(Node.js) Validate Certificate using OCSP Protocol

Demonstrates how to validate a certificate (check the revoked status) using the OCSP protocol.

Install Chilkat for Node.js and Electron using npm at Chilkat npm packages for Node.js Chilkat npm packages for Electron on Windows, Linux, MacOSX, and ARM

var os = require('os');
if (os.platform() == 'win32') {  
    if (os.arch() == 'ia32') {
        var chilkat = require('@chilkat/ck-node21-win-ia32');
    } else {
        var chilkat = require('@chilkat/ck-node21-win64'); 
    }
} else if (os.platform() == 'linux') {
    if (os.arch() == 'arm') {
        var chilkat = require('@chilkat/ck-node21-arm');
    } else if (os.arch() == 'x86') {
        var chilkat = require('@chilkat/ck-node21-linux32');
    } else {
        var chilkat = require('@chilkat/ck-node21-linux64');
    }
} else if (os.platform() == 'darwin') {
    if (os.arch() == 'arm64') {
        var chilkat = require('@chilkat/ck-node21-mac-m1');
    } else {
        var chilkat = require('@chilkat/ck-node21-macosx');
    }
}

function chilkatExample() {

    // Note: Requires Chilkat v9.5.0.75 or greater.

    // This requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // This example will check the revoked status of a certificate loaded from a file.
    var cert = new chilkat.Cert();
    var success = cert.LoadFromFile("qa_data/certs/google.crt");
    if (success !== true) {
        console.log(cert.LastErrorText);
        return;
    }

    // Get the cert's OCSP URL.
    var ocspUrl = cert.OcspUrl;

    // Build the JSON that will be the OCSP request.

    // Possible hash algorithms are sha1, sha256, sha384, sha512.  
    var hashAlg = "sha256";
    var prng = new chilkat.Prng();
    var json = new chilkat.JsonObject();
    json.EmitCompact = false;
    // Read more about OCSP nonce lengths
    json.UpdateString("extensions.ocspNonce",prng.GenRandom(16,"base64"));
    json.I = 0;
    json.UpdateString("request[i].cert.hashAlg",hashAlg);
    json.UpdateString("request[i].cert.issuerNameHash",cert.HashOf("IssuerDN",hashAlg,"base64"));
    json.UpdateString("request[i].cert.issuerKeyHash",cert.HashOf("IssuerPublicKey",hashAlg,"base64"));
    json.UpdateString("request[i].cert.serialNumber",cert.SerialNumber);

    console.log(json.Emit());

    // Our OCSP request looks something like this:
    // {
    //   "extensions": {
    //     "ocspNonce": "qZDfbpO+nUxRzz6c/SPjE5QCAsPfpkQlRDxTnGl0gnxt7iXO"
    //   },
    //   "request": [
    //     {
    //       "cert": {
    //         "hashAlg": "sha1",
    //         "issuerNameHash": "9u2wY2IygZo19o11oJ0CShGqbK0=",
    //         "issuerKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=",
    //         "serialNumber": "6175535D87BF94B6"
    //       }
    //     }
    //   ]
    // }

    var ocspRequest = new chilkat.BinData();
    var http = new chilkat.Http();

    // Convert our JSON to a binary (ASN.1) OCSP request
    success = http.CreateOcspRequest(json,ocspRequest);
    if (success == false) {
        console.log(http.LastErrorText);
        return;
    }

    // Send the OCSP request to the OCSP server
    // resp: HttpResponse
    var resp = http.PBinaryBd("POST",ocspUrl,ocspRequest,"application/ocsp-request",false,false);
    if (http.LastMethodSuccess !== true) {
        console.log(http.LastErrorText);
        return;
    }

    // Get the binary (ASN.1) OCSP reply
    var ocspReply = new chilkat.BinData();
    resp.GetBodyBd(ocspReply);

    // Convert the binary reply to JSON.
    // Also returns the overall OCSP response status.
    var jsonReply = new chilkat.JsonObject();
    var ocspStatus = http.ParseOcspReply(ocspReply,jsonReply);

    // The ocspStatus can have one of these values:
    // -1:  The ARG1 does not contain a valid OCSP reply.
    // 0:  Successful - Response has valid confirmations..
    // 1: Malformed request - Illegal confirmation request.
    // 2: Internal error - Internal error in issuer.
    // 3: Try later -  Try again later.
    // 4: Not used - This value is never returned.
    // 5: Sig required - Must sign the request.
    // 6: Unauthorized - Request unauthorized.

    if (ocspStatus < 0) {
        console.log("Invalid OCSP reply.");
        return;
    }

    console.log("Overall OCSP Response Status: " + ocspStatus);

    // Let's examine the OCSP response (in JSON).
    jsonReply.EmitCompact = false;
    console.log(jsonReply.Emit());

    // The JSON reply looks like this:
    // (Use the online tool at https://tools.chilkat.io/jsonParse.cshtml
    // to generate JSON parsing code.)

    // {
    //   "responseStatus": 0,
    //   "responseTypeOid": "1.3.6.1.5.5.7.48.1.1",
    //   "responseTypeName": "ocspBasic",
    //   "response": {
    //     "responderIdChoice": "KeyHash",
    //     "responderKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=",
    //     "dateTime": "20180803193937Z",
    //     "cert": [
    //       {
    //         "hashOid": "1.3.14.3.2.26",
    //         "hashAlg": "SHA-1",
    //         "issuerNameHash": "9u2wY2IygZo19o11oJ0CShGqbK0=",
    //         "issuerKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=",
    //         "serialNumber": "6175535D87BF94B6",
    //         "status": 0,
    //         "thisUpdate": "20180803193937Z",
    //         "nextUpdate": "20180810193937Z"
    //       }
    //     ]
    //   }
    // }
    // 

    // The certificate status:
    var certStatus = -1;
    if (jsonReply.HasMember("response.cert[0].status") == true) {
        certStatus = jsonReply.IntOf("response.cert[0].status");
    }

    // Possible certStatus values are:
    // -1: No status returned.
    // 0: Good
    // 1: Revoked
    // 2: Unknown.
    console.log("Certificate Status: " + certStatus);

}

chilkatExample();