A zero-dependency TypeScript X.509 and PKI toolkit. Create certificates and CSRs, verify certificate chains and identities, manage revocation, and work with keys and PKCS containers using WebCrypto.
Zero dependencies. Tree-shakeable subpath entrypoints. Pure WebCrypto. Runs in Node, Bun, Deno, browsers, and Cloudflare Workers.
micro509/kdf derives Argon2d, Argon2i, and Argon2id keys across supported runtimes,
including versions 0x10 and 0x13.
Prerelease — API may change before 1.0.
npm install micro509Create a self-signed certificate, verify its chain and service identity, then see a typed failure when the requested identity does not match:
import { createSelfSignedCertificate, verifyCertificateChain } from 'micro509';
const { certificate } = await createSelfSignedCertificate({
subject: { commonName: 'app.example.com' },
extensions: {
subjectAltNames: [{ type: 'dns', value: 'app.example.com' }],
},
});
const options = {
leaf: certificate.pem,
roots: [certificate.pem],
allowSelfSignedLeaf: true,
} as const;
const valid = await verifyCertificateChain({
...options,
serviceIdentity: { type: 'dns', value: 'app.example.com' },
});
console.log(valid.ok ? 'verified app.example.com' : valid.error.code);
const mismatch = await verifyCertificateChain({
...options,
serviceIdentity: { type: 'dns', value: 'admin.example.com' },
});
console.log(mismatch.ok ? 'verified' : mismatch.error.code);Output:
verified app.example.com
subject_alt_name_mismatch
A verification failure is a typed result with an error code, failing
certificate index when relevant, and structured details. Callers can handle a
specific case without parsing messages or collapsing every failure into
false.
The self-signed leaf option above is useful for a compact local demo. In production, supply the appropriate trust anchors and intermediates for your PKI.
- Certificates and CSRs: create, parse, and encode common X.509 extensions
- Verification: build and validate chains, enforce policy, and match DNS, IP, URI, and SRV service identities
- Revocation: create and process CRLs and OCSP requests and responses
- Keys and signatures: import, export, and generate RSA, ECDSA, and Ed25519 keys, plus signing and verification of detached data
- PKCS workflows: PKCS#7 SignedData and password-protected PFX/PKCS#12
- PEM and DER: encode, decode, and parse common formats
The root package exports the usual workflows:
import { createCertificate, parseCertificatePem, verifyCertificateChain } from 'micro509';For smaller imports or more specialized types, use domain entrypoints:
import { parseCertificatePem } from 'micro509/x509';
import { verifyCertificateChain } from 'micro509/verify';
import { checkCertificateRevocation } from 'micro509/revocation';
import { createPfx } from 'micro509/pkcs';
import { generateKeyPair } from 'micro509/keys';See the API reference for the full entrypoint list.
micro509 implements core certificate path validation, service identity, policy, PEM, safe-curve, OCSP, and PKCS container workflows. The exact claim boundary and partial areas are documented in the PKIX scope. See algorithms for supported curves and signature schemes, runtimes for environment support, and standards for implementation coverage.
The browser example is a single HTML file that issues a certificate and parses it back with no build step. The Vite example adds TypeScript and a dev server.
This repository also publishes statically linked OpenSSL builds to GHCR for micro509 CI and general use. See build details.