PKIjs provides a Typescript implementation of the most common formats and algorithms needed to build PKI-enabled applications
- The creation and validation of X.509 certificates (RFC 5280) is used by all certificate-enabled applications.
- PKCS#10 (RFC 2986) is the most commonly used enrollment data structure used by X.509 applications. It enables the requestor to prove control of a given public key.
- Cryptographic Message Syntax (RFC 5652) is the most commonly used data structure for signing data in X.509 applications. CMS makes it easy to both sign and represent all of the data needed to verify a signature.
- Cryptographic Message Syntax (RFC 5652) is also the most commonly used data structure for encrypting data in X.509 applications. CMS makes it easy to provide interoperable data encryption.
- Time-Stamp Protocol (RFC 3161) is the most commonly used protocol for proving that data existed before a particular time. It is commonly used in signing applications to ensure signatures are verifiable long into the future.
- Typescript and object-oriented implementation
- Contains no cryptographic implementations and instead leverages Web Crypto API
- Work uniformly both in browser and in Node/Deno
npm install pkijs asn1jsasn1js is a peer dependency: pkijs and your application must use the same copy (see below).
v4 is ESM-only and requires Node.js ^20.19.0 || >=22.12.0 (was >=16.0.0). CommonJS code can still require("pkijs") on these versions; Node.js 22.0–22.11 can't. The exported API is unchanged, but some input handling changed with the move from pvutils/pvtsutils to @peculiar/utils (last three items).
- TypeScript compiling to CommonJS: use
"module": "node20"or"nodenext"(node16fails with TS1479). ESM and bundler setups need no changes. - Jest in CommonJS mode: switch to ESM mode or Vitest, or configure an ESM-to-CommonJS transformer and make sure
transformIgnorePatternsdoesn't excludepkijsand its ESM dependencies (asn1js,bytestreamjs,@peculiar/utils,@noble/hashes). - Deep imports (
pkijs/build/index.js,pkijs/build/index.es.js) are blocked byexports; import frompkijs. - asn1js 4 is a peer dependency (v3 depended on asn1js 3), and
bytestreamjsmoves to 3. Installasn1js@^4next to pkijs. pkijs checksinstanceof asn1js.Sequenceand similar on values you pass in, so they must come from the same asn1js copy as pkijs's: values built with asn1js 3 fail those checks. Upgrade other libraries that still depend on asn1js 3 (such as@peculiar/asn1-schema2) at the same time. - Stricter base64:
RSAPublicKeyandECPublicKeyfromJSON()throw aTypeErrorwhen a JWK member isn't base64url (padding is still accepted), andSignedCertificateTimestamp#verify()throws one when the logkeyisn't base64. v3 decoded such text into wrong bytes or failed later with anAsnError.RSAPublicKey.fromJSON()also decodesnandeexactly: v3 turnede= 3 into 196608, cut longer exponents to 3 bytes, and kept a trailing zero byte on some modulus lengths. - SCT timestamps:
SignedCertificateTimestamptoStream(),toSchema()andverify()throw aRangeErrorfor an invalid or pre-1970timestamp; v3 wrote0or wrapped bytes. - Untyped input:
PkiObject#toString()accepts only"hex","base64"and"base64url"(v3 also took"utf8","binary"and"utf16"), andnew CertificateChainValidationEngine(null)throws aTypeError, like the other constructors.
- Create and validate an X.509 certificate
- Working with certificate requests
- Creating and parsing CRLs
- Working with OCSP requests
- Working with OCSP responses
- Working with CMS Signing
- Working with CMS Certificate-based Encryption
- Working with CMS password-based Encryption
- Working with PKCS#7 Certificate bags (P7B)
- How to verify a signature in a PDF file
- S/MIME signature verification
- S/MIME encryption
- Working with PKCS#12 files
You can find the PKI.js documentation on the website.
Want to file a bug, contribute some code, or improve documentation? Excellent! See CONTRIBUTING.md for development setup, commit conventions and the release flow.