Skip to main content

BasicOCSPResponseVerifyParams

Properties​

issuerCerts?​

optional issuerCerts?: Certificate[]

Candidate issuer certificates used to resolve the CertID of each SingleResponse and to validate delegated OCSP responders.

This context is optional. For each SingleResponse, PKI.js looks for an issuer whose issuerNameHash / issuerKeyHash (computed using the response's hash algorithm) match the CertID. Issuers are also searched in embedded response certificates, trustedCerts, and the validated signer path. verify() fails closed only when the issuer cannot be found in any of those sources.

trustedCerts?​

optional trustedCerts?: Certificate[]

Trust anchors used for building the signer's certificate chain.

Important: being merely chained to a certificate in trustedCerts does NOT authorize a certificate to sign OCSP responses. Inclusion in trustedCerts only makes a chain verifiable; authorization to respond for a given CA still requires being that CA, being a delegated responder issued by that CA with id-kp-OCSPSigning, or being listed in trustedResponders.

trustedResponders?​

optional trustedResponders?: Certificate[]

Certificates explicitly authorized to sign OCSP responses, independent of CA delegation. Matching is by exact DER of the full certificate; chaining to one of these certificates does NOT inherit this permission.

For a matched certificate, chain validation, expiry, and id-kp-OCSPSigning are skipped. The OCSP signature MUST still verify against the pinned certificate's public key. Use this for locally trusted responders that are not the issuing CA and are not formally delegated. For normal delegated responders, leave this list empty.