证书链在线校验证书吊销状态
=============

#### 本地证书链吊销状态校验时仅校验终端实体证书

API 22开始支持本地证书链吊销状态校验时仅校验终端实体证书。

#### \[h2\]开发步骤

1.  导入[证书模块](https://developer.huawei.com/consumer/cn/doc/harmonyos-references/js-apis-cert)。
    
    import { cert } from '@kit.DeviceCertificateKit';
    
2.  调用[cert.createX509CertChain](https://developer.huawei.com/consumer/cn/doc/harmonyos-references/js-apis-cert#certcreatex509certchain11)创建证书链对象。
    
3.  调用[cert.createX509Cert](https://developer.huawei.com/consumer/cn/doc/harmonyos-references/js-apis-cert#certcreatex509cert)创建X509证书对象。
    
4.  调用[cert.createX509CRL](https://developer.huawei.com/consumer/cn/doc/harmonyos-references/js-apis-cert#certcreatex509crl11)创建X509证书吊销列表对象。
    
5.  构造[cert.CertChainValidationParameters](https://developer.huawei.com/consumer/cn/doc/harmonyos-references/js-apis-cert#certchainvalidationparameters11)证书链校验参数对象。
    
6.  调用[cert.validate](https://developer.huawei.com/consumer/cn/doc/harmonyos-references/js-apis-cert#validate11)，传入证书链校验参数，进行证书链校验。
    

本地仅校验终端实体证书的吊销状态示例：

import { cert } from '@kit.DeviceCertificateKit';

// string转Uint8Array。
function stringToUint8Array(str: string): Uint8Array {
  let arr: number\[\] = \[\];
  for (let i = 0, j = str.length; i < j; i++) {
    arr.push(str.charCodeAt(i));
  }
  return new Uint8Array(arr);
}

async function createCertChain(certData: string): Promise<cert.X509CertChain> {
  // 证书二进制数据，需业务自行赋值。
  let encodingBlob: cert.EncodingBlob = {
    data: stringToUint8Array(certData),
    // 根据encodingData的格式进行赋值，支持FORMAT\_PEM和FORMAT\_DER。
    encodingFormat: cert.EncodingFormat.FORMAT\_PEM
  };

  let x509CertChain: cert.X509CertChain = {} as cert.X509CertChain;
  try {
    x509CertChain = await cert.createX509CertChain(encodingBlob);
  } catch (err) {
    console.error(\`createCertChain failed: errCode: ${err.code}, message: ${err.message}\`);
  }
  return x509CertChain;
}

async function createCert(certData: string): Promise<cert.X509Cert> {
  // 证书二进制数据，需业务自行赋值。
  let encodingBlob: cert.EncodingBlob = {
    data: stringToUint8Array(certData),
    // 根据encodingData的格式进行赋值，支持FORMAT\_PEM和FORMAT\_DER。
    encodingFormat: cert.EncodingFormat.FORMAT\_PEM
  };

  let x509Cert: cert.X509Cert = {} as cert.X509Cert;
  try {
    x509Cert = await cert.createX509Cert(encodingBlob);
  } catch (err) {
    console.error(\`createCert failed: errCode: ${err.code}, message: ${err.message}\`);
  }
  return x509Cert;
}

export async function createCRL(crlPem: string): Promise<cert.CertCRLCollection> {
  try {
    let crlEncodingBlob: cert.EncodingBlob = {
      data: stringToUint8Array(crlPem),
      encodingFormat: cert.EncodingFormat.FORMAT\_PEM
    }
    let crl: cert.X509CRL = await cert.createX509CRL(crlEncodingBlob);
    let collection: cert.CertCRLCollection = cert.createCertCRLCollection(\[\], \[crl\]);
    return collection;
  } catch (error) {
    throw error as Error;
  }
}
// ...
async function doTestLeafCertCrlCheck() {
  try {
    let x509CertChain: cert.X509CertChain = await createCertChain(certChainData);
    let x509Cert: cert.X509Cert = await createCert(trustRootCertPem);
    let caCollection: cert.CertCRLCollection = await createCRL(crl);
    const param: cert.CertChainValidationParameters = {
      date: '20250926080000Z',
      trustAnchors: \[{
        CACert: x509Cert
      }\],
      certCRLs: \[caCollection\],
      revocationCheckParam: {
        options: \[
          cert.RevocationCheckOptions.REVOCATION\_CHECK\_OPTION\_LOCAL\_CRL\_ONLY\_CHECK\_END\_ENTITY\_CERT
        \],
      }
    };
    await x509CertChain.validate(param);
    console.info(\`validate result: success.\`);
  } catch (error) {
    console.error(\`x509CertChain validate failed: errCode: ${error.code}, message: ${error.message}\`);
  }
}

#### 在线校验证书链中的中间CA证书的吊销状态

从API version 22开始，支持在线校验证书链中的中间CA证书的吊销状态。

#### \[h2\]开发步骤

1.  导入[证书模块](https://developer.huawei.com/consumer/cn/doc/harmonyos-references/js-apis-cert)。
    
    import { cert } from '@kit.DeviceCertificateKit';
    
2.  调用[cert.createX509CertChain](https://developer.huawei.com/consumer/cn/doc/harmonyos-references/js-apis-cert#certcreatex509certchain11)创建证书链对象。
    
3.  调用[cert.createX509Cert](https://developer.huawei.com/consumer/cn/doc/harmonyos-references/js-apis-cert#certcreatex509cert)创建X509证书对象。
    
4.  构造[cert.CertChainValidationParameters](https://developer.huawei.com/consumer/cn/doc/harmonyos-references/js-apis-cert#certchainvalidationparameters11)证书链校验参数。
    
5.  调用[cert.validate](https://developer.huawei.com/consumer/cn/doc/harmonyos-references/js-apis-cert#validate11)，传入证书链校验参数，进行证书链校验。
    

![](https://contentcenter-vali-drcn.dbankcdn.cn/pvt_2/DeveloperAlliance_scene_100_1/80/v3/w1zbzMnAT42YqSjXJBp9gg/note_3.0-zh-cn.png?HW-CC-KV=V1&HW-CC-Date=20260612T073408Z&HW-CC-Expire=86400&HW-CC-Sign=13205E7DE1D49659AABC260059288B1F996D8F217D9FB8DFC88439DAA35B8376)

本开发指导中提供的示例代码需要在配置网络的前提下执行。

在线校验中间证书的吊销状态示例：

import { cert } from '@kit.DeviceCertificateKit';

// string转Uint8Array。
function stringToUint8Array(str: string): Uint8Array {
  let arr: number\[\] = \[\];
  for (let i = 0, j = str.length; i < j; i++) {
    arr.push(str.charCodeAt(i));
  }
  return new Uint8Array(arr);
}

async function createCertChain(certData: string): Promise<cert.X509CertChain> {
  // 证书二进制数据，需业务自行赋值。
  let encodingBlob: cert.EncodingBlob = {
    data: stringToUint8Array(certData),
    // 根据encodingData的格式进行赋值，支持FORMAT\_PEM和FORMAT\_DER。
    encodingFormat: cert.EncodingFormat.FORMAT\_PEM
  };

  let x509CertChain: cert.X509CertChain = {} as cert.X509CertChain;
  try {
    x509CertChain = await cert.createX509CertChain(encodingBlob);
  } catch (err) {
    console.error(\`createCertChain failed: errCode: ${err.code}, message: ${err.message}\`);
  }
  return x509CertChain;
}

async function createCert(certData: string): Promise<cert.X509Cert> {
  // 证书二进制数据，需业务自行赋值。
  let encodingBlob: cert.EncodingBlob = {
    data: stringToUint8Array(certData),
    // 根据encodingData的格式进行赋值，支持FORMAT\_PEM和FORMAT\_DER。
    encodingFormat: cert.EncodingFormat.FORMAT\_PEM
  };

  let x509Cert: cert.X509Cert = {} as cert.X509Cert;
  try {
    x509Cert = await cert.createX509Cert(encodingBlob);
  } catch (err) {
    console.error(\`createCert failed: errCode: ${err.code}, message: ${err.message}\`);
  }
  return x509Cert;
}

// ...
async function doTestCaCheck() {
  try {
    let x509CertChain: cert.X509CertChain = await createCertChain(caChain);
    let x509Cert: cert.X509Cert = await createCert(caTrustCert);
    const param: cert.CertChainValidationParameters = {
      trustAnchors: \[{
        CACert: x509Cert
      }\],
      revocationCheckParam: {
        options: \[
          cert.RevocationCheckOptions.REVOCATION\_CHECK\_OPTION\_ACCESS\_NETWORK,
          cert.RevocationCheckOptions.REVOCATION\_CHECK\_OPTION\_CHECK\_INTERMEDIATE\_CA\_ONLINE
        \],
      }
    };
    await x509CertChain.validate(param);
    console.info(\`validate result: success.\`);
  } catch (error) {
    console.error(\`x509CertChain validate failed: errCode: ${error.code}, message: ${error.message}\`);
  }
}

#### 证书链校验时忽略在线证书吊销检查的网络不可达异常

从API version 23开始，支持证书链校验时忽略网络不可达的在线证书吊销检查异常。

#### \[h2\]开发步骤

1.  导入[证书模块](https://developer.huawei.com/consumer/cn/doc/harmonyos-references/js-apis-cert)。
    
    import { cert } from '@kit.DeviceCertificateKit';
    
2.  调用[cert.createX509CertChain](https://developer.huawei.com/consumer/cn/doc/harmonyos-references/js-apis-cert#certcreatex509certchain11-2)创建证书链对象。
    
3.  调用[cert.createX509Cert](https://developer.huawei.com/consumer/cn/doc/harmonyos-references/js-apis-cert#certcreatex509cert)创建X509证书对象。构造 cert.CertChainValidationParameters 证书链校验参数，配置 revocationCheckParam 为 RevocationCheckOptions.REVOCATION\_CHECK\_OPTION\_IGNORE\_NETWORK\_ERROR，以忽略网络不可达的情况。
    
4.  调用[cert.validate](https://developer.huawei.com/consumer/cn/doc/harmonyos-references/js-apis-cert#validate11)，传入证书链校验参数，进行证书链校验。
    

在线CRL检查忽略网络不可达异常示例：

import { cert } from '@kit.DeviceCertificateKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { util } from '@kit.ArkTS';

// string转Uint8Array。
function stringToUint8Array(str: string): Uint8Array {
  const encoder = new util.TextEncoder();
  return encoder.encodeInto(str);
}
// ...
async function createX509Cert(certData: string): Promise<cert.X509Cert> {
  // 证书二进制数据，需业务自行赋值。
  let encodingBlob: cert.EncodingBlob = {
    data: stringToUint8Array(certData),
    // 根据encodingData的格式进行赋值，支持FORMAT\_PEM和FORMAT\_DER。
    encodingFormat: cert.EncodingFormat.FORMAT\_PEM
  };

  let x509Cert: cert.X509Cert = {} as cert.X509Cert;
  try {
    x509Cert = await cert.createX509Cert(encodingBlob);
  } catch (error) {
    let e: BusinessError = error as BusinessError;
    console.error(\`createX509Cert failed: errCode: ${e.code}, message: ${e.message}\`);
  }
  return x509Cert;
}

async function createX509CertChain(): Promise<cert.X509CertChain> {
  const root = await createX509Cert(rootCert);
  const intermediate = await createX509Cert(intermediateCert);
  const leaf = await createX509Cert(leafCert);
  let x509CertChain: cert.X509CertChain = {} as cert.X509CertChain;
  try {
    x509CertChain = cert.createX509CertChain(\[leaf, intermediate, root\]);
  } catch (error) {
    let e: BusinessError = error as BusinessError;
    console.error(\`createX509CertChain failed: errCode: ${e.code}, message: ${e.message}\`);
  }
  return x509CertChain;
}

async function validateCRL() {
  const certChain = await createX509CertChain();
  console.info('createX509CertChain result: success.');
  const root = await createX509Cert(rootCert);
  // 证书链校验数据，需业务自行赋值。
  const param: cert.CertChainValidationParameters = {
    trustAnchors: \[{ CACert: root }\],
    revocationCheckParam: {
      options: \[
        cert.RevocationCheckOptions.REVOCATION\_CHECK\_OPTION\_IGNORE\_NETWORK\_ERROR,
        cert.RevocationCheckOptions.REVOCATION\_CHECK\_OPTION\_ACCESS\_NETWORK
      \],
    }
  }
  try {
    await certChain.validate(param);
    console.info('validateCRL result: success.');
  } catch (err) {
    console.error(\`X509CertChain validate failed: errCode: ${err.code}, message: ${err.message}\`);
  }
}