName = function(params) {
+845 KJUR.asn1.x509.DistributionPointName.superclass.constructor.call(this);
+846 var asn1Obj = null,
+847 type = null,
+848 tag = null,
+849 asn1V = null,
+850 _KJUR = KJUR,
+851 _KJUR_asn1 = _KJUR.asn1,
+852 _DERTaggedObject = _KJUR_asn1.DERTaggedObject;
+853
+854 this.getEncodedHex = function() {
+855 if (this.type != "full")
+856 throw new Error("currently type shall be 'full': " + this.type);
+857 this.asn1Obj = new _DERTaggedObject({'explicit': false,
+858 'tag': this.tag,
+859 'obj': this.asn1V});
+860 this.hTLV = this.asn1Obj.getEncodedHex();
+861 return this.hTLV;
+862 };
+863
+864 if (params !== undefined) {
+865 if (_KJUR_asn1.x509.GeneralNames.prototype.isPrototypeOf(params)) {
+866 this.type = "full";
+867 this.tag = "a0";
+868 this.asn1V = params;
+869 } else if (params.full !== undefined) {
+870 this.type = "full";
+871 this.tag = "a0";
+872 this.asn1V = new _KJUR_asn1.x509.GeneralNames(params.full);
+873 } else {
+874 throw new Error("This class supports GeneralNames only as argument");
+875 }
+876 }
+877 };
+878 YAHOO.lang.extend(KJUR.asn1.x509.DistributionPointName, KJUR.asn1.ASN1Object);
+879
+880 /**
+881 * CertificatePolicies ASN.1 structure class
+882 * @name KJUR.asn1.x509.CertificatePolicies
+883 * @class CertificatePolicies ASN.1 structure class
+884 * @param {Array} params associative array of parameters
+885 * @extends KJUR.asn1.x509.Extension
+886 * @since jsrsasign 8.0.23 asn1x509 1.1.12
+887 * @see KJUR.asn1.x509.CertificatePolicies
+888 * @see KJUR.asn1.x509.PolicyInformation
+889 * @see KJUR.asn1.x509.PolicyQualifierInfo
+890 * @see KJUR.asn1.x509.UserNotice
+891 * @see KJUR.asn1.x509.NoticeReference
+892 * @see KJUR.asn1.x509.DisplayText
+893 * @description
+894 * This class represents
+895 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.4">
+896 * CertificatePolicies extension defined in RFC 5280 4.2.1.4</a>.
+897 * <pre>
+898 * id-ce-certificatePolicies OBJECT IDENTIFIER ::= { id-ce 32 }
+899 * CertificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
+900 * </pre>
+901 * Its constructor can have following parameters:
+902 * <ul>
+903 * <li>array - array of {@link KJUR.asn1.x509.PolicyInformation} parameter</li>
+904 * <li>critical - boolean: critical flag</li>
+905 * </ul>
+906 * NOTE: Returned JSON value format have been changed without
+907 * backward compatibility since jsrsasign 9.0.0 asn1x509 2.0.0.
+908 * @example
+909 * e1 = new KJUR.asn1.x509.CertificatePolicies({
+910 * array: [
+911 * { policyoid: "1.2.3.4.5",
+912 * array: [
+913 * { cps: "https://example.com/repository" },
+914 * { unotice: {
+915 * noticeref: { // CA SHOULD NOT use this by RFC
+916 * org: {type: "ia5", str: "Sample Org"},
+917 * noticenum: [{int: 5}, {hex: "01af"}]
+918 * },
+919 * exptext: {type: "ia5", str: "Sample Policy"}
+920 * }}
+921 * ]
+922 * }
+923 * ],
+924 * critical: true
+925 * });
+926 */
+927 KJUR.asn1.x509.CertificatePolicies = function(params) {
+928 KJUR.asn1.x509.CertificatePolicies.superclass.constructor.call(this, params);
+929 var _KJUR = KJUR,
+930 _KJUR_asn1 = _KJUR.asn1,
+931 _KJUR_asn1_x509 = _KJUR_asn1.x509,
+932 _DERSequence = _KJUR_asn1.DERSequence,
+933 _PolicyInformation = _KJUR_asn1_x509.PolicyInformation;
+934
+935 this.params = null;
+936
+937 this.getExtnValueHex = function() {
+938 var aPI = [];
+939 for (var i = 0; i < this.params.array.length; i++) {
+940 aPI.push(new _PolicyInformation(this.params.array[i]));
+941 }
+942 var seq = new _DERSequence({array: aPI});
+943 this.asn1ExtnValue = seq;
+944 return this.asn1ExtnValue.getEncodedHex();
+945 };
+946
+947 this.oid = "2.5.29.32";
+948 if (params !== undefined) {
+949 this.params = params;
+950 }
+951 };
+952 YAHOO.lang.extend(KJUR.asn1.x509.CertificatePolicies, KJUR.asn1.x509.Extension);
+953
+954 // ===== BEGIN CertificatePolicies related classes =====
+955 /**
+956 * PolicyInformation ASN.1 structure class
+957 * @name KJUR.asn1.x509.PolicyInformation
+958 * @class PolicyInformation ASN.1 structure class
+959 * @param {Array} params JSON object of parameters
+960 * @extends KJUR.asn1.ASN1Object
+961 * @since jsrsasign 8.0.23 asn1x509 1.1.12
+962 * @see KJUR.asn1.x509.CertificatePolicies
+963 * @see KJUR.asn1.x509.PolicyInformation
+964 * @see KJUR.asn1.x509.PolicyQualifierInfo
+965 * @see KJUR.asn1.x509.UserNotice
+966 * @see KJUR.asn1.x509.NoticeReference
+967 * @see KJUR.asn1.x509.DisplayText
+968 * @description
+969 * This class represents
+970 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.4">
+971 * PolicyInformation defined in RFC 5280 4.2.1.4</a>.
+972 * <pre>
+973 * PolicyInformation ::= SEQUENCE {
+974 * policyIdentifier CertPolicyId,
+975 * policyQualifiers SEQUENCE SIZE (1..MAX) OF
+976 * PolicyQualifierInfo OPTIONAL }
+977 * CertPolicyId ::= OBJECT IDENTIFIER
+978 * Its constructor can have following parameters:
+979 * <ul>
+980 * <li>{String}policyoid - policy OID (ex. "1.2.3.4.5")</li>
+981 * <li>{Object}array - array of {@link KJUR.asn1.x509.PolicyQualifierInfo}
+982 * parameters (OPTIONAL)</li>
+983 * </ul>
+984 * @example
+985 * new KJUR.asn1.x509.PolicyInformation({
+986 * policyoid: "1.2.3.4.5",
+987 * array: [
+988 * { cps: "https://example.com/repository" },
+989 * { unotice: {
+990 * noticeref: { // CA SHOULD NOT use this by RFC
+991 * org: {type: "ia5", str: "Sample Org"},
+992 * noticenum: [{int: 5}, {hex: "01af"}]
+993 * },
+994 * exptext: {type: "ia5", str: "Sample Policy"}
+995 * }}
+996 * ]
+997 * })
+998 */
+999 KJUR.asn1.x509.PolicyInformation = function(params) {
+1000 KJUR.asn1.x509.PolicyInformation.superclass.constructor.call(this,
+1001 params);
+1002 var _KJUR_asn1 = KJUR.asn1,
+1003 _DERSequence = _KJUR_asn1.DERSequence,
+1004 _DERObjectIdentifier = _KJUR_asn1.DERObjectIdentifier,
+1005 _PolicyQualifierInfo = _KJUR_asn1.x509.PolicyQualifierInfo;
+1006
+1007 this.params = null;
+1008
+1009 this.getEncodedHex = function() {
+1010 if (this.params.policyoid === undefined &&
+1011 this.params.array === undefined)
+1012 throw new Error("parameter oid and array missing");
+1013
+1014 // policy oid
+1015 var a = [new _DERObjectIdentifier(this.params.policyoid)];
+1016
+1017 // array of ASN1Object of PolicyQualifierInfo
+1018 if (this.params.array !== undefined) {
+1019 var aPQI = [];
+1020 for (var i = 0; i < this.params.array.length; i++) {
+1021 aPQI.push(new _PolicyQualifierInfo(this.params.array[i]));
+1022 }
+1023 if (aPQI.length > 0) {
+1024 a.push(new _DERSequence({array: aPQI}));
+1025 }
+1026 }
+1027
+1028 var seq = new _DERSequence({array: a});
+1029 return seq.getEncodedHex();
+1030 };
+1031
+1032 if (params !== undefined) {
+1033 this.params = params;
+1034 }
+1035 };
+1036 YAHOO.lang.extend(KJUR.asn1.x509.PolicyInformation, KJUR.asn1.ASN1Object);
+1037
+1038 /**
+1039 * PolicyQualifierInfo ASN.1 structure class
+1040 * @name KJUR.asn1.x509.PolicyQualifierInfo
+1041 * @class PolicyQualifierInfo ASN.1 structure class
+1042 * @param {Array} params associative array of parameters
+1043 * @extends KJUR.asn1.ASN1Object
+1044 * @since jsrsasign 8.0.23 asn1x509 1.1.12
+1045 * @description
+1046 * This class represents
+1047 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.4">
+1048 * PolicyQualifierInfo defined in RFC 5280 4.2.1.4</a>.
+1049 * <pre>
+1050 * PolicyQualifierInfo ::= SEQUENCE {
+1051 * policyQualifierId PolicyQualifierId,
+1052 * qualifier ANY DEFINED BY policyQualifierId }
+1053 * PolicyQualifierId ::= OBJECT IDENTIFIER ( id-qt-cps | id-qt-unotice )
+1054 * CPSuri ::= IA5String
+1055 * </pre>
+1056 * Its constructor can have one of following two parameters:
+1057 * <ul>
+1058 * <li>{String}cps - URI string for CPS</li>
+1059 * <li>{Object}unotice - {@link KJUR.asn1.x509.UserNotice} parameter</li>
+1060 * </ul>
+1061 * @example
+1062 * new PolicyQualifierInfo({
+1063 * cps: "https://example.com/repository/cps"
+1064 * })
+1065 *
+1066 * new PolicyQualifierInfo({
+1067 * unotice: {
+1068 * noticeref: { // CA SHOULD NOT use this by RFC
+1069 * org: {type: "bmp", str: "Sample Org"},
+1070 * noticenum: [{int: 3}, {hex: "01af"}]
+1071 * },
+1072 * exptext: {type: "ia5", str: "Sample Policy"}
+1073 * }
+1074 * })
+1075 */
+1076 KJUR.asn1.x509.PolicyQualifierInfo = function(params) {
+1077 KJUR.asn1.x509.PolicyQualifierInfo.superclass.constructor.call(this,
+1078 params);
+1079 var _KJUR_asn1 = KJUR.asn1,
+1080 _DERSequence = _KJUR_asn1.DERSequence,
+1081 _DERIA5String = _KJUR_asn1.DERIA5String,
+1082 _DERObjectIdentifier = _KJUR_asn1.DERObjectIdentifier,
+1083 _UserNotice = _KJUR_asn1.x509.UserNotice;
+1084
+1085 this.params = null;
+1086
+1087 this.getEncodedHex = function() {
+1088 if (this.params.cps !== undefined) {
+1089 var seq = new _DERSequence({array: [
+1090 new _DERObjectIdentifier({oid: '1.3.6.1.5.5.7.2.1'}),
+1091 new _DERIA5String({str: this.params.cps})
+1092 ]});
+1093 return seq.getEncodedHex();
+1094 }
+1095 if (this.params.unotice != undefined) {
+1096 var seq = new _DERSequence({array: [
+1097 new _DERObjectIdentifier({oid: '1.3.6.1.5.5.7.2.2'}),
+1098 new _UserNotice(this.params.unotice)
+1099 ]});
+1100 return seq.getEncodedHex();
+1101 }
+1102 };
+1103
+1104 if (params !== undefined) {
+1105 this.params = params;
+1106 }
+1107 };
+1108 YAHOO.lang.extend(KJUR.asn1.x509.PolicyQualifierInfo, KJUR.asn1.ASN1Object);
1109
-1110 /**
-1111 * UserNotice ASN.1 structure class
-1112 * @name KJUR.asn1.x509.UserNotice
-1113 * @class UserNotice ASN.1 structure class
-1114 * @param {Array} params associative array of parameters
-1115 * @extends KJUR.asn1.ASN1Object
-1116 * @since jsrsasign 8.0.23 asn1x509 1.1.12
-1117 * @description
-1118 * This class represents
-1119 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.4">
-1120 * UserNotice defined in RFC 5280 4.2.1.4</a>.
-1121 * <pre>
-1122 * UserNotice ::= SEQUENCE {
-1123 * noticeRef NoticeReference OPTIONAL,
-1124 * explicitText DisplayText OPTIONAL }
-1125 * </pre>
-1126 * Its constructor can have following two parameters:
-1127 * <ul>
-1128 * <li>{Object}noticeref - {@link KJUR.asn1.x509.NoticeReference} parameter.
-1129 * This SHALL NOT be set for conforming CA by RFC 5280. (OPTIONAL)</li>
-1130 * <li>{Object}exptext - explicitText value
-1131 * by {@link KJUR.asn1.x509.DisplayText} parameter (OPTIONAL)</li>
-1132 * </ul>
-1133 * @example
-1134 * new UserNotice({
-1135 * noticeref: {
-1136 * org: {type: "bmp", str: "Sample Org"},
-1137 * noticenum: [{int: 3}, {hex: "01af"}]
-1138 * },
-1139 * exptext: {type: "ia5", str: "Sample Policy"}
-1140 * })
-1141 */
-1142 KJUR.asn1.x509.UserNotice = function(params) {
-1143 KJUR.asn1.x509.UserNotice.superclass.constructor.call(this, params);
-1144 var _DERSequence = KJUR.asn1.DERSequence,
-1145 _DERInteger = KJUR.asn1.DERInteger,
-1146 _DisplayText = KJUR.asn1.x509.DisplayText,
-1147 _NoticeReference = KJUR.asn1.x509.NoticeReference;
-1148
-1149 this.params = null;
-1150
-1151 this.getEncodedHex = function() {
-1152 var a = [];
-1153 if (this.params.noticeref !== undefined) {
-1154 a.push(new _NoticeReference(this.params.noticeref));
-1155 }
-1156 if (this.params.exptext !== undefined) {
-1157 a.push(new _DisplayText(this.params.exptext));
-1158 }
-1159 var seq = new _DERSequence({array: a});
-1160 return seq.getEncodedHex();
-1161 };
-1162
-1163 if (params !== undefined) {
-1164 this.params = params;
-1165 }
-1166 };
-1167 YAHOO.lang.extend(KJUR.asn1.x509.UserNotice, KJUR.asn1.ASN1Object);
-1168
-1169 /**
-1170 * NoticeReference ASN.1 structure class
-1171 * @name KJUR.asn1.x509.NoticeReference
-1172 * @class NoticeReference ASN.1 structure class
-1173 * @param {Array} params associative array of parameters
-1174 * @extends KJUR.asn1.ASN1Object
-1175 * @since jsrsasign 8.0.23 asn1x509 1.1.12
-1176 * @description
-1177 * This class represents
-1178 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.4">
-1179 * NoticeReference defined in RFC 5280 4.2.1.4</a>.
-1180 * <pre>
-1181 * NoticeReference ::= SEQUENCE {
-1182 * organization DisplayText,
-1183 * noticeNumbers SEQUENCE OF INTEGER }
-1184 * </pre>
-1185 * Its constructor can have following two parameters:
-1186 * <ul>
-1187 * <li>{Object}org - organization by {@link KJUR.asn1.x509.DisplayText}
-1188 * parameter.</li>
-1189 * <li>{Object}noticenum - noticeNumbers value by an array of
-1190 * {@link KJUR.asn1.DERInteger} parameter</li>
-1191 * </ul>
-1192 * @example
-1193 * new NoticeReference({
-1194 * org: {type: "bmp", str: "Sample Org"},
-1195 * noticenum: [{int: 3}, {hex: "01af"}]
-1196 * })
-1197 */
-1198 KJUR.asn1.x509.NoticeReference = function(params) {
-1199 KJUR.asn1.x509.NoticeReference.superclass.constructor.call(this, params);
-1200 var _DERSequence = KJUR.asn1.DERSequence,
-1201 _DERInteger = KJUR.asn1.DERInteger,
-1202 _DisplayText = KJUR.asn1.x509.DisplayText;
-1203
-1204 this.params = null;
-1205
-1206 this.getEncodedHex = function() {
-1207 var a = [];
-1208 if (this.params.org !== undefined) {
-1209 a.push(new _DisplayText(this.params.org));
-1210 }
-1211 if (this.params.noticenum !== undefined) {
-1212 var aNoticeNum = [];
-1213 var aNumParam = this.params.noticenum;
-1214 for (var i = 0; i < aNumParam.length; i++) {
-1215 aNoticeNum.push(new _DERInteger(aNumParam[i]));
-1216 }
-1217 a.push(new _DERSequence({array: aNoticeNum}));
-1218 }
-1219 if (a.length == 0) throw new Error("parameter is empty");
-1220 var seq = new _DERSequence({array: a});
-1221 return seq.getEncodedHex();
-1222 }
-1223
-1224 if (params !== undefined) {
-1225 this.params = params;
-1226 }
-1227 };
-1228 YAHOO.lang.extend(KJUR.asn1.x509.NoticeReference, KJUR.asn1.ASN1Object);
-1229
-1230 /**
-1231 * DisplayText ASN.1 structure class
-1232 * @name KJUR.asn1.x509.DisplayText
-1233 * @class DisplayText ASN.1 structure class
-1234 * @param {Array} params associative array of parameters
-1235 * @extends KJUR.asn1.DERAbstractString
-1236 * @since jsrsasign 8.0.23 asn1x509 1.1.12
-1237 * @description
-1238 * This class represents
-1239 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.4">
-1240 * DisplayText defined in RFC 5280 4.2.1.4</a>.
-1241 * <pre>
-1242 * -- from RFC 5280 Appendix A
-1243 * DisplayText ::= CHOICE {
-1244 * ia5String IA5String (SIZE (1..200)),
-1245 * visibleString VisibleString (SIZE (1..200)),
-1246 * bmpString BMPString (SIZE (1..200)),
-1247 * utf8String UTF8String (SIZE (1..200)) }
-1248 * </pre>
-1249 * {@link KJUR.asn1.DERAbstractString} parameters and methods
-1250 * can be used.
-1251 * Its constructor can also have following parameter:
-1252 * <ul>
-1253 * <li>{String} type - DirectoryString type of DisplayText.
-1254 * "ia5" for IA5String, "vis" for VisibleString,
-1255 * "bmp" for BMPString and "utf8" for UTF8String.
-1256 * Default is "utf8". (OPTIONAL)</li>
-1257 * </ul>
-1258 * @example
-1259 * new DisplayText({type: "bmp", str: "Sample Org"})
-1260 * new DisplayText({type: "ia5", str: "Sample Org"})
-1261 * new DisplayText({str: "Sample Org"})
-1262 */
-1263 KJUR.asn1.x509.DisplayText = function(params) {
-1264 KJUR.asn1.x509.DisplayText.superclass.constructor.call(this, params);
-1265
-1266 this.hT = "0c"; // DEFAULT "utf8"
-1267
-1268 if (params !== undefined) {
-1269 if (params.type === "ia5") {
-1270 this.hT = "16";
-1271 } else if (params.type === "vis") {
-1272 this.hT = "1a";
-1273 } else if (params.type === "bmp") {
-1274 this.hT = "1e";
-1275 }
-1276 }
-1277 };
-1278 YAHOO.lang.extend(KJUR.asn1.x509.DisplayText, KJUR.asn1.DERAbstractString);
-1279 // ===== END CertificatePolicies related classes =====
-1280
-1281 // =====================================================================
-1282 /**
-1283 * KeyUsage ASN.1 structure class
-1284 * @name KJUR.asn1.x509.ExtKeyUsage
-1285 * @class ExtKeyUsage ASN.1 structure class
-1286 * @param {Array} params associative array of parameters
-1287 * @extends KJUR.asn1.x509.Extension
-1288 * @description
-1289 * @example
-1290 * e1 = new KJUR.asn1.x509.ExtKeyUsage({
-1291 * critical: true,
-1292 * array: [
-1293 * {oid: '2.5.29.37.0'}, // anyExtendedKeyUsage
-1294 * {name: 'clientAuth'},
-1295 * "1.2.3.4",
-1296 * "serverAuth"
-1297 * ]
-1298 * });
-1299 * // id-ce-extKeyUsage OBJECT IDENTIFIER ::= { id-ce 37 }
-1300 * // ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
-1301 * // KeyPurposeId ::= OBJECT IDENTIFIER
-1302 */
-1303 KJUR.asn1.x509.ExtKeyUsage = function(params) {
-1304 KJUR.asn1.x509.ExtKeyUsage.superclass.constructor.call(this, params);
-1305 var _KJUR = KJUR,
-1306 _KJUR_asn1 = _KJUR.asn1;
-1307
-1308 this.setPurposeArray = function(purposeArray) {
-1309 this.asn1ExtnValue = new _KJUR_asn1.DERSequence();
-1310 for (var i = 0; i < purposeArray.length; i++) {
-1311 var o = new _KJUR_asn1.DERObjectIdentifier(purposeArray[i]);
-1312 this.asn1ExtnValue.appendASN1Object(o);
-1313 }
-1314 };
-1315
-1316 this.getExtnValueHex = function() {
-1317 return this.asn1ExtnValue.getEncodedHex();
-1318 };
-1319
-1320 this.oid = "2.5.29.37";
-1321 if (params !== undefined) {
-1322 if (params.array !== undefined) {
-1323 this.setPurposeArray(params.array);
-1324 }
-1325 }
-1326 };
-1327 YAHOO.lang.extend(KJUR.asn1.x509.ExtKeyUsage, KJUR.asn1.x509.Extension);
-1328
-1329 /**
-1330 * AuthorityKeyIdentifier ASN.1 structure class
-1331 * @name KJUR.asn1.x509.AuthorityKeyIdentifier
-1332 * @class AuthorityKeyIdentifier ASN.1 structure class
-1333 * @param {Array} params associative array of parameters (ex. {kid: {hex: '89ab...'}, critical: true})
-1334 * @extends KJUR.asn1.x509.Extension
-1335 * @since asn1x509 1.0.8
-1336 * @description
-1337 * This class represents ASN.1 structure for <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.1">AuthorityKeyIdentifier in RFC 5280</a>.
-1338 * Constructor of this class may have following parameters.:
-1339 * <ul>
-1340 * <li>kid - When key object (RSA, KJUR.crypto.ECDSA/DSA) or PEM string of issuing authority public key or issuer certificate is specified, key identifier will be automatically calculated by the method specified in RFC 5280. When a hexadecimal string is specifed, kid will be set explicitly by it.</li>
-1341 * <li>isscert - When PEM string of authority certificate is specified, both authorityCertIssuer and authorityCertSerialNumber will be set by the certificate.</li>
-1342 * <li>issuer - {@link KJUR.asn1.x509.X500Name} parameter to specify issuer name explicitly.</li>
-1343 * <li>sn - hexadecimal string to specify serial number explicitly.</li>
-1344 * <li>critical - boolean to specify criticality of this extension
-1345 * however conforming CA must mark this extension as non-critical in RFC 5280.</li>
-1346 * </ul>
-1347 *
-1348 * <pre>
-1349 * d-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 35 }
-1350 * AuthorityKeyIdentifier ::= SEQUENCE {
-1351 * keyIdentifier [0] KeyIdentifier OPTIONAL,
-1352 * authorityCertIssuer [1] GeneralNames OPTIONAL,
-1353 * authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL }
-1354 * KeyIdentifier ::= OCTET STRING
-1355 * </pre>
-1356 *
-1357 * @example
-1358 * // 1. kid by key object
-1359 * keyobj = KEYUTIL.getKey("-----BEGIN PUBLIC KEY...");
-1360 * e1 = new KJUR.asn1.x509.AuthorityKeyIdentifier({kid: keyobj});
-1361 * // 2. kid by PEM string of authority certificate or public key
-1362 * e1 = new KJUR.asn1.x509.AuthorityKeyIdentifier({kid: "-----BEGIN..."});
-1363 * // 3. specify kid explicitly
-1364 * e1 = new KJUR.asn1.x509.AuthorityKeyIdentifier({kid: "8ab1d3..."});
-1365 * });
-1366 * // 4. issuer and serial number by auhtority PEM certificate
-1367 * e1 = new KJUR.asn1.x509.AuthorityKeyIdentifier({isscert: "-----BEGIN..."});
-1368 * // 5. issuer and serial number explicitly
-1369 * e1 = new KJUR.asn1.x509.AuthorityKeyIdentifier({
-1370 * issuer: {ldapstr: "O=test,C=US"},
-1371 * sn: {hex: "1ac7..."}});
-1372 * // 6. combination
-1373 * e1 = new KJUR.asn1.x509.AuthorityKeyIdentifier({
-1374 * kid: "-----BEGIN CERTIFICATE...",
-1375 * isscert: "-----BEGIN CERTIFICATE..."});
-1376 */
-1377 KJUR.asn1.x509.AuthorityKeyIdentifier = function(params) {
-1378 KJUR.asn1.x509.AuthorityKeyIdentifier.superclass.constructor.call(this, params);
-1379 var _KJUR = KJUR,
-1380 _KJUR_asn1 = _KJUR.asn1,
-1381 _DERTaggedObject = _KJUR_asn1.DERTaggedObject,
-1382 _GeneralNames = _KJUR_asn1.x509.GeneralNames,
-1383 _isKey = _KJUR.crypto.Util.isKey;
-1384
-1385 this.asn1KID = null;
-1386 this.asn1CertIssuer = null; // X500Name hTLV
-1387 this.asn1CertSN = null;
-1388
-1389 this.getExtnValueHex = function() {
-1390 var a = new Array();
-1391 if (this.asn1KID)
-1392 a.push(new _DERTaggedObject({'explicit': false,
-1393 'tag': '80',
-1394 'obj': this.asn1KID}));
-1395
-1396 if (this.asn1CertIssuer)
-1397 a.push(new _DERTaggedObject({'explicit': false,
-1398 'tag': 'a1',
-1399 'obj': new _GeneralNames([{dn: this.asn1CertIssuer}])}));
-1400
-1401 if (this.asn1CertSN)
-1402 a.push(new _DERTaggedObject({'explicit': false,
-1403 'tag': '82',
-1404 'obj': this.asn1CertSN}));
-1405
-1406 var asn1Seq = new _KJUR_asn1.DERSequence({'array': a});
-1407 this.asn1ExtnValue = asn1Seq;
-1408 return this.asn1ExtnValue.getEncodedHex();
-1409 };
-1410
-1411 /**
-1412 * set keyIdentifier value by DEROctetString parameter, key object or PEM file
-1413 * @name setKIDByParam
-1414 * @memberOf KJUR.asn1.x509.AuthorityKeyIdentifier#
-1415 * @function
-1416 * @param {Array} param parameter to set key identifier
-1417 * @since asn1x509 1.0.8
-1418 * @description
-1419 * This method will set keyIdentifier by param.
-1420 * Its key identifier value can be set by following type of param argument:
-1421 * <ul>
-1422 * <li>{str: "123"} - by raw string</li>
-1423 * <li>{hex: "01af..."} - by hexadecimal value</li>
-1424 * <li>RSAKey/DSA/ECDSA - by RSAKey, KJUR.crypto.{DSA/ECDSA} public key object.
-1425 * key identifier value will be calculated by the method described in
-1426 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.2">RFC 5280 4.2.1.2 (1)</a>.
-1427 * </li>
-1428 * <li>certificate PEM string - extract subjectPublicKeyInfo from specified PEM
-1429 * certificate and
-1430 * key identifier value will be calculated by the method described in
-1431 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.2">RFC 5280 4.2.1.2 (1)</a>.
-1432 * <li>PKCS#1/#8 public key PEM string - pem will be converted to a key object and
-1433 * to PKCS#8 ASN.1 structure then calculate
-1434 * a key identifier value will be calculated by the method described in
-1435 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.2">RFC 5280 4.2.1.2 (1)</a>.
-1436 * </ul>
-1437 *
-1438 * NOTE1: Automatic key identifier calculation is supported
-1439 * since jsrsasign 8.0.16.
-1440 *
-1441 * @see KEYUTIL.getKeyID
-1442 *
-1443 * @example
-1444 * o = new KJUR.asn1.x509.AuthorityKeyIdentifier();
-1445 * // set by hexadecimal string
-1446 * o.setKIDByParam({hex: '1ad9...'});
-1447 * // set by SubjectPublicKeyInfo of PEM certificate string
-1448 * o.setKIDByParam("-----BEGIN CERTIFICATE...");
-1449 * // set by PKCS#8 PEM public key string
-1450 * o.setKIDByParam("-----BEGIN PUBLIC KEY...");
-1451 * // set by public key object
-1452 * pubkey = KEYUTIL.getKey("-----BEGIN CERTIFICATE...");
-1453 * o.setKIDByParam(pubkey);
-1454 */
-1455 this.setKIDByParam = function(param) {
-1456 if (param.str !== undefined ||
-1457 param.hex !== undefined) {
-1458 this.asn1KID = new KJUR.asn1.DEROctetString(param);
-1459 } else if ((typeof param === "object" &&
-1460 KJUR.crypto.Util.isKey(param)) ||
-1461 (typeof param === "string" &&
-1462 param.indexOf("BEGIN ") != -1)) {
-1463
-1464 var keyobj = param;
-1465 if (typeof param === "string") {
-1466 keyobj = KEYUTIL.getKey(param);
-1467 }
-1468
-1469 var kid = KEYUTIL.getKeyID(keyobj);
-1470 this.asn1KID = new KJUR.asn1.DEROctetString({hex: kid});
-1471 }
-1472 };
-1473
-1474 /**
-1475 * set authorityCertIssuer value by X500Name parameter
-1476 * @name setCertIssuerByParam
-1477 * @memberOf KJUR.asn1.x509.AuthorityKeyIdentifier#
-1478 * @function
-1479 * @param {Array} param parameter to set issuer name
-1480 * @since asn1x509 1.0.8
-1481 * @description
-1482 * This method will set authorityCertIssuer name by param.
-1483 * Issuer name can be set by following type of param argument:
-1484 * <ul>
-1485 * <li>str/ldapstr/hex/certsubject/certissuer -
-1486 * set issuer by {@link KJUR.asn1.x509.X500Name}
-1487 * object with specified parameters.</li>
-1488 * <li>PEM CERTIFICATE STRING - extract its subject name from
-1489 * specified issuer PEM certificate and set.
-1490 * </ul>
-1491 * NOTE1: Automatic authorityCertIssuer setting by certificate
-1492 * is supported since jsrsasign 8.0.16.
-1493 *
-1494 * @see KJUR.asn1.x509.X500Name
-1495 * @see KJUR.asn1.x509.GeneralNames
-1496 * @see X509.getSubjectHex
-1497 *
-1498 * @example
-1499 * var o = new KJUR.asn1.x509.AuthorityKeyIdentifier();
-1500 * // 1. set it by string
-1501 * o.setCertIssuerByParam({str: '/C=US/O=Test'});
-1502 * // 2. set it by issuer PEM certificate
-1503 * o.setCertIssuerByParam("-----BEGIN CERTIFICATE...");
-1504 *
-1505 */
-1506 this.setCertIssuerByParam = function(param) {
-1507 if (param.str !== undefined ||
-1508 param.ldapstr !== undefined ||
-1509 param.hex !== undefined ||
-1510 param.certsubject !== undefined ||
-1511 param.certissuer !== undefined) {
-1512 this.asn1CertIssuer = new KJUR.asn1.x509.X500Name(param);
-1513 } else if (typeof param === "string" &&
-1514 param.indexOf("BEGIN ") != -1 &&
-1515 param.indexOf("CERTIFICATE") != -1) {
-1516 this.asn1CertIssuer = new KJUR.asn1.x509.X500Name({certissuer: param});
-1517 }
-1518 };
-1519
-1520 /**
-1521 * set authorityCertSerialNumber value
-1522 * @name setCertSerialNumberByParam
-1523 * @memberOf KJUR.asn1.x509.AuthorityKeyIdentifier#
-1524 * @function
-1525 * @param {Object} param parameter to set serial number
-1526 * @since asn1x509 1.0.8
-1527 * @description
-1528 * This method will set authorityCertSerialNumber by param.
-1529 * Serial number can be set by following type of param argument:
-1530 *
-1531 * <ul>
-1532 * <li>{int: 123} - by integer value</li>
-1533 * <li>{hex: "01af"} - by hexadecimal integer value</li>
-1534 * <li>{bigint: new BigInteger(...)} - by hexadecimal integer value</li>
-1535 * <li>PEM CERTIFICATE STRING - extract serial number from issuer certificate and
-1536 * set serial number.
-1537 *
-1538 * NOTE1: Automatic authorityCertSerialNumber setting by certificate
-1539 * is supported since jsrsasign 8.0.16.
-1540 *
-1541 * @see X509.getSerialNumberHex
-1542 */
-1543 this.setCertSNByParam = function(param) {
-1544 if (param.str !== undefined ||
-1545 param.bigint !== undefined ||
-1546 param.hex !== undefined) {
-1547 this.asn1CertSN = new KJUR.asn1.DERInteger(param);
-1548 } else if (typeof param === "string" &&
-1549 param.indexOf("BEGIN ") != -1 &&
-1550 param.indexOf("CERTIFICATE")) {
-1551
-1552 var x = new X509();
-1553 x.readCertPEM(param);
-1554 var sn = x.getSerialNumberHex();
-1555 this.asn1CertSN = new KJUR.asn1.DERInteger({hex: sn});
-1556 }
-1557 };
-1558
-1559 this.oid = "2.5.29.35";
-1560 if (params !== undefined) {
-1561 if (params.kid !== undefined) {
-1562 this.setKIDByParam(params.kid);
-1563 }
-1564 if (params.issuer !== undefined) {
-1565 this.setCertIssuerByParam(params.issuer);
-1566 }
-1567 if (params.sn !== undefined) {
-1568 this.setCertSNByParam(params.sn);
-1569 }
-1570
-1571 if (params.issuersn !== undefined &&
-1572 typeof params.issuersn === "string" &&
-1573 params.issuersn.indexOf("BEGIN ") != -1 &&
-1574 params.issuersn.indexOf("CERTIFICATE")) {
-1575 this.setCertSNByParam(params.issuersn);
-1576 this.setCertIssuerByParam(params.issuersn);
-1577 }
-1578 }
-1579 };
-1580 YAHOO.lang.extend(KJUR.asn1.x509.AuthorityKeyIdentifier, KJUR.asn1.x509.Extension);
-1581
-1582 /**
-1583 * SubjectKeyIdentifier extension ASN.1 structure class
-1584 * @name KJUR.asn1.x509.SubjectKeyIdentifier
-1585 * @class SubjectKeyIdentifier ASN.1 structure class
-1586 * @param {Array} params associative array of parameters (ex. {kid: {hex: '89ab...'}, critical: true})
-1587 * @extends KJUR.asn1.x509.Extension
-1588 * @since asn1x509 1.1.7 jsrsasign 8.0.14
-1589 * @description
-1590 * This class represents ASN.1 structure for
-1591 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.2">
-1592 * SubjectKeyIdentifier in RFC 5280</a>.
-1593 * Constructor of this class may have following parameters:
-1594 * <ul>
-1595 * <li>kid - When key object (RSA, KJUR.crypto.ECDSA/DSA) or PEM string of subject public key or certificate is specified, key identifier will be automatically calculated by the method specified in RFC 5280. When a hexadecimal string is specifed, kid will be set explicitly by it.</li>
-1596 * <li>critical - boolean to specify criticality of this extension
-1597 * however conforming CA must mark this extension as non-critical in RFC 5280.</li>
-1598 * </ul>
-1599 * <pre>
-1600 * d-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 14 }
-1601 * SubjectKeyIdentifier ::= KeyIdentifier
-1602 * KeyIdentifier ::= OCTET STRING
-1603 * </pre>
-1604 *
-1605 * @example
-1606 * // set by hexadecimal string
-1607 * e = new KJUR.asn1.x509.SubjectKeyIdentifier({kid: {hex: '89ab'}});
-1608 * // set by PEM public key or certificate string
-1609 * e = new KJUR.asn1.x509.SubjectKeyIdentifier({kid: "-----BEGIN CERTIFICATE..."});
-1610 * // set by public key object
-1611 * pubkey = KEYUTIL.getKey("-----BEGIN CERTIFICATE...");
-1612 * e = new KJUR.asn1.x509.SubjectKeyIdentifier({kid: pubkey});
-1613 */
-1614 KJUR.asn1.x509.SubjectKeyIdentifier = function(params) {
-1615 KJUR.asn1.x509.SubjectKeyIdentifier.superclass.constructor.call(this, params);
-1616 var _KJUR = KJUR,
-1617 _KJUR_asn1 = _KJUR.asn1,
-1618 _DEROctetString = _KJUR_asn1.DEROctetString;
-1619
-1620 this.asn1KID = null;
-1621
-1622 this.getExtnValueHex = function() {
-1623 this.asn1ExtnValue = this.asn1KID;
-1624 return this.asn1ExtnValue.getEncodedHex();
-1625 };
-1626
-1627 /**
-1628 * set keyIdentifier value by DEROctetString parameter, key object or PEM file
-1629 * @name setKIDByParam
-1630 * @memberOf KJUR.asn1.x509.SubjectKeyIdentifier#
-1631 * @function
-1632 * @param {Array} param array of {@link KJUR.asn1.DERInteger} parameter
-1633 * @since asn1x509 1.1.7 jsrsasign 8.0.14
-1634 * @description
-1635 * <ul>
-1636 * <li>{str: "123"} - by raw string</li>
-1637 * <li>{hex: "01af..."} - by hexadecimal value</li>
-1638 * <li>RSAKey/DSA/ECDSA - by RSAKey, KJUR.crypto.{DSA/ECDSA} public key object.
-1639 * key identifier value will be calculated by the method described in
-1640 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.2">RFC 5280 4.2.1.2 (1)</a>.
-1641 * </li>
-1642 * <li>certificate PEM string - extract subjectPublicKeyInfo from specified PEM
-1643 * certificate and
-1644 * key identifier value will be calculated by the method described in
-1645 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.2">RFC 5280 4.2.1.2 (1)</a>.
-1646 * <li>PKCS#1/#8 public key PEM string - pem will be converted to a key object and
-1647 * to PKCS#8 ASN.1 structure then calculate
-1648 * a key identifier value will be calculated by the method described in
-1649 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.2">RFC 5280 4.2.1.2 (1)</a>.
-1650 * </ul>
-1651 *
-1652 * NOTE1: Automatic key identifier calculation is supported
-1653 * since jsrsasign 8.0.16.
-1654 *
-1655 * @see KEYUTIL.getKeyID
-1656 *
-1657 * @example
-1658 * o = new KJUR.asn1.x509.SubjectKeyIdentifier();
-1659 * // set by hexadecimal string
-1660 * o.setKIDByParam({hex: '1ad9...'});
-1661 * // set by SubjectPublicKeyInfo of PEM certificate string
-1662 * o.setKIDByParam("-----BEGIN CERTIFICATE...");
-1663 * // set by PKCS#8 PEM public key string
-1664 * o.setKIDByParam("-----BEGIN PUBLIC KEY...");
-1665 * // set by public key object
-1666 * pubkey = KEYUTIL.getKey("-----BEGIN CERTIFICATE...");
-1667 * o.setKIDByParam(pubkey);
-1668 */
-1669 this.setKIDByParam = function(param) {
-1670 if (param.str !== undefined ||
-1671 param.hex !== undefined) {
-1672 this.asn1KID = new _DEROctetString(param);
-1673 } else if ((typeof param === "object" &&
-1674 KJUR.crypto.Util.isKey(param)) ||
-1675 (typeof param === "string" &&
-1676 param.indexOf("BEGIN") != -1)) {
-1677
-1678 var keyobj = param;
-1679 if (typeof param === "string") {
-1680 keyobj = KEYUTIL.getKey(param);
-1681 }
-1682
-1683 var kid = KEYUTIL.getKeyID(keyobj);
-1684 this.asn1KID = new KJUR.asn1.DEROctetString({hex: kid});
-1685 }
-1686 };
-1687
-1688 this.oid = "2.5.29.14";
-1689 if (params !== undefined) {
-1690 if (params.kid !== undefined) {
-1691 this.setKIDByParam(params.kid);
-1692 }
-1693 }
-1694 };
-1695 YAHOO.lang.extend(KJUR.asn1.x509.SubjectKeyIdentifier, KJUR.asn1.x509.Extension);
-1696
-1697 /**
-1698 * AuthorityInfoAccess ASN.1 structure class
-1699 * @name KJUR.asn1.x509.AuthorityInfoAccess
-1700 * @class AuthorityInfoAccess ASN.1 structure class
-1701 * @param {Array} params JSON object of AuthorityInfoAccess parameters
-1702 * @extends KJUR.asn1.x509.Extension
-1703 * @since asn1x509 1.0.8
-1704 * @see {@link X509#getExtAuthorityInfoAccess}
-1705 * @description
-1706 * This class represents
-1707 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.2.1">
-1708 * AuthorityInfoAccess extension defined in RFC 5280 4.2.2.1</a>.
-1709 * <pre>
-1710 * id-pe OBJECT IDENTIFIER ::= { id-pkix 1 }
-1711 * id-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pe 1 }
-1712 * AuthorityInfoAccessSyntax ::=
-1713 * SEQUENCE SIZE (1..MAX) OF AccessDescription
-1714 * AccessDescription ::= SEQUENCE {
-1715 * accessMethod OBJECT IDENTIFIER,
-1716 * accessLocation GeneralName }
-1717 * id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
-1718 * id-ad-caIssuers OBJECT IDENTIFIER ::= { id-ad 2 }
-1719 * id-ad-ocsp OBJECT IDENTIFIER ::= { id-ad 1 }
-1720 * </pre>
-1721 * NOTE: Acceptable parameters have been changed since
-1722 * from jsrsasign 9.0.0 asn1x509 2.0.0.
-1723 * Parameter generated by {@link X509#getAuthorityInfoAccess}
-1724 * can be accepted as a argument of this constructor.
-1725 * @example
-1726 * e1 = new KJUR.asn1.x509.AuthorityInfoAccess({
-1727 * array: [
-1728 * {ocsp: 'http://ocsp.example.org'},
-1729 * {caissuer: 'https://repository.example.org/aaa.crt'}
-1730 * ]
-1731 * });
-1732 */
-1733 KJUR.asn1.x509.AuthorityInfoAccess = function(params) {
-1734 KJUR.asn1.x509.AuthorityInfoAccess.superclass.constructor.call(this, params);
-1735
-1736 this.setAccessDescriptionArray = function(aParam) {
-1737 var aASN1 = new Array(),
-1738 _KJUR = KJUR,
-1739 _KJUR_asn1 = _KJUR.asn1,
-1740 _DERSequence = _KJUR_asn1.DERSequence,
-1741 _DERObjectIdentifier = _KJUR_asn1.DERObjectIdentifier,
-1742 _GeneralName = _KJUR_asn1.x509.GeneralName;
-1743
-1744 for (var i = 0; i < aParam.length; i++) {
-1745 var adseq;
-1746 var adparam = aParam[i];
-1747
-1748 if (adparam.ocsp !== undefined) {
-1749 adseq = new _DERSequence({array: [
-1750 new _DERObjectIdentifier({oid: "1.3.6.1.5.5.7.48.1"}),
-1751 new _GeneralName({uri: adparam.ocsp})
-1752 ]});
-1753 } else if (adparam.caissuer !== undefined) {
-1754 adseq = new _DERSequence({array: [
-1755 new _DERObjectIdentifier({oid: "1.3.6.1.5.5.7.48.2"}),
-1756 new _GeneralName({uri: adparam.caissuer})
-1757 ]});
-1758 } else {
-1759 throw new Error("unknown AccessMethod parameter: " +
-1760 JSON.stringify(adparam));
-1761 }
-1762 aASN1.push(adseq);
-1763 }
-1764 this.asn1ExtnValue = new _DERSequence({'array':aASN1});
-1765 };
-1766
-1767 this.getExtnValueHex = function() {
-1768 return this.asn1ExtnValue.getEncodedHex();
-1769 };
-1770
-1771 this.oid = "1.3.6.1.5.5.7.1.1";
-1772 if (params !== undefined) {
-1773 if (params.array !== undefined) {
-1774 this.setAccessDescriptionArray(params.array);
-1775 }
-1776 }
-1777 };
-1778 YAHOO.lang.extend(KJUR.asn1.x509.AuthorityInfoAccess, KJUR.asn1.x509.Extension);
-1779
-1780 /**
-1781 * SubjectAltName ASN.1 structure class<br/>
-1782 * @name KJUR.asn1.x509.SubjectAltName
-1783 * @class SubjectAltName ASN.1 structure class
-1784 * @param {Array} params associative array of parameters
-1785 * @extends KJUR.asn1.x509.Extension
-1786 * @since jsrsasign 6.2.3 asn1x509 1.0.19
-1787 * @see KJUR.asn1.x509.GeneralNames
-1788 * @see KJUR.asn1.x509.GeneralName
-1789 * @description
-1790 * This class provides X.509v3 SubjectAltName extension.
-1791 * <pre>
-1792 * id-ce-subjectAltName OBJECT IDENTIFIER ::= { id-ce 17 }
-1793 * SubjectAltName ::= GeneralNames
-1794 * GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
-1795 * GeneralName ::= CHOICE {
-1796 * otherName [0] OtherName,
-1797 * rfc822Name [1] IA5String,
-1798 * dNSName [2] IA5String,
-1799 * x400Address [3] ORAddress,
-1800 * directoryName [4] Name,
-1801 * ediPartyName [5] EDIPartyName,
-1802 * uniformResourceIdentifier [6] IA5String,
-1803 * iPAddress [7] OCTET STRING,
-1804 * registeredID [8] OBJECT IDENTIFIER }
-1805 * </pre>
-1806 * @example
-1807 * e1 = new KJUR.asn1.x509.SubjectAltName({
-1808 * critical: true,
-1809 * array: [{uri: 'http://aaa.com/'}, {uri: 'http://bbb.com/'}]
-1810 * });
-1811 */
-1812 KJUR.asn1.x509.SubjectAltName = function(params) {
-1813 KJUR.asn1.x509.SubjectAltName.superclass.constructor.call(this, params)
-1814
-1815 this.setNameArray = function(paramsArray) {
-1816 this.asn1ExtnValue = new KJUR.asn1.x509.GeneralNames(paramsArray);
-1817 };
-1818
-1819 this.getExtnValueHex = function() {
-1820 return this.asn1ExtnValue.getEncodedHex();
-1821 };
-1822
-1823 this.oid = "2.5.29.17";
-1824 if (params !== undefined) {
-1825 if (params.array !== undefined) {
-1826 this.setNameArray(params.array);
-1827 }
-1828 }
-1829 };
-1830 YAHOO.lang.extend(KJUR.asn1.x509.SubjectAltName, KJUR.asn1.x509.Extension);
-1831
-1832 /**
-1833 * IssuerAltName ASN.1 structure class<br/>
-1834 * @name KJUR.asn1.x509.IssuerAltName
-1835 * @class IssuerAltName ASN.1 structure class
-1836 * @param {Array} params associative array of parameters
-1837 * @extends KJUR.asn1.x509.Extension
-1838 * @since jsrsasign 6.2.3 asn1x509 1.0.19
-1839 * @see KJUR.asn1.x509.GeneralNames
-1840 * @see KJUR.asn1.x509.GeneralName
-1841 * @description
-1842 * This class provides X.509v3 IssuerAltName extension.
-1843 * <pre>
-1844 * id-ce-subjectAltName OBJECT IDENTIFIER ::= { id-ce 18 }
-1845 * IssuerAltName ::= GeneralNames
-1846 * GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
-1847 * GeneralName ::= CHOICE {
-1848 * otherName [0] OtherName,
-1849 * rfc822Name [1] IA5String,
-1850 * dNSName [2] IA5String,
-1851 * x400Address [3] ORAddress,
-1852 * directoryName [4] Name,
-1853 * ediPartyName [5] EDIPartyName,
-1854 * uniformResourceIdentifier [6] IA5String,
-1855 * iPAddress [7] OCTET STRING,
-1856 * registeredID [8] OBJECT IDENTIFIER }
-1857 * </pre>
-1858 * @example
-1859 * e1 = new KJUR.asn1.x509.IssuerAltName({
-1860 * critical: true,
-1861 * array: [{uri: 'http://aaa.com/'}, {uri: 'http://bbb.com/'}]
-1862 * });
-1863 */
-1864 KJUR.asn1.x509.IssuerAltName = function(params) {
-1865 KJUR.asn1.x509.IssuerAltName.superclass.constructor.call(this, params)
-1866
-1867 this.setNameArray = function(paramsArray) {
-1868 this.asn1ExtnValue = new KJUR.asn1.x509.GeneralNames(paramsArray);
-1869 };
-1870
-1871 this.getExtnValueHex = function() {
-1872 return this.asn1ExtnValue.getEncodedHex();
-1873 };
-1874
-1875 this.oid = "2.5.29.18";
-1876 if (params !== undefined) {
-1877 if (params.array !== undefined) {
-1878 this.setNameArray(params.array);
-1879 }
-1880 }
-1881 };
-1882 YAHOO.lang.extend(KJUR.asn1.x509.IssuerAltName, KJUR.asn1.x509.Extension);
-1883
-1884 /**
-1885 * SubjectDirectoryAttributes ASN.1 structure class<br/>
-1886 * @name KJUR.asn1.x509.SubjectDirectoryAttributes
-1887 * @class SubjectDirectoryAttributes ASN.1 structure class
-1888 * @param {Array} params associative array of parameters
-1889 * @extends KJUR.asn1.x509.Extension
-1890 * @since jsrsasign 10.1.9 asn1x509 2.1.7
-1891 * @description
-1892 * This class provides X.509v3 SubjectDirectoryAttributes extension
-1893 * defined in <a href="https://tools.ietf.org/html/rfc3739#section-3.3.2">
-1894 * RFC 3739 Qualified Certificate Profile section 3.3.2</a>.
-1895 * <pre>
-1896 * SubjectDirectoryAttributes ::= Attributes
-1897 * Attributes ::= SEQUENCE SIZE (1..MAX) OF Attribute
-1898 * Attribute ::= SEQUENCE {
-1899 * type AttributeType
-1900 * values SET OF AttributeValue }
-1901 * AttributeType ::= OBJECT IDENTIFIER
-1902 * AttributeValue ::= ANY DEFINED BY AttributeType
-1903 * </pre>
-1904 * @example
-1905 * e1 = new KJUR.asn1.x509.SubjectDirectoryAttributes({
-1906 * extname: "subjectDirectoryAttributes",
-1907 * array: [
-1908 * { attr: "dateOfBirth", str: "19701231230000Z" },
-1909 * { attr: "placeOfBirth", str: "Tokyo" },
-1910 * { attr: "gender", str: "F" },
-1911 * { attr: "countryOfCitizenship", str: "JP" },
-1912 * { attr: "countryOfResidence", str: "JP" }
-1913 * ]
-1914 * });
-1915 */
-1916 KJUR.asn1.x509.SubjectDirectoryAttributes = function(params) {
-1917 KJUR.asn1.x509.SubjectDirectoryAttributes.superclass.constructor.call(this, params);
-1918 var _KJUR_asn1 = KJUR.asn1,
-1919 _DERSequence = _KJUR_asn1.DERSequence,
-1920 _newObject = _KJUR_asn1.ASN1Util.newObject,
-1921 _name2oid = _KJUR_asn1.x509.OID.name2oid;
-1922
-1923 this.params = null;
-1924
-1925 this.getExtnValueHex = function() {
-1926 var a = [];
-1927 for (var i = 0; i < this.params.array.length; i++) {
-1928 var pAttr = this.params.array[i];
-1929
-1930 var newparam = {
-1931 "seq": [
-1932 {"oid": "1.2.3.4"},
-1933 {"set": [{"utf8str": "DE"}]}
-1934 ]
-1935 };
-1936
-1937 if (pAttr.attr == "dateOfBirth") {
-1938 newparam.seq[0].oid = _name2oid(pAttr.attr);
-1939 newparam.seq[1].set[0] = {"gentime": pAttr.str};
-1940 } else if (pAttr.attr == "placeOfBirth") {
-1941 newparam.seq[0].oid = _name2oid(pAttr.attr);
-1942 newparam.seq[1].set[0] = {"utf8str": pAttr.str};
-1943 } else if (pAttr.attr == "gender") {
-1944 newparam.seq[0].oid = _name2oid(pAttr.attr);
-1945 newparam.seq[1].set[0] = {"prnstr": pAttr.str};
-1946 } else if (pAttr.attr == "countryOfCitizenship") {
-1947 newparam.seq[0].oid = _name2oid(pAttr.attr);
-1948 newparam.seq[1].set[0] = {"prnstr": pAttr.str};
-1949 } else if (pAttr.attr == "countryOfResidence") {
-1950 newparam.seq[0].oid = _name2oid(pAttr.attr);
-1951 newparam.seq[1].set[0] = {"prnstr": pAttr.str};
-1952 } else {
-1953 throw new Error("unsupported attribute: " + pAttr.attr);
-1954 }
-1955 a.push(new _newObject(newparam));
-1956 }
-1957 var seq = new _DERSequence({array: a});
-1958 this.asn1ExtnValue = seq;
-1959 return this.asn1ExtnValue.getEncodedHex();
-1960 };
-1961
-1962 this.oid = "2.5.29.9";
-1963 if (params !== undefined) {
-1964 this.params = params;
-1965 }
-1966 };
-1967 YAHOO.lang.extend(KJUR.asn1.x509.SubjectDirectoryAttributes, KJUR.asn1.x509.Extension);
-1968
+1110
+1111 /**
+1112 * UserNotice ASN.1 structure class
+1113 * @name KJUR.asn1.x509.UserNotice
+1114 * @class UserNotice ASN.1 structure class
+1115 * @param {Array} params associative array of parameters
+1116 * @extends KJUR.asn1.ASN1Object
+1117 * @since jsrsasign 8.0.23 asn1x509 1.1.12
+1118 * @description
+1119 * This class represents
+1120 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.4">
+1121 * UserNotice defined in RFC 5280 4.2.1.4</a>.
+1122 * <pre>
+1123 * UserNotice ::= SEQUENCE {
+1124 * noticeRef NoticeReference OPTIONAL,
+1125 * explicitText DisplayText OPTIONAL }
+1126 * </pre>
+1127 * Its constructor can have following two parameters:
+1128 * <ul>
+1129 * <li>{Object}noticeref - {@link KJUR.asn1.x509.NoticeReference} parameter.
+1130 * This SHALL NOT be set for conforming CA by RFC 5280. (OPTIONAL)</li>
+1131 * <li>{Object}exptext - explicitText value
+1132 * by {@link KJUR.asn1.x509.DisplayText} parameter (OPTIONAL)</li>
+1133 * </ul>
+1134 * @example
+1135 * new UserNotice({
+1136 * noticeref: {
+1137 * org: {type: "bmp", str: "Sample Org"},
+1138 * noticenum: [{int: 3}, {hex: "01af"}]
+1139 * },
+1140 * exptext: {type: "ia5", str: "Sample Policy"}
+1141 * })
+1142 */
+1143 KJUR.asn1.x509.UserNotice = function(params) {
+1144 KJUR.asn1.x509.UserNotice.superclass.constructor.call(this, params);
+1145 var _DERSequence = KJUR.asn1.DERSequence,
+1146 _DERInteger = KJUR.asn1.DERInteger,
+1147 _DisplayText = KJUR.asn1.x509.DisplayText,
+1148 _NoticeReference = KJUR.asn1.x509.NoticeReference;
+1149
+1150 this.params = null;
+1151
+1152 this.getEncodedHex = function() {
+1153 var a = [];
+1154 if (this.params.noticeref !== undefined) {
+1155 a.push(new _NoticeReference(this.params.noticeref));
+1156 }
+1157 if (this.params.exptext !== undefined) {
+1158 a.push(new _DisplayText(this.params.exptext));
+1159 }
+1160 var seq = new _DERSequence({array: a});
+1161 return seq.getEncodedHex();
+1162 };
+1163
+1164 if (params !== undefined) {
+1165 this.params = params;
+1166 }
+1167 };
+1168 YAHOO.lang.extend(KJUR.asn1.x509.UserNotice, KJUR.asn1.ASN1Object);
+1169
+1170 /**
+1171 * NoticeReference ASN.1 structure class
+1172 * @name KJUR.asn1.x509.NoticeReference
+1173 * @class NoticeReference ASN.1 structure class
+1174 * @param {Array} params associative array of parameters
+1175 * @extends KJUR.asn1.ASN1Object
+1176 * @since jsrsasign 8.0.23 asn1x509 1.1.12
+1177 * @description
+1178 * This class represents
+1179 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.4">
+1180 * NoticeReference defined in RFC 5280 4.2.1.4</a>.
+1181 * <pre>
+1182 * NoticeReference ::= SEQUENCE {
+1183 * organization DisplayText,
+1184 * noticeNumbers SEQUENCE OF INTEGER }
+1185 * </pre>
+1186 * Its constructor can have following two parameters:
+1187 * <ul>
+1188 * <li>{Object}org - organization by {@link KJUR.asn1.x509.DisplayText}
+1189 * parameter.</li>
+1190 * <li>{Object}noticenum - noticeNumbers value by an array of
+1191 * {@link KJUR.asn1.DERInteger} parameter</li>
+1192 * </ul>
+1193 * @example
+1194 * new NoticeReference({
+1195 * org: {type: "bmp", str: "Sample Org"},
+1196 * noticenum: [{int: 3}, {hex: "01af"}]
+1197 * })
+1198 */
+1199 KJUR.asn1.x509.NoticeReference = function(params) {
+1200 KJUR.asn1.x509.NoticeReference.superclass.constructor.call(this, params);
+1201 var _DERSequence = KJUR.asn1.DERSequence,
+1202 _DERInteger = KJUR.asn1.DERInteger,
+1203 _DisplayText = KJUR.asn1.x509.DisplayText;
+1204
+1205 this.params = null;
+1206
+1207 this.getEncodedHex = function() {
+1208 var a = [];
+1209 if (this.params.org !== undefined) {
+1210 a.push(new _DisplayText(this.params.org));
+1211 }
+1212 if (this.params.noticenum !== undefined) {
+1213 var aNoticeNum = [];
+1214 var aNumParam = this.params.noticenum;
+1215 for (var i = 0; i < aNumParam.length; i++) {
+1216 aNoticeNum.push(new _DERInteger(aNumParam[i]));
+1217 }
+1218 a.push(new _DERSequence({array: aNoticeNum}));
+1219 }
+1220 if (a.length == 0) throw new Error("parameter is empty");
+1221 var seq = new _DERSequence({array: a});
+1222 return seq.getEncodedHex();
+1223 }
+1224
+1225 if (params !== undefined) {
+1226 this.params = params;
+1227 }
+1228 };
+1229 YAHOO.lang.extend(KJUR.asn1.x509.NoticeReference, KJUR.asn1.ASN1Object);
+1230
+1231 /**
+1232 * DisplayText ASN.1 structure class
+1233 * @name KJUR.asn1.x509.DisplayText
+1234 * @class DisplayText ASN.1 structure class
+1235 * @param {Array} params associative array of parameters
+1236 * @extends KJUR.asn1.DERAbstractString
+1237 * @since jsrsasign 8.0.23 asn1x509 1.1.12
+1238 * @description
+1239 * This class represents
+1240 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.4">
+1241 * DisplayText defined in RFC 5280 4.2.1.4</a>.
+1242 * <pre>
+1243 * -- from RFC 5280 Appendix A
+1244 * DisplayText ::= CHOICE {
+1245 * ia5String IA5String (SIZE (1..200)),
+1246 * visibleString VisibleString (SIZE (1..200)),
+1247 * bmpString BMPString (SIZE (1..200)),
+1248 * utf8String UTF8String (SIZE (1..200)) }
+1249 * </pre>
+1250 * {@link KJUR.asn1.DERAbstractString} parameters and methods
+1251 * can be used.
+1252 * Its constructor can also have following parameter:
+1253 * <ul>
+1254 * <li>{String} type - DirectoryString type of DisplayText.
+1255 * "ia5" for IA5String, "vis" for VisibleString,
+1256 * "bmp" for BMPString and "utf8" for UTF8String.
+1257 * Default is "utf8". (OPTIONAL)</li>
+1258 * </ul>
+1259 * @example
+1260 * new DisplayText({type: "bmp", str: "Sample Org"})
+1261 * new DisplayText({type: "ia5", str: "Sample Org"})
+1262 * new DisplayText({str: "Sample Org"})
+1263 */
+1264 KJUR.asn1.x509.DisplayText = function(params) {
+1265 KJUR.asn1.x509.DisplayText.superclass.constructor.call(this, params);
+1266
+1267 this.hT = "0c"; // DEFAULT "utf8"
+1268
+1269 if (params !== undefined) {
+1270 if (params.type === "ia5") {
+1271 this.hT = "16";
+1272 } else if (params.type === "vis") {
+1273 this.hT = "1a";
+1274 } else if (params.type === "bmp") {
+1275 this.hT = "1e";
+1276 }
+1277 }
+1278 };
+1279 YAHOO.lang.extend(KJUR.asn1.x509.DisplayText, KJUR.asn1.DERAbstractString);
+1280 // ===== END CertificatePolicies related classes =====
+1281
+1282 // =====================================================================
+1283 /**
+1284 * KeyUsage ASN.1 structure class
+1285 * @name KJUR.asn1.x509.ExtKeyUsage
+1286 * @class ExtKeyUsage ASN.1 structure class
+1287 * @param {Array} params associative array of parameters
+1288 * @extends KJUR.asn1.x509.Extension
+1289 * @description
+1290 * @example
+1291 * e1 = new KJUR.asn1.x509.ExtKeyUsage({
+1292 * critical: true,
+1293 * array: [
+1294 * {oid: '2.5.29.37.0'}, // anyExtendedKeyUsage
+1295 * {name: 'clientAuth'},
+1296 * "1.2.3.4",
+1297 * "serverAuth"
+1298 * ]
+1299 * });
+1300 * // id-ce-extKeyUsage OBJECT IDENTIFIER ::= { id-ce 37 }
+1301 * // ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
+1302 * // KeyPurposeId ::= OBJECT IDENTIFIER
+1303 */
+1304 KJUR.asn1.x509.ExtKeyUsage = function(params) {
+1305 KJUR.asn1.x509.ExtKeyUsage.superclass.constructor.call(this, params);
+1306 var _KJUR = KJUR,
+1307 _KJUR_asn1 = _KJUR.asn1;
+1308
+1309 this.setPurposeArray = function(purposeArray) {
+1310 this.asn1ExtnValue = new _KJUR_asn1.DERSequence();
+1311 for (var i = 0; i < purposeArray.length; i++) {
+1312 var o = new _KJUR_asn1.DERObjectIdentifier(purposeArray[i]);
+1313 this.asn1ExtnValue.appendASN1Object(o);
+1314 }
+1315 };
+1316
+1317 this.getExtnValueHex = function() {
+1318 return this.asn1ExtnValue.getEncodedHex();
+1319 };
+1320
+1321 this.oid = "2.5.29.37";
+1322 if (params !== undefined) {
+1323 if (params.array !== undefined) {
+1324 this.setPurposeArray(params.array);
+1325 }
+1326 }
+1327 };
+1328 YAHOO.lang.extend(KJUR.asn1.x509.ExtKeyUsage, KJUR.asn1.x509.Extension);
+1329
+1330 /**
+1331 * AuthorityKeyIdentifier ASN.1 structure class
+1332 * @name KJUR.asn1.x509.AuthorityKeyIdentifier
+1333 * @class AuthorityKeyIdentifier ASN.1 structure class
+1334 * @param {Array} params associative array of parameters (ex. {kid: {hex: '89ab...'}, critical: true})
+1335 * @extends KJUR.asn1.x509.Extension
+1336 * @since asn1x509 1.0.8
+1337 * @description
+1338 * This class represents ASN.1 structure for <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.1">AuthorityKeyIdentifier in RFC 5280</a>.
+1339 * Constructor of this class may have following parameters.:
+1340 * <ul>
+1341 * <li>kid - When key object (RSA, KJUR.crypto.ECDSA/DSA) or PEM string of issuing authority public key or issuer certificate is specified, key identifier will be automatically calculated by the method specified in RFC 5280. When a hexadecimal string is specifed, kid will be set explicitly by it.</li>
+1342 * <li>isscert - When PEM string of authority certificate is specified, both authorityCertIssuer and authorityCertSerialNumber will be set by the certificate.</li>
+1343 * <li>issuer - {@link KJUR.asn1.x509.X500Name} parameter to specify issuer name explicitly.</li>
+1344 * <li>sn - hexadecimal string to specify serial number explicitly.</li>
+1345 * <li>critical - boolean to specify criticality of this extension
+1346 * however conforming CA must mark this extension as non-critical in RFC 5280.</li>
+1347 * </ul>
+1348 *
+1349 * <pre>
+1350 * d-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 35 }
+1351 * AuthorityKeyIdentifier ::= SEQUENCE {
+1352 * keyIdentifier [0] KeyIdentifier OPTIONAL,
+1353 * authorityCertIssuer [1] GeneralNames OPTIONAL,
+1354 * authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL }
+1355 * KeyIdentifier ::= OCTET STRING
+1356 * </pre>
+1357 *
+1358 * @example
+1359 * // 1. kid by key object
+1360 * keyobj = KEYUTIL.getKey("-----BEGIN PUBLIC KEY...");
+1361 * e1 = new KJUR.asn1.x509.AuthorityKeyIdentifier({kid: keyobj});
+1362 * // 2. kid by PEM string of authority certificate or public key
+1363 * e1 = new KJUR.asn1.x509.AuthorityKeyIdentifier({kid: "-----BEGIN..."});
+1364 * // 3. specify kid explicitly
+1365 * e1 = new KJUR.asn1.x509.AuthorityKeyIdentifier({kid: "8ab1d3..."});
+1366 * });
+1367 * // 4. issuer and serial number by auhtority PEM certificate
+1368 * e1 = new KJUR.asn1.x509.AuthorityKeyIdentifier({isscert: "-----BEGIN..."});
+1369 * // 5. issuer and serial number explicitly
+1370 * e1 = new KJUR.asn1.x509.AuthorityKeyIdentifier({
+1371 * issuer: {ldapstr: "O=test,C=US"},
+1372 * sn: {hex: "1ac7..."}});
+1373 * // 6. combination
+1374 * e1 = new KJUR.asn1.x509.AuthorityKeyIdentifier({
+1375 * kid: "-----BEGIN CERTIFICATE...",
+1376 * isscert: "-----BEGIN CERTIFICATE..."});
+1377 */
+1378 KJUR.asn1.x509.AuthorityKeyIdentifier = function(params) {
+1379 KJUR.asn1.x509.AuthorityKeyIdentifier.superclass.constructor.call(this, params);
+1380 var _KJUR = KJUR,
+1381 _KJUR_asn1 = _KJUR.asn1,
+1382 _DERTaggedObject = _KJUR_asn1.DERTaggedObject,
+1383 _GeneralNames = _KJUR_asn1.x509.GeneralNames,
+1384 _isKey = _KJUR.crypto.Util.isKey;
+1385
+1386 this.asn1KID = null;
+1387 this.asn1CertIssuer = null; // X500Name hTLV
+1388 this.asn1CertSN = null;
+1389
+1390 this.getExtnValueHex = function() {
+1391 var a = new Array();
+1392 if (this.asn1KID)
+1393 a.push(new _DERTaggedObject({'explicit': false,
+1394 'tag': '80',
+1395 'obj': this.asn1KID}));
+1396
+1397 if (this.asn1CertIssuer)
+1398 a.push(new _DERTaggedObject({'explicit': false,
+1399 'tag': 'a1',
+1400 'obj': new _GeneralNames([{dn: this.asn1CertIssuer}])}));
+1401
+1402 if (this.asn1CertSN)
+1403 a.push(new _DERTaggedObject({'explicit': false,
+1404 'tag': '82',
+1405 'obj': this.asn1CertSN}));
+1406
+1407 var asn1Seq = new _KJUR_asn1.DERSequence({'array': a});
+1408 this.asn1ExtnValue = asn1Seq;
+1409 return this.asn1ExtnValue.getEncodedHex();
+1410 };
+1411
+1412 /**
+1413 * set keyIdentifier value by DEROctetString parameter, key object or PEM file
+1414 * @name setKIDByParam
+1415 * @memberOf KJUR.asn1.x509.AuthorityKeyIdentifier#
+1416 * @function
+1417 * @param {Array} param parameter to set key identifier
+1418 * @since asn1x509 1.0.8
+1419 * @description
+1420 * This method will set keyIdentifier by param.
+1421 * Its key identifier value can be set by following type of param argument:
+1422 * <ul>
+1423 * <li>{str: "123"} - by raw string</li>
+1424 * <li>{hex: "01af..."} - by hexadecimal value</li>
+1425 * <li>RSAKey/DSA/ECDSA - by RSAKey, KJUR.crypto.{DSA/ECDSA} public key object.
+1426 * key identifier value will be calculated by the method described in
+1427 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.2">RFC 5280 4.2.1.2 (1)</a>.
+1428 * </li>
+1429 * <li>certificate PEM string - extract subjectPublicKeyInfo from specified PEM
+1430 * certificate and
+1431 * key identifier value will be calculated by the method described in
+1432 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.2">RFC 5280 4.2.1.2 (1)</a>.
+1433 * <li>PKCS#1/#8 public key PEM string - pem will be converted to a key object and
+1434 * to PKCS#8 ASN.1 structure then calculate
+1435 * a key identifier value will be calculated by the method described in
+1436 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.2">RFC 5280 4.2.1.2 (1)</a>.
+1437 * </ul>
+1438 *
+1439 * NOTE1: Automatic key identifier calculation is supported
+1440 * since jsrsasign 8.0.16.
+1441 *
+1442 * @see KEYUTIL.getKeyID
+1443 *
+1444 * @example
+1445 * o = new KJUR.asn1.x509.AuthorityKeyIdentifier();
+1446 * // set by hexadecimal string
+1447 * o.setKIDByParam({hex: '1ad9...'});
+1448 * // set by SubjectPublicKeyInfo of PEM certificate string
+1449 * o.setKIDByParam("-----BEGIN CERTIFICATE...");
+1450 * // set by PKCS#8 PEM public key string
+1451 * o.setKIDByParam("-----BEGIN PUBLIC KEY...");
+1452 * // set by public key object
+1453 * pubkey = KEYUTIL.getKey("-----BEGIN CERTIFICATE...");
+1454 * o.setKIDByParam(pubkey);
+1455 */
+1456 this.setKIDByParam = function(param) {
+1457 if (param.str !== undefined ||
+1458 param.hex !== undefined) {
+1459 this.asn1KID = new KJUR.asn1.DEROctetString(param);
+1460 } else if ((typeof param === "object" &&
+1461 KJUR.crypto.Util.isKey(param)) ||
+1462 (typeof param === "string" &&
+1463 param.indexOf("BEGIN ") != -1)) {
+1464
+1465 var keyobj = param;
+1466 if (typeof param === "string") {
+1467 keyobj = KEYUTIL.getKey(param);
+1468 }
+1469
+1470 var kid = KEYUTIL.getKeyID(keyobj);
+1471 this.asn1KID = new KJUR.asn1.DEROctetString({hex: kid});
+1472 }
+1473 };
+1474
+1475 /**
+1476 * set authorityCertIssuer value by X500Name parameter
+1477 * @name setCertIssuerByParam
+1478 * @memberOf KJUR.asn1.x509.AuthorityKeyIdentifier#
+1479 * @function
+1480 * @param {Array} param parameter to set issuer name
+1481 * @since asn1x509 1.0.8
+1482 * @description
+1483 * This method will set authorityCertIssuer name by param.
+1484 * Issuer name can be set by following type of param argument:
+1485 * <ul>
+1486 * <li>str/ldapstr/hex/certsubject/certissuer -
+1487 * set issuer by {@link KJUR.asn1.x509.X500Name}
+1488 * object with specified parameters.</li>
+1489 * <li>PEM CERTIFICATE STRING - extract its subject name from
+1490 * specified issuer PEM certificate and set.
+1491 * </ul>
+1492 * NOTE1: Automatic authorityCertIssuer setting by certificate
+1493 * is supported since jsrsasign 8.0.16.
+1494 *
+1495 * @see KJUR.asn1.x509.X500Name
+1496 * @see KJUR.asn1.x509.GeneralNames
+1497 * @see X509.getSubjectHex
+1498 *
+1499 * @example
+1500 * var o = new KJUR.asn1.x509.AuthorityKeyIdentifier();
+1501 * // 1. set it by string
+1502 * o.setCertIssuerByParam({str: '/C=US/O=Test'});
+1503 * // 2. set it by issuer PEM certificate
+1504 * o.setCertIssuerByParam("-----BEGIN CERTIFICATE...");
+1505 *
+1506 */
+1507 this.setCertIssuerByParam = function(param) {
+1508 if (param.str !== undefined ||
+1509 param.ldapstr !== undefined ||
+1510 param.hex !== undefined ||
+1511 param.certsubject !== undefined ||
+1512 param.certissuer !== undefined) {
+1513 this.asn1CertIssuer = new KJUR.asn1.x509.X500Name(param);
+1514 } else if (typeof param === "string" &&
+1515 param.indexOf("BEGIN ") != -1 &&
+1516 param.indexOf("CERTIFICATE") != -1) {
+1517 this.asn1CertIssuer = new KJUR.asn1.x509.X500Name({certissuer: param});
+1518 }
+1519 };
+1520
+1521 /**
+1522 * set authorityCertSerialNumber value
+1523 * @name setCertSerialNumberByParam
+1524 * @memberOf KJUR.asn1.x509.AuthorityKeyIdentifier#
+1525 * @function
+1526 * @param {Object} param parameter to set serial number
+1527 * @since asn1x509 1.0.8
+1528 * @description
+1529 * This method will set authorityCertSerialNumber by param.
+1530 * Serial number can be set by following type of param argument:
+1531 *
+1532 * <ul>
+1533 * <li>{int: 123} - by integer value</li>
+1534 * <li>{hex: "01af"} - by hexadecimal integer value</li>
+1535 * <li>{bigint: new BigInteger(...)} - by hexadecimal integer value</li>
+1536 * <li>PEM CERTIFICATE STRING - extract serial number from issuer certificate and
+1537 * set serial number.
+1538 *
+1539 * NOTE1: Automatic authorityCertSerialNumber setting by certificate
+1540 * is supported since jsrsasign 8.0.16.
+1541 *
+1542 * @see X509.getSerialNumberHex
+1543 */
+1544 this.setCertSNByParam = function(param) {
+1545 if (param.str !== undefined ||
+1546 param.bigint !== undefined ||
+1547 param.hex !== undefined) {
+1548 this.asn1CertSN = new KJUR.asn1.DERInteger(param);
+1549 } else if (typeof param === "string" &&
+1550 param.indexOf("BEGIN ") != -1 &&
+1551 param.indexOf("CERTIFICATE")) {
+1552
+1553 var x = new X509();
+1554 x.readCertPEM(param);
+1555 var sn = x.getSerialNumberHex();
+1556 this.asn1CertSN = new KJUR.asn1.DERInteger({hex: sn});
+1557 }
+1558 };
+1559
+1560 this.oid = "2.5.29.35";
+1561 if (params !== undefined) {
+1562 if (params.kid !== undefined) {
+1563 this.setKIDByParam(params.kid);
+1564 }
+1565 if (params.issuer !== undefined) {
+1566 this.setCertIssuerByParam(params.issuer);
+1567 }
+1568 if (params.sn !== undefined) {
+1569 this.setCertSNByParam(params.sn);
+1570 }
+1571
+1572 if (params.issuersn !== undefined &&
+1573 typeof params.issuersn === "string" &&
+1574 params.issuersn.indexOf("BEGIN ") != -1 &&
+1575 params.issuersn.indexOf("CERTIFICATE")) {
+1576 this.setCertSNByParam(params.issuersn);
+1577 this.setCertIssuerByParam(params.issuersn);
+1578 }
+1579 }
+1580 };
+1581 YAHOO.lang.extend(KJUR.asn1.x509.AuthorityKeyIdentifier, KJUR.asn1.x509.Extension);
+1582
+1583 /**
+1584 * SubjectKeyIdentifier extension ASN.1 structure class
+1585 * @name KJUR.asn1.x509.SubjectKeyIdentifier
+1586 * @class SubjectKeyIdentifier ASN.1 structure class
+1587 * @param {Array} params associative array of parameters (ex. {kid: {hex: '89ab...'}, critical: true})
+1588 * @extends KJUR.asn1.x509.Extension
+1589 * @since asn1x509 1.1.7 jsrsasign 8.0.14
+1590 * @description
+1591 * This class represents ASN.1 structure for
+1592 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.2">
+1593 * SubjectKeyIdentifier in RFC 5280</a>.
+1594 * Constructor of this class may have following parameters:
+1595 * <ul>
+1596 * <li>kid - When key object (RSA, KJUR.crypto.ECDSA/DSA) or PEM string of subject public key or certificate is specified, key identifier will be automatically calculated by the method specified in RFC 5280. When a hexadecimal string is specifed, kid will be set explicitly by it.</li>
+1597 * <li>critical - boolean to specify criticality of this extension
+1598 * however conforming CA must mark this extension as non-critical in RFC 5280.</li>
+1599 * </ul>
+1600 * <pre>
+1601 * d-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 14 }
+1602 * SubjectKeyIdentifier ::= KeyIdentifier
+1603 * KeyIdentifier ::= OCTET STRING
+1604 * </pre>
+1605 *
+1606 * @example
+1607 * // set by hexadecimal string
+1608 * e = new KJUR.asn1.x509.SubjectKeyIdentifier({kid: {hex: '89ab'}});
+1609 * // set by PEM public key or certificate string
+1610 * e = new KJUR.asn1.x509.SubjectKeyIdentifier({kid: "-----BEGIN CERTIFICATE..."});
+1611 * // set by public key object
+1612 * pubkey = KEYUTIL.getKey("-----BEGIN CERTIFICATE...");
+1613 * e = new KJUR.asn1.x509.SubjectKeyIdentifier({kid: pubkey});
+1614 */
+1615 KJUR.asn1.x509.SubjectKeyIdentifier = function(params) {
+1616 KJUR.asn1.x509.SubjectKeyIdentifier.superclass.constructor.call(this, params);
+1617 var _KJUR = KJUR,
+1618 _KJUR_asn1 = _KJUR.asn1,
+1619 _DEROctetString = _KJUR_asn1.DEROctetString;
+1620
+1621 this.asn1KID = null;
+1622
+1623 this.getExtnValueHex = function() {
+1624 this.asn1ExtnValue = this.asn1KID;
+1625 return this.asn1ExtnValue.getEncodedHex();
+1626 };
+1627
+1628 /**
+1629 * set keyIdentifier value by DEROctetString parameter, key object or PEM file
+1630 * @name setKIDByParam
+1631 * @memberOf KJUR.asn1.x509.SubjectKeyIdentifier#
+1632 * @function
+1633 * @param {Array} param array of {@link KJUR.asn1.DERInteger} parameter
+1634 * @since asn1x509 1.1.7 jsrsasign 8.0.14
+1635 * @description
+1636 * <ul>
+1637 * <li>{str: "123"} - by raw string</li>
+1638 * <li>{hex: "01af..."} - by hexadecimal value</li>
+1639 * <li>RSAKey/DSA/ECDSA - by RSAKey, KJUR.crypto.{DSA/ECDSA} public key object.
+1640 * key identifier value will be calculated by the method described in
+1641 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.2">RFC 5280 4.2.1.2 (1)</a>.
+1642 * </li>
+1643 * <li>certificate PEM string - extract subjectPublicKeyInfo from specified PEM
+1644 * certificate and
+1645 * key identifier value will be calculated by the method described in
+1646 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.2">RFC 5280 4.2.1.2 (1)</a>.
+1647 * <li>PKCS#1/#8 public key PEM string - pem will be converted to a key object and
+1648 * to PKCS#8 ASN.1 structure then calculate
+1649 * a key identifier value will be calculated by the method described in
+1650 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.2">RFC 5280 4.2.1.2 (1)</a>.
+1651 * </ul>
+1652 *
+1653 * NOTE1: Automatic key identifier calculation is supported
+1654 * since jsrsasign 8.0.16.
+1655 *
+1656 * @see KEYUTIL.getKeyID
+1657 *
+1658 * @example
+1659 * o = new KJUR.asn1.x509.SubjectKeyIdentifier();
+1660 * // set by hexadecimal string
+1661 * o.setKIDByParam({hex: '1ad9...'});
+1662 * // set by SubjectPublicKeyInfo of PEM certificate string
+1663 * o.setKIDByParam("-----BEGIN CERTIFICATE...");
+1664 * // set by PKCS#8 PEM public key string
+1665 * o.setKIDByParam("-----BEGIN PUBLIC KEY...");
+1666 * // set by public key object
+1667 * pubkey = KEYUTIL.getKey("-----BEGIN CERTIFICATE...");
+1668 * o.setKIDByParam(pubkey);
+1669 */
+1670 this.setKIDByParam = function(param) {
+1671 if (param.str !== undefined ||
+1672 param.hex !== undefined) {
+1673 this.asn1KID = new _DEROctetString(param);
+1674 } else if ((typeof param === "object" &&
+1675 KJUR.crypto.Util.isKey(param)) ||
+1676 (typeof param === "string" &&
+1677 param.indexOf("BEGIN") != -1)) {
+1678
+1679 var keyobj = param;
+1680 if (typeof param === "string") {
+1681 keyobj = KEYUTIL.getKey(param);
+1682 }
+1683
+1684 var kid = KEYUTIL.getKeyID(keyobj);
+1685 this.asn1KID = new KJUR.asn1.DEROctetString({hex: kid});
+1686 }
+1687 };
+1688
+1689 this.oid = "2.5.29.14";
+1690 if (params !== undefined) {
+1691 if (params.kid !== undefined) {
+1692 this.setKIDByParam(params.kid);
+1693 }
+1694 }
+1695 };
+1696 YAHOO.lang.extend(KJUR.asn1.x509.SubjectKeyIdentifier, KJUR.asn1.x509.Extension);
+1697
+1698 /**
+1699 * AuthorityInfoAccess ASN.1 structure class
+1700 * @name KJUR.asn1.x509.AuthorityInfoAccess
+1701 * @class AuthorityInfoAccess ASN.1 structure class
+1702 * @param {Array} params JSON object of AuthorityInfoAccess parameters
+1703 * @extends KJUR.asn1.x509.Extension
+1704 * @since asn1x509 1.0.8
+1705 * @see {@link X509#getExtAuthorityInfoAccess}
+1706 * @description
+1707 * This class represents
+1708 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.2.1">
+1709 * AuthorityInfoAccess extension defined in RFC 5280 4.2.2.1</a>.
+1710 * <pre>
+1711 * id-pe OBJECT IDENTIFIER ::= { id-pkix 1 }
+1712 * id-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pe 1 }
+1713 * AuthorityInfoAccessSyntax ::=
+1714 * SEQUENCE SIZE (1..MAX) OF AccessDescription
+1715 * AccessDescription ::= SEQUENCE {
+1716 * accessMethod OBJECT IDENTIFIER,
+1717 * accessLocation GeneralName }
+1718 * id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
+1719 * id-ad-caIssuers OBJECT IDENTIFIER ::= { id-ad 2 }
+1720 * id-ad-ocsp OBJECT IDENTIFIER ::= { id-ad 1 }
+1721 * </pre>
+1722 * NOTE: Acceptable parameters have been changed since
+1723 * from jsrsasign 9.0.0 asn1x509 2.0.0.
+1724 * Parameter generated by {@link X509#getAuthorityInfoAccess}
+1725 * can be accepted as a argument of this constructor.
+1726 * @example
+1727 * e1 = new KJUR.asn1.x509.AuthorityInfoAccess({
+1728 * array: [
+1729 * {ocsp: 'http://ocsp.example.org'},
+1730 * {caissuer: 'https://repository.example.org/aaa.crt'}
+1731 * ]
+1732 * });
+1733 */
+1734 KJUR.asn1.x509.AuthorityInfoAccess = function(params) {
+1735 KJUR.asn1.x509.AuthorityInfoAccess.superclass.constructor.call(this, params);
+1736
+1737 this.setAccessDescriptionArray = function(aParam) {
+1738 var aASN1 = new Array(),
+1739 _KJUR = KJUR,
+1740 _KJUR_asn1 = _KJUR.asn1,
+1741 _DERSequence = _KJUR_asn1.DERSequence,
+1742 _DERObjectIdentifier = _KJUR_asn1.DERObjectIdentifier,
+1743 _GeneralName = _KJUR_asn1.x509.GeneralName;
+1744
+1745 for (var i = 0; i < aParam.length; i++) {
+1746 var adseq;
+1747 var adparam = aParam[i];
+1748
+1749 if (adparam.ocsp !== undefined) {
+1750 adseq = new _DERSequence({array: [
+1751 new _DERObjectIdentifier({oid: "1.3.6.1.5.5.7.48.1"}),
+1752 new _GeneralName({uri: adparam.ocsp})
+1753 ]});
+1754 } else if (adparam.caissuer !== undefined) {
+1755 adseq = new _DERSequence({array: [
+1756 new _DERObjectIdentifier({oid: "1.3.6.1.5.5.7.48.2"}),
+1757 new _GeneralName({uri: adparam.caissuer})
+1758 ]});
+1759 } else {
+1760 throw new Error("unknown AccessMethod parameter: " +
+1761 JSON.stringify(adparam));
+1762 }
+1763 aASN1.push(adseq);
+1764 }
+1765 this.asn1ExtnValue = new _DERSequence({'array':aASN1});
+1766 };
+1767
+1768 this.getExtnValueHex = function() {
+1769 return this.asn1ExtnValue.getEncodedHex();
+1770 };
+1771
+1772 this.oid = "1.3.6.1.5.5.7.1.1";
+1773 if (params !== undefined) {
+1774 if (params.array !== undefined) {
+1775 this.setAccessDescriptionArray(params.array);
+1776 }
+1777 }
+1778 };
+1779 YAHOO.lang.extend(KJUR.asn1.x509.AuthorityInfoAccess, KJUR.asn1.x509.Extension);
+1780
+1781 /**
+1782 * SubjectAltName ASN.1 structure class<br/>
+1783 * @name KJUR.asn1.x509.SubjectAltName
+1784 * @class SubjectAltName ASN.1 structure class
+1785 * @param {Array} params associative array of parameters
+1786 * @extends KJUR.asn1.x509.Extension
+1787 * @since jsrsasign 6.2.3 asn1x509 1.0.19
+1788 * @see KJUR.asn1.x509.GeneralNames
+1789 * @see KJUR.asn1.x509.GeneralName
+1790 * @description
+1791 * This class provides X.509v3 SubjectAltName extension.
+1792 * <pre>
+1793 * id-ce-subjectAltName OBJECT IDENTIFIER ::= { id-ce 17 }
+1794 * SubjectAltName ::= GeneralNames
+1795 * GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
+1796 * GeneralName ::= CHOICE {
+1797 * otherName [0] OtherName,
+1798 * rfc822Name [1] IA5String,
+1799 * dNSName [2] IA5String,
+1800 * x400Address [3] ORAddress,
+1801 * directoryName [4] Name,
+1802 * ediPartyName [5] EDIPartyName,
+1803 * uniformResourceIdentifier [6] IA5String,
+1804 * iPAddress [7] OCTET STRING,
+1805 * registeredID [8] OBJECT IDENTIFIER }
+1806 * </pre>
+1807 * @example
+1808 * e1 = new KJUR.asn1.x509.SubjectAltName({
+1809 * critical: true,
+1810 * array: [{uri: 'http://aaa.com/'}, {uri: 'http://bbb.com/'}]
+1811 * });
+1812 */
+1813 KJUR.asn1.x509.SubjectAltName = function(params) {
+1814 KJUR.asn1.x509.SubjectAltName.superclass.constructor.call(this, params)
+1815
+1816 this.setNameArray = function(paramsArray) {
+1817 this.asn1ExtnValue = new KJUR.asn1.x509.GeneralNames(paramsArray);
+1818 };
+1819
+1820 this.getExtnValueHex = function() {
+1821 return this.asn1ExtnValue.getEncodedHex();
+1822 };
+1823
+1824 this.oid = "2.5.29.17";
+1825 if (params !== undefined) {
+1826 if (params.array !== undefined) {
+1827 this.setNameArray(params.array);
+1828 }
+1829 }
+1830 };
+1831 YAHOO.lang.extend(KJUR.asn1.x509.SubjectAltName, KJUR.asn1.x509.Extension);
+1832
+1833 /**
+1834 * IssuerAltName ASN.1 structure class<br/>
+1835 * @name KJUR.asn1.x509.IssuerAltName
+1836 * @class IssuerAltName ASN.1 structure class
+1837 * @param {Array} params associative array of parameters
+1838 * @extends KJUR.asn1.x509.Extension
+1839 * @since jsrsasign 6.2.3 asn1x509 1.0.19
+1840 * @see KJUR.asn1.x509.GeneralNames
+1841 * @see KJUR.asn1.x509.GeneralName
+1842 * @description
+1843 * This class provides X.509v3 IssuerAltName extension.
+1844 * <pre>
+1845 * id-ce-subjectAltName OBJECT IDENTIFIER ::= { id-ce 18 }
+1846 * IssuerAltName ::= GeneralNames
+1847 * GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
+1848 * GeneralName ::= CHOICE {
+1849 * otherName [0] OtherName,
+1850 * rfc822Name [1] IA5String,
+1851 * dNSName [2] IA5String,
+1852 * x400Address [3] ORAddress,
+1853 * directoryName [4] Name,
+1854 * ediPartyName [5] EDIPartyName,
+1855 * uniformResourceIdentifier [6] IA5String,
+1856 * iPAddress [7] OCTET STRING,
+1857 * registeredID [8] OBJECT IDENTIFIER }
+1858 * </pre>
+1859 * @example
+1860 * e1 = new KJUR.asn1.x509.IssuerAltName({
+1861 * critical: true,
+1862 * array: [{uri: 'http://aaa.com/'}, {uri: 'http://bbb.com/'}]
+1863 * });
+1864 */
+1865 KJUR.asn1.x509.IssuerAltName = function(params) {
+1866 KJUR.asn1.x509.IssuerAltName.superclass.constructor.call(this, params)
+1867
+1868 this.setNameArray = function(paramsArray) {
+1869 this.asn1ExtnValue = new KJUR.asn1.x509.GeneralNames(paramsArray);
+1870 };
+1871
+1872 this.getExtnValueHex = function() {
+1873 return this.asn1ExtnValue.getEncodedHex();
+1874 };
+1875
+1876 this.oid = "2.5.29.18";
+1877 if (params !== undefined) {
+1878 if (params.array !== undefined) {
+1879 this.setNameArray(params.array);
+1880 }
+1881 }
+1882 };
+1883 YAHOO.lang.extend(KJUR.asn1.x509.IssuerAltName, KJUR.asn1.x509.Extension);
+1884
+1885 /**
+1886 * SubjectDirectoryAttributes ASN.1 structure class<br/>
+1887 * @name KJUR.asn1.x509.SubjectDirectoryAttributes
+1888 * @class SubjectDirectoryAttributes ASN.1 structure class
+1889 * @param {Array} params associative array of parameters
+1890 * @extends KJUR.asn1.x509.Extension
+1891 * @since jsrsasign 10.1.9 asn1x509 2.1.7
+1892 * @description
+1893 * This class provides X.509v3 SubjectDirectoryAttributes extension
+1894 * defined in <a href="https://tools.ietf.org/html/rfc3739#section-3.3.2">
+1895 * RFC 3739 Qualified Certificate Profile section 3.3.2</a>.
+1896 * <pre>
+1897 * SubjectDirectoryAttributes ::= Attributes
+1898 * Attributes ::= SEQUENCE SIZE (1..MAX) OF Attribute
+1899 * Attribute ::= SEQUENCE {
+1900 * type AttributeType
+1901 * values SET OF AttributeValue }
+1902 * AttributeType ::= OBJECT IDENTIFIER
+1903 * AttributeValue ::= ANY DEFINED BY AttributeType
+1904 * </pre>
+1905 * @example
+1906 * e1 = new KJUR.asn1.x509.SubjectDirectoryAttributes({
+1907 * extname: "subjectDirectoryAttributes",
+1908 * array: [
+1909 * { attr: "dateOfBirth", str: "19701231230000Z" },
+1910 * { attr: "placeOfBirth", str: "Tokyo" },
+1911 * { attr: "gender", str: "F" },
+1912 * { attr: "countryOfCitizenship", str: "JP" },
+1913 * { attr: "countryOfResidence", str: "JP" }
+1914 * ]
+1915 * });
+1916 */
+1917 KJUR.asn1.x509.SubjectDirectoryAttributes = function(params) {
+1918 KJUR.asn1.x509.SubjectDirectoryAttributes.superclass.constructor.call(this, params);
+1919 var _KJUR_asn1 = KJUR.asn1,
+1920 _DERSequence = _KJUR_asn1.DERSequence,
+1921 _newObject = _KJUR_asn1.ASN1Util.newObject,
+1922 _name2oid = _KJUR_asn1.x509.OID.name2oid;
+1923
+1924 this.params = null;
+1925
+1926 this.getExtnValueHex = function() {
+1927 var a = [];
+1928 for (var i = 0; i < this.params.array.length; i++) {
+1929 var pAttr = this.params.array[i];
+1930
+1931 var newparam = {
+1932 "seq": [
+1933 {"oid": "1.2.3.4"},
+1934 {"set": [{"utf8str": "DE"}]}
+1935 ]
+1936 };
+1937
+1938 if (pAttr.attr == "dateOfBirth") {
+1939 newparam.seq[0].oid = _name2oid(pAttr.attr);
+1940 newparam.seq[1].set[0] = {"gentime": pAttr.str};
+1941 } else if (pAttr.attr == "placeOfBirth") {
+1942 newparam.seq[0].oid = _name2oid(pAttr.attr);
+1943 newparam.seq[1].set[0] = {"utf8str": pAttr.str};
+1944 } else if (pAttr.attr == "gender") {
+1945 newparam.seq[0].oid = _name2oid(pAttr.attr);
+1946 newparam.seq[1].set[0] = {"prnstr": pAttr.str};
+1947 } else if (pAttr.attr == "countryOfCitizenship") {
+1948 newparam.seq[0].oid = _name2oid(pAttr.attr);
+1949 newparam.seq[1].set[0] = {"prnstr": pAttr.str};
+1950 } else if (pAttr.attr == "countryOfResidence") {
+1951 newparam.seq[0].oid = _name2oid(pAttr.attr);
+1952 newparam.seq[1].set[0] = {"prnstr": pAttr.str};
+1953 } else {
+1954 throw new Error("unsupported attribute: " + pAttr.attr);
+1955 }
+1956 a.push(new _newObject(newparam));
+1957 }
+1958 var seq = new _DERSequence({array: a});
+1959 this.asn1ExtnValue = seq;
+1960 return this.asn1ExtnValue.getEncodedHex();
+1961 };
+1962
+1963 this.oid = "2.5.29.9";
+1964 if (params !== undefined) {
+1965 this.params = params;
+1966 }
+1967 };
+1968 YAHOO.lang.extend(KJUR.asn1.x509.SubjectDirectoryAttributes, KJUR.asn1.x509.Extension);
1969
-1970 /**
-1971 * priavte extension ASN.1 structure class<br/>
-1972 * @name KJUR.asn1.x509.PrivateExtension
-1973 * @class private extension ASN.1 structure class
-1974 * @param {Array} params JSON object of private extension
-1975 * @extends KJUR.asn1.x509.Extension
-1976 * @since jsrsasign 9.1.1 asn1x509
-1977 * @see KJUR.asn1.ASN1Util.newObject
-1978 *
-1979 * @description
-1980 * This class is to represent private extension or
-1981 * unsupported extension.
-1982 * <pre>
-1983 * Extension ::= SEQUENCE {
-1984 * extnID OBJECT IDENTIFIER,
-1985 * critical BOOLEAN DEFAULT FALSE,
-1986 * extnValue OCTET STRING }
-1987 * </pre>
-1988 * Following properties can be set for JSON parameter:
-1989 * <ul>
-1990 * <li>{String}extname - string of OID or predefined extension name</li>
-1991 * <li>{Boolean}critical - critical flag</li>
-1992 * <li>{Object}extn - hexadecimal string or
-1993 * of {@link KJUR.asn1.ASN1Util.newObject}
-1994 * JSON parameter for extnValue field</li>
-1995 * </li>
-1996 * </ul>
-1997 *
-1998 * @example
-1999 * // extn by hexadecimal
-2000 * new KJUR.asn1.x509.PrivateExtension({
-2001 * extname: "1.2.3.4",
-2002 * critical: true,
-2003 * extn: "13026161" // means PrintableString "aa"
-2004 * });
-2005 *
-2006 * // extn by JSON parameter
-2007 * new KJUR.asn1.x509.PrivateExtension({
-2008 * extname: "1.2.3.5",
-2009 * extn: {seq: [{prnstr:"abc"},{utf8str:"def"}]}
-2010 * });
-2011 */
-2012 KJUR.asn1.x509.PrivateExtension = function(params) {
-2013 KJUR.asn1.x509.PrivateExtension.superclass.constructor.call(this, params)
-2014
-2015 var _KJUR = KJUR,
-2016 _isHex = _KJUR.lang.String.isHex,
-2017 _KJUR_asn1 = _KJUR.asn1,
-2018 _name2oid = _KJUR_asn1.x509.OID.name2oid,
-2019 _newObject = _KJUR_asn1.ASN1Util.newObject;
-2020
-2021 this.params = null;
-2022
-2023 this.setByParam = function(params) {
-2024 this.oid = _name2oid(params.extname);
-2025 this.params = params;
-2026 };
-2027
-2028 this.getExtnValueHex = function() {
-2029 if (this.params.extname == undefined ||
-2030 this.params.extn == undefined) {
-2031 throw new Error("extname or extnhex not specified");
-2032 }
-2033
-2034 var extn = this.params.extn;
-2035 if (typeof extn == "string" && _isHex(extn)) {
-2036 return extn;
-2037 } else if (typeof extn == "object") {
-2038 try {
-2039 return _newObject(extn).getEncodedHex();
-2040 } catch(ex) {}
-2041 }
-2042 throw new Error("unsupported extn value");
-2043 };
-2044
-2045 if (params != undefined) {
-2046 this.setByParam(params);
-2047 }
-2048 };
-2049 YAHOO.lang.extend(KJUR.asn1.x509.PrivateExtension, KJUR.asn1.x509.Extension);
-2050
-2051 // === END X.509v3 Extensions Related =======================================
-2052
-2053 // === BEGIN CRL Related ===================================================
-2054 /**
-2055 * X.509 CRL class to sign and generate hex encoded CRL<br/>
-2056 * @name KJUR.asn1.x509.CRL
-2057 * @class X.509 CRL class to sign and generate hex encoded certificate
-2058 * @property {Array} params JSON object of parameters
-2059 * @param {Array} params JSON object of CRL parameters
-2060 * @extends KJUR.asn1.ASN1Object
-2061 * @since 1.0.3
-2062 * @see KJUR.asn1.x509.TBSCertList
-2063 *
-2064 * @description
-2065 * This class represents CertificateList ASN.1 structur of X.509 CRL
-2066 * defined in <a href="https://tools.ietf.org/html/rfc5280#section-5.1">
-2067 * RFC 5280 5.1</a>
-2068 * <pre>
-2069 * CertificateList ::= SEQUENCE {
-2070 * tbsCertList TBSCertList,
-2071 * signatureAlgorithm AlgorithmIdentifier,
-2072 * signatureValue BIT STRING }
-2073 * </pre>
-2074 * NOTE: CRL class is updated without backward
-2075 * compatibility from jsrsasign 9.1.0 asn1x509 2.1.0.
-2076 * Most of methods are removed and parameters can be set
-2077 * by JSON object.
-2078 * <br/>
-2079 * Constructor of this class can accept all
-2080 * parameters of {@link KJUR.asn1.x509.TBSCertList}.
-2081 * It also accept following parameters additionally:
-2082 * <ul>
-2083 * <li>{TBSCertList}tbsobj (OPTION) -
-2084 * specifies {@link KJUR.asn1.x509.TBSCertList}
-2085 * object to be signed if needed.
-2086 * When this isn't specified,
-2087 * this will be set from other parametes of TBSCertList.</li>
-2088 * <li>{Object}cakey (OPTION) - specifies CRL signing private key.
-2089 * Parameter "cakey" or "sighex" shall be specified. Following
-2090 * values can be specified:
-2091 * <ul>
-2092 * <li>PKCS#1/5 or PKCS#8 PEM string of private key</li>
-2093 * <li>RSAKey/DSA/ECDSA key object. {@link KEYUTIL.getKey} is useful
-2094 * to generate a key object.</li>
-2095 * </ul>
-2096 * </li>
-2097 * <li>{String}sighex (OPTION) - hexadecimal string of signature value
-2098 * (i.e. ASN.1 value(V) of signatureValue BIT STRING without
-2099 * unused bits)</li>
-2100 * </ul>
-2101 *
-2102 * @example
-2103 * var crl = new KJUR.asn1.x509.CRL({
-2104 * sigalg: "SHA256withRSA",
-2105 * issuer: {str:'/C=JP/O=Test1'},
-2106 * thisupdate: "200821235959Z",
-2107 * nextupdate: "200828235959Z", // OPTION
-2108 * revcert: [{sn: {hex: "12ab"}, date: "200401235959Z"}],
-2109 * ext: [
-2110 * {extname: "cRLNumber", num: {'int': 8}},
-2111 * {extname: "authorityKeyIdentifier", "kid": {hex: "12ab"}}
-2112 * ],
-2113 * cakey: prvkey
-2114 * });
-2115 * crl.getEncodedHex() → "30..."
-2116 * crl.getPEM() → "-----BEGIN X509 CRL..."
-2117 */
-2118 KJUR.asn1.x509.CRL = function(params) {
-2119 KJUR.asn1.x509.CRL.superclass.constructor.call(this);
-2120 var _KJUR = KJUR,
-2121 _KJUR_asn1 = _KJUR.asn1,
-2122 _DERSequence = _KJUR_asn1.DERSequence,
-2123 _DERBitString = _KJUR_asn1.DERBitString,
-2124 _KJUR_asn1_x509 = _KJUR_asn1.x509,
-2125 _AlgorithmIdentifier = _KJUR_asn1_x509.AlgorithmIdentifier,
-2126 _TBSCertList = _KJUR_asn1_x509.TBSCertList;
-2127
-2128 this.params = undefined;
-2129
-2130 this.setByParam = function(params) {
-2131 this.params = params;
-2132 };
-2133
-2134 /**
-2135 * sign CRL<br/>
-2136 * @name sign
-2137 * @memberOf KJUR.asn1.x509.CRL#
-2138 * @function
-2139 * @description
-2140 * This method signs TBSCertList with a specified
-2141 * private key and algorithm by
-2142 * this.params.cakey and this.params.sigalg parameter.
-2143 * @example
-2144 * crl = new KJUR.asn1.x509.CRL({..., cakey:prvkey});
-2145 * crl.sign()
-2146 */
-2147 this.sign = function() {
-2148 var hTBSCL = (new _TBSCertList(this.params)).getEncodedHex();
-2149 var sig = new KJUR.crypto.Signature({alg: this.params.sigalg});
-2150 sig.init(this.params.cakey);
-2151 sig.updateHex(hTBSCL);
-2152 var sighex = sig.sign();
-2153 this.params.sighex = sighex;
-2154 };
-2155
-2156 /**
-2157 * get PEM formatted CRL string after signed<br/>
-2158 * @name getPEM
-2159 * @memberOf KJUR.asn1.x509.CRL#
-2160 * @function
-2161 * @return PEM formatted string of CRL
-2162 * @since jsrsasign 9.1.0 asn1hex 2.1.0
-2163 * @description
-2164 * This method returns a string of PEM formatted
-2165 * CRL.
-2166 * @example
-2167 * crl = new KJUR.asn1.x509.CRL({...});
-2168 * crl.getPEM() →
-2169 * "-----BEGIN X509 CRL-----\r\n..."
-2170 */
-2171 this.getPEM = function() {
-2172 return hextopem(this.getEncodedHex(), "X509 CRL");
-2173 };
-2174
-2175 this.getEncodedHex = function() {
-2176 var params = this.params;
-2177
-2178 if (params.tbsobj == undefined) {
-2179 params.tbsobj = new _TBSCertList(params);
-2180 }
-2181
-2182 if (params.sighex == undefined && params.cakey != undefined) {
-2183 this.sign();
-2184 }
-2185
-2186 if (params.sighex == undefined) {
-2187 throw new Error("sighex or cakey parameter not defined");
-2188 }
-2189
-2190 var a = [];
-2191 a.push(params.tbsobj);
-2192 a.push(new _AlgorithmIdentifier({name: params.sigalg}));
-2193 a.push(new _DERBitString({hex: "00" + params.sighex}));
-2194 var seq = new _DERSequence({array: a});
-2195 return seq.getEncodedHex();
-2196 };
-2197
-2198 if (params != undefined) this.params = params;
-2199 };
-2200 YAHOO.lang.extend(KJUR.asn1.x509.CRL, KJUR.asn1.ASN1Object);
-2201
-2202 /**
-2203 * ASN.1 TBSCertList ASN.1 structure class for CRL<br/>
-2204 * @name KJUR.asn1.x509.TBSCertList
-2205 * @class TBSCertList ASN.1 structure class for CRL
-2206 * @property {Array} params JSON object of parameters
-2207 * @param {Array} params JSON object of TBSCertList parameters
-2208 * @extends KJUR.asn1.ASN1Object
-2209 * @since 1.0.3
-2210 *
-2211 * @description
-2212 * This class represents TBSCertList of CRL defined in
-2213 * <a href="https://tools.ietf.org/html/rfc5280#section-5.1">
-2214 * RFC 5280 5.1</a>.
-2215 * <pre>
-2216 * TBSCertList ::= SEQUENCE {
-2217 * version Version OPTIONAL,
-2218 * -- if present, MUST be v2
-2219 * signature AlgorithmIdentifier,
-2220 * issuer Name,
-2221 * thisUpdate Time,
-2222 * nextUpdate Time OPTIONAL,
-2223 * revokedCertificates SEQUENCE OF SEQUENCE {
-2224 * userCertificate CertificateSerialNumber,
-2225 * revocationDate Time,
-2226 * crlEntryExtensions Extensions OPTIONAL
-2227 * -- if present, version MUST be v2
-2228 * } OPTIONAL,
-2229 * crlExtensions [0] EXPLICIT Extensions OPTIONAL
-2230 * }
-2231 * </pre>
-2232 * NOTE: TBSCertList class is updated without backward
-2233 * compatibility from jsrsasign 9.1.0 asn1x509 2.1.0.
-2234 * Most of methods are removed and parameters can be set
-2235 * by JSON object.
-2236 * <br/>
-2237 * Constructor of this class may have following parameters:
-2238 * <ul>
-2239 * <li>{Integer}version (OPTION) - version number. Omitted by default.</li>
-2240 * <li>{String}sigalg - signature algorithm name</li>
-2241 * <li>{Array}issuer - issuer parameter of {@link KJUR.asn1.x509.X500Name}</li>
-2242 * <li>{String}thisupdate - thisUpdate field value</li>
-2243 * <li>{String}nextupdate (OPTION) - thisUpdate field value</li>
-2244 * <li>{Array}revcert (OPTION) - revokedCertificates field value as array
-2245 * Its element may have following property:
-2246 * <ul>
-2247 * <li>{Array}sn - serialNumber of userCertificate field specified
-2248 * by {@link KJUR.asn1.DERInteger}</li>
-2249 * <li>{String}date - revocationDate field specified by
-2250 * a string of {@link KJUR.asn1.x509.Time} parameter</li>
-2251 * <li>{Array}ext (OPTION) - array of CRL entry extension parameter</li>
-2252 * </ul>
-2253 * </li>
-2254 * </ul>
-2255 *
-2256 * @example
-2257 * var o = new KJUR.asn1.x509.TBSCertList({
-2258 * sigalg: "SHA256withRSA",
-2259 * issuer: {array: [[{type:'C',value:'JP',ds:'prn'}],
-2260 * [{type:'O',value:'T1',ds:'prn'}]]},
-2261 * thisupdate: "200821235959Z",
-2262 * nextupdate: "200828235959Z", // OPTION
-2263 * revcert: [
-2264 * {sn: {hex: "12ab"}, date: "200401235959Z", ext: [{extname: "cRLReason", code:1}]},
-2265 * {sn: {hex: "12bc"}, date: "200405235959Z", ext: [{extname: "cRLReason", code:2}]}
-2266 * ],
-2267 * ext: [
-2268 * {extname: "cRLNumber", num: {'int': 8}},
-2269 * {extname: "authorityKeyIdentifier", "kid": {hex: "12ab"}}
-2270 * ]
-2271 * });
-2272 * o.getEncodedHex() → "30..."
-2273 */
-2274 KJUR.asn1.x509.TBSCertList = function(params) {
-2275 KJUR.asn1.x509.TBSCertList.superclass.constructor.call(this);
-2276 var _KJUR = KJUR,
-2277 _KJUR_asn1 = _KJUR.asn1,
-2278 _DERInteger = _KJUR_asn1.DERInteger,
-2279 _DERSequence = _KJUR_asn1.DERSequence,
-2280 _DERTaggedObject = _KJUR_asn1.DERTaggedObject,
-2281 _DERObjectIdentifier = _KJUR_asn1.DERObjectIdentifier,
-2282 _KJUR_asn1_x509 = _KJUR_asn1.x509,
-2283 _AlgorithmIdentifier = _KJUR_asn1_x509.AlgorithmIdentifier,
-2284 _Time = _KJUR_asn1_x509.Time,
-2285 _Extensions = _KJUR_asn1_x509.Extensions,
-2286 _X500Name = _KJUR_asn1_x509.X500Name;
-2287 this.params = null;
-2288
-2289 /**
-2290 * get array of ASN.1 object for extensions<br/>
-2291 * @name setByParam
-2292 * @memberOf KJUR.asn1.x509.TBSCertList#
-2293 * @function
-2294 * @param {Array} JSON object of TBSCertList parameters
-2295 * @example
-2296 * tbsc = new KJUR.asn1.x509.TBSCertificate();
-2297 * tbsc.setByParam({version:3, serial:{hex:'1234...'},...});
-2298 */
-2299 this.setByParam = function(params) {
-2300 this.params = params;
-2301 };
-2302
-2303 /**
-2304 * get DERSequence for revokedCertificates<br/>
-2305 * @name getRevCertSequence
-2306 * @memberOf KJUR.asn1.x509.TBSCertList#
-2307 * @function
-2308 * @return {@link KJUR.asn1.DERSequence} of revokedCertificates
-2309 */
-2310 this.getRevCertSequence = function() {
-2311 var a = [];
-2312 var aRevCert = this.params.revcert;
-2313 for (var i = 0; i < aRevCert.length; i++) {
-2314 var aEntry = [
-2315 new _DERInteger(aRevCert[i].sn),
-2316 new _Time(aRevCert[i].date)
-2317 ];
-2318 if (aRevCert[i].ext != undefined) {
-2319 aEntry.push(new _Extensions(aRevCert[i].ext));
-2320 }
-2321 a.push(new _DERSequence({array: aEntry}));
-2322 }
-2323 return new _DERSequence({array: a});
-2324 };
-2325
-2326 this.getEncodedHex = function() {
-2327 var a = [];
-2328 var params = this.params;
-2329
-2330 if (params.version != undefined) {
-2331 var version = params.version - 1;
-2332 var obj = new _DERInteger({'int': version});
-2333 a.push(obj);
-2334 }
-2335
-2336 a.push(new _AlgorithmIdentifier({name: params.sigalg}));
-2337 a.push(new _X500Name(params.issuer));
-2338 a.push(new _Time(params.thisupdate));
-2339 if (params.nextupdate != undefined)
-2340 a.push(new _Time(params.nextupdate))
-2341 if (params.revcert != undefined) {
-2342 a.push(this.getRevCertSequence());
-2343 }
-2344 if (params.ext != undefined) {
-2345 var dExt = new _Extensions(params.ext);
-2346 a.push(new _DERTaggedObject({tag:'a0',
-2347 explicit:true,
-2348 obj:dExt}));
-2349 }
-2350
-2351 var seq = new _DERSequence({array: a});
-2352 return seq.getEncodedHex();
-2353 };
-2354
-2355 if (params !== undefined) this.setByParam(params);
-2356 };
-2357 YAHOO.lang.extend(KJUR.asn1.x509.TBSCertList, KJUR.asn1.ASN1Object);
-2358
-2359 /**
-2360 * ASN.1 CRLEntry structure class for CRL (DEPRECATED)<br/>
-2361 * @name KJUR.asn1.x509.CRLEntry
-2362 * @class ASN.1 CRLEntry structure class for CRL
-2363 * @param {Array} params JSON object for CRL entry parameter
-2364 * @extends KJUR.asn1.ASN1Object
-2365 * @since 1.0.3
-2366 * @see KJUR.asn1.x509.TBSCertList
-2367 * @deprecated since jsrsasign 9.1.0 asn1x509 2.1.0
-2368 * @description
-2369 * This class is to represent revokedCertificate in TBSCertList.
-2370 * However this is no more used by TBSCertList since
-2371 * jsrsasign 9.1.0. So this class have been deprecated in
-2372 * jsrsasign 9.1.0.
-2373 * <pre>
-2374 * revokedCertificates SEQUENCE OF SEQUENCE {
-2375 * userCertificate CertificateSerialNumber,
-2376 * revocationDate Time,
-2377 * crlEntryExtensions Extensions OPTIONAL
-2378 * -- if present, version MUST be v2 }
-2379 * </pre>
-2380 * @example
-2381 * var e = new KJUR.asn1.x509.CRLEntry({'time': {'str': '130514235959Z'}, 'sn': {'int': 234}});
-2382 */
-2383 KJUR.asn1.x509.CRLEntry = function(params) {
-2384 KJUR.asn1.x509.CRLEntry.superclass.constructor.call(this);
-2385 var sn = null,
-2386 time = null,
-2387 _KJUR = KJUR,
-2388 _KJUR_asn1 = _KJUR.asn1;
-2389
-2390 /**
-2391 * set DERInteger parameter for serial number of revoked certificate
-2392 * @name setCertSerial
-2393 * @memberOf KJUR.asn1.x509.CRLEntry
-2394 * @function
-2395 * @param {Array} intParam DERInteger parameter for certificate serial number
-2396 * @description
-2397 * @example
-2398 * entry.setCertSerial({'int': 3});
-2399 */
-2400 this.setCertSerial = function(intParam) {
-2401 this.sn = new _KJUR_asn1.DERInteger(intParam);
-2402 };
-2403
-2404 /**
-2405 * set Time parameter for revocation date
-2406 * @name setRevocationDate
-2407 * @memberOf KJUR.asn1.x509.CRLEntry
-2408 * @function
-2409 * @param {Array} timeParam Time parameter for revocation date
-2410 * @description
-2411 * @example
-2412 * entry.setRevocationDate({'str': '130508235959Z'});
-2413 */
-2414 this.setRevocationDate = function(timeParam) {
-2415 this.time = new _KJUR_asn1.x509.Time(timeParam);
-2416 };
-2417
-2418 this.getEncodedHex = function() {
-2419 var o = new _KJUR_asn1.DERSequence({"array": [this.sn, this.time]});
-2420 this.TLV = o.getEncodedHex();
-2421 return this.TLV;
-2422 };
-2423
-2424 if (params !== undefined) {
-2425 if (params.time !== undefined) {
-2426 this.setRevocationDate(params.time);
-2427 }
-2428 if (params.sn !== undefined) {
-2429 this.setCertSerial(params.sn);
-2430 }
-2431 }
-2432 };
-2433 YAHOO.lang.extend(KJUR.asn1.x509.CRLEntry, KJUR.asn1.ASN1Object);
-2434
-2435 /**
-2436 * CRLNumber CRL extension ASN.1 structure class<br/>
-2437 * @name KJUR.asn1.x509.CRLNumber
-2438 * @class CRLNumber CRL extension ASN.1 structure class
-2439 * @extends KJUR.asn1.x509.Extension
-2440 * @since jsrsasign 9.1.0 asn1x509 2.1.0
-2441 * @see KJUR.asn1.x509.TBSCertList
-2442 * @see KJUR.asn1.x509.Extensions
-2443 * @description
-2444 * This class represents ASN.1 structure for
-2445 * CRLNumber CRL extension defined in
-2446 * <a href="https://tools.ietf.org/html/rfc5280#section-5.2.3">
-2447 * RFC 5280 5.2.3</a>.
-2448 * <pre>
-2449 * id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 }
-2450 * CRLNumber ::= INTEGER (0..MAX)
-2451 * </pre>
-2452 * Constructor of this class may have following parameters:
-2453 * <ul>
-2454 * <li>{String}extname - name "cRLNumber". It is ignored in this class but
-2455 * required to use with {@link KJUR.asn1.x509.Extensions} class. (OPTION)</li>
-2456 * <li>{Object}num - CRLNumber value to specify
-2457 * {@link KJUR.asn1.DERInteger} parameter.</li>
-2458 * <li>{Boolean}critical - critical flag. Generally false and not specified
-2459 * in this class.(OPTION)</li>
-2460 * </ul>
-2461 *
-2462 * @example
-2463 * new KJUR.asn1.x509.CRLNumber({extname:'cRLNumber',
-2464 * num:{'int':147}})
-2465 */
-2466 KJUR.asn1.x509.CRLNumber = function(params) {
-2467 KJUR.asn1.x509.CRLNumber.superclass.constructor.call(this, params);
-2468 this.params = undefined;
-2469
-2470 this.getExtnValueHex = function() {
-2471 this.asn1ExtnValue = new KJUR.asn1.DERInteger(this.params.num);
-2472 return this.asn1ExtnValue.getEncodedHex();
-2473 };
-2474
-2475 this.oid = "2.5.29.20";
-2476 if (params != undefined) this.params = params;
-2477 };
-2478 YAHOO.lang.extend(KJUR.asn1.x509.CRLNumber, KJUR.asn1.x509.Extension);
-2479
-2480 /**
-2481 * CRLReason CRL entry extension ASN.1 structure class<br/>
-2482 * @name KJUR.asn1.x509.CRLReason
-2483 * @class CRLReason CRL entry extension ASN.1 structure class
-2484 * @extends KJUR.asn1.x509.Extension
-2485 * @since jsrsasign 9.1.0 asn1x509 2.1.0
-2486 * @see KJUR.asn1.x509.TBSCertList
-2487 * @see KJUR.asn1.x509.Extensions
-2488 * @description
-2489 * This class represents ASN.1 structure for
-2490 * CRLReason CRL entry extension defined in
-2491 * <a href="https://tools.ietf.org/html/rfc5280#section-5.3.1">
-2492 * RFC 5280 5.3.1</a>
-2493 * <pre>
-2494 * id-ce-cRLReasons OBJECT IDENTIFIER ::= { id-ce 21 }
-2495 * -- reasonCode ::= { CRLReason }
-2496 * CRLReason ::= ENUMERATED {
-2497 * unspecified (0),
-2498 * keyCompromise (1),
-2499 * cACompromise (2),
-2500 * affiliationChanged (3),
-2501 * superseded (4),
-2502 * cessationOfOperation (5),
-2503 * certificateHold (6),
-2504 * removeFromCRL (8),
-2505 * privilegeWithdrawn (9),
-2506 * aACompromise (10) }
-2507 * </pre>
-2508 * Constructor of this class may have following parameters:
-2509 * <ul>
-2510 * <li>{String}extname - name "cRLReason". It is ignored in this class but
-2511 * required to use with {@link KJUR.asn1.x509.Extensions} class. (OPTION)</li>
-2512 * <li>{Integer}code - reasonCode value</li>
-2513 * <li>{Boolean}critical - critical flag. Generally false and not specified
-2514 * in this class.(OPTION)</li>
-2515 * </ul>
-2516 *
-2517 * @example
-2518 * new KJUR.asn1.x509.CRLReason({extname:'cRLNumber',code:4})
-2519 */
-2520 KJUR.asn1.x509.CRLReason = function(params) {
-2521 KJUR.asn1.x509.CRLReason.superclass.constructor.call(this, params);
-2522 this.params = undefined;
-2523
-2524 this.getExtnValueHex = function() {
-2525 this.asn1ExtnValue = new KJUR.asn1.DEREnumerated(this.params.code);
-2526 return this.asn1ExtnValue.getEncodedHex();
-2527 };
-2528
-2529 this.oid = "2.5.29.21";
-2530 if (params != undefined) this.params = params;
-2531 };
-2532 YAHOO.lang.extend(KJUR.asn1.x509.CRLReason, KJUR.asn1.x509.Extension);
-2533
-2534 // === END CRL Related ===================================================
-2535
-2536 // === BEGIN OCSP Related ===================================================
-2537 /**
-2538 * Nonce OCSP extension ASN.1 structure class<br/>
-2539 * @name KJUR.asn1.x509.OCSPNonce
-2540 * @class Nonce OCSP extension ASN.1 structure class
-2541 * @extends KJUR.asn1.x509.Extension
-2542 * @since jsrsasign 9.1.6 asn1x509 2.1.2
-2543 * @param {Array} params JSON object for Nonce extension
-2544 * @see KJUR.asn1.ocsp.ResponseData
-2545 * @see KJUR.asn1.x509.Extensions
-2546 * @see X509#getExtOCSPNonce
-2547 * @description
-2548 * This class represents
-2549 * Nonce OCSP extension value defined in
-2550 * <a href="https://tools.ietf.org/html/rfc6960#section-4.4.1">
-2551 * RFC 6960 4.4.1</a> as JSON object.
-2552 * <pre>
-2553 * id-pkix-ocsp OBJECT IDENTIFIER ::= { id-ad-ocsp }
-2554 * id-pkix-ocsp-nonce OBJECT IDENTIFIER ::= { id-pkix-ocsp 2 }
-2555 * Nonce ::= OCTET STRING
-2556 * </pre>
-2557 * Constructor of this class may have following parameters:
-2558 * <ul>
-2559 * <li>{String}extname - name "ocspNonce". It is ignored in this class but
-2560 * required to use with {@link KJUR.asn1.x509.Extensions} class. (OPTION)</li>
-2561 * <li>{String}hex - hexadecimal string of nonce value</li>
-2562 * <li>{Number}int - integer of nonce value. "hex" or "int" needs to be
-2563 * specified.</li>
-2564 * <li>{Boolean}critical - critical flag. Generally false and not specified
-2565 * in this class.(OPTION)</li>
-2566 * </ul>
-2567 *
-2568 * @example
-2569 * new KJUR.asn1.x509.OCSPNonce({extname:'ocspNonce',
-2570 * hex: '12ab...'})
-2571 */
-2572 KJUR.asn1.x509.OCSPNonce = function(params) {
-2573 KJUR.asn1.x509.OCSPNonce.superclass.constructor.call(this, params);
-2574 this.params = undefined;
-2575
-2576 this.getExtnValueHex = function() {
-2577 this.asn1ExtnValue = new KJUR.asn1.DEROctetString(this.params);
-2578 return this.asn1ExtnValue.getEncodedHex();
-2579 };
-2580
-2581 this.oid = "1.3.6.1.5.5.7.48.1.2";
-2582 if (params != undefined) this.params = params;
-2583 };
-2584 YAHOO.lang.extend(KJUR.asn1.x509.OCSPNonce, KJUR.asn1.x509.Extension);
-2585
-2586 /**
-2587 * OCSPNoCheck certificate ASN.1 structure class<br/>
-2588 * @name KJUR.asn1.x509.OCSPNoCheck
-2589 * @class OCSPNoCheck extension ASN.1 structure class
-2590 * @extends KJUR.asn1.x509.Extension
-2591 * @since jsrsasign 9.1.6 asn1x509 2.1.2
-2592 * @param {Array} params JSON object for OCSPNoCheck extension
-2593 * @see KJUR.asn1.x509.Extensions
-2594 * @see X509#getExtOCSPNoCheck
-2595 * @description
-2596 * This class represents
-2597 * OCSPNoCheck extension value defined in
-2598 * <a href="https://tools.ietf.org/html/rfc6960#section-4.2.2.2.1">
-2599 * RFC 6960 4.2.2.2.1</a> as JSON object.
-2600 * <pre>
-2601 * id-pkix-ocsp-nocheck OBJECT IDENTIFIER ::= { id-pkix-ocsp 5 }
-2602 * </pre>
-2603 * Constructor of this class may have following parameters:
-2604 * <ul>
-2605 * <li>{String}extname - name "ocspNoCheck". It is ignored in this class but
-2606 * required to use with {@link KJUR.asn1.x509.Extensions} class. (OPTION)</li>
-2607 * <li>{Boolean}critical - critical flag. Generally false and not specified
-2608 * in this class.(OPTION)</li>
-2609 * </ul>
-2610 *
-2611 * @example
-2612 * new KJUR.asn1.x509.OCSPNonce({extname:'ocspNoCheck'})
-2613 */
-2614 KJUR.asn1.x509.OCSPNoCheck = function(params) {
-2615 KJUR.asn1.x509.OCSPNoCheck.superclass.constructor.call(this, params);
-2616 this.params = undefined;
-2617
-2618 this.getExtnValueHex = function() {
-2619 this.asn1ExtnValue = new KJUR.asn1.DERNull();
-2620 return this.asn1ExtnValue.getEncodedHex();
-2621 };
-2622
-2623 this.oid = "1.3.6.1.5.5.7.48.1.5";
-2624 if (params != undefined) this.params = params;
-2625 };
-2626 YAHOO.lang.extend(KJUR.asn1.x509.OCSPNoCheck, KJUR.asn1.x509.Extension);
-2627
-2628 // === END OCSP Related ===================================================
-2629
-2630 // === BEGIN Other X.509v3 Extensions========================================
-2631
-2632 /**
-2633 * AdobeTimeStamp X.509v3 extension ASN.1 encoder class<br/>
-2634 * @name KJUR.asn1.x509.AdobeTimeStamp
-2635 * @class AdobeTimeStamp X.509v3 extension ASN.1 encoder class
-2636 * @extends KJUR.asn1.x509.Extension
-2637 * @since jsrsasign 10.0.1 asn1x509 2.1.4
-2638 * @param {Array} params JSON object for AdobeTimeStamp extension parameter
-2639 * @see KJUR.asn1.x509.Extensions
-2640 * @see X509#getExtAdobeTimeStamp
-2641 * @description
-2642 * This class represents
-2643 * AdobeTimeStamp X.509v3 extension value defined in
-2644 * <a href="https://www.adobe.com/devnet-docs/acrobatetk/tools/DigSigDC/oids.html">
-2645 * Adobe site</a> as JSON object.
-2646 * <pre>
-2647 * adbe- OBJECT IDENTIFIER ::= { adbe(1.2.840.113583) acrobat(1) security(1) x509Ext(9) 1 }
-2648 * ::= SEQUENCE {
-2649 * version INTEGER { v1(1) }, -- extension version
-2650 * location GeneralName (In v1 GeneralName can be only uniformResourceIdentifier)
-2651 * requiresAuth boolean (default false), OPTIONAL }
-2652 * </pre>
-2653 * Constructor of this class may have following parameters:
-2654 * <ul>
-2655 * <li>{String}uri - RFC 3161 time stamp service URL</li>
-2656 * <li>{Boolean}reqauth - authentication required or not</li>
-2657 * </ul>
-2658 * </pre>
-2659 * <br/>
-2660 * NOTE: This extesion doesn't seem to have official name. This may be called as "pdfTimeStamp".
-2661 * @example
-2662 * new KJUR.asn1.x509.AdobeTimesStamp({
-2663 * uri: "http://tsa.example.com/",
-2664 * reqauth: true
-2665 * }
-2666 */
-2667 KJUR.asn1.x509.AdobeTimeStamp = function(params) {
-2668 KJUR.asn1.x509.AdobeTimeStamp.superclass.constructor.call(this, params);
-2669
-2670 var _KJUR = KJUR,
-2671 _KJUR_asn1 = _KJUR.asn1,
-2672 _DERInteger = _KJUR_asn1.DERInteger,
-2673 _DERBoolean = _KJUR_asn1.DERBoolean,
-2674 _DERSequence = _KJUR_asn1.DERSequence,
-2675 _GeneralName = _KJUR_asn1.x509.GeneralName;
-2676
-2677 this.params = null;
-2678
-2679 this.getExtnValueHex = function() {
-2680 var params = this.params;
-2681 var a = [new _DERInteger(1)];
-2682 a.push(new _GeneralName({uri: params.uri}));
-2683 if (params.reqauth != undefined) {
-2684 a.push(new _DERBoolean(params.reqauth));
-2685 }
-2686
-2687 this.asn1ExtnValue = new _DERSequence({array: a});
-2688 return this.asn1ExtnValue.getEncodedHex();
-2689 };
-2690
-2691 this.oid = "1.2.840.113583.1.1.9.1";
-2692 if (params !== undefined) this.setByParam(params);
-2693 };
-2694 YAHOO.lang.extend(KJUR.asn1.x509.AdobeTimeStamp, KJUR.asn1.x509.Extension);
-2695
-2696 // === END Other X.509v3 Extensions========================================
-2697
+1970
+1971 /**
+1972 * priavte extension ASN.1 structure class<br/>
+1973 * @name KJUR.asn1.x509.PrivateExtension
+1974 * @class private extension ASN.1 structure class
+1975 * @param {Array} params JSON object of private extension
+1976 * @extends KJUR.asn1.x509.Extension
+1977 * @since jsrsasign 9.1.1 asn1x509
+1978 * @see KJUR.asn1.ASN1Util.newObject
+1979 *
+1980 * @description
+1981 * This class is to represent private extension or
+1982 * unsupported extension.
+1983 * <pre>
+1984 * Extension ::= SEQUENCE {
+1985 * extnID OBJECT IDENTIFIER,
+1986 * critical BOOLEAN DEFAULT FALSE,
+1987 * extnValue OCTET STRING }
+1988 * </pre>
+1989 * Following properties can be set for JSON parameter:
+1990 * <ul>
+1991 * <li>{String}extname - string of OID or predefined extension name</li>
+1992 * <li>{Boolean}critical - critical flag</li>
+1993 * <li>{Object}extn - hexadecimal string or
+1994 * of {@link KJUR.asn1.ASN1Util.newObject}
+1995 * JSON parameter for extnValue field</li>
+1996 * </li>
+1997 * </ul>
+1998 *
+1999 * @example
+2000 * // extn by hexadecimal
+2001 * new KJUR.asn1.x509.PrivateExtension({
+2002 * extname: "1.2.3.4",
+2003 * critical: true,
+2004 * extn: "13026161" // means PrintableString "aa"
+2005 * });
+2006 *
+2007 * // extn by JSON parameter
+2008 * new KJUR.asn1.x509.PrivateExtension({
+2009 * extname: "1.2.3.5",
+2010 * extn: {seq: [{prnstr:"abc"},{utf8str:"def"}]}
+2011 * });
+2012 */
+2013 KJUR.asn1.x509.PrivateExtension = function(params) {
+2014 KJUR.asn1.x509.PrivateExtension.superclass.constructor.call(this, params)
+2015
+2016 var _KJUR = KJUR,
+2017 _isHex = _KJUR.lang.String.isHex,
+2018 _KJUR_asn1 = _KJUR.asn1,
+2019 _name2oid = _KJUR_asn1.x509.OID.name2oid,
+2020 _newObject = _KJUR_asn1.ASN1Util.newObject;
+2021
+2022 this.params = null;
+2023
+2024 this.setByParam = function(params) {
+2025 this.oid = _name2oid(params.extname);
+2026 this.params = params;
+2027 };
+2028
+2029 this.getExtnValueHex = function() {
+2030 if (this.params.extname == undefined ||
+2031 this.params.extn == undefined) {
+2032 throw new Error("extname or extnhex not specified");
+2033 }
+2034
+2035 var extn = this.params.extn;
+2036 if (typeof extn == "string" && _isHex(extn)) {
+2037 return extn;
+2038 } else if (typeof extn == "object") {
+2039 try {
+2040 return _newObject(extn).getEncodedHex();
+2041 } catch(ex) {}
+2042 }
+2043 throw new Error("unsupported extn value");
+2044 };
+2045
+2046 if (params != undefined) {
+2047 this.setByParam(params);
+2048 }
+2049 };
+2050 YAHOO.lang.extend(KJUR.asn1.x509.PrivateExtension, KJUR.asn1.x509.Extension);
+2051
+2052 // === END X.509v3 Extensions Related =======================================
+2053
+2054 // === BEGIN CRL Related ===================================================
+2055 /**
+2056 * X.509 CRL class to sign and generate hex encoded CRL<br/>
+2057 * @name KJUR.asn1.x509.CRL
+2058 * @class X.509 CRL class to sign and generate hex encoded certificate
+2059 * @property {Array} params JSON object of parameters
+2060 * @param {Array} params JSON object of CRL parameters
+2061 * @extends KJUR.asn1.ASN1Object
+2062 * @since 1.0.3
+2063 * @see KJUR.asn1.x509.TBSCertList
+2064 *
+2065 * @description
+2066 * This class represents CertificateList ASN.1 structur of X.509 CRL
+2067 * defined in <a href="https://tools.ietf.org/html/rfc5280#section-5.1">
+2068 * RFC 5280 5.1</a>
+2069 * <pre>
+2070 * CertificateList ::= SEQUENCE {
+2071 * tbsCertList TBSCertList,
+2072 * signatureAlgorithm AlgorithmIdentifier,
+2073 * signatureValue BIT STRING }
+2074 * </pre>
+2075 * NOTE: CRL class is updated without backward
+2076 * compatibility from jsrsasign 9.1.0 asn1x509 2.1.0.
+2077 * Most of methods are removed and parameters can be set
+2078 * by JSON object.
+2079 * <br/>
+2080 * Constructor of this class can accept all
+2081 * parameters of {@link KJUR.asn1.x509.TBSCertList}.
+2082 * It also accept following parameters additionally:
+2083 * <ul>
+2084 * <li>{TBSCertList}tbsobj (OPTION) -
+2085 * specifies {@link KJUR.asn1.x509.TBSCertList}
+2086 * object to be signed if needed.
+2087 * When this isn't specified,
+2088 * this will be set from other parametes of TBSCertList.</li>
+2089 * <li>{Object}cakey (OPTION) - specifies CRL signing private key.
+2090 * Parameter "cakey" or "sighex" shall be specified. Following
+2091 * values can be specified:
+2092 * <ul>
+2093 * <li>PKCS#1/5 or PKCS#8 PEM string of private key</li>
+2094 * <li>RSAKey/DSA/ECDSA key object. {@link KEYUTIL.getKey} is useful
+2095 * to generate a key object.</li>
+2096 * </ul>
+2097 * </li>
+2098 * <li>{String}sighex (OPTION) - hexadecimal string of signature value
+2099 * (i.e. ASN.1 value(V) of signatureValue BIT STRING without
+2100 * unused bits)</li>
+2101 * </ul>
+2102 *
+2103 * @example
+2104 * var crl = new KJUR.asn1.x509.CRL({
+2105 * sigalg: "SHA256withRSA",
+2106 * issuer: {str:'/C=JP/O=Test1'},
+2107 * thisupdate: "200821235959Z",
+2108 * nextupdate: "200828235959Z", // OPTION
+2109 * revcert: [{sn: {hex: "12ab"}, date: "200401235959Z"}],
+2110 * ext: [
+2111 * {extname: "cRLNumber", num: {'int': 8}},
+2112 * {extname: "authorityKeyIdentifier", "kid": {hex: "12ab"}}
+2113 * ],
+2114 * cakey: prvkey
+2115 * });
+2116 * crl.getEncodedHex() → "30..."
+2117 * crl.getPEM() → "-----BEGIN X509 CRL..."
+2118 */
+2119 KJUR.asn1.x509.CRL = function(params) {
+2120 KJUR.asn1.x509.CRL.superclass.constructor.call(this);
+2121 var _KJUR = KJUR,
+2122 _KJUR_asn1 = _KJUR.asn1,
+2123 _DERSequence = _KJUR_asn1.DERSequence,
+2124 _DERBitString = _KJUR_asn1.DERBitString,
+2125 _KJUR_asn1_x509 = _KJUR_asn1.x509,
+2126 _AlgorithmIdentifier = _KJUR_asn1_x509.AlgorithmIdentifier,
+2127 _TBSCertList = _KJUR_asn1_x509.TBSCertList;
+2128
+2129 this.params = undefined;
+2130
+2131 this.setByParam = function(params) {
+2132 this.params = params;
+2133 };
+2134
+2135 /**
+2136 * sign CRL<br/>
+2137 * @name sign
+2138 * @memberOf KJUR.asn1.x509.CRL#
+2139 * @function
+2140 * @description
+2141 * This method signs TBSCertList with a specified
+2142 * private key and algorithm by
+2143 * this.params.cakey and this.params.sigalg parameter.
+2144 * @example
+2145 * crl = new KJUR.asn1.x509.CRL({..., cakey:prvkey});
+2146 * crl.sign()
+2147 */
+2148 this.sign = function() {
+2149 var hTBSCL = (new _TBSCertList(this.params)).getEncodedHex();
+2150 var sig = new KJUR.crypto.Signature({alg: this.params.sigalg});
+2151 sig.init(this.params.cakey);
+2152 sig.updateHex(hTBSCL);
+2153 var sighex = sig.sign();
+2154 this.params.sighex = sighex;
+2155 };
+2156
+2157 /**
+2158 * get PEM formatted CRL string after signed<br/>
+2159 * @name getPEM
+2160 * @memberOf KJUR.asn1.x509.CRL#
+2161 * @function
+2162 * @return PEM formatted string of CRL
+2163 * @since jsrsasign 9.1.0 asn1hex 2.1.0
+2164 * @description
+2165 * This method returns a string of PEM formatted
+2166 * CRL.
+2167 * @example
+2168 * crl = new KJUR.asn1.x509.CRL({...});
+2169 * crl.getPEM() →
+2170 * "-----BEGIN X509 CRL-----\r\n..."
+2171 */
+2172 this.getPEM = function() {
+2173 return hextopem(this.getEncodedHex(), "X509 CRL");
+2174 };
+2175
+2176 this.getEncodedHex = function() {
+2177 var params = this.params;
+2178
+2179 if (params.tbsobj == undefined) {
+2180 params.tbsobj = new _TBSCertList(params);
+2181 }
+2182
+2183 if (params.sighex == undefined && params.cakey != undefined) {
+2184 this.sign();
+2185 }
+2186
+2187 if (params.sighex == undefined) {
+2188 throw new Error("sighex or cakey parameter not defined");
+2189 }
+2190
+2191 var a = [];
+2192 a.push(params.tbsobj);
+2193 a.push(new _AlgorithmIdentifier({name: params.sigalg}));
+2194 a.push(new _DERBitString({hex: "00" + params.sighex}));
+2195 var seq = new _DERSequence({array: a});
+2196 return seq.getEncodedHex();
+2197 };
+2198
+2199 if (params != undefined) this.params = params;
+2200 };
+2201 YAHOO.lang.extend(KJUR.asn1.x509.CRL, KJUR.asn1.ASN1Object);
+2202
+2203 /**
+2204 * ASN.1 TBSCertList ASN.1 structure class for CRL<br/>
+2205 * @name KJUR.asn1.x509.TBSCertList
+2206 * @class TBSCertList ASN.1 structure class for CRL
+2207 * @property {Array} params JSON object of parameters
+2208 * @param {Array} params JSON object of TBSCertList parameters
+2209 * @extends KJUR.asn1.ASN1Object
+2210 * @since 1.0.3
+2211 *
+2212 * @description
+2213 * This class represents TBSCertList of CRL defined in
+2214 * <a href="https://tools.ietf.org/html/rfc5280#section-5.1">
+2215 * RFC 5280 5.1</a>.
+2216 * <pre>
+2217 * TBSCertList ::= SEQUENCE {
+2218 * version Version OPTIONAL,
+2219 * -- if present, MUST be v2
+2220 * signature AlgorithmIdentifier,
+2221 * issuer Name,
+2222 * thisUpdate Time,
+2223 * nextUpdate Time OPTIONAL,
+2224 * revokedCertificates SEQUENCE OF SEQUENCE {
+2225 * userCertificate CertificateSerialNumber,
+2226 * revocationDate Time,
+2227 * crlEntryExtensions Extensions OPTIONAL
+2228 * -- if present, version MUST be v2
+2229 * } OPTIONAL,
+2230 * crlExtensions [0] EXPLICIT Extensions OPTIONAL
+2231 * }
+2232 * </pre>
+2233 * NOTE: TBSCertList class is updated without backward
+2234 * compatibility from jsrsasign 9.1.0 asn1x509 2.1.0.
+2235 * Most of methods are removed and parameters can be set
+2236 * by JSON object.
+2237 * <br/>
+2238 * Constructor of this class may have following parameters:
+2239 * <ul>
+2240 * <li>{Integer}version (OPTION) - version number. Omitted by default.</li>
+2241 * <li>{String}sigalg - signature algorithm name</li>
+2242 * <li>{Array}issuer - issuer parameter of {@link KJUR.asn1.x509.X500Name}</li>
+2243 * <li>{String}thisupdate - thisUpdate field value</li>
+2244 * <li>{String}nextupdate (OPTION) - thisUpdate field value</li>
+2245 * <li>{Array}revcert (OPTION) - revokedCertificates field value as array
+2246 * Its element may have following property:
+2247 * <ul>
+2248 * <li>{Array}sn - serialNumber of userCertificate field specified
+2249 * by {@link KJUR.asn1.DERInteger}</li>
+2250 * <li>{String}date - revocationDate field specified by
+2251 * a string of {@link KJUR.asn1.x509.Time} parameter</li>
+2252 * <li>{Array}ext (OPTION) - array of CRL entry extension parameter</li>
+2253 * </ul>
+2254 * </li>
+2255 * </ul>
+2256 *
+2257 * @example
+2258 * var o = new KJUR.asn1.x509.TBSCertList({
+2259 * sigalg: "SHA256withRSA",
+2260 * issuer: {array: [[{type:'C',value:'JP',ds:'prn'}],
+2261 * [{type:'O',value:'T1',ds:'prn'}]]},
+2262 * thisupdate: "200821235959Z",
+2263 * nextupdate: "200828235959Z", // OPTION
+2264 * revcert: [
+2265 * {sn: {hex: "12ab"}, date: "200401235959Z", ext: [{extname: "cRLReason", code:1}]},
+2266 * {sn: {hex: "12bc"}, date: "200405235959Z", ext: [{extname: "cRLReason", code:2}]}
+2267 * ],
+2268 * ext: [
+2269 * {extname: "cRLNumber", num: {'int': 8}},
+2270 * {extname: "authorityKeyIdentifier", "kid": {hex: "12ab"}}
+2271 * ]
+2272 * });
+2273 * o.getEncodedHex() → "30..."
+2274 */
+2275 KJUR.asn1.x509.TBSCertList = function(params) {
+2276 KJUR.asn1.x509.TBSCertList.superclass.constructor.call(this);
+2277 var _KJUR = KJUR,
+2278 _KJUR_asn1 = _KJUR.asn1,
+2279 _DERInteger = _KJUR_asn1.DERInteger,
+2280 _DERSequence = _KJUR_asn1.DERSequence,
+2281 _DERTaggedObject = _KJUR_asn1.DERTaggedObject,
+2282 _DERObjectIdentifier = _KJUR_asn1.DERObjectIdentifier,
+2283 _KJUR_asn1_x509 = _KJUR_asn1.x509,
+2284 _AlgorithmIdentifier = _KJUR_asn1_x509.AlgorithmIdentifier,
+2285 _Time = _KJUR_asn1_x509.Time,
+2286 _Extensions = _KJUR_asn1_x509.Extensions,
+2287 _X500Name = _KJUR_asn1_x509.X500Name;
+2288 this.params = null;
+2289
+2290 /**
+2291 * get array of ASN.1 object for extensions<br/>
+2292 * @name setByParam
+2293 * @memberOf KJUR.asn1.x509.TBSCertList#
+2294 * @function
+2295 * @param {Array} JSON object of TBSCertList parameters
+2296 * @example
+2297 * tbsc = new KJUR.asn1.x509.TBSCertificate();
+2298 * tbsc.setByParam({version:3, serial:{hex:'1234...'},...});
+2299 */
+2300 this.setByParam = function(params) {
+2301 this.params = params;
+2302 };
+2303
+2304 /**
+2305 * get DERSequence for revokedCertificates<br/>
+2306 * @name getRevCertSequence
+2307 * @memberOf KJUR.asn1.x509.TBSCertList#
+2308 * @function
+2309 * @return {@link KJUR.asn1.DERSequence} of revokedCertificates
+2310 */
+2311 this.getRevCertSequence = function() {
+2312 var a = [];
+2313 var aRevCert = this.params.revcert;
+2314 for (var i = 0; i < aRevCert.length; i++) {
+2315 var aEntry = [
+2316 new _DERInteger(aRevCert[i].sn),
+2317 new _Time(aRevCert[i].date)
+2318 ];
+2319 if (aRevCert[i].ext != undefined) {
+2320 aEntry.push(new _Extensions(aRevCert[i].ext));
+2321 }
+2322 a.push(new _DERSequence({array: aEntry}));
+2323 }
+2324 return new _DERSequence({array: a});
+2325 };
+2326
+2327 this.getEncodedHex = function() {
+2328 var a = [];
+2329 var params = this.params;
+2330
+2331 if (params.version != undefined) {
+2332 var version = params.version - 1;
+2333 var obj = new _DERInteger({'int': version});
+2334 a.push(obj);
+2335 }
+2336
+2337 a.push(new _AlgorithmIdentifier({name: params.sigalg}));
+2338 a.push(new _X500Name(params.issuer));
+2339 a.push(new _Time(params.thisupdate));
+2340 if (params.nextupdate != undefined)
+2341 a.push(new _Time(params.nextupdate))
+2342 if (params.revcert != undefined) {
+2343 a.push(this.getRevCertSequence());
+2344 }
+2345 if (params.ext != undefined) {
+2346 var dExt = new _Extensions(params.ext);
+2347 a.push(new _DERTaggedObject({tag:'a0',
+2348 explicit:true,
+2349 obj:dExt}));
+2350 }
+2351
+2352 var seq = new _DERSequence({array: a});
+2353 return seq.getEncodedHex();
+2354 };
+2355
+2356 if (params !== undefined) this.setByParam(params);
+2357 };
+2358 YAHOO.lang.extend(KJUR.asn1.x509.TBSCertList, KJUR.asn1.ASN1Object);
+2359
+2360 /**
+2361 * ASN.1 CRLEntry structure class for CRL (DEPRECATED)<br/>
+2362 * @name KJUR.asn1.x509.CRLEntry
+2363 * @class ASN.1 CRLEntry structure class for CRL
+2364 * @param {Array} params JSON object for CRL entry parameter
+2365 * @extends KJUR.asn1.ASN1Object
+2366 * @since 1.0.3
+2367 * @see KJUR.asn1.x509.TBSCertList
+2368 * @deprecated since jsrsasign 9.1.0 asn1x509 2.1.0
+2369 * @description
+2370 * This class is to represent revokedCertificate in TBSCertList.
+2371 * However this is no more used by TBSCertList since
+2372 * jsrsasign 9.1.0. So this class have been deprecated in
+2373 * jsrsasign 9.1.0.
+2374 * <pre>
+2375 * revokedCertificates SEQUENCE OF SEQUENCE {
+2376 * userCertificate CertificateSerialNumber,
+2377 * revocationDate Time,
+2378 * crlEntryExtensions Extensions OPTIONAL
+2379 * -- if present, version MUST be v2 }
+2380 * </pre>
+2381 * @example
+2382 * var e = new KJUR.asn1.x509.CRLEntry({'time': {'str': '130514235959Z'}, 'sn': {'int': 234}});
+2383 */
+2384 KJUR.asn1.x509.CRLEntry = function(params) {
+2385 KJUR.asn1.x509.CRLEntry.superclass.constructor.call(this);
+2386 var sn = null,
+2387 time = null,
+2388 _KJUR = KJUR,
+2389 _KJUR_asn1 = _KJUR.asn1;
+2390
+2391 /**
+2392 * set DERInteger parameter for serial number of revoked certificate
+2393 * @name setCertSerial
+2394 * @memberOf KJUR.asn1.x509.CRLEntry
+2395 * @function
+2396 * @param {Array} intParam DERInteger parameter for certificate serial number
+2397 * @description
+2398 * @example
+2399 * entry.setCertSerial({'int': 3});
+2400 */
+2401 this.setCertSerial = function(intParam) {
+2402 this.sn = new _KJUR_asn1.DERInteger(intParam);
+2403 };
+2404
+2405 /**
+2406 * set Time parameter for revocation date
+2407 * @name setRevocationDate
+2408 * @memberOf KJUR.asn1.x509.CRLEntry
+2409 * @function
+2410 * @param {Array} timeParam Time parameter for revocation date
+2411 * @description
+2412 * @example
+2413 * entry.setRevocationDate({'str': '130508235959Z'});
+2414 */
+2415 this.setRevocationDate = function(timeParam) {
+2416 this.time = new _KJUR_asn1.x509.Time(timeParam);
+2417 };
+2418
+2419 this.getEncodedHex = function() {
+2420 var o = new _KJUR_asn1.DERSequence({"array": [this.sn, this.time]});
+2421 this.TLV = o.getEncodedHex();
+2422 return this.TLV;
+2423 };
+2424
+2425 if (params !== undefined) {
+2426 if (params.time !== undefined) {
+2427 this.setRevocationDate(params.time);
+2428 }
+2429 if (params.sn !== undefined) {
+2430 this.setCertSerial(params.sn);
+2431 }
+2432 }
+2433 };
+2434 YAHOO.lang.extend(KJUR.asn1.x509.CRLEntry, KJUR.asn1.ASN1Object);
+2435
+2436 /**
+2437 * CRLNumber CRL extension ASN.1 structure class<br/>
+2438 * @name KJUR.asn1.x509.CRLNumber
+2439 * @class CRLNumber CRL extension ASN.1 structure class
+2440 * @extends KJUR.asn1.x509.Extension
+2441 * @since jsrsasign 9.1.0 asn1x509 2.1.0
+2442 * @see KJUR.asn1.x509.TBSCertList
+2443 * @see KJUR.asn1.x509.Extensions
+2444 * @description
+2445 * This class represents ASN.1 structure for
+2446 * CRLNumber CRL extension defined in
+2447 * <a href="https://tools.ietf.org/html/rfc5280#section-5.2.3">
+2448 * RFC 5280 5.2.3</a>.
+2449 * <pre>
+2450 * id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 }
+2451 * CRLNumber ::= INTEGER (0..MAX)
+2452 * </pre>
+2453 * Constructor of this class may have following parameters:
+2454 * <ul>
+2455 * <li>{String}extname - name "cRLNumber". It is ignored in this class but
+2456 * required to use with {@link KJUR.asn1.x509.Extensions} class. (OPTION)</li>
+2457 * <li>{Object}num - CRLNumber value to specify
+2458 * {@link KJUR.asn1.DERInteger} parameter.</li>
+2459 * <li>{Boolean}critical - critical flag. Generally false and not specified
+2460 * in this class.(OPTION)</li>
+2461 * </ul>
+2462 *
+2463 * @example
+2464 * new KJUR.asn1.x509.CRLNumber({extname:'cRLNumber',
+2465 * num:{'int':147}})
+2466 */
+2467 KJUR.asn1.x509.CRLNumber = function(params) {
+2468 KJUR.asn1.x509.CRLNumber.superclass.constructor.call(this, params);
+2469 this.params = undefined;
+2470
+2471 this.getExtnValueHex = function() {
+2472 this.asn1ExtnValue = new KJUR.asn1.DERInteger(this.params.num);
+2473 return this.asn1ExtnValue.getEncodedHex();
+2474 };
+2475
+2476 this.oid = "2.5.29.20";
+2477 if (params != undefined) this.params = params;
+2478 };
+2479 YAHOO.lang.extend(KJUR.asn1.x509.CRLNumber, KJUR.asn1.x509.Extension);
+2480
+2481 /**
+2482 * CRLReason CRL entry extension ASN.1 structure class<br/>
+2483 * @name KJUR.asn1.x509.CRLReason
+2484 * @class CRLReason CRL entry extension ASN.1 structure class
+2485 * @extends KJUR.asn1.x509.Extension
+2486 * @since jsrsasign 9.1.0 asn1x509 2.1.0
+2487 * @see KJUR.asn1.x509.TBSCertList
+2488 * @see KJUR.asn1.x509.Extensions
+2489 * @description
+2490 * This class represents ASN.1 structure for
+2491 * CRLReason CRL entry extension defined in
+2492 * <a href="https://tools.ietf.org/html/rfc5280#section-5.3.1">
+2493 * RFC 5280 5.3.1</a>
+2494 * <pre>
+2495 * id-ce-cRLReasons OBJECT IDENTIFIER ::= { id-ce 21 }
+2496 * -- reasonCode ::= { CRLReason }
+2497 * CRLReason ::= ENUMERATED {
+2498 * unspecified (0),
+2499 * keyCompromise (1),
+2500 * cACompromise (2),
+2501 * affiliationChanged (3),
+2502 * superseded (4),
+2503 * cessationOfOperation (5),
+2504 * certificateHold (6),
+2505 * removeFromCRL (8),
+2506 * privilegeWithdrawn (9),
+2507 * aACompromise (10) }
+2508 * </pre>
+2509 * Constructor of this class may have following parameters:
+2510 * <ul>
+2511 * <li>{String}extname - name "cRLReason". It is ignored in this class but
+2512 * required to use with {@link KJUR.asn1.x509.Extensions} class. (OPTION)</li>
+2513 * <li>{Integer}code - reasonCode value</li>
+2514 * <li>{Boolean}critical - critical flag. Generally false and not specified
+2515 * in this class.(OPTION)</li>
+2516 * </ul>
+2517 *
+2518 * @example
+2519 * new KJUR.asn1.x509.CRLReason({extname:'cRLNumber',code:4})
+2520 */
+2521 KJUR.asn1.x509.CRLReason = function(params) {
+2522 KJUR.asn1.x509.CRLReason.superclass.constructor.call(this, params);
+2523 this.params = undefined;
+2524
+2525 this.getExtnValueHex = function() {
+2526 this.asn1ExtnValue = new KJUR.asn1.DEREnumerated(this.params.code);
+2527 return this.asn1ExtnValue.getEncodedHex();
+2528 };
+2529
+2530 this.oid = "2.5.29.21";
+2531 if (params != undefined) this.params = params;
+2532 };
+2533 YAHOO.lang.extend(KJUR.asn1.x509.CRLReason, KJUR.asn1.x509.Extension);
+2534
+2535 // === END CRL Related ===================================================
+2536
+2537 // === BEGIN OCSP Related ===================================================
+2538 /**
+2539 * Nonce OCSP extension ASN.1 structure class<br/>
+2540 * @name KJUR.asn1.x509.OCSPNonce
+2541 * @class Nonce OCSP extension ASN.1 structure class
+2542 * @extends KJUR.asn1.x509.Extension
+2543 * @since jsrsasign 9.1.6 asn1x509 2.1.2
+2544 * @param {Array} params JSON object for Nonce extension
+2545 * @see KJUR.asn1.ocsp.ResponseData
+2546 * @see KJUR.asn1.x509.Extensions
+2547 * @see X509#getExtOCSPNonce
+2548 * @description
+2549 * This class represents
+2550 * Nonce OCSP extension value defined in
+2551 * <a href="https://tools.ietf.org/html/rfc6960#section-4.4.1">
+2552 * RFC 6960 4.4.1</a> as JSON object.
+2553 * <pre>
+2554 * id-pkix-ocsp OBJECT IDENTIFIER ::= { id-ad-ocsp }
+2555 * id-pkix-ocsp-nonce OBJECT IDENTIFIER ::= { id-pkix-ocsp 2 }
+2556 * Nonce ::= OCTET STRING
+2557 * </pre>
+2558 * Constructor of this class may have following parameters:
+2559 * <ul>
+2560 * <li>{String}extname - name "ocspNonce". It is ignored in this class but
+2561 * required to use with {@link KJUR.asn1.x509.Extensions} class. (OPTION)</li>
+2562 * <li>{String}hex - hexadecimal string of nonce value</li>
+2563 * <li>{Number}int - integer of nonce value. "hex" or "int" needs to be
+2564 * specified.</li>
+2565 * <li>{Boolean}critical - critical flag. Generally false and not specified
+2566 * in this class.(OPTION)</li>
+2567 * </ul>
+2568 *
+2569 * @example
+2570 * new KJUR.asn1.x509.OCSPNonce({extname:'ocspNonce',
+2571 * hex: '12ab...'})
+2572 */
+2573 KJUR.asn1.x509.OCSPNonce = function(params) {
+2574 KJUR.asn1.x509.OCSPNonce.superclass.constructor.call(this, params);
+2575 this.params = undefined;
+2576
+2577 this.getExtnValueHex = function() {
+2578 this.asn1ExtnValue = new KJUR.asn1.DEROctetString(this.params);
+2579 return this.asn1ExtnValue.getEncodedHex();
+2580 };
+2581
+2582 this.oid = "1.3.6.1.5.5.7.48.1.2";
+2583 if (params != undefined) this.params = params;
+2584 };
+2585 YAHOO.lang.extend(KJUR.asn1.x509.OCSPNonce, KJUR.asn1.x509.Extension);
+2586
+2587 /**
+2588 * OCSPNoCheck certificate ASN.1 structure class<br/>
+2589 * @name KJUR.asn1.x509.OCSPNoCheck
+2590 * @class OCSPNoCheck extension ASN.1 structure class
+2591 * @extends KJUR.asn1.x509.Extension
+2592 * @since jsrsasign 9.1.6 asn1x509 2.1.2
+2593 * @param {Array} params JSON object for OCSPNoCheck extension
+2594 * @see KJUR.asn1.x509.Extensions
+2595 * @see X509#getExtOCSPNoCheck
+2596 * @description
+2597 * This class represents
+2598 * OCSPNoCheck extension value defined in
+2599 * <a href="https://tools.ietf.org/html/rfc6960#section-4.2.2.2.1">
+2600 * RFC 6960 4.2.2.2.1</a> as JSON object.
+2601 * <pre>
+2602 * id-pkix-ocsp-nocheck OBJECT IDENTIFIER ::= { id-pkix-ocsp 5 }
+2603 * </pre>
+2604 * Constructor of this class may have following parameters:
+2605 * <ul>
+2606 * <li>{String}extname - name "ocspNoCheck". It is ignored in this class but
+2607 * required to use with {@link KJUR.asn1.x509.Extensions} class. (OPTION)</li>
+2608 * <li>{Boolean}critical - critical flag. Generally false and not specified
+2609 * in this class.(OPTION)</li>
+2610 * </ul>
+2611 *
+2612 * @example
+2613 * new KJUR.asn1.x509.OCSPNonce({extname:'ocspNoCheck'})
+2614 */
+2615 KJUR.asn1.x509.OCSPNoCheck = function(params) {
+2616 KJUR.asn1.x509.OCSPNoCheck.superclass.constructor.call(this, params);
+2617 this.params = undefined;
+2618
+2619 this.getExtnValueHex = function() {
+2620 this.asn1ExtnValue = new KJUR.asn1.DERNull();
+2621 return this.asn1ExtnValue.getEncodedHex();
+2622 };
+2623
+2624 this.oid = "1.3.6.1.5.5.7.48.1.5";
+2625 if (params != undefined) this.params = params;
+2626 };
+2627 YAHOO.lang.extend(KJUR.asn1.x509.OCSPNoCheck, KJUR.asn1.x509.Extension);
+2628
+2629 // === END OCSP Related ===================================================
+2630
+2631 // === BEGIN Other X.509v3 Extensions========================================
+2632
+2633 /**
+2634 * AdobeTimeStamp X.509v3 extension ASN.1 encoder class<br/>
+2635 * @name KJUR.asn1.x509.AdobeTimeStamp
+2636 * @class AdobeTimeStamp X.509v3 extension ASN.1 encoder class
+2637 * @extends KJUR.asn1.x509.Extension
+2638 * @since jsrsasign 10.0.1 asn1x509 2.1.4
+2639 * @param {Array} params JSON object for AdobeTimeStamp extension parameter
+2640 * @see KJUR.asn1.x509.Extensions
+2641 * @see X509#getExtAdobeTimeStamp
+2642 * @description
+2643 * This class represents
+2644 * AdobeTimeStamp X.509v3 extension value defined in
+2645 * <a href="https://www.adobe.com/devnet-docs/acrobatetk/tools/DigSigDC/oids.html">
+2646 * Adobe site</a> as JSON object.
+2647 * <pre>
+2648 * adbe- OBJECT IDENTIFIER ::= { adbe(1.2.840.113583) acrobat(1) security(1) x509Ext(9) 1 }
+2649 * ::= SEQUENCE {
+2650 * version INTEGER { v1(1) }, -- extension version
+2651 * location GeneralName (In v1 GeneralName can be only uniformResourceIdentifier)
+2652 * requiresAuth boolean (default false), OPTIONAL }
+2653 * </pre>
+2654 * Constructor of this class may have following parameters:
+2655 * <ul>
+2656 * <li>{String}uri - RFC 3161 time stamp service URL</li>
+2657 * <li>{Boolean}reqauth - authentication required or not</li>
+2658 * </ul>
+2659 * </pre>
+2660 * <br/>
+2661 * NOTE: This extesion doesn't seem to have official name. This may be called as "pdfTimeStamp".
+2662 * @example
+2663 * new KJUR.asn1.x509.AdobeTimesStamp({
+2664 * uri: "http://tsa.example.com/",
+2665 * reqauth: true
+2666 * }
+2667 */
+2668 KJUR.asn1.x509.AdobeTimeStamp = function(params) {
+2669 KJUR.asn1.x509.AdobeTimeStamp.superclass.constructor.call(this, params);
+2670
+2671 var _KJUR = KJUR,
+2672 _KJUR_asn1 = _KJUR.asn1,
+2673 _DERInteger = _KJUR_asn1.DERInteger,
+2674 _DERBoolean = _KJUR_asn1.DERBoolean,
+2675 _DERSequence = _KJUR_asn1.DERSequence,
+2676 _GeneralName = _KJUR_asn1.x509.GeneralName;
+2677
+2678 this.params = null;
+2679
+2680 this.getExtnValueHex = function() {
+2681 var params = this.params;
+2682 var a = [new _DERInteger(1)];
+2683 a.push(new _GeneralName({uri: params.uri}));
+2684 if (params.reqauth != undefined) {
+2685 a.push(new _DERBoolean(params.reqauth));
+2686 }
+2687
+2688 this.asn1ExtnValue = new _DERSequence({array: a});
+2689 return this.asn1ExtnValue.getEncodedHex();
+2690 };
+2691
+2692 this.oid = "1.2.840.113583.1.1.9.1";
+2693 if (params !== undefined) this.setByParam(params);
+2694 };
+2695 YAHOO.lang.extend(KJUR.asn1.x509.AdobeTimeStamp, KJUR.asn1.x509.Extension);
+2696
+2697 // === END Other X.509v3 Extensions========================================
2698
-2699 // === BEGIN X500Name Related =================================================
-2700 /**
-2701 * X500Name ASN.1 structure class
-2702 * @name KJUR.asn1.x509.X500Name
-2703 * @class X500Name ASN.1 structure class
-2704 * @param {Array} params associative array of parameters (ex. {'str': '/C=US/O=a'})
-2705 * @extends KJUR.asn1.ASN1Object
-2706 * @see KJUR.asn1.x509.X500Name
-2707 * @see KJUR.asn1.x509.RDN
-2708 * @see KJUR.asn1.x509.AttributeTypeAndValue
-2709 * @see X509#getX500Name
-2710 * @description
-2711 * This class provides DistinguishedName ASN.1 class structure
-2712 * defined in <a href="https://tools.ietf.org/html/rfc2253#section-2">RFC 2253 section 2</a>.
-2713 * <blockquote><pre>
-2714 * DistinguishedName ::= RDNSequence
-2715 * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
-2716 * RelativeDistinguishedName ::= SET SIZE (1..MAX) OF
-2717 * AttributeTypeAndValue
-2718 * AttributeTypeAndValue ::= SEQUENCE {
-2719 * type AttributeType,
-2720 * value AttributeValue }
-2721 * </pre></blockquote>
-2722 * <br/>
-2723 * Argument for the constructor can be one of following parameters:
-2724 * <ul>
-2725 * <li>{Array}array - array of {@link KJUR.asn1.x509.RDN} parameter</li>
-2726 * <li>`String}str - string for distingish name in OpenSSL One line foramt (ex: /C=US/O=test/CN=test) See <a href="https://github.com/kjur/jsrsasign/wiki/NOTE-distinguished-name-representation-in-jsrsasign">this</a> in detail.</li>
-2727 * <li>{String}ldapstr - string for distinguish name in LDAP format (ex: CN=test,O=test,C=US)</li>
-2728 * <li>{String}hex - hexadecimal string for ASN.1 distinguish name structure</li>
-2729 * <li>{String}certissuer - issuer name in the specified PEM certificate</li>
-2730 * <li>{String}certsubject - subject name in the specified PEM certificate</li>
-2731 * <li>{String}rule - DirectoryString rule (ex. "prn" or "utf8")</li>
-2732 * </ul>
-2733 * <br/>
-2734 * NOTE1: The "array" and "rule" parameters have been supported
-2735 * since jsrsasign 9.0.0 asn1x509 2.0.0.
-2736 * <br/>
-2737 * NOTE2: Multi-valued RDN in "str" parameter have been
-2738 * supported since jsrsasign 6.2.1 asn1x509 1.0.17.
-2739 * @example
-2740 * // 1. construct with array
-2741 * new KJUR.asn1.x509.X500Name({array:[
-2742 * [{type:'C',value:'JP',ds:'prn'}],
-2743 * [{type:'O',value:'aaa',ds:'utf8'}, // multi-valued RDN
-2744 * {type:'CN',value:'bob@example.com',ds:'ia5'}]
-2745 * ]})
-2746 * // 2. construct with string
-2747 * new KJUR.asn1.x509.X500Name({str: "/C=US/ST=NY/L=Ballston Spa/STREET=915 Stillwater Ave"});
-2748 * new KJUR.asn1.x509.X500Name({str: "/CN=AAA/2.5.4.42=John/surname=Ray"});
-2749 * new KJUR.asn1.x509.X500Name({str: "/C=US/O=aaa+CN=contact@example.com"}); // multi valued
-2750 * // 3. construct by LDAP string
-2751 * new KJUR.asn1.x509.X500Name({ldapstr: "CN=foo@example.com,OU=bbb,C=US"});
-2752 * // 4. construct by ASN.1 hex string
-2753 * new KJUR.asn1.x509.X500Name({hex: "304c3120..."});
-2754 * // 5. construct by issuer of PEM certificate
-2755 * new KJUR.asn1.x509.X500Name({certsubject: "-----BEGIN CERT..."});
-2756 * // 6. construct by subject of PEM certificate
-2757 * new KJUR.asn1.x509.X500Name({certissuer: "-----BEGIN CERT..."});
-2758 * // 7. construct by object (DEPRECATED)
-2759 * new KJUR.asn1.x509.X500Name({C:"US",O:"aaa",CN:"http://example.com/"});
-2760 */
-2761 KJUR.asn1.x509.X500Name = function(params) {
-2762 KJUR.asn1.x509.X500Name.superclass.constructor.call(this);
-2763 this.asn1Array = [];
-2764 this.paramArray = [];
-2765 this.sRule = "utf8";
-2766 var _KJUR = KJUR,
-2767 _KJUR_asn1 = _KJUR.asn1,
-2768 _KJUR_asn1_x509 = _KJUR_asn1.x509,
-2769 _RDN = _KJUR_asn1_x509.RDN,
-2770 _pemtohex = pemtohex;
-2771
-2772 /**
-2773 * set DN by OpenSSL oneline distinguished name string<br/>
-2774 * @name setByString
-2775 * @memberOf KJUR.asn1.x509.X500Name#
-2776 * @function
-2777 * @param {String} dnStr distinguished name by string (ex. /C=US/O=aaa)
-2778 * @description
-2779 * Sets distinguished name by string.
-2780 * dnStr must be formatted as
-2781 * "/type0=value0/type1=value1/type2=value2...".
-2782 * No need to escape a slash in an attribute value.
-2783 * @example
-2784 * name = new KJUR.asn1.x509.X500Name();
-2785 * name.setByString("/C=US/O=aaa/OU=bbb/CN=foo@example.com");
-2786 * // no need to escape slash in an attribute value
-2787 * name.setByString("/C=US/O=aaa/CN=1980/12/31");
-2788 */
-2789 this.setByString = function(dnStr, sRule) {
-2790 if (sRule !== undefined) this.sRule = sRule;
-2791 var a = dnStr.split('/');
-2792 a.shift();
-2793
-2794 var a1 = [];
-2795 for (var i = 0; i < a.length; i++) {
-2796 if (a[i].match(/^[^=]+=.+$/)) {
-2797 a1.push(a[i]);
-2798 } else {
-2799 var lastidx = a1.length - 1;
-2800 a1[lastidx] = a1[lastidx] + "/" + a[i];
-2801 }
-2802 }
-2803
-2804 for (var i = 0; i < a1.length; i++) {
-2805 this.asn1Array.push(new _RDN({'str':a1[i], rule:this.sRule}));
-2806 }
-2807 };
-2808
-2809 /**
-2810 * set DN by LDAP(RFC 2253) distinguished name string<br/>
-2811 * @name setByLdapString
-2812 * @memberOf KJUR.asn1.x509.X500Name#
-2813 * @function
-2814 * @param {String} dnStr distinguished name by LDAP string (ex. O=aaa,C=US)
-2815 * @since jsrsasign 6.2.2 asn1x509 1.0.18
-2816 * @see {@link KJUR.asn1.x509.X500Name.ldapToCompat}
-2817 * @description
-2818 * @example
-2819 * name = new KJUR.asn1.x509.X500Name();
-2820 * name.setByLdapString("CN=foo@example.com,OU=bbb,O=aaa,C=US");
-2821 */
-2822 this.setByLdapString = function(dnStr, sRule) {
-2823 if (sRule !== undefined) this.sRule = sRule;
-2824 var compat = _KJUR_asn1_x509.X500Name.ldapToCompat(dnStr);
-2825 this.setByString(compat, sRule);
-2826 };
-2827
-2828 /**
-2829 * set DN by associative array<br/>
-2830 * @name setByObject
-2831 * @memberOf KJUR.asn1.x509.X500Name#
-2832 * @function
-2833 * @param {Array} dnObj associative array of DN (ex. {C: "US", O: "aaa"})
-2834 * @since jsrsasign 4.9. asn1x509 1.0.13
-2835 * @description
-2836 * @example
-2837 * name = new KJUR.asn1.x509.X500Name();
-2838 * name.setByObject({C: "US", O: "aaa", CN="http://example.com/"1});
-2839 */
-2840 this.setByObject = function(dnObj, sRule) {
-2841 if (sRule !== undefined) this.sRule = sRule;
-2842
-2843 // Get all the dnObject attributes and stuff them in the ASN.1 array.
-2844 for (var x in dnObj) {
-2845 if (dnObj.hasOwnProperty(x)) {
-2846 var newRDN = new _RDN({str: x + '=' + dnObj[x], rule: this.sRule});
-2847 // Initialize or push into the ANS1 array.
-2848 this.asn1Array ? this.asn1Array.push(newRDN)
-2849 : this.asn1Array = [newRDN];
-2850 }
-2851 }
-2852 };
-2853
-2854 this.setByParam = function(params) {
-2855 if (params.rule !== undefined) this.sRule = params.rule;
-2856
-2857 if (params.array !== undefined) {
-2858 this.paramArray = params.array;
-2859 } else {
-2860 if (params.str !== undefined) {
-2861 this.setByString(params.str);
-2862 } else if (params.ldapstr !== undefined) {
-2863 this.setByLdapString(params.ldapstr);
-2864 } else if (params.hex !== undefined) {
-2865 this.hTLV = params.hex;
-2866 } else if (params.certissuer !== undefined) {
-2867 var x = new X509();
-2868 x.readCertPEM(params.certissuer);
-2869 this.hTLV = x.getIssuerHex();
-2870 } else if (params.certsubject !== undefined) {
-2871 var x = new X509();
-2872 x.readCertPEM(params.certsubject);
-2873 this.hTLV = x.getSubjectHex();
-2874 // If params is an object, then set the ASN1 array
-2875 // just using the object attributes.
-2876 // This is nice for fields that have lots of special
-2877 // characters (i.e. CN: 'https://www.github.com/kjur//').
-2878 } else if (typeof params === "object" &&
-2879 params.certsubject === undefined &&
-2880 params.certissuer === undefined) {
-2881 this.setByObject(params);
-2882 }
-2883 }
-2884 }
-2885
-2886 this.getEncodedHex = function() {
-2887 if (typeof this.hTLV == "string") return this.hTLV;
-2888
-2889 if (this.asn1Array.length == 0 && this.paramArray.length > 0) {
-2890 for (var i = 0; i < this.paramArray.length; i++) {
-2891 var param = {array: this.paramArray[i]};
-2892 if (this.sRule != "utf8") param.rule = this.sRule;
-2893 var asn1RDN = new _RDN(param);
-2894 this.asn1Array.push(asn1RDN);
-2895 }
-2896 }
-2897
-2898 var o = new _KJUR_asn1.DERSequence({"array": this.asn1Array});
-2899 this.hTLV = o.getEncodedHex();
-2900 return this.hTLV;
-2901 };
-2902
-2903 if (params !== undefined) this.setByParam(params);
-2904 };
-2905 YAHOO.lang.extend(KJUR.asn1.x509.X500Name, KJUR.asn1.ASN1Object);
-2906
-2907 /**
-2908 * convert OpenSSL compat distinguished name format string to LDAP(RFC 2253) format<br/>
-2909 * @name compatToLDAP
-2910 * @memberOf KJUR.asn1.x509.X500Name
-2911 * @function
-2912 * @param {String} s distinguished name string in OpenSSL oneline compat (ex. /C=US/O=test)
-2913 * @return {String} distinguished name string in LDAP(RFC 2253) format (ex. O=test,C=US)
-2914 * @since jsrsasign 8.0.19 asn1x509 1.1.20
-2915 * @description
-2916 * This static method converts a distinguished name string in OpenSSL compat
-2917 * format to LDAP(RFC 2253) format.
-2918 * @see <a href="https://github.com/kjur/jsrsasign/wiki/NOTE-distinguished-name-representation-in-jsrsasign">jsrsasign wiki: distinguished name string difference between OpenSSL compat and LDAP(RFC 2253)</a>
-2919 * @see <a href="https://www.openssl.org/docs/man1.0.2/man1/openssl-x509.html#NAME-OPTIONS">OpenSSL x509 command manual - NAME OPTIONS</a>
-2920 * @example
-2921 * KJUR.asn1.x509.X500Name.compatToLDAP("/C=US/O=test") → 'O=test,C=US'
-2922 * KJUR.asn1.x509.X500Name.compatToLDAP("/C=US/O=a,a") → 'O=a\,a,C=US'
-2923 */
-2924 KJUR.asn1.x509.X500Name.compatToLDAP = function(s) {
-2925 if (s.substr(0, 1) !== "/") throw "malformed input";
-2926
-2927 var result = "";
-2928 s = s.substr(1);
-2929
-2930 var a = s.split("/");
-2931 a.reverse();
-2932 a = a.map(function(s) {return s.replace(/,/, "\\,")});
-2933
-2934 return a.join(",");
-2935 };
-2936
-2937 /**
-2938 * convert OpenSSL compat distinguished name format string to LDAP(RFC 2253) format (DEPRECATED)<br/>
-2939 * @name onelineToLDAP
-2940 * @memberOf KJUR.asn1.x509.X500Name
-2941 * @function
-2942 * @param {String} s distinguished name string in OpenSSL compat format (ex. /C=US/O=test)
-2943 * @return {String} distinguished name string in LDAP(RFC 2253) format (ex. O=test,C=US)
-2944 * @since jsrsasign 6.2.2 asn1x509 1.0.18
-2945 * @see KJUR.asn1.x509.X500Name.compatToLDAP
-2946 * @description
-2947 * This method is deprecated. Please use
-2948 * {@link KJUR.asn1.x509.X500Name.compatToLDAP} instead.
-2949 */
-2950 KJUR.asn1.x509.X500Name.onelineToLDAP = function(s) {
-2951 return KJUR.asn1.x509.X500Name.compatToLDAP(s);
-2952 }
-2953
-2954 /**
-2955 * convert LDAP(RFC 2253) distinguished name format string to OpenSSL compat format<br/>
-2956 * @name ldapToCompat
-2957 * @memberOf KJUR.asn1.x509.X500Name
-2958 * @function
-2959 * @param {String} s distinguished name string in LDAP(RFC 2253) format (ex. O=test,C=US)
-2960 * @return {String} distinguished name string in OpenSSL compat format (ex. /C=US/O=test)
-2961 * @since jsrsasign 8.0.19 asn1x509 1.1.10
-2962 * @description
-2963 * This static method converts a distinguished name string in
-2964 * LDAP(RFC 2253) format to OpenSSL compat format.
-2965 * @see <a href="https://github.com/kjur/jsrsasign/wiki/NOTE-distinguished-name-representation-in-jsrsasign">jsrsasign wiki: distinguished name string difference between OpenSSL compat and LDAP(RFC 2253)</a>
-2966 * @example
-2967 * KJUR.asn1.x509.X500Name.ldapToCompat('O=test,C=US') → '/C=US/O=test'
-2968 * KJUR.asn1.x509.X500Name.ldapToCompat('O=a\,a,C=US') → '/C=US/O=a,a'
-2969 * KJUR.asn1.x509.X500Name.ldapToCompat('O=a/a,C=US') → '/C=US/O=a\/a'
-2970 */
-2971 KJUR.asn1.x509.X500Name.ldapToCompat = function(s) {
-2972 var a = s.split(",");
-2973
-2974 // join \,
-2975 var isBSbefore = false;
-2976 var a2 = [];
-2977 for (var i = 0; a.length > 0; i++) {
-2978 var item = a.shift();
-2979 //console.log("item=" + item);
-2980
-2981 if (isBSbefore === true) {
-2982 var a2last = a2.pop();
-2983 var newitem = (a2last + "," + item).replace(/\\,/g, ",");
-2984 a2.push(newitem);
-2985 isBSbefore = false;
-2986 } else {
-2987 a2.push(item);
-2988 }
-2989
-2990 if (item.substr(-1, 1) === "\\") isBSbefore = true;
-2991 }
-2992
-2993 a2 = a2.map(function(s) {return s.replace("/", "\\/")});
-2994 a2.reverse();
-2995 return "/" + a2.join("/");
-2996 };
-2997
-2998 /**
-2999 * convert LDAP(RFC 2253) distinguished name format string to OpenSSL compat format (DEPRECATED)<br/>
-3000 * @name ldapToOneline
-3001 * @memberOf KJUR.asn1.x509.X500Name
-3002 * @function
-3003 * @param {String} s distinguished name string in LDAP(RFC 2253) format (ex. O=test,C=US)
-3004 * @return {String} distinguished name string in OpenSSL compat format (ex. /C=US/O=test)
-3005 * @since jsrsasign 6.2.2 asn1x509 1.0.18
-3006 * @description
-3007 * This method is deprecated. Please use
-3008 * {@link KJUR.asn1.x509.X500Name.ldapToCompat} instead.
-3009 */
-3010 KJUR.asn1.x509.X500Name.ldapToOneline = function(s) {
-3011 return KJUR.asn1.x509.X500Name.ldapToCompat(s);
-3012 };
-3013
-3014 /**
-3015 * RDN (Relative Distinguished Name) ASN.1 structure class
-3016 * @name KJUR.asn1.x509.RDN
-3017 * @class RDN (Relative Distinguished Name) ASN.1 structure class
-3018 * @param {Array} params associative array of parameters (ex. {'str': 'C=US'})
-3019 * @extends KJUR.asn1.ASN1Object
-3020 * @see KJUR.asn1.x509.X500Name
-3021 * @see KJUR.asn1.x509.RDN
-3022 * @see KJUR.asn1.x509.AttributeTypeAndValue
-3023 * @description
-3024 * This class provides RelativeDistinguishedName ASN.1 class structure
-3025 * defined in <a href="https://tools.ietf.org/html/rfc2253#section-2">RFC 2253 section 2</a>.
-3026 * <blockquote><pre>
-3027 * RelativeDistinguishedName ::= SET SIZE (1..MAX) OF
-3028 * AttributeTypeAndValue
-3029 *
-3030 * AttributeTypeAndValue ::= SEQUENCE {
-3031 * type AttributeType,
-3032 * value AttributeValue }
-3033 * </pre></blockquote>
-3034 * <br/>
-3035 * NOTE1: The "array" and "rule" parameters have been supported
-3036 * since jsrsasign 9.0.0 asn1x509 2.0.0.
-3037 * <br/>
-3038 * NOTE2: Multi-valued RDN in "str" parameter have been
-3039 * supported since jsrsasign 6.2.1 asn1x509 1.0.17.
-3040 * @example
-3041 * new KJUR.asn1.x509.RDN({array: [ // multi-valued
-3042 * {type:"CN",value:"Bob",ds:"prn"},
-3043 * {type:"CN",value:"bob@example.com", ds:"ia5"}
-3044 * ]});
-3045 * new KJUR.asn1.x509.RDN({str: "CN=test"});
-3046 * new KJUR.asn1.x509.RDN({str: "O=a+O=bb+O=c"}); // multi-valued
-3047 * new KJUR.asn1.x509.RDN({str: "O=a+O=b\\+b+O=c"}); // plus escaped
-3048 * new KJUR.asn1.x509.RDN({str: "O=a+O=\"b+b\"+O=c"}); // double quoted
-3049 */
-3050 KJUR.asn1.x509.RDN = function(params) {
-3051 KJUR.asn1.x509.RDN.superclass.constructor.call(this);
-3052 this.asn1Array = [];
-3053 this.paramArray = [];
-3054 this.sRule = "utf8"; // DEFAULT "utf8"
-3055 var _AttributeTypeAndValue = KJUR.asn1.x509.AttributeTypeAndValue;
-3056
-3057 this.setByParam = function(params) {
-3058 if (params.rule !== undefined) this.sRule = params.rule;
-3059 if (params.str !== undefined) {
-3060 this.addByMultiValuedString(params.str);
-3061 }
-3062 if (params.array !== undefined) this.paramArray = params.array;
-3063 };
-3064
-3065 /**
-3066 * add one AttributeTypeAndValue by string<br/>
-3067 * @name addByString
-3068 * @memberOf KJUR.asn1.x509.RDN#
-3069 * @function
-3070 * @param {String} s string of AttributeTypeAndValue
-3071 * @return {Object} unspecified
-3072 * @description
-3073 * This method add one AttributeTypeAndValue to RDN object.
-3074 * @example
-3075 * rdn = new KJUR.asn1.x509.RDN();
-3076 * rdn.addByString("CN=john");
-3077 * rdn.addByString("serialNumber=1234"); // for multi-valued RDN
-3078 */
-3079 this.addByString = function(s) {
-3080 this.asn1Array.push(new KJUR.asn1.x509.AttributeTypeAndValue({'str': s, rule: this.sRule}));
-3081 };
-3082
-3083 /**
-3084 * add one AttributeTypeAndValue by multi-valued string<br/>
-3085 * @name addByMultiValuedString
-3086 * @memberOf KJUR.asn1.x509.RDN#
-3087 * @function
-3088 * @param {String} s string of multi-valued RDN
-3089 * @return {Object} unspecified
-3090 * @since jsrsasign 6.2.1 asn1x509 1.0.17
-3091 * @description
-3092 * This method add multi-valued RDN to RDN object.
-3093 * @example
-3094 * rdn = new KJUR.asn1.x509.RDN();
-3095 * rdn.addByMultiValuedString("CN=john+O=test");
-3096 * rdn.addByMultiValuedString("O=a+O=b\+b\+b+O=c"); // multi-valued RDN with quoted plus
-3097 * rdn.addByMultiValuedString("O=a+O=\"b+b+b\"+O=c"); // multi-valued RDN with quoted quotation
-3098 */
-3099 this.addByMultiValuedString = function(s) {
-3100 var a = KJUR.asn1.x509.RDN.parseString(s);
-3101 for (var i = 0; i < a.length; i++) {
-3102 this.addByString(a[i]);
-3103 }
-3104 };
-3105
-3106 this.getEncodedHex = function() {
-3107 if (this.asn1Array.length == 0 && this.paramArray.length > 0) {
-3108 for (var i = 0; i < this.paramArray.length; i++) {
-3109 var param = this.paramArray[i];
-3110 if (param.rule !== undefined &&
-3111 this.sRule != "utf8") {
-3112 param.rule = this.sRule;
-3113 }
-3114 //alert(JSON.stringify(param));
-3115 var asn1ATV = new _AttributeTypeAndValue(param);
-3116 this.asn1Array.push(asn1ATV);
-3117 }
-3118 }
-3119 var o = new KJUR.asn1.DERSet({"array": this.asn1Array});
-3120 this.TLV = o.getEncodedHex();
-3121 return this.TLV;
-3122 };
-3123
-3124 if (params !== undefined) {
-3125 this.setByParam(params);
-3126 }
-3127 };
-3128 YAHOO.lang.extend(KJUR.asn1.x509.RDN, KJUR.asn1.ASN1Object);
-3129
-3130 /**
-3131 * parse multi-valued RDN string and split into array of 'AttributeTypeAndValue'<br/>
-3132 * @name parseString
-3133 * @memberOf KJUR.asn1.x509.RDN
-3134 * @function
-3135 * @param {String} s multi-valued string of RDN
-3136 * @return {Array} array of string of AttributeTypeAndValue
-3137 * @since jsrsasign 6.2.1 asn1x509 1.0.17
-3138 * @description
-3139 * This static method parses multi-valued RDN string and split into
-3140 * array of AttributeTypeAndValue.
-3141 * @example
-3142 * KJUR.asn1.x509.RDN.parseString("CN=john") → ["CN=john"]
-3143 * KJUR.asn1.x509.RDN.parseString("CN=john+OU=test") → ["CN=john", "OU=test"]
-3144 * KJUR.asn1.x509.RDN.parseString('CN="jo+hn"+OU=test') → ["CN=jo+hn", "OU=test"]
-3145 * KJUR.asn1.x509.RDN.parseString('CN=jo\+hn+OU=test') → ["CN=jo+hn", "OU=test"]
-3146 * KJUR.asn1.x509.RDN.parseString("CN=john+OU=test+OU=t1") → ["CN=john", "OU=test", "OU=t1"]
-3147 */
-3148 KJUR.asn1.x509.RDN.parseString = function(s) {
-3149 var a = s.split(/\+/);
-3150
-3151 // join \+
-3152 var isBSbefore = false;
-3153 var a2 = [];
-3154 for (var i = 0; a.length > 0; i++) {
-3155 var item = a.shift();
-3156 //console.log("item=" + item);
-3157
-3158 if (isBSbefore === true) {
-3159 var a2last = a2.pop();
-3160 var newitem = (a2last + "+" + item).replace(/\\\+/g, "+");
-3161 a2.push(newitem);
-3162 isBSbefore = false;
-3163 } else {
-3164 a2.push(item);
-3165 }
-3166
-3167 if (item.substr(-1, 1) === "\\") isBSbefore = true;
-3168 }
-3169
-3170 // join quote
-3171 var beginQuote = false;
-3172 var a3 = [];
-3173 for (var i = 0; a2.length > 0; i++) {
-3174 var item = a2.shift();
-3175
-3176 if (beginQuote === true) {
-3177 var a3last = a3.pop();
-3178 if (item.match(/"$/)) {
-3179 var newitem = (a3last + "+" + item).replace(/^([^=]+)="(.*)"$/, "$1=$2");
-3180 a3.push(newitem);
-3181 beginQuote = false;
-3182 } else {
-3183 a3.push(a3last + "+" + item);
-3184 }
-3185 } else {
-3186 a3.push(item);
-3187 }
-3188
-3189 if (item.match(/^[^=]+="/)) {
-3190 //console.log(i + "=" + item);
-3191 beginQuote = true;
-3192 }
-3193 }
-3194 return a3;
-3195 };
-3196
-3197 /**
-3198 * AttributeTypeAndValue ASN.1 structure class
-3199 * @name KJUR.asn1.x509.AttributeTypeAndValue
-3200 * @class AttributeTypeAndValue ASN.1 structure class
-3201 * @param {Array} params JSON object for parameters (ex. {str: 'C=US'})
-3202 * @extends KJUR.asn1.ASN1Object
-3203 * @see KJUR.asn1.x509.X500Name
-3204 * @see KJUR.asn1.x509.RDN
-3205 * @see KJUR.asn1.x509.AttributeTypeAndValue
-3206 * @see X509#getAttrTypeAndValue
-3207 * @description
-3208 * This class generates AttributeTypeAndValue defined in
-3209 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.4">
-3210 * RFC 5280 4.1.2.4</a>.
-3211 * <pre>
-3212 * AttributeTypeAndValue ::= SEQUENCE {
-3213 * type AttributeType,
-3214 * value AttributeValue }
-3215 * AttributeType ::= OBJECT IDENTIFIER
-3216 * AttributeValue ::= ANY -- DEFINED BY AttributeType
-3217 * </pre>
-3218 * The constructor argument can have following parameters:
-3219 * <ul>
-3220 * <li>{String}type - AttributeType name or OID(ex. C,O,CN)</li>
-3221 * <li>{String}value - raw string of ASN.1 value of AttributeValue</li>
-3222 * <li>{String}ds - DirectoryString type of AttributeValue</li>
-3223 * <li>{String}rule - DirectoryString type rule (ex. "prn" or "utf8")
-3224 * set DirectoryString type automatically when "ds" not specified.</li>
-3225 * <li>{String}str - AttributeTypeAndVale string (ex. "C=US").
-3226 * When type and value don't exists,
-3227 * this "str" will be converted to "type" and "value".
-3228 * </li>
-3229 * </ul>
-3230 * <br
-3231 * NOTE: Parameters "type", "value,", "ds" and "rule" have
-3232 * been supported since jsrsasign 9.0.0 asn1x509 2.0.0.
-3233 * @example
-3234 * new KJUR.asn1.x509.AttributeTypeAndValue({type:'C',value:'US',ds:'prn'})
-3235 * new KJUR.asn1.x509.AttributeTypeAndValue({type:'givenName',value:'John',ds:'prn'})
-3236 * new KJUR.asn1.x509.AttributeTypeAndValue({type:'2.5.4.9',value:'71 Bowman St',ds:'prn'})
-3237 * new KJUR.asn1.x509.AttributeTypeAndValue({str:'O=T1'})
-3238 * new KJUR.asn1.x509.AttributeTypeAndValue({str:'streetAddress=71 Bowman St'})
-3239 * new KJUR.asn1.x509.AttributeTypeAndValue({str:'O=T1',rule='prn'})
-3240 * new KJUR.asn1.x509.AttributeTypeAndValue({str:'O=T1',rule='utf8'})
-3241 */
-3242 KJUR.asn1.x509.AttributeTypeAndValue = function(params) {
-3243 KJUR.asn1.x509.AttributeTypeAndValue.superclass.constructor.call(this);
-3244 this.sRule = "utf8";
-3245 this.sType = null;
-3246 this.sValue = null;
-3247 this.dsType = null;
-3248 var _KJUR = KJUR,
-3249 _KJUR_asn1 = _KJUR.asn1,
-3250 _DERSequence = _KJUR_asn1.DERSequence,
-3251 _DERUTF8String = _KJUR_asn1.DERUTF8String,
-3252 _DERPrintableString = _KJUR_asn1.DERPrintableString,
-3253 _DERTeletexString = _KJUR_asn1.DERTeletexString,
-3254 _DERIA5String = _KJUR_asn1.DERIA5String,
-3255 _DERVisibleString = _KJUR_asn1.DERVisibleString,
-3256 _DERBMPString = _KJUR_asn1.DERBMPString,
-3257 _isMail = _KJUR.lang.String.isMail,
-3258 _isPrintable = _KJUR.lang.String.isPrintable;
-3259
-3260 this.setByParam = function(params) {
-3261 if (params.rule !== undefined) this.sRule = params.rule;
-3262 if (params.ds !== undefined) this.dsType = params.ds;
-3263
-3264 if (params.value === undefined &&
-3265 params.str !== undefined) {
-3266 var str = params.str;
-3267 var matchResult = str.match(/^([^=]+)=(.+)$/);
-3268 if (matchResult) {
-3269 this.sType = matchResult[1];
-3270 this.sValue = matchResult[2];
-3271 } else {
-3272 throw new Error("malformed attrTypeAndValueStr: " +
-3273 attrTypeAndValueStr);
-3274 }
-3275
-3276 //this.setByString(params.str);
-3277 } else {
-3278 this.sType = params.type;
-3279 this.sValue = params.value;
-3280 }
-3281 };
-3282
-3283 /*
-3284 * @deprecated
-3285 */
-3286 this.setByString = function(sTypeValue, sRule) {
-3287 if (sRule !== undefined) this.sRule = sRule;
-3288 var matchResult = sTypeValue.match(/^([^=]+)=(.+)$/);
-3289 if (matchResult) {
-3290 this.setByAttrTypeAndValueStr(matchResult[1], matchResult[2]);
-3291 } else {
-3292 throw new Error("malformed attrTypeAndValueStr: " +
-3293 attrTypeAndValueStr);
-3294 }
-3295 };
-3296
-3297 this._getDsType = function() {
-3298 var sType = this.sType;
-3299 var sValue = this.sValue;
-3300 var sRule = this.sRule;
-3301
-3302 if (sRule === "prn") {
-3303 if (sType == "CN" && _isMail(sValue)) return "ia5";
-3304 if (_isPrintable(sValue)) return "prn";
-3305 return "utf8";
-3306 } else if (sRule === "utf8") {
-3307 if (sType == "CN" && _isMail(sValue)) return "ia5";
-3308 if (sType == "C") return "prn";
-3309 return "utf8";
-3310 }
-3311 return "utf8"; // default
-3312 };
-3313
-3314 this.setByAttrTypeAndValueStr = function(sType, sValue, sRule) {
-3315 if (sRule !== undefined) this.sRule = sRule;
-3316 this.sType = sType;
-3317 this.sValue = sValue;
-3318 };
-3319
-3320 this.getValueObj = function(dsType, valueStr) {
-3321 if (dsType == "utf8") return new _DERUTF8String({"str": valueStr});
-3322 if (dsType == "prn") return new _DERPrintableString({"str": valueStr});
-3323 if (dsType == "tel") return new _DERTeletexString({"str": valueStr});
-3324 if (dsType == "ia5") return new _DERIA5String({"str": valueStr});
-3325 if (dsType == "vis") return new _DERVisibleString({"str": valueStr});
-3326 if (dsType == "bmp") return new _DERBMPString({"str": valueStr});
-3327 throw new Error("unsupported directory string type: type=" +
-3328 dsType + " value=" + valueStr);
-3329 };
-3330
-3331 this.getEncodedHex = function() {
-3332 if (this.dsType == null) this.dsType = this._getDsType();
-3333 var asn1Type = KJUR.asn1.x509.OID.atype2obj(this.sType);
-3334 var asn1Value = this.getValueObj(this.dsType, this.sValue);
-3335 var o = new _DERSequence({"array": [asn1Type, asn1Value]});
-3336 this.TLV = o.getEncodedHex();
-3337 return this.TLV;
-3338 };
-3339
-3340 if (params !== undefined) {
-3341 this.setByParam(params);
-3342 }
-3343 };
-3344 YAHOO.lang.extend(KJUR.asn1.x509.AttributeTypeAndValue, KJUR.asn1.ASN1Object);
-3345
-3346 // === END X500Name Related =================================================
-3347
-3348 // === BEGIN Other ASN1 structure class ======================================
-3349
-3350 /**
-3351 * SubjectPublicKeyInfo ASN.1 structure class
-3352 * @name KJUR.asn1.x509.SubjectPublicKeyInfo
-3353 * @class SubjectPublicKeyInfo ASN.1 structure class
-3354 * @param {Object} params parameter for subject public key
-3355 * @extends KJUR.asn1.ASN1Object
-3356 * @description
-3357 * <br/>
-3358 * As for argument 'params' for constructor, you can specify one of
-3359 * following properties:
-3360 * <ul>
-3361 * <li>{@link RSAKey} object</li>
-3362 * <li>{@link KJUR.crypto.ECDSA} object</li>
-3363 * <li>{@link KJUR.crypto.DSA} object</li>
-3364 * </ul>
-3365 * NOTE1: 'params' can be omitted.<br/>
-3366 * NOTE2: DSA/ECDSA key object is also supported since asn1x509 1.0.6.<br/>
-3367 * <h4>EXAMPLE</h4>
-3368 * @example
-3369 * spki = new KJUR.asn1.x509.SubjectPublicKeyInfo(RSAKey_object);
-3370 * spki = new KJUR.asn1.x509.SubjectPublicKeyInfo(KJURcryptoECDSA_object);
-3371 * spki = new KJUR.asn1.x509.SubjectPublicKeyInfo(KJURcryptoDSA_object);
-3372 */
-3373 KJUR.asn1.x509.SubjectPublicKeyInfo = function(params) {
-3374 KJUR.asn1.x509.SubjectPublicKeyInfo.superclass.constructor.call(this);
-3375 var asn1AlgId = null,
-3376 asn1SubjPKey = null,
-3377 _KJUR = KJUR,
-3378 _KJUR_asn1 = _KJUR.asn1,
-3379 _DERInteger = _KJUR_asn1.DERInteger,
-3380 _DERBitString = _KJUR_asn1.DERBitString,
-3381 _DERObjectIdentifier = _KJUR_asn1.DERObjectIdentifier,
-3382 _DERSequence = _KJUR_asn1.DERSequence,
-3383 _newObject = _KJUR_asn1.ASN1Util.newObject,
-3384 _KJUR_asn1_x509 = _KJUR_asn1.x509,
-3385 _AlgorithmIdentifier = _KJUR_asn1_x509.AlgorithmIdentifier,
-3386 _KJUR_crypto = _KJUR.crypto,
-3387 _KJUR_crypto_ECDSA = _KJUR_crypto.ECDSA,
-3388 _KJUR_crypto_DSA = _KJUR_crypto.DSA;
-3389
-3390 /*
-3391 * @since asn1x509 1.0.7
-3392 */
-3393 this.getASN1Object = function() {
-3394 if (this.asn1AlgId == null || this.asn1SubjPKey == null)
-3395 throw "algId and/or subjPubKey not set";
-3396 var o = new _DERSequence({'array':
-3397 [this.asn1AlgId, this.asn1SubjPKey]});
-3398 return o;
-3399 };
-3400
-3401 this.getEncodedHex = function() {
-3402 var o = this.getASN1Object();
-3403 this.hTLV = o.getEncodedHex();
-3404 return this.hTLV;
-3405 };
-3406
-3407 /**
-3408 * @name setPubKey
-3409 * @memberOf KJUR.asn1.x509.SubjectPublicKeyInfo#
-3410 * @function
-3411 * @param {Object} {@link RSAKey}, {@link KJUR.crypto.ECDSA} or {@link KJUR.crypto.DSA} object
-3412 * @since jsrsasign 8.0.0 asn1x509 1.1.0
-3413 * @description
-3414 * @example
-3415 * spki = new KJUR.asn1.x509.SubjectPublicKeyInfo();
-3416 * pubKey = KEYUTIL.getKey(PKCS8PUBKEYPEM);
-3417 * spki.setPubKey(pubKey);
-3418 */
-3419 this.setPubKey = function(key) {
-3420 try {
-3421 if (key instanceof RSAKey) {
-3422 var asn1RsaPub = _newObject({
-3423 'seq': [{'int': {'bigint': key.n}}, {'int': {'int': key.e}}]
-3424 });
-3425 var rsaKeyHex = asn1RsaPub.getEncodedHex();
-3426 this.asn1AlgId = new _AlgorithmIdentifier({'name':'rsaEncryption'});
-3427 this.asn1SubjPKey = new _DERBitString({'hex':'00'+rsaKeyHex});
-3428 }
-3429 } catch(ex) {};
-3430
-3431 try {
-3432 if (key instanceof KJUR.crypto.ECDSA) {
-3433 var asn1Params = new _DERObjectIdentifier({'name': key.curveName});
-3434 this.asn1AlgId =
-3435 new _AlgorithmIdentifier({'name': 'ecPublicKey',
-3436 'asn1params': asn1Params});
-3437 this.asn1SubjPKey = new _DERBitString({'hex': '00' + key.pubKeyHex});
-3438 }
-3439 } catch(ex) {};
-3440
-3441 try {
-3442 if (key instanceof KJUR.crypto.DSA) {
-3443 var asn1Params = new _newObject({
-3444 'seq': [{'int': {'bigint': key.p}},
-3445 {'int': {'bigint': key.q}},
-3446 {'int': {'bigint': key.g}}]
-3447 });
-3448 this.asn1AlgId =
-3449 new _AlgorithmIdentifier({'name': 'dsa',
-3450 'asn1params': asn1Params});
-3451 var pubInt = new _DERInteger({'bigint': key.y});
-3452 this.asn1SubjPKey =
-3453 new _DERBitString({'hex': '00' + pubInt.getEncodedHex()});
-3454 }
-3455 } catch(ex) {};
-3456 };
-3457
-3458 if (params !== undefined) {
-3459 this.setPubKey(params);
-3460 }
-3461 };
-3462 YAHOO.lang.extend(KJUR.asn1.x509.SubjectPublicKeyInfo, KJUR.asn1.ASN1Object);
-3463
-3464 /**
-3465 * Time ASN.1 structure class<br/>
-3466 * @name KJUR.asn1.x509.Time
-3467 * @class Time ASN.1 structure class
-3468 * @param {Array} params associative array of parameters (ex. {'str': '130508235959Z'})
-3469 * @extends KJUR.asn1.ASN1Object
-3470 * @see KJUR.asn1.DERUTCTime
-3471 * @see KJUR.asn1.DERGeneralizedTime
-3472 * @description
-3473 * This class represents Time ASN.1 structure defined in
-3474 * <a href="https://tools.ietf.org/html/rfc5280">RFC 5280</a>
-3475 * <pre>
-3476 * Time ::= CHOICE {
-3477 * utcTime UTCTime,
-3478 * generalTime GeneralizedTime }
-3479 * </pre>
-3480 *
-3481 * @example
-3482 * var t1 = new KJUR.asn1.x509.Time{'str': '130508235959Z'} // UTCTime by default
-3483 * var t2 = new KJUR.asn1.x509.Time{'type': 'gen', 'str': '20130508235959Z'} // GeneralizedTime
-3484 */
-3485 KJUR.asn1.x509.Time = function(params) {
-3486 KJUR.asn1.x509.Time.superclass.constructor.call(this);
-3487 var type = null,
-3488 timeParams = null,
-3489 _KJUR = KJUR,
-3490 _KJUR_asn1 = _KJUR.asn1,
-3491 _DERUTCTime = _KJUR_asn1.DERUTCTime,
-3492 _DERGeneralizedTime = _KJUR_asn1.DERGeneralizedTime;
-3493
-3494 this.setTimeParams = function(timeParams) {
-3495 this.timeParams = timeParams;
-3496 }
-3497
-3498 this.getEncodedHex = function() {
-3499 var o = null;
-3500
-3501 if (this.timeParams != null) {
-3502 if (this.type == "utc") {
-3503 o = new _DERUTCTime(this.timeParams);
-3504 } else {
-3505 o = new _DERGeneralizedTime(this.timeParams);
-3506 }
-3507 } else {
-3508 if (this.type == "utc") {
-3509 o = new _DERUTCTime();
-3510 } else {
-3511 o = new _DERGeneralizedTime();
-3512 }
-3513 }
-3514 this.TLV = o.getEncodedHex();
-3515 return this.TLV;
-3516 };
-3517
-3518 this.type = "utc";
-3519 if (params !== undefined) {
-3520 if (params.type !== undefined) {
-3521 this.type = params.type;
-3522 } else {
-3523 if (params.str !== undefined) {
-3524 if (params.str.match(/^[0-9]{12}Z$/)) this.type = "utc";
-3525 if (params.str.match(/^[0-9]{14}Z$/)) this.type = "gen";
-3526 }
-3527 }
-3528 this.timeParams = params;
-3529 }
-3530 };
-3531 YAHOO.lang.extend(KJUR.asn1.x509.Time, KJUR.asn1.ASN1Object);
-3532
-3533 /**
-3534 * AlgorithmIdentifier ASN.1 structure class
-3535 * @name KJUR.asn1.x509.AlgorithmIdentifier
-3536 * @class AlgorithmIdentifier ASN.1 structure class
-3537 * @param {Array} params associative array of parameters (ex. {'name': 'SHA1withRSA'})
-3538 * @extends KJUR.asn1.ASN1Object
-3539 * @description
-3540 * The 'params' argument is an associative array and has following parameters:
-3541 * <ul>
-3542 * <li>name: algorithm name (MANDATORY, ex. sha1, SHA256withRSA)</li>
-3543 * <li>asn1params: explicitly specify ASN.1 object for algorithm.
-3544 * (OPTION)</li>
-3545 * <li>paramempty: set algorithm parameter to NULL by force.
-3546 * If paramempty is false, algorithm parameter will be set automatically.
-3547 * If paramempty is false and algorithm name is "*withDSA" or "withECDSA" parameter field of
-3548 * AlgorithmIdentifier will be ommitted otherwise
-3549 * it will be NULL by default.
-3550 * (OPTION, DEFAULT = false)</li>
-3551 * </ul>
-3552 * RSA-PSS algorithm names such as SHA{,256,384,512}withRSAandMGF1 are
-3553 * special names. They will set a suite of algorithm OID and multiple algorithm
-3554 * parameters. Its ASN.1 schema is defined in
-3555 * <a href="https://tools.ietf.org/html/rfc3447#appendix-A.2.3">RFC 3447 PKCS#1 2.1
-3556 * section A.2.3</a>.
-3557 * <blockquote><pre>
-3558 * id-RSASSA-PSS OBJECT IDENTIFIER ::= { pkcs-1 10 }
-3559 * RSASSA-PSS-params ::= SEQUENCE {
-3560 * hashAlgorithm [0] HashAlgorithm DEFAULT sha1,
-3561 * maskGenAlgorithm [1] MaskGenAlgorithm DEFAULT mgf1SHA1,
-3562 * saltLength [2] INTEGER DEFAULT 20,
-3563 * trailerField [3] TrailerField DEFAULT trailerFieldBC }
-3564 * mgf1SHA1 MaskGenAlgorithm ::= {
-3565 * algorithm id-mgf1,
-3566 * parameters HashAlgorithm : sha1 }
-3567 * id-mgf1 OBJECT IDENTIFIER ::= { pkcs-1 8 }
-3568 * TrailerField ::= INTEGER { trailerFieldBC(1) }
-3569 * </pre></blockquote>
-3570 * Here is a table for PSS parameters:
-3571 * <table>
-3572 * <tr><th>Name</th><th>alg oid</th><th>pss hash</th><th>maskgen</th></th><th>pss saltlen</th><th>trailer</th></tr>
-3573 * <tr><td>SHAwithRSAandMGF1</td><td>1.2.840.113549.1.1.10(rsapss)</td><td>default(sha1)</td><td>default(mgf1sha1)</td><td>default(20)</td><td>default(1)</td></tr>
-3574 * <tr><td>SHA256withRSAandMGF1</td><td>1.2.840.113549.1.1.10(rsapss)</td><td>sha256</td><td>mgf1sha256</td><td>32</td><td>default(1)</td></tr>
-3575 * <tr><td>SHA384withRSAandMGF1</td><td>1.2.840.113549.1.1.10(rsapss)</td><td>sha384</td><td>mgf1sha384</td><td>48</td><td>default(1)</td></tr>
-3576 * <tr><td>SHA512withRSAandMGF1</td><td>1.2.840.113549.1.1.10(rsapss)</td><td>sha512</td><td>mgf1sha512</td><td>64</td><td>default(1)</td></tr>
-3577 * </table>
-3578 * Default value is omitted as defined in ASN.1 schema.
-3579 * These parameters are interoperable to OpenSSL or IAIK toolkit.
-3580 * <br/>
-3581 * NOTE: RSA-PSS algorihtm names are supported since jsrsasign 8.0.21.
-3582 * @example
-3583 * new KJUR.asn1.x509.AlgorithmIdentifier({name: "sha1"})
-3584 * new KJUR.asn1.x509.AlgorithmIdentifier({name: "SHA256withRSA"})
-3585 * new KJUR.asn1.x509.AlgorithmIdentifier({name: "SHA512withRSAandMGF1"}) // set parameters automatically
-3586 * new KJUR.asn1.x509.AlgorithmIdentifier({name: "SHA256withRSA", paramempty: true})
-3587 * new KJUR.asn1.x509.AlgorithmIdentifier({name: "rsaEncryption"})
-3588 */
-3589 KJUR.asn1.x509.AlgorithmIdentifier = function(params) {
-3590 KJUR.asn1.x509.AlgorithmIdentifier.superclass.constructor.call(this);
-3591 this.nameAlg = null;
-3592 this.asn1Alg = null;
-3593 this.asn1Params = null;
-3594 this.paramEmpty = false;
-3595
-3596 var _KJUR = KJUR,
-3597 _KJUR_asn1 = _KJUR.asn1,
-3598 _PSSNAME2ASN1TLV = _KJUR_asn1.x509.AlgorithmIdentifier.PSSNAME2ASN1TLV;
-3599
-3600 this.getEncodedHex = function() {
-3601 if (this.nameAlg === null && this.asn1Alg === null) {
-3602 throw new Error("algorithm not specified");
-3603 }
-3604
-3605 // for RSAPSS algorithm name
-3606 // && this.hTLV === null
-3607 if (this.nameAlg !== null) {
-3608 var hTLV = null;
-3609 for (var key in _PSSNAME2ASN1TLV) {
-3610 if (key === this.nameAlg) {
-3611 hTLV = _PSSNAME2ASN1TLV[key];
-3612 }
-3613 }
-3614 if (hTLV !== null) {
-3615 this.hTLV = hTLV;
-3616 return this.hTLV;
-3617 }
-3618 }
-3619
-3620 if (this.nameAlg !== null && this.asn1Alg === null) {
-3621 this.asn1Alg = _KJUR_asn1.x509.OID.name2obj(this.nameAlg);
-3622 }
-3623 var a = [this.asn1Alg];
-3624 if (this.asn1Params !== null) a.push(this.asn1Params);
-3625
-3626 var o = new _KJUR_asn1.DERSequence({'array': a});
-3627 this.hTLV = o.getEncodedHex();
-3628 return this.hTLV;
-3629 };
-3630
-3631 if (params !== undefined) {
-3632 if (params.name !== undefined) {
-3633 this.nameAlg = params.name;
-3634 }
-3635 if (params.asn1params !== undefined) {
-3636 this.asn1Params = params.asn1params;
-3637 }
-3638 if (params.paramempty !== undefined) {
-3639 this.paramEmpty = params.paramempty;
-3640 }
-3641 }
-3642
-3643 // set algorithm parameters will be ommitted for
-3644 // "*withDSA" or "*withECDSA" otherwise will be NULL.
-3645 if (this.asn1Params === null &&
-3646 this.paramEmpty === false &&
-3647 this.nameAlg !== null) {
-3648
-3649 if (this.nameAlg.name !== undefined) {
-3650 this.nameAlg = this.nameAlg.name;
-3651 }
-3652 var lcNameAlg = this.nameAlg.toLowerCase();
-3653
-3654 if (lcNameAlg.substr(-7, 7) !== "withdsa" &&
-3655 lcNameAlg.substr(-9, 9) !== "withecdsa") {
-3656 this.asn1Params = new _KJUR_asn1.DERNull();
-3657 }
-3658 }
-3659 };
-3660 YAHOO.lang.extend(KJUR.asn1.x509.AlgorithmIdentifier, KJUR.asn1.ASN1Object);
-3661
-3662 /**
-3663 * AlgorithmIdentifier ASN.1 TLV string associative array for RSA-PSS algorithm names
-3664 * @const
-3665 */
-3666 KJUR.asn1.x509.AlgorithmIdentifier.PSSNAME2ASN1TLV = {
-3667 "SHAwithRSAandMGF1":
-3668 "300d06092a864886f70d01010a3000",
-3669 "SHA256withRSAandMGF1":
-3670 "303d06092a864886f70d01010a3030a00d300b0609608648016503040201a11a301806092a864886f70d010108300b0609608648016503040201a203020120",
-3671 "SHA384withRSAandMGF1":
-3672 "303d06092a864886f70d01010a3030a00d300b0609608648016503040202a11a301806092a864886f70d010108300b0609608648016503040202a203020130",
-3673 "SHA512withRSAandMGF1":
-3674 "303d06092a864886f70d01010a3030a00d300b0609608648016503040203a11a301806092a864886f70d010108300b0609608648016503040203a203020140"
-3675 };
-3676
-3677 /**
-3678 * GeneralName ASN.1 structure class<br/>
-3679 * @name KJUR.asn1.x509.GeneralName
-3680 * @class GeneralName ASN.1 structure class
-3681 * @description
-3682 * <br/>
-3683 * As for argument 'params' for constructor, you can specify one of
-3684 * following properties:
-3685 * <ul>
-3686 * <li>rfc822 - rfc822Name[1] (ex. user1@foo.com)</li>
-3687 * <li>dns - dNSName[2] (ex. foo.com)</li>
-3688 * <li>uri - uniformResourceIdentifier[6] (ex. http://foo.com/)</li>
-3689 * <li>dn - directoryName[4]
-3690 * distinguished name string or X500Name class parameters can be
-3691 * specified (ex. "/C=US/O=Test", {hex: '301c...')</li>
-3692 * <li>ldapdn - directoryName[4] (ex. O=Test,C=US)</li>
-3693 * <li>certissuer - directoryName[4] (PEM or hex string of cert)</li>
-3694 * <li>certsubj - directoryName[4] (PEM or hex string of cert)</li>
-3695 * <li>ip - iPAddress[7] (ex. 192.168.1.1, 2001:db3::43, 3faa0101...)</li>
-3696 * </ul>
-3697 * NOTE1: certissuer and certsubj were supported since asn1x509 1.0.10.<br/>
-3698 * NOTE2: dn and ldapdn were supported since jsrsasign 6.2.3 asn1x509 1.0.19.<br/>
-3699 * NOTE3: ip were supported since jsrsasign 8.0.10 asn1x509 1.1.4.<br/>
-3700 * NOTE4: X500Name parameters in dn were supported since jsrsasign 8.0.16.<br/>
-3701 *
-3702 * Here is definition of the ASN.1 syntax:
-3703 * <pre>
-3704 * -- NOTE: under the CHOICE, it will always be explicit.
-3705 * GeneralName ::= CHOICE {
-3706 * otherName [0] OtherName,
-3707 * rfc822Name [1] IA5String,
-3708 * dNSName [2] IA5String,
-3709 * x400Address [3] ORAddress,
-3710 * directoryName [4] Name,
-3711 * ediPartyName [5] EDIPartyName,
-3712 * uniformResourceIdentifier [6] IA5String,
-3713 * iPAddress [7] OCTET STRING,
-3714 * registeredID [8] OBJECT IDENTIFIER }
-3715 * </pre>
-3716 *
-3717 * @example
-3718 * gn = new KJUR.asn1.x509.GeneralName({dn: '/C=US/O=Test'});
-3719 * gn = new KJUR.asn1.x509.GeneralName({dn: X500NameObject);
-3720 * gn = new KJUR.asn1.x509.GeneralName({dn: {str: /C=US/O=Test'});
-3721 * gn = new KJUR.asn1.x509.GeneralName({dn: {ldapstr: 'O=Test,C=US'});
-3722 * gn = new KJUR.asn1.x509.GeneralName({dn: {hex: '301c...'});
-3723 * gn = new KJUR.asn1.x509.GeneralName({dn: {certissuer: PEMCERTSTRING});
-3724 * gn = new KJUR.asn1.x509.GeneralName({dn: {certsubject: PEMCERTSTRING});
-3725 * gn = new KJUR.asn1.x509.GeneralName({ip: '192.168.1.1'});
-3726 * gn = new KJUR.asn1.x509.GeneralName({ip: '2001:db4::4:1'});
-3727 * gn = new KJUR.asn1.x509.GeneralName({ip: 'c0a80101'});
-3728 * gn = new KJUR.asn1.x509.GeneralName({rfc822: 'test@aaa.com'});
-3729 * gn = new KJUR.asn1.x509.GeneralName({dns: 'aaa.com'});
-3730 * gn = new KJUR.asn1.x509.GeneralName({uri: 'http://aaa.com/'});
-3731 *
-3732 * gn = new KJUR.asn1.x509.GeneralName({ldapdn: 'O=Test,C=US'}); // DEPRECATED
-3733 * gn = new KJUR.asn1.x509.GeneralName({certissuer: certPEM}); // DEPRECATED
-3734 * gn = new KJUR.asn1.x509.GeneralName({certsubj: certPEM}); // DEPRECATED
-3735 */
-3736 KJUR.asn1.x509.GeneralName = function(params) {
-3737 KJUR.asn1.x509.GeneralName.superclass.constructor.call(this);
-3738 var asn1Obj = null,
-3739 type = null,
-3740 pTag = {rfc822: '81', dns: '82', dn: 'a4', uri: '86', ip: '87'},
-3741 _KJUR = KJUR,
-3742 _KJUR_asn1 = _KJUR.asn1,
-3743 _DERSequence = _KJUR_asn1.DERSequence,
-3744 _DEROctetString = _KJUR_asn1.DEROctetString,
-3745 _DERIA5String = _KJUR_asn1.DERIA5String,
-3746 _DERTaggedObject = _KJUR_asn1.DERTaggedObject,
-3747 _ASN1Object = _KJUR_asn1.ASN1Object,
-3748 _X500Name = _KJUR_asn1.x509.X500Name,
-3749 _pemtohex = pemtohex;
-3750
-3751 this.explicit = false;
-3752
-3753 this.setByParam = function(params) {
-3754 var str = null;
-3755 var v = null;
-3756
-3757 if (params === undefined) return;
-3758
-3759 if (params.rfc822 !== undefined) {
-3760 this.type = 'rfc822';
-3761 v = new _DERIA5String({str: params[this.type]});
-3762 }
-3763
-3764 if (params.dns !== undefined) {
-3765 this.type = 'dns';
-3766 v = new _DERIA5String({str: params[this.type]});
-3767 }
-3768
-3769 if (params.uri !== undefined) {
-3770 this.type = 'uri';
-3771 v = new _DERIA5String({str: params[this.type]});
-3772 }
-3773
-3774 if (params.dn !== undefined) {
-3775 this.type = 'dn';
-3776 this.explicit = true;
-3777 if (typeof params.dn === "string") {
-3778 v = new _X500Name({str: params.dn});
-3779 } else if (params.dn instanceof KJUR.asn1.x509.X500Name) {
-3780 v = params.dn;
-3781 } else {
-3782 v = new _X500Name(params.dn);
-3783 }
-3784 }
-3785
-3786 if (params.ldapdn !== undefined) {
-3787 this.type = 'dn';
-3788 this.explicit = true;
-3789 v = new _X500Name({ldapstr: params.ldapdn});
-3790 }
-3791
-3792 if (params.certissuer !== undefined) {
-3793 this.type = 'dn';
-3794 this.explicit = true;
-3795 var certStr = params.certissuer;
-3796 var certHex = null;
-3797
-3798 if (certStr.match(/^[0-9A-Fa-f]+$/)) {
-3799 certHex == certStr;
-3800 }
-3801
-3802 if (certStr.indexOf("-----BEGIN ") != -1) {
-3803 certHex = _pemtohex(certStr);
-3804 }
-3805
-3806 if (certHex == null) throw "certissuer param not cert";
-3807 var x = new X509();
-3808 x.hex = certHex;
-3809 var dnHex = x.getIssuerHex();
-3810 v = new _ASN1Object();
-3811 v.hTLV = dnHex;
-3812 }
-3813
-3814 if (params.certsubj !== undefined) {
-3815 this.type = 'dn';
-3816 this.explicit = true;
-3817 var certStr = params.certsubj;
-3818 var certHex = null;
-3819 if (certStr.match(/^[0-9A-Fa-f]+$/)) {
-3820 certHex == certStr;
-3821 }
-3822 if (certStr.indexOf("-----BEGIN ") != -1) {
-3823 certHex = _pemtohex(certStr);
-3824 }
-3825 if (certHex == null) throw "certsubj param not cert";
-3826 var x = new X509();
-3827 x.hex = certHex;
-3828 var dnHex = x.getSubjectHex();
-3829 v = new _ASN1Object();
-3830 v.hTLV = dnHex;
-3831 }
-3832
-3833 if (params.ip !== undefined) {
-3834 this.type = 'ip';
-3835 this.explicit = false;
-3836 var ip = params.ip;
-3837 var hIP;
-3838 var malformedIPMsg = "malformed IP address";
-3839 if (ip.match(/^[0-9.]+[.][0-9.]+$/)) { // ipv4
-3840 hIP = intarystrtohex("[" + ip.split(".").join(",") + "]");
-3841 if (hIP.length !== 8) throw malformedIPMsg;
-3842 } else if (ip.match(/^[0-9A-Fa-f:]+:[0-9A-Fa-f:]+$/)) { // ipv6
-3843 hIP = ipv6tohex(ip);
-3844 } else if (ip.match(/^([0-9A-Fa-f][0-9A-Fa-f]){1,}$/)) { // hex
-3845 hIP = ip;
-3846 } else {
-3847 throw malformedIPMsg;
-3848 }
-3849 v = new _DEROctetString({hex: hIP});
-3850 }
-3851
-3852 if (this.type == null)
-3853 throw "unsupported type in params=" + params;
-3854 this.asn1Obj = new _DERTaggedObject({'explicit': this.explicit,
-3855 'tag': pTag[this.type],
-3856 'obj': v});
-3857 };
-3858
-3859 this.getEncodedHex = function() {
-3860 return this.asn1Obj.getEncodedHex();
-3861 }
-3862
-3863 if (params !== undefined) {
-3864 this.setByParam(params);
-3865 }
-3866
-3867 };
-3868 YAHOO.lang.extend(KJUR.asn1.x509.GeneralName, KJUR.asn1.ASN1Object);
-3869
-3870 /**
-3871 * GeneralNames ASN.1 structure class<br/>
-3872 * @name KJUR.asn1.x509.GeneralNames
-3873 * @class GeneralNames ASN.1 structure class
-3874 * @description
-3875 * <br/>
-3876 * <h4>EXAMPLE AND ASN.1 SYNTAX</h4>
-3877 * @example
-3878 * gns = new KJUR.asn1.x509.GeneralNames([{'uri': 'http://aaa.com/'}, {'uri': 'http://bbb.com/'}]);
-3879 *
-3880 * GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
-3881 */
-3882 KJUR.asn1.x509.GeneralNames = function(paramsArray) {
-3883 KJUR.asn1.x509.GeneralNames.superclass.constructor.call(this);
-3884 var asn1Array = null,
-3885 _KJUR = KJUR,
-3886 _KJUR_asn1 = _KJUR.asn1;
-3887
-3888 /**
-3889 * set a array of {@link KJUR.asn1.x509.GeneralName} parameters<br/>
-3890 * @name setByParamArray
-3891 * @memberOf KJUR.asn1.x509.GeneralNames#
-3892 * @function
-3893 * @param {Array} paramsArray Array of {@link KJUR.asn1.x509.GeneralNames}
-3894 * @description
-3895 * <br/>
-3896 * <h4>EXAMPLES</h4>
-3897 * @example
-3898 * gns = new KJUR.asn1.x509.GeneralNames();
-3899 * gns.setByParamArray([{uri: 'http://aaa.com/'}, {uri: 'http://bbb.com/'}]);
-3900 */
-3901 this.setByParamArray = function(paramsArray) {
-3902 for (var i = 0; i < paramsArray.length; i++) {
-3903 var o = new _KJUR_asn1.x509.GeneralName(paramsArray[i]);
-3904 this.asn1Array.push(o);
-3905 }
-3906 };
-3907
-3908 this.getEncodedHex = function() {
-3909 var o = new _KJUR_asn1.DERSequence({'array': this.asn1Array});
-3910 return o.getEncodedHex();
-3911 };
-3912
-3913 this.asn1Array = new Array();
-3914 if (typeof paramsArray != "undefined") {
-3915 this.setByParamArray(paramsArray);
-3916 }
-3917 };
-3918 YAHOO.lang.extend(KJUR.asn1.x509.GeneralNames, KJUR.asn1.ASN1Object);
-3919
-3920 /**
-3921 * static object for OID
-3922 * @name KJUR.asn1.x509.OID
-3923 * @class static object for OID
-3924 * @property {Assoc Array} atype2oidList for short attribute type name and oid (ex. 'C' and '2.5.4.6')
-3925 * @property {Assoc Array} name2oidList for oid name and oid (ex. 'keyUsage' and '2.5.29.15')
-3926 * @property {Assoc Array} objCache for caching name and DERObjectIdentifier object
-3927 * @description
-3928 * This class defines OID name and values.
-3929 * AttributeType names registered in OID.atype2oidList are following:
-3930 * <table style="border-width: thin; border-style: solid; witdh: 100%">
-3931 * <tr><th>short</th><th>long</th><th>OID</th></tr>
-3932 * <tr><td>CN</td>commonName<td></td><td>2.5.4.3</td></tr>
-3933 * <tr><td>L</td><td>localityName</td><td>2.5.4.7</td></tr>
-3934 * <tr><td>ST</td><td>stateOrProvinceName</td><td>2.5.4.8</td></tr>
-3935 * <tr><td>O</td><td>organizationName</td><td>2.5.4.10</td></tr>
-3936 * <tr><td>OU</td><td>organizationalUnitName</td><td>2.5.4.11</td></tr>
-3937 * <tr><td>C</td><td></td>countryName<td>2.5.4.6</td></tr>
-3938 * <tr><td>STREET</td>streetAddress<td></td><td>2.5.4.6</td></tr>
-3939 * <tr><td>DC</td><td>domainComponent</td><td>0.9.2342.19200300.100.1.25</td></tr>
-3940 * <tr><td>UID</td><td>userId</td><td>0.9.2342.19200300.100.1.1</td></tr>
-3941 * <tr><td>SN</td><td>surname</td><td>2.5.4.4</td></tr>
-3942 * <tr><td>DN</td><td>distinguishedName</td><td>2.5.4.49</td></tr>
-3943 * <tr><td>E</td><td>emailAddress</td><td>1.2.840.113549.1.9.1</td></tr>
-3944 * <tr><td></td><td>businessCategory</td><td>2.5.4.15</td></tr>
-3945 * <tr><td></td><td>postalCode</td><td>2.5.4.17</td></tr>
-3946 * <tr><td></td><td>jurisdictionOfIncorporationL</td><td>1.3.6.1.4.1.311.60.2.1.1</td></tr>
-3947 * <tr><td></td><td>jurisdictionOfIncorporationSP</td><td>1.3.6.1.4.1.311.60.2.1.2</td></tr>
-3948 * <tr><td></td><td>jurisdictionOfIncorporationC</td><td>1.3.6.1.4.1.311.60.2.1.3</td></tr>
-3949 * </table>
-3950 *
-3951 * @example
-3952 */
-3953 KJUR.asn1.x509.OID = new function(params) {
-3954 this.atype2oidList = {
-3955 // RFC 4514 AttributeType name string (MUST recognized)
-3956 'CN': '2.5.4.3',
-3957 'L': '2.5.4.7',
-3958 'ST': '2.5.4.8',
-3959 'O': '2.5.4.10',
-3960 'OU': '2.5.4.11',
-3961 'C': '2.5.4.6',
-3962 'STREET': '2.5.4.9',
-3963 'DC': '0.9.2342.19200300.100.1.25',
-3964 'UID': '0.9.2342.19200300.100.1.1',
-3965 // other AttributeType name string
-3966 // http://blog.livedoor.jp/k_urushima/archives/656114.html
-3967 'SN': '2.5.4.4', // surname
-3968 'T': '2.5.4.12', // title
-3969 'DN': '2.5.4.49', // distinguishedName
-3970 'E': '1.2.840.113549.1.9.1', // emailAddress in MS.NET or Bouncy
-3971 // other AttributeType name string (no short name)
-3972 'description': '2.5.4.13',
-3973 'businessCategory': '2.5.4.15',
-3974 'postalCode': '2.5.4.17',
-3975 'serialNumber': '2.5.4.5',
-3976 'uniqueIdentifier': '2.5.4.45',
-3977 'organizationIdentifier': '2.5.4.97',
-3978 'jurisdictionOfIncorporationL': '1.3.6.1.4.1.311.60.2.1.1',
-3979 'jurisdictionOfIncorporationSP':'1.3.6.1.4.1.311.60.2.1.2',
-3980 'jurisdictionOfIncorporationC': '1.3.6.1.4.1.311.60.2.1.3'
-3981 };
-3982 this.name2oidList = {
-3983 'sha1': '1.3.14.3.2.26',
-3984 'sha256': '2.16.840.1.101.3.4.2.1',
-3985 'sha384': '2.16.840.1.101.3.4.2.2',
-3986 'sha512': '2.16.840.1.101.3.4.2.3',
-3987 'sha224': '2.16.840.1.101.3.4.2.4',
-3988 'md5': '1.2.840.113549.2.5',
-3989 'md2': '1.3.14.7.2.2.1',
-3990 'ripemd160': '1.3.36.3.2.1',
-3991
-3992 'MD2withRSA': '1.2.840.113549.1.1.2',
-3993 'MD4withRSA': '1.2.840.113549.1.1.3',
-3994 'MD5withRSA': '1.2.840.113549.1.1.4',
-3995 'SHA1withRSA': '1.2.840.113549.1.1.5',
-3996 'pkcs1-MGF': '1.2.840.113549.1.1.8',
-3997 'rsaPSS': '1.2.840.113549.1.1.10',
-3998 'SHA224withRSA': '1.2.840.113549.1.1.14',
-3999 'SHA256withRSA': '1.2.840.113549.1.1.11',
-4000 'SHA384withRSA': '1.2.840.113549.1.1.12',
-4001 'SHA512withRSA': '1.2.840.113549.1.1.13',
-4002
-4003 'SHA1withECDSA': '1.2.840.10045.4.1',
-4004 'SHA224withECDSA': '1.2.840.10045.4.3.1',
-4005 'SHA256withECDSA': '1.2.840.10045.4.3.2',
-4006 'SHA384withECDSA': '1.2.840.10045.4.3.3',
-4007 'SHA512withECDSA': '1.2.840.10045.4.3.4',
-4008
-4009 'dsa': '1.2.840.10040.4.1',
-4010 'SHA1withDSA': '1.2.840.10040.4.3',
-4011 'SHA224withDSA': '2.16.840.1.101.3.4.3.1',
-4012 'SHA256withDSA': '2.16.840.1.101.3.4.3.2',
-4013
-4014 'rsaEncryption': '1.2.840.113549.1.1.1',
-4015
-4016 // X.500 AttributeType defined in RFC 4514
-4017 'commonName': '2.5.4.3',
-4018 'countryName': '2.5.4.6',
-4019 'localityName': '2.5.4.7',
-4020 'stateOrProvinceName': '2.5.4.8',
-4021 'streetAddress': '2.5.4.9',
-4022 'organizationName': '2.5.4.10',
-4023 'organizationalUnitName': '2.5.4.11',
-4024 'domainComponent': '0.9.2342.19200300.100.1.25',
-4025 'userId': '0.9.2342.19200300.100.1.1',
-4026 // other AttributeType name string
-4027 'surname': '2.5.4.4',
-4028 'givenName': '2.5.4.42',
-4029 'title': '2.5.4.12',
-4030 'distinguishedName': '2.5.4.49',
-4031 'emailAddress': '1.2.840.113549.1.9.1',
-4032 // other AttributeType name string (no short name)
-4033 'description': '2.5.4.13',
-4034 'businessCategory': '2.5.4.15',
-4035 'postalCode': '2.5.4.17',
-4036 'uniqueIdentifier': '2.5.4.45',
-4037 'organizationIdentifier': '2.5.4.97',
-4038 'jurisdictionOfIncorporationL': '1.3.6.1.4.1.311.60.2.1.1',
-4039 'jurisdictionOfIncorporationSP':'1.3.6.1.4.1.311.60.2.1.2',
-4040 'jurisdictionOfIncorporationC': '1.3.6.1.4.1.311.60.2.1.3',
-4041
-4042 'subjectDirectoryAttributes': '2.5.29.9',
-4043 'subjectKeyIdentifier': '2.5.29.14',
-4044 'keyUsage': '2.5.29.15',
-4045 'subjectAltName': '2.5.29.17',
-4046 'issuerAltName': '2.5.29.18',
-4047 'basicConstraints': '2.5.29.19',
-4048 'cRLNumber': '2.5.29.20',
-4049 'cRLReason': '2.5.29.21',
-4050 'nameConstraints': '2.5.29.30',
-4051 'cRLDistributionPoints':'2.5.29.31',
-4052 'certificatePolicies': '2.5.29.32',
-4053 'anyPolicy': '2.5.29.32.0',
-4054 'authorityKeyIdentifier':'2.5.29.35',
-4055 'policyConstraints': '2.5.29.36',
-4056 'extKeyUsage': '2.5.29.37',
-4057 'authorityInfoAccess': '1.3.6.1.5.5.7.1.1',
-4058 'ocsp': '1.3.6.1.5.5.7.48.1',
-4059 'ocspBasic': '1.3.6.1.5.5.7.48.1.1',
-4060 'ocspNonce': '1.3.6.1.5.5.7.48.1.2',
-4061 'ocspNoCheck': '1.3.6.1.5.5.7.48.1.5',
-4062 'caIssuers': '1.3.6.1.5.5.7.48.2',
-4063
-4064 'anyExtendedKeyUsage': '2.5.29.37.0',
-4065 'serverAuth': '1.3.6.1.5.5.7.3.1',
-4066 'clientAuth': '1.3.6.1.5.5.7.3.2',
-4067 'codeSigning': '1.3.6.1.5.5.7.3.3',
-4068 'emailProtection': '1.3.6.1.5.5.7.3.4',
-4069 'timeStamping': '1.3.6.1.5.5.7.3.8',
-4070 'ocspSigning': '1.3.6.1.5.5.7.3.9',
-4071
-4072 'dateOfBirth': '1.3.6.1.5.5.7.9.1',
-4073 'placeOfBirth': '1.3.6.1.5.5.7.9.2',
-4074 'gender': '1.3.6.1.5.5.7.9.3',
-4075 'countryOfCitizenship': '1.3.6.1.5.5.7.9.4',
-4076 'countryOfResidence': '1.3.6.1.5.5.7.9.5',
-4077
-4078 'ecPublicKey': '1.2.840.10045.2.1',
-4079 'P-256': '1.2.840.10045.3.1.7',
-4080 'secp256r1': '1.2.840.10045.3.1.7',
-4081 'secp256k1': '1.3.132.0.10',
-4082 'secp384r1': '1.3.132.0.34',
-4083
-4084 'pkcs5PBES2': '1.2.840.113549.1.5.13',
-4085 'pkcs5PBKDF2': '1.2.840.113549.1.5.12',
-4086
-4087 'des-EDE3-CBC': '1.2.840.113549.3.7',
-4088
-4089 'data': '1.2.840.113549.1.7.1', // CMS data
-4090 'signed-data': '1.2.840.113549.1.7.2', // CMS signed-data
-4091 'enveloped-data': '1.2.840.113549.1.7.3', // CMS enveloped-data
-4092 'digested-data': '1.2.840.113549.1.7.5', // CMS digested-data
-4093 'encrypted-data': '1.2.840.113549.1.7.6', // CMS encrypted-data
-4094 'authenticated-data': '1.2.840.113549.1.9.16.1.2', // CMS authenticated-data
-4095 'tstinfo': '1.2.840.113549.1.9.16.1.4', // RFC3161 TSTInfo
-4096 'signingCertificate': '1.2.840.113549.1.9.16.2.12',// SMIME
-4097 'timeStampToken': '1.2.840.113549.1.9.16.2.14',// sigTS
-4098 'signaturePolicyIdentifier': '1.2.840.113549.1.9.16.2.15',// cades
-4099 'etsArchiveTimeStamp': '1.2.840.113549.1.9.16.2.27',// SMIME
-4100 'signingCertificateV2': '1.2.840.113549.1.9.16.2.47',// SMIME
-4101 'etsArchiveTimeStampV2':'1.2.840.113549.1.9.16.2.48',// SMIME
-4102 'extensionRequest': '1.2.840.113549.1.9.14',// CSR extensionRequest
-4103 'contentType': '1.2.840.113549.1.9.3',//PKCS#9
-4104 'messageDigest': '1.2.840.113549.1.9.4',//PKCS#9
-4105 'signingTime': '1.2.840.113549.1.9.5',//PKCS#9
-4106 'counterSignature': '1.2.840.113549.1.9.6',//PKCS#9
-4107 'archiveTimeStampV3': '0.4.0.1733.2.4',//ETSI EN29319122/TS101733
-4108 'pdfRevocationInfoArchival':'1.2.840.113583.1.1.8', //Adobe
-4109 'adobeTimeStamp': '1.2.840.113583.1.1.9.1' // Adobe
-4110 };
-4111
-4112 this.objCache = {};
-4113
-4114 /**
-4115 * get DERObjectIdentifier by registered OID name
-4116 * @name name2obj
-4117 * @memberOf KJUR.asn1.x509.OID
-4118 * @function
-4119 * @param {String} name OID
-4120 * @description
-4121 * @example
-4122 * var asn1ObjOID = OID.name2obj('SHA1withRSA');
-4123 */
-4124 this.name2obj = function(name) {
-4125 if (typeof this.objCache[name] != "undefined")
-4126 return this.objCache[name];
-4127 if (typeof this.name2oidList[name] == "undefined")
-4128 throw "Name of ObjectIdentifier not defined: " + name;
-4129 var oid = this.name2oidList[name];
-4130 var obj = new KJUR.asn1.DERObjectIdentifier({'oid': oid});
-4131 this.objCache[name] = obj;
-4132 return obj;
-4133 };
-4134
-4135 /**
-4136 * get DERObjectIdentifier by registered attribute type name such like 'C' or 'CN'<br/>
-4137 * @name atype2obj
-4138 * @memberOf KJUR.asn1.x509.OID
-4139 * @function
-4140 * @param {String} atype short attribute type name such like 'C', 'CN' or OID
-4141 * @return {@link KJUR.asn1.DERObjectIdentifier} instance
-4142 * @description
-4143 * @example
-4144 * KJUR.asn1.x509.OID.atype2obj('CN') → DERObjectIdentifier of 2.5.4.3
-4145 * KJUR.asn1.x509.OID.atype2obj('OU') → DERObjectIdentifier of 2.5.4.11
-4146 * KJUR.asn1.x509.OID.atype2obj('streetAddress') → DERObjectIdentifier of 2.5.4.9
-4147 * KJUR.asn1.x509.OID.atype2obj('2.5.4.9') → DERObjectIdentifier of 2.5.4.9
-4148 */
-4149 this.atype2obj = function(atype) {
-4150 if (this.objCache[atype] !== undefined)
-4151 return this.objCache[atype];
-4152
-4153 var oid;
-4154
-4155 if (atype.match(/^\d+\.\d+\.[0-9.]+$/)) {
-4156 oid = atype;
-4157 } else if (this.atype2oidList[atype] !== undefined) {
-4158 oid = this.atype2oidList[atype];
-4159 } else if (this.name2oidList[atype] !== undefined) {
-4160 oid = this.name2oidList[atype];
-4161 } else {
-4162 throw "AttributeType name undefined: " + atype;
-4163 }
-4164 var obj = new KJUR.asn1.DERObjectIdentifier({'oid': oid});
-4165 this.objCache[atype] = obj;
-4166 return obj;
-4167 };
-4168 };
-4169
-4170 /**
-4171 * convert OID to name<br/>
-4172 * @name oid2name
-4173 * @memberOf KJUR.asn1.x509.OID
-4174 * @function
-4175 * @param {String} oid dot noted Object Identifer string (ex. 1.2.3.4)
-4176 * @return {String} OID name if registered otherwise empty string
-4177 * @since asn1x509 1.0.9
-4178 * @description
-4179 * This static method converts OID string to its name.
-4180 * If OID is undefined then it returns empty string (i.e. '').
-4181 * @example
-4182 * KJUR.asn1.x509.OID.oid2name("1.3.6.1.5.5.7.1.1") → 'authorityInfoAccess'
-4183 */
-4184 KJUR.asn1.x509.OID.oid2name = function(oid) {
-4185 var list = KJUR.asn1.x509.OID.name2oidList;
-4186 for (var name in list) {
-4187 if (list[name] == oid) return name;
-4188 }
-4189 return '';
-4190 };
-4191
-4192 /**
-4193 * convert OID to AttributeType name<br/>
-4194 * @name oid2atype
-4195 * @memberOf KJUR.asn1.x509.OID
-4196 * @function
-4197 * @param {String} oid dot noted Object Identifer string (ex. 1.2.3.4)
-4198 * @return {String} OID AttributeType name if registered otherwise oid
-4199 * @since jsrsasign 6.2.2 asn1x509 1.0.18
-4200 * @description
-4201 * This static method converts OID string to its AttributeType name.
-4202 * If OID is not defined in OID.atype2oidList associative array then it returns OID
-4203 * specified as argument.
-4204 * @example
-4205 * KJUR.asn1.x509.OID.oid2atype("2.5.4.3") → CN
-4206 * KJUR.asn1.x509.OID.oid2atype("1.3.6.1.4.1.311.60.2.1.3") → jurisdictionOfIncorporationC
-4207 * KJUR.asn1.x509.OID.oid2atype("0.1.2.3.4") → 0.1.2.3.4 // unregistered OID
-4208 */
-4209 KJUR.asn1.x509.OID.oid2atype = function(oid) {
-4210 var list = KJUR.asn1.x509.OID.atype2oidList;
-4211 for (var atype in list) {
-4212 if (list[atype] == oid) return atype;
-4213 }
-4214 return oid;
-4215 };
-4216
-4217 /**
-4218 * convert OID name to OID value<br/>
-4219 * @name name2oid
-4220 * @memberOf KJUR.asn1.x509.OID
-4221 * @function
-4222 * @param {String} name OID name or OID (ex. "sha1" or "1.2.3.4")
-4223 * @return {String} dot noted Object Identifer string (ex. 1.2.3.4)
-4224 * @since asn1x509 1.0.11
-4225 * @description
-4226 * This static method converts from OID name to OID string.
-4227 * If OID is undefined then it returns empty string (i.e. '').
-4228 * @example
-4229 * KJUR.asn1.x509.OID.name2oid("authorityInfoAccess") → "1.3.6.1.5.5.7.1.1"
-4230 * KJUR.asn1.x509.OID.name2oid("1.2.3.4") → "1.2.3.4"
-4231 * KJUR.asn1.x509.OID.name2oid("UNKNOWN NAME") → ""
-4232 */
-4233 KJUR.asn1.x509.OID.name2oid = function(name) {
-4234 if (name.match(/^[0-9.]+$/)) return name;
-4235 var list = KJUR.asn1.x509.OID.name2oidList;
-4236 if (list[name] === undefined) return '';
-4237 return list[name];
-4238 };
-4239
-4240 /**
-4241 * X.509 certificate and CRL utilities class<br/>
-4242 * @name KJUR.asn1.x509.X509Util
-4243 * @class X.509 certificate and CRL utilities class
-4244 */
-4245 KJUR.asn1.x509.X509Util = {};
-4246
-4247 /**
-4248 * issue a certificate in PEM format (DEPRECATED)
-4249 * @name newCertPEM
-4250 * @memberOf KJUR.asn1.x509.X509Util
-4251 * @function
-4252 * @param {Array} param JSON object of parameter to issue a certificate
-4253 * @since asn1x509 1.0.6
-4254 * @deprecated since jsrsasign 9.0.0 asn1x509 2.0.0. please move to {@link KJUR.asn1.x509.Certificate} constructor
-4255 * @description
-4256 * This method can issue a certificate by a simple
-4257 * JSON object.
-4258 * Signature value will be provided by signing with
-4259 * private key using 'cakey' parameter or
-4260 * hexadecimal signature value by 'sighex' parameter.
-4261 * <br/>
-4262 * NOTE: Algorithm parameter of AlgorithmIdentifier will
-4263 * be set automatically by default.
-4264 * (see {@link KJUR.asn1.x509.AlgorithmIdentifier})
-4265 * from jsrsasign 7.1.1 asn1x509 1.0.20.
-4266 * <br/>
-4267 * NOTE2:
-4268 * RSA-PSS algorithm has been supported from jsrsasign 8.0.21.
-4269 * As for RSA-PSS signature algorithm names and signing parameters
-4270 * such as MGF function and salt length, please see
-4271 * {@link KJUR.asn1.x509.AlgorithmIdentifier} class.
-4272 *
-4273 * @example
-4274 * var certPEM = KJUR.asn1.x509.X509Util.newCertPEM({
-4275 * serial: {int: 4},
-4276 * sigalg: {name: 'SHA1withECDSA'},
-4277 * issuer: {str: '/C=US/O=a'},
-4278 * notbefore: {'str': '130504235959Z'},
-4279 * notafter: {'str': '140504235959Z'},
-4280 * subject: {str: '/C=US/O=b'},
-4281 * sbjpubkey: pubKeyObj,
-4282 * ext: [
-4283 * {basicConstraints: {cA: true, critical: true}},
-4284 * {keyUsage: {bin: '11'}},
-4285 * ],
-4286 * cakey: prvKeyObj
-4287 * });
-4288 * // -- or --
-4289 * var certPEM = KJUR.asn1.x509.X509Util.newCertPEM({
-4290 * serial: {int: 4},
-4291 * sigalg: {name: 'SHA1withECDSA'},
-4292 * issuer: {str: '/C=US/O=a'},
-4293 * notbefore: {'str': '130504235959Z'},
-4294 * notafter: {'str': '140504235959Z'},
-4295 * subject: {str: '/C=US/O=b'},
-4296 * sbjpubkey: pubKeyPEM,
-4297 * ext: [
-4298 * {basicConstraints: {cA: true, critical: true}},
-4299 * {keyUsage: {bin: '11'}},
-4300 * ],
-4301 * cakey: [prvkey, pass]}
-4302 * );
-4303 * // -- or --
-4304 * var certPEM = KJUR.asn1.x509.X509Util.newCertPEM({
-4305 * serial: {int: 1},
-4306 * sigalg: {name: 'SHA1withRSA'},
-4307 * issuer: {str: '/C=US/O=T1'},
-4308 * notbefore: {'str': '130504235959Z'},
-4309 * notafter: {'str': '140504235959Z'},
-4310 * subject: {str: '/C=US/O=T1'},
-4311 * sbjpubkey: pubKeyObj,
-4312 * sighex: '0102030405..'
-4313 * });
-4314 * // for the issuer and subject field, another
-4315 * // representation is also available
-4316 * var certPEM = KJUR.asn1.x509.X509Util.newCertPEM({
-4317 * serial: {int: 1},
-4318 * sigalg: {name: 'SHA256withRSA'},
-4319 * issuer: {C: "US", O: "T1"},
-4320 * notbefore: {'str': '130504235959Z'},
-4321 * notafter: {'str': '140504235959Z'},
-4322 * subject: {C: "US", O: "T1", CN: "http://example.com/"},
-4323 * sbjpubkey: pubKeyObj,
-4324 * sighex: '0102030405..'
-4325 * });
-4326 */
-4327 KJUR.asn1.x509.X509Util.newCertPEM = function(param) {
-4328 var _KJUR_asn1_x509 = KJUR.asn1.x509,
-4329 _TBSCertificate = _KJUR_asn1_x509.TBSCertificate,
-4330 _Certificate = _KJUR_asn1_x509.Certificate;
-4331 var cert = new _Certificate(param);
-4332 return cert.getPEM();
-4333 };
-4334
-4335