INNER CODE UNIT · TypeScript

notAfter

certd/certd · packages/core/acme-client/src/crypto/index.ts:531

    const notAfter = new Date(now.getTime() + 24 * 60 * 60 * 1000);
    const commonName = authz.identifier.value;

    /* Pseudo-random serial - max 20 bytes, 11 for epoch (year 5138), 9 random */
    const random = await randomInt(1, 999999999);
    const serialNumber = `${Math.floor(now.getTime() / 1000)}${random}`;

    /* CryptoKeyPair and signing algorithm from private key */
    const [keys, signingAlgorithm] = await getWebCryptoKeyPair(keyPem);

    const extensions = [
        /* TLS 服务端挑战证书只用于签名，不是 CA 证书。 */
        new x509.KeyUsagesExtension(x509.KeyUsageFlags.digitalSignature, true),

        /* https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.6 */
        createSubjectAltNameExtension([commonName]),
    ];

View source record →