Module validation 

RFC5755 profile and supplied-certificate checks, without an authorization verdict.

Signature arithmetic, authenticated certificate paths and holder identity, explicit AA trust, evaluation time, targeting/proxy effects, and revocation remain separate obligations (RFC5755 §5). A parsed critical extension is not, by itself, an enforced critical extension. https://www.rfc-editor.org/rfc/rfc5755#section-5

Modules

aa_path

RFC5755 §7.4 restrictions along one explicitly supplied AA certificate path.

Structs

Profile

Static profile facts borrowing the original AC and owning decoded catalogues. A critical extension’s effect must still be enforced before using the AC.

Rejection

Original source of a completed profile or binding refusal.

Enums

Check

A completed check or a located semantic refusal. Execution failures use Result.

HolderMethod

A Holder alternative explicitly chosen by the authenticating protocol. No fallback or precedence is inferred when several alternatives are written.

Reason

A semantic refusal, never a substitute for resource or decoding failure.

Revocation

The issuer’s written revocation scheme, not an authenticated status answer.

Constants

AUDIT_IDENTITY

id-pe-ac-auditIdentity, RFC5755 §4.3.1.

NO_REV_AVAILABLE

id-ce-noRevAvail, RFC5755 §4.3.6.