Create, parse, sign, and verify certificates, CRLs, OCSP messages, CMS messages, timestamps, and PKCS#12 files in browsers and Node.js. PKIjs is written in TypeScript, relies on the Web Crypto API for all cryptography, and is built on asn1js.
Create, parse, sign, and verify X.509 certificates (RFC 5280) and PKCS#10 certificate requests (RFC 2986), with typed classes for the standard extensions.
Build and validate certificate chains against your trusted roots, checking revocation with CRLs (RFC 5280) and OCSP responses (RFC 6960), which PKIjs can also create and parse.
Sign and verify data with Cryptographic Message Syntax (RFC 5652), with attached or detached content and signed attributes. CMS is the basis of S/MIME, signed PDFs, and code signing.
Encrypt and decrypt CMS enveloped data for certificate holders (RSA-OAEP or ECDH), with a shared key, or with a password, using AES-CBC or AES-GCM.
Create and verify Time-Stamp Protocol (RFC 3161) requests and responses, which prove that data existed before a given time and keep signatures verifiable long after certificates expire.
Create and parse PKCS#12 (PFX) files (RFC 7292) protected with passwords or certificates, and PKCS#8 private keys (RFC 5208).