PKIjs

PKIjs implements the data structures and protocols that PKI-enabled applications actually need: X.509 certificates and certificate requests (PKCS#10), certificate revocation lists, Cryptographic Message Syntax (CMS) for signing and encrypting data, OCSP requests and responses, and the Time-Stamp Protocol. Every cryptographic operation is delegated to the Web Cryptography API rather than reimplemented, which keeps the library free of its own crypto primitives and lets it run unmodified in browsers, Node.js, and Deno.

The object model mirrors the ASN.1 structures defined in the relevant RFCs (5280 for X.509, 2986 for PKCS#10, 5652 for CMS, 3161 for TSP), built on top of the companion ASN1js library for encoding and decoding. Nearly every internal type — GeneralName, AlgorithmIdentifier, certificate extensions, revoked-certificate entries, SafeBags for PKCS#12 — is exposed as its own class with parsing, mutation, and re-encoding support, so consumers can construct a certificate or CMS message from scratch or walk and modify one that was parsed from raw bytes.

A built-in certificate chain validation engine handles the trust-path logic (path building, signature verification, revocation checks) without depending on a platform certificate store, which matters for environments like browsers and Deno that don’t expose one. PKIjs is maintained by Peculiar Ventures and is the engine behind several downstream tools for certificate creation, S/MIME, and PDF signature verification.

What You Get

• Full X.509 certificate lifecycle: parse, construct from scratch, mutate fields, and re-encode
• A built-in certificate chain validation engine with no dependency on a platform trust store
• CMS SignedData, EnvelopedData, and EncryptedData support, including password-based and certificate-based encryption
• OCSP request/response and CRL parsing, construction, and signature validation
• Time-Stamp Protocol (RFC 3161) request and response creation and validation
• PKCS#12 parsing and construction for working with SafeBags and SafeContents
• Coverage of Suite B algorithm combinations (RSA-PSS, ECDSA, ECDH+KDF, AES-KW/CBC/GCM) via WebCrypto

Common Use Cases

• Verifying a certificate chain in a Node.js or browser app with no native OpenSSL dependency
• Creating and signing a CMS message for S/MIME or document signing workflows
• Building an OCSP responder or client to check certificate revocation status
• Issuing a timestamp request/response pair for long-term signature verification
• Parsing PKCS#12 files to extract keys and certificate chains in a pure-JS environment

Under The Hood

Architecture PKIjs organizes each PKI ASN.1 structure (Certificate, CertificationRequest, ContentInfo, EnvelopedData, and roughly 120 more files under src/) as its own class extending a common PkiObject base, each responsible for parsing and serializing itself to and from ASN.1 via the companion asn1js library. CertificateChainValidationEngine.ts implements path-building and revocation-aware trust validation as a separate orchestration layer sitting on top of the certificate/CRL/OCSP primitives. Cryptographic operations are abstracted behind AbstractCryptoEngine and CryptoEngineInterface, letting a single global crypto engine instance be swapped between native WebCrypto and a polyfill without touching the ASN.1 classes. Changing the core PkiObject base or the CryptoEngine interface would ripple through nearly every structure class, since all of them depend on both.

Tech Stack The library is written in TypeScript targeting ES2019, compiled with tsc and bundled with Rollup, producing both ESM and CommonJS builds plus generated type declarations. Runtime dependencies are minimal and hand-picked: asn1js (a companion ASN.1 codec from the same maintainers), pvtsutils and pvutils for buffer utilities, bytestreamjs, @noble/hashes, and tslib. There is no application framework involved — it’s a standalone library consumed via npm. Testing runs on Vitest with coverage-v8; linting and formatting use oxlint and oxfmt rather than ESLint/Prettier; CI runs via GitHub Actions across dedicated library, release, and website workflows.

Code Quality The test suite favors end-to-end scenario specs over narrow unit tests — full-flow certificate, CMS, CRL, and OCSP examples, plus a spec that runs against NIST’s PKI test-suite vectors — exercising the library against realistic ASN.1 payloads rather than isolated functions. Error handling is centralized through dedicated ArgumentError, ParameterError, and AsnError classes with typed static assert/isType helpers used consistently for input validation across the codebase, rather than ad hoc throws. Strict TypeScript mode and noImplicitOverride are enabled, and naming follows RFC structure names closely, which keeps the codebase navigable once the underlying specs are familiar.

API Design The public API mirrors ASN.1/RFC terminology directly, so anyone already familiar with X.509, CMS, or OCSP specs can map data onto classes with little translation — though that same fidelity means the learning curve is steep for newcomers unfamiliar with the RFCs. Construction and parsing both flow through the same class, keeping the build-from-scratch and parse-existing-bytes code paths symmetric. The CryptoEngine abstraction is exposed publicly so consumers can swap in a custom engine without forking. Documentation lives primarily on a separate docs website with a runnable example for every major RFC scenario, which is how most users learn the API in practice rather than through the README alone.