TLS Certificate Validator (tls/certificate.ts)

Parses and validates PEM certificate/key pairs using Node's X509Certificate API, checking chain, names, and self-signed status without openssl binary.

// Source: https://github.com/Termix-SSH/Termix | License: Apache-2.0 | Copyright 2026 Luke Gustafson
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * Reading and checking PEM certificates with node's own X509 parser, so none
 * of this needs the openssl binary.
 */

import { X509Certificate, createPrivateKey } from "crypto";

export interface TlsCertificateInfo {
  subject: string;
  issuer: string;
  names: string[];
  notBefore: string;
  notAfter: string;
  selfSigned: boolean;
  fingerprint: string;
}

export class TlsValidationError extends Error {
  constructor(message: string) {
    super(message);
    this.name = "TlsValidationError";
  }
}

const PEM_CERT =
  /-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g;

/** The leaf is the first certifi

... (truncated -- full source via MCP)