/**
 * @license
 * Copyright 2022-2026 Matter.js Authors
 * SPDX-License-Identifier: Apache-2.0
 */
import { CertificateError, Logger, Time } from "#general";
import { Certificate } from "./Certificate.js";
const logger = Logger.get("OperationalBaseCertificate");
class OperationalBase extends Certificate {
  constructor(cert) {
    super(cert);
    this.validateFields();
  }
  /**
   * Verifies general requirements a Matter certificate fields must fulfill.
   * Rules for this are listed in @see {@link MatterSpecification.v12.Core} §6.5.x
   */
  generalVerify() {
    const cert = this.cert;
    if (cert.serialNumber.byteLength > 20)
      throw new CertificateError(
        `Serial number must not be longer then 20 octets. Current serial number has ${cert.serialNumber.byteLength} octets.`
      );
    if (cert.signatureAlgorithm !== 1) {
      throw new CertificateError(`Unsupported signature algorithm: ${cert.signatureAlgorithm}`);
    }
    if (cert.publicKeyAlgorithm !== 1) {
      throw new CertificateError(`Unsupported public key algorithm: ${cert.publicKeyAlgorithm}`);
    }
    if (cert.ellipticCurveIdentifier !== 1) {
      throw new CertificateError(`Unsupported elliptic curve identifier: ${cert.ellipticCurveIdentifier}`);
    }
    if (Object.keys(cert.subject).length > 5) {
      throw new CertificateError(`Certificate subject must not contain more than 5 RDNs.`);
    }
    if (Object.keys(cert.issuer).length > 5) {
      throw new CertificateError(`Certificate issuer must not contain more than 5 RDNs.`);
    }
    if (cert.notBefore * 1e3 > Time.nowMs) {
      logger.warn(`Certificate notBefore date is in the future: ${cert.notBefore * 1e3} vs ${Time.nowMs}`);
    }
  }
}
export {
  OperationalBase
};
//# sourceMappingURL=OperationalBase.js.map
