Certificates and Revocation

📄️Create and validate a certificate

Create a root CA and an end-entity certificate signed by it, encode the certificate to DER, parse it back, check its signature, and validate the chain up to the trusted root.

📄️Working with certificate requests

Create a PKCS#10 certificate signing request (CSR) that asks for subject alternative names, then parse it as a certificate authority would: check its signature, which proves the requester holds the private key, and read the requested subject, key, and extensions.

📄️Creating and parsing CRLs

Create a certificate revocation list (CRL) that revokes a certificate, parse it, check the CA's signature, look up certificates in it, and see chain validation reject the revoked certificate.

📄️Working with OCSP requests

Create an OCSP request for a certificate's revocation status, with a nonce, and parse it as a responder would.

📄️Working with OCSP responses

Create and sign an OCSP response that reports a certificate as good, then parse it as a client would: check the responder's signature and read the certificate's status.