src/index.js
function tryVerify (rawBytes) {
  const {
    tbsCertificate,
    tbsCertificate: {
      validity: {
        notBefore: { value: notBefore },
        notAfter: { value: notAfter }
      }
    },
    signatureAlgorithm: { algorithm },
    signature: { data: signature }
  } = Certificate.decode(rawBytes, 'der')

  // Require sha512WithRSAEncryption.
  if (algorithm.join('.') !== '1.2.840.113549.1.1.13') {
    return false
  }

  // Check if certificate is still valid.–
  const now = Date.now()
  if (now < notBefore || now > notAfter) {
    return false
  }
  // Make sure the certificate was signed by CloudFlare's origin pull
  // certificate authority.
  const verifier = createVerify('RSA-SHA512')
  verifier.update(TBSCertificate.encode(tbsCertificate, 'der'))
  return verifier.verify(originPullCa, signature)
}
function tryVerify (rawBytes) {
  const {
    tbsCertificate,
    tbsCertificate: {
      validity: {
        notBefore: { value: notBefore },
        notAfter: { value: notAfter }
      }
    },
    signatureAlgorithm: { algorithm },
    signature: { data: signature }
  } = Certificate.decode(rawBytes, 'der')

  // Require sha512WithRSAEncryption.
  if (algorithm.join('.') !== '1.2.840.113549.1.1.13') {
    return false
  }

  // Check if certificate is still valid.–
  const now = Date.now()
  if (now < notBefore || now > notAfter) {
    return false
  }
  // Make sure the certificate was signed by CloudFlare's origin pull
  // certificate authority.
  const verifier = createVerify('RSA-SHA512')
  verifier.update(TBSCertificate.encode(tbsCertificate, 'der'))
  return verifier.verify(originPullCa, signature)
}
function tryVerify ( rawBytes ) { const { tbsCertificate , tbsCertificate : { validity : { notBefore : { value : notBefore } , notAfter : { value : notAfter } } } , signatureAlgorithm : { algorithm } , signature : { data : signature } } = Certificate . decode ( rawBytes , 'der' ) // Require sha512WithRSAEncryption. if ( algorithm . join ( '.' ) !== '1.2.840.113549.1.1.13' ) { return false } // Check if certificate is still valid.– const now = Date . now ( ) if ( now < notBefore || now > notAfter ) { return false } // Make sure the certificate was signed by CloudFlare's origin pull // certificate authority. const verifier = createVerify ( 'RSA-SHA512' ) verifier . update ( TBSCertificate . encode ( tbsCertificate , 'der' ) ) return verifier . verify ( originPullCa , signature ) }
N.B. This only checks if the timestamps are valid and if the signature matches. Proper certificate validation requires more checks but that seems unnecessary in this case.
N . B . This only checks if the timestamps are valid and if the signature matches . Proper certificate validation requires more checks but that seems unnecessary in this case .