Adding upstream version 115.7.0esr.upstream/115.7.0esrupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 1828 insertions, 0 deletions

diff --git a/third_party/js/PKI.js/src/CertificateChainValidationEngine.ts b/third_party/js/PKI.js/src/CertificateChainValidationEngine.ts
new file mode 100644
index 0000000000..66d57b035c
--- /dev/null
+++ b/third_party/js/PKI.js/src/CertificateChainValidationEngine.ts
@@ -0,0 +1,1828 @@
+import * as asn1js from "asn1js";
+import * as pvtsutils from "pvtsutils";
+import * as pvutils from "pvutils";
+import { AuthorityKeyIdentifier } from "./AuthorityKeyIdentifier";
+import { BasicOCSPResponse } from "./BasicOCSPResponse";
+import { Certificate } from "./Certificate";
+import { CertificateRevocationList } from "./CertificateRevocationList";
+import * as common from "./common";
+import * as Helpers from "./Helpers";
+import { GeneralName } from "./GeneralName";
+import { id_AnyPolicy, id_AuthorityInfoAccess, id_AuthorityKeyIdentifier, id_BasicConstraints, id_CertificatePolicies, id_CRLDistributionPoints, id_FreshestCRL, id_InhibitAnyPolicy, id_KeyUsage, id_NameConstraints, id_PolicyConstraints, id_PolicyMappings, id_SubjectAltName, id_SubjectKeyIdentifier } from "./ObjectIdentifiers";
+import { RelativeDistinguishedNames } from "./RelativeDistinguishedNames";
+import { GeneralSubtree } from "./GeneralSubtree";
+import { EMPTY_STRING } from "./constants";
+
+const TRUSTED_CERTS = "trustedCerts";
+const CERTS = "certs";
+const CRLS = "crls";
+const OCSPS = "ocsps";
+const CHECK_DATE = "checkDate";
+const FIND_ORIGIN = "findOrigin";
+const FIND_ISSUER = "findIssuer";
+
+
+export enum ChainValidationCode {
+  unknown = -1,
+  success = 0,
+  noRevocation = 11,
+  noPath = 60,
+  noValidPath = 97,
+}
+
+export class ChainValidationError extends Error {
+
+  public static readonly NAME = "ChainValidationError";
+
+  public code: ChainValidationCode;
+
+  constructor(code: ChainValidationCode, message: string) {
+    super(message);
+
+    this.name = ChainValidationError.NAME;
+    this.code = code;
+    this.message = message;
+  }
+
+}
+
+export interface CertificateChainValidationEngineVerifyResult {
+  result: boolean;
+  resultCode: number;
+  resultMessage: string;
+  error?: Error | ChainValidationError;
+  authConstrPolicies?: string[];
+  userConstrPolicies?: string[];
+  explicitPolicyIndicator?: boolean;
+  policyMappings?: string[];
+  certificatePath?: Certificate[];
+}
+
+export type FindOriginCallback = (certificate: Certificate, validationEngine: CertificateChainValidationEngine) => string;
+export type FindIssuerCallback = (certificate: Certificate, validationEngine: CertificateChainValidationEngine, crypto?: common.ICryptoEngine) => Promise<Certificate[]>;
+
+export interface CertificateChainValidationEngineParameters {
+  trustedCerts?: Certificate[];
+  certs?: Certificate[];
+  crls?: CertificateRevocationList[];
+  ocsps?: BasicOCSPResponse[];
+  checkDate?: Date;
+  findOrigin?: FindOriginCallback;
+  findIssuer?: FindIssuerCallback;
+}
+interface CrlAndCertificate {
+  crl: CertificateRevocationList;
+  certificate: Certificate;
+}
+
+interface FindCrlResult {
+  status: number;
+  statusMessage: string;
+  result?: CrlAndCertificate[];
+}
+
+export interface CertificateChainValidationEngineVerifyParams {
+  initialPolicySet?: string[];
+  initialExplicitPolicy?: boolean;
+  initialPolicyMappingInhibit?: boolean;
+  initialInhibitPolicy?: boolean;
+  initialPermittedSubtreesSet?: GeneralSubtree[];
+  initialExcludedSubtreesSet?: GeneralSubtree[];
+  initialRequiredNameForms?: GeneralSubtree[];
+  passedWhenNotRevValues?: boolean;
+}
+
+/**
+ * Returns `true` if the certificate is in the trusted list, otherwise `false`
+ * @param cert A certificate that is expected to be in the trusted list
+ * @param trustedList List of trusted certificates
+ * @returns
+ */
+function isTrusted(cert: Certificate, trustedList: Certificate[]): boolean {
+  for (let i = 0; i < trustedList.length; i++) {
+    if (pvtsutils.BufferSourceConverter.isEqual(cert.tbsView, trustedList[i].tbsView)) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+/**
+ * Represents a chain-building engine for {@link Certificate} certificates.
+ *
+ * @example
+ * ```js The following example demonstrates how to verify certificate chain
+ * const rootCa = pkijs.Certificate.fromBER(certRaw1);
+ * const intermediateCa = pkijs.Certificate.fromBER(certRaw2);
+ * const leafCert = pkijs.Certificate.fromBER(certRaw3);
+ * const crl1 = pkijs.CertificateRevocationList.fromBER(crlRaw1);
+ * const ocsp1 = pkijs.BasicOCSPResponse.fromBER(ocspRaw1);
+ *
+ * const chainEngine = new pkijs.CertificateChainValidationEngine({
+ *   certs: [rootCa, intermediateCa, leafCert],
+ *   crls: [crl1],
+ *   ocsps: [ocsp1],
+ *   checkDate: new Date("2015-07-13"), // optional
+ *   trustedCerts: [rootCa],
+ * });
+ *
+ * const chain = await chainEngine.verify();
+ * ```
+ */
+export class CertificateChainValidationEngine {
+
+  /**
+   * Array of pre-defined trusted (by user) certificates
+   */
+  public trustedCerts: Certificate[];
+  /**
+   * Array with certificate chain. Could be only one end-user certificate in there!
+   */
+  public certs: Certificate[];
+  /**
+   * Array of all CRLs for all certificates from certificate chain
+   */
+  public crls: CertificateRevocationList[];
+  /**
+   * Array of all OCSP responses
+   */
+  public ocsps: BasicOCSPResponse[];
+  /**
+   * The date at which the check would be
+   */
+  public checkDate: Date;
+  /**
+   * The date at which the check would be
+   */
+  public findOrigin: FindOriginCallback;
+  /**
+   * The date at which the check would be
+   */
+  public findIssuer: FindIssuerCallback;
+
+  /**
+   * Constructor for CertificateChainValidationEngine class
+   * @param parameters
+   */
+  constructor(parameters: CertificateChainValidationEngineParameters = {}) {
+    //#region Internal properties of the object
+    this.trustedCerts = pvutils.getParametersValue(parameters, TRUSTED_CERTS, this.defaultValues(TRUSTED_CERTS));
+    this.certs = pvutils.getParametersValue(parameters, CERTS, this.defaultValues(CERTS));
+    this.crls = pvutils.getParametersValue(parameters, CRLS, this.defaultValues(CRLS));
+    this.ocsps = pvutils.getParametersValue(parameters, OCSPS, this.defaultValues(OCSPS));
+    this.checkDate = pvutils.getParametersValue(parameters, CHECK_DATE, this.defaultValues(CHECK_DATE));
+    this.findOrigin = pvutils.getParametersValue(parameters, FIND_ORIGIN, this.defaultValues(FIND_ORIGIN));
+    this.findIssuer = pvutils.getParametersValue(parameters, FIND_ISSUER, this.defaultValues(FIND_ISSUER));
+    //#endregion
+  }
+
+  public static defaultFindOrigin(certificate: Certificate, validationEngine: CertificateChainValidationEngine): string {
+    //#region Firstly encode TBS for certificate
+    if (certificate.tbsView.byteLength === 0) {
+      certificate.tbsView = new Uint8Array(certificate.encodeTBS().toBER());
+    }
+    //#endregion
+
+    //#region Search in Intermediate Certificates
+    for (const localCert of validationEngine.certs) {
+      //#region Firstly encode TBS for certificate
+      if (localCert.tbsView.byteLength === 0) {
+        localCert.tbsView = new Uint8Array(localCert.encodeTBS().toBER());
+      }
+      //#endregion
+
+      if (pvtsutils.BufferSourceConverter.isEqual(certificate.tbsView, localCert.tbsView))
+        return "Intermediate Certificates";
+    }
+    //#endregion
+
+    //#region Search in Trusted Certificates
+    for (const trustedCert of validationEngine.trustedCerts) {
+      //#region Firstly encode TBS for certificate
+      if (trustedCert.tbsView.byteLength === 0)
+        trustedCert.tbsView = new Uint8Array(trustedCert.encodeTBS().toBER());
+      //#endregion
+
+      if (pvtsutils.BufferSourceConverter.isEqual(certificate.tbsView, trustedCert.tbsView))
+        return "Trusted Certificates";
+    }
+    //#endregion
+
+    return "Unknown";
+  }
+
+  public async defaultFindIssuer(certificate: Certificate, validationEngine: CertificateChainValidationEngine, crypto = common.getCrypto(true)): Promise<Certificate[]> {
+    //#region Initial variables
+    const result: Certificate[] = [];
+
+    let keyIdentifier: asn1js.OctetString | null = null;
+    let authorityCertIssuer: GeneralName[] | null = null;
+    let authorityCertSerialNumber: asn1js.Integer | null = null;
+    //#endregion
+
+    //#region Speed-up searching in case of self-signed certificates
+    if (certificate.subject.isEqual(certificate.issuer)) {
+      try {
+        const verificationResult = await certificate.verify(undefined, crypto);
+        if (verificationResult) {
+          return [certificate];
+        }
+      }
+      catch (ex) {
+        // nothing
+      }
+    }
+    //#endregion
+
+    //#region Find values to speed-up search
+    if (certificate.extensions) {
+      for (const extension of certificate.extensions) {
+        if (extension.extnID === id_AuthorityKeyIdentifier && extension.parsedValue instanceof AuthorityKeyIdentifier) {
+          if (extension.parsedValue.keyIdentifier) {
+            keyIdentifier = extension.parsedValue.keyIdentifier;
+          } else {
+            if (extension.parsedValue.authorityCertIssuer) {
+              authorityCertIssuer = extension.parsedValue.authorityCertIssuer;
+            }
+            if (extension.parsedValue.authorityCertSerialNumber) {
+              authorityCertSerialNumber = extension.parsedValue.authorityCertSerialNumber;
+            }
+          }
+
+          break;
+        }
+      }
+    }
+    //#endregion
+
+    // Aux function
+    function checkCertificate(possibleIssuer: Certificate): void {
+      //#region Firstly search for appropriate extensions
+      if (keyIdentifier !== null) {
+        if (possibleIssuer.extensions) {
+          let extensionFound = false;
+
+          for (const extension of possibleIssuer.extensions) {
+            if (extension.extnID === id_SubjectKeyIdentifier && extension.parsedValue) {
+              extensionFound = true;
+
+              if (pvtsutils.BufferSourceConverter.isEqual(extension.parsedValue.valueBlock.valueHex, keyIdentifier.valueBlock.valueHexView)) {
+                result.push(possibleIssuer);
+              }
+
+              break;
+            }
+          }
+
+          if (extensionFound) {
+            return;
+          }
+        }
+      }
+      //#endregion
+
+      //#region Now search for authorityCertSerialNumber
+      let authorityCertSerialNumberEqual = false;
+
+      if (authorityCertSerialNumber !== null)
+        authorityCertSerialNumberEqual = possibleIssuer.serialNumber.isEqual(authorityCertSerialNumber);
+      //#endregion
+
+      //#region And at least search for Issuer data
+      if (authorityCertIssuer !== null) {
+        if (possibleIssuer.subject.isEqual(authorityCertIssuer)) {
+          if (authorityCertSerialNumberEqual)
+            result.push(possibleIssuer);
+        }
+      }
+      else {
+        if (certificate.issuer.isEqual(possibleIssuer.subject))
+          result.push(possibleIssuer);
+      }
+      //#endregion
+    }
+
+    // Search in Trusted Certificates
+    for (const trustedCert of validationEngine.trustedCerts) {
+      checkCertificate(trustedCert);
+    }
+
+    // Search in Intermediate Certificates
+    for (const intermediateCert of validationEngine.certs) {
+      checkCertificate(intermediateCert);
+    }
+
+    // Now perform certificate verification checking
+    for (let i = 0; i < result.length; i++) {
+      try {
+        const verificationResult = await certificate.verify(result[i], crypto);
+        if (verificationResult === false)
+          result.splice(i, 1);
+      }
+      catch (ex) {
+        result.splice(i, 1); // Something wrong, remove the certificate
+      }
+    }
+
+    return result;
+  }
+
+  /**
+   * Returns default values for all class members
+   * @param memberName String name for a class member
+   * @returns Default value
+   */
+  public defaultValues(memberName: typeof TRUSTED_CERTS): Certificate[];
+  public defaultValues(memberName: typeof CERTS): Certificate[];
+  public defaultValues(memberName: typeof CRLS): CertificateRevocationList[];
+  public defaultValues(memberName: typeof OCSPS): BasicOCSPResponse[];
+  public defaultValues(memberName: typeof CHECK_DATE): Date;
+  public defaultValues(memberName: typeof FIND_ORIGIN): FindOriginCallback;
+  public defaultValues(memberName: typeof FIND_ISSUER): FindIssuerCallback;
+  public defaultValues(memberName: string): any {
+    switch (memberName) {
+      case TRUSTED_CERTS:
+        return [];
+      case CERTS:
+        return [];
+      case CRLS:
+        return [];
+      case OCSPS:
+        return [];
+      case CHECK_DATE:
+        return new Date();
+      case FIND_ORIGIN:
+        return CertificateChainValidationEngine.defaultFindOrigin;
+      case FIND_ISSUER:
+        return this.defaultFindIssuer;
+      default:
+        throw new Error(`Invalid member name for CertificateChainValidationEngine class: ${memberName}`);
+    }
+  }
+
+  public async sort(passedWhenNotRevValues = false, crypto = common.getCrypto(true)): Promise<Certificate[]> {
+    // Initial variables
+    const localCerts: Certificate[] = [];
+
+    //#region Building certificate path
+    const buildPath = async (certificate: Certificate, crypto: common.ICryptoEngine): Promise<Certificate[][]> => {
+      const result: Certificate[][] = [];
+
+      // Aux function checking array for unique elements
+      function checkUnique(array: Certificate[]): boolean {
+        let unique = true;
+
+        for (let i = 0; i < array.length; i++) {
+          for (let j = 0; j < array.length; j++) {
+            if (j === i)
+              continue;
+
+            if (array[i] === array[j]) {
+              unique = false;
+              break;
+            }
+          }
+
+          if (!unique)
+            break;
+        }
+
+        return unique;
+      }
+
+      if (isTrusted(certificate, this.trustedCerts)) {
+        return [[certificate]];
+      }
+
+      const findIssuerResult = await this.findIssuer(certificate, this, crypto);
+      if (findIssuerResult.length === 0) {
+        throw new Error("No valid certificate paths found");
+      }
+
+      for (let i = 0; i < findIssuerResult.length; i++) {
+        if (pvtsutils.BufferSourceConverter.isEqual(findIssuerResult[i].tbsView, certificate.tbsView)) {
+          result.push([findIssuerResult[i]]);
+          continue;
+        }
+
+        const buildPathResult = await buildPath(findIssuerResult[i], crypto);
+
+        for (let j = 0; j < buildPathResult.length; j++) {
+          const copy = buildPathResult[j].slice();
+          copy.splice(0, 0, findIssuerResult[i]);
+
+          if (checkUnique(copy))
+            result.push(copy);
+          else
+            result.push(buildPathResult[j]);
+        }
+      }
+
+      return result;
+    };
+    //#endregion
+
+    //#region Find CRL for specific certificate
+    const findCRL = async (certificate: Certificate): Promise<FindCrlResult> => {
+      //#region Initial variables
+      const issuerCertificates: Certificate[] = [];
+      const crls: CertificateRevocationList[] = [];
+      const crlsAndCertificates: CrlAndCertificate[] = [];
+      //#endregion
+
+      //#region Find all possible CRL issuers
+      issuerCertificates.push(...localCerts.filter(element => certificate.issuer.isEqual(element.subject)));
+      if (issuerCertificates.length === 0) {
+        return {
+          status: 1,
+          statusMessage: "No certificate's issuers"
+        };
+      }
+      //#endregion
+
+      //#region Find all CRLs for certificate's issuer
+      crls.push(...this.crls.filter(o => o.issuer.isEqual(certificate.issuer)));
+      if (crls.length === 0) {
+        return {
+          status: 2,
+          statusMessage: "No CRLs for specific certificate issuer"
+        };
+      }
+      //#endregion
+
+      //#region Find specific certificate of issuer for each CRL
+      for (let i = 0; i < crls.length; i++) {
+        const crl = crls[i];
+        //#region Check "nextUpdate" for the CRL
+        // The "nextUpdate" is older than CHECK_DATE.
+        // Thus we should do have another, updated CRL.
+        // Thus the CRL assumed to be invalid.
+        if (crl.nextUpdate && crl.nextUpdate.value < this.checkDate) {
+          continue;
+        }
+        //#endregion
+
+        for (let j = 0; j < issuerCertificates.length; j++) {
+          try {
+            const result = await crls[i].verify({ issuerCertificate: issuerCertificates[j] }, crypto);
+            if (result) {
+              crlsAndCertificates.push({
+                crl: crls[i],
+                certificate: issuerCertificates[j]
+              });
+
+              break;
+            }
+          }
+          catch (ex) {
+            // nothing
+          }
+        }
+      }
+      //#endregion
+
+      if (crlsAndCertificates.length) {
+        return {
+          status: 0,
+          statusMessage: EMPTY_STRING,
+          result: crlsAndCertificates
+        };
+      }
+
+      return {
+        status: 3,
+        statusMessage: "No valid CRLs found"
+      };
+    };
+    //#endregion
+
+    //#region Find OCSP for specific certificate
+    const findOCSP = async (certificate: Certificate, issuerCertificate: Certificate): Promise<number> => {
+      //#region Get hash algorithm from certificate
+      const hashAlgorithm = crypto.getAlgorithmByOID<any>(certificate.signatureAlgorithm.algorithmId);
+      if (!hashAlgorithm.name) {
+        return 1;
+      }
+      if (!hashAlgorithm.hash) {
+        return 1;
+      }
+      //#endregion
+
+      //#region Search for OCSP response for the certificate
+      for (let i = 0; i < this.ocsps.length; i++) {
+        const ocsp = this.ocsps[i];
+        const result = await ocsp.getCertificateStatus(certificate, issuerCertificate, crypto);
+        if (result.isForCertificate) {
+          if (result.status === 0)
+            return 0;
+
+          return 1;
+        }
+      }
+      //#endregion
+
+      return 2;
+    };
+    //#endregion
+
+    //#region Check for certificate to be CA
+    async function checkForCA(certificate: Certificate, needToCheckCRL = false) {
+      //#region Initial variables
+      let isCA = false;
+      let mustBeCA = false;
+      let keyUsagePresent = false;
+      let cRLSign = false;
+      //#endregion
+
+      if (certificate.extensions) {
+        for (let j = 0; j < certificate.extensions.length; j++) {
+          const extension = certificate.extensions[j];
+          if (extension.critical && !extension.parsedValue) {
+            return {
+              result: false,
+              resultCode: 6,
+              resultMessage: `Unable to parse critical certificate extension: ${extension.extnID}`
+            };
+          }
+
+          if (extension.extnID === id_KeyUsage) // KeyUsage
+          {
+            keyUsagePresent = true;
+
+            const view = new Uint8Array(extension.parsedValue.valueBlock.valueHex);
+
+            if ((view[0] & 0x04) === 0x04) // Set flag "keyCertSign"
+              mustBeCA = true;
+
+            if ((view[0] & 0x02) === 0x02) // Set flag "cRLSign"
+              cRLSign = true;
+          }
+
+          if (extension.extnID === id_BasicConstraints) // BasicConstraints
+          {
+            if ("cA" in extension.parsedValue) {
+              if (extension.parsedValue.cA === true)
+                isCA = true;
+            }
+          }
+        }
+
+        if ((mustBeCA === true) && (isCA === false)) {
+          return {
+            result: false,
+            resultCode: 3,
+            resultMessage: "Unable to build certificate chain - using \"keyCertSign\" flag set without BasicConstraints"
+          };
+        }
+
+        if ((keyUsagePresent === true) && (isCA === true) && (mustBeCA === false)) {
+          return {
+            result: false,
+            resultCode: 4,
+            resultMessage: "Unable to build certificate chain - \"keyCertSign\" flag was not set"
+          };
+        }
+
+        if ((isCA === true) && (keyUsagePresent === true) && ((needToCheckCRL) && (cRLSign === false))) {
+          return {
+            result: false,
+            resultCode: 5,
+            resultMessage: "Unable to build certificate chain - intermediate certificate must have \"cRLSign\" key usage flag"
+          };
+        }
+      }
+
+      if (isCA === false) {
+        return {
+          result: false,
+          resultCode: 7,
+          resultMessage: "Unable to build certificate chain - more than one possible end-user certificate"
+        };
+      }
+
+      return {
+        result: true,
+        resultCode: 0,
+        resultMessage: EMPTY_STRING
+      };
+    }
+    //#endregion
+
+    //#region Basic check for certificate path
+    const basicCheck = async (path: Certificate[], checkDate: Date): Promise<{ result: boolean; resultCode?: number; resultMessage?: string; }> => {
+      //#region Check that all dates are valid
+      for (let i = 0; i < path.length; i++) {
+        if ((path[i].notBefore.value > checkDate) ||
+          (path[i].notAfter.value < checkDate)) {
+          return {
+            result: false,
+            resultCode: 8,
+            resultMessage: "The certificate is either not yet valid or expired"
+          };
+        }
+      }
+      //#endregion
+
+      //#region Check certificate name chain
+
+      // We should have at least two certificates: end entity and trusted root
+      if (path.length < 2) {
+        return {
+          result: false,
+          resultCode: 9,
+          resultMessage: "Too short certificate path"
+        };
+      }
+
+      for (let i = (path.length - 2); i >= 0; i--) {
+        //#region Check that we do not have a "self-signed" certificate
+        if (path[i].issuer.isEqual(path[i].subject) === false) {
+          if (path[i].issuer.isEqual(path[i + 1].subject) === false) {
+            return {
+              result: false,
+              resultCode: 10,
+              resultMessage: "Incorrect name chaining"
+            };
+          }
+        }
+        //#endregion
+      }
+      //#endregion
+
+      //#region Check each certificate (except "trusted root") to be non-revoked
+      if ((this.crls.length !== 0) || (this.ocsps.length !== 0)) // If CRLs and OCSPs are empty then we consider all certificates to be valid
+      {
+        for (let i = 0; i < (path.length - 1); i++) {
+          //#region Initial variables
+          let ocspResult = 2;
+          let crlResult: FindCrlResult = {
+            status: 0,
+            statusMessage: EMPTY_STRING
+          };
+          //#endregion
+
+          //#region Check OCSPs first
+          if (this.ocsps.length !== 0) {
+            ocspResult = await findOCSP(path[i], path[i + 1]);
+
+            switch (ocspResult) {
+              case 0:
+                continue;
+              case 1:
+                return {
+                  result: false,
+                  resultCode: 12,
+                  resultMessage: "One of certificates was revoked via OCSP response"
+                };
+              case 2: // continue to check the certificate with CRL
+                break;
+              default:
+            }
+          }
+          //#endregion
+
+          //#region Check CRLs
+          if (this.crls.length !== 0) {
+            crlResult = await findCRL(path[i]);
+
+            if (crlResult.status === 0 && crlResult.result) {
+              for (let j = 0; j < crlResult.result.length; j++) {
+                //#region Check that the CRL issuer certificate have not been revoked
+                const isCertificateRevoked = crlResult.result[j].crl.isCertificateRevoked(path[i]);
+                if (isCertificateRevoked) {
+                  return {
+                    result: false,
+                    resultCode: 12,
+                    resultMessage: "One of certificates had been revoked"
+                  };
+                }
+                //#endregion
+
+                //#region Check that the CRL issuer certificate is a CA certificate
+                const isCertificateCA = await checkForCA(crlResult.result[j].certificate, true);
+                if (isCertificateCA.result === false) {
+                  return {
+                    result: false,
+                    resultCode: 13,
+                    resultMessage: "CRL issuer certificate is not a CA certificate or does not have crlSign flag"
+                  };
+                }
+                //#endregion
+              }
+            } else {
+              if (passedWhenNotRevValues === false) {
+                throw new ChainValidationError(ChainValidationCode.noRevocation, `No revocation values found for one of certificates: ${crlResult.statusMessage}`);
+              }
+            }
+          } else {
+            if (ocspResult === 2) {
+              return {
+                result: false,
+                resultCode: 11,
+                resultMessage: "No revocation values found for one of certificates"
+              };
+            }
+          }
+          //#endregion
+
+          //#region Check we do have links to revocation values inside issuer's certificate
+          if ((ocspResult === 2) && (crlResult.status === 2) && passedWhenNotRevValues) {
+            const issuerCertificate = path[i + 1];
+            let extensionFound = false;
+
+            if (issuerCertificate.extensions) {
+              for (const extension of issuerCertificate.extensions) {
+                switch (extension.extnID) {
+                  case id_CRLDistributionPoints:
+                  case id_FreshestCRL:
+                  case id_AuthorityInfoAccess:
+                    extensionFound = true;
+                    break;
+                  default:
+                }
+              }
+            }
+
+            if (extensionFound) {
+              throw new ChainValidationError(ChainValidationCode.noRevocation, `No revocation values found for one of certificates: ${crlResult.statusMessage}`);
+            }
+          }
+          //#endregion
+        }
+      }
+      //#endregion
+
+      //#region Check each certificate (except "end entity") in the path to be a CA certificate
+      for (const [i, cert] of path.entries()) {
+        if (!i) {
+          // Skip entity certificate
+          continue;
+        }
+
+        const result = await checkForCA(cert);
+        if (!result.result) {
+          return {
+            result: false,
+            resultCode: 14,
+            resultMessage: "One of intermediate certificates is not a CA certificate"
+          };
+        }
+      }
+      //#endregion
+
+      return {
+        result: true
+      };
+    };
+    //#endregion
+
+    //#region Do main work
+    //#region Initialize "localCerts" by value of "this.certs" + "this.trustedCerts" arrays
+    localCerts.push(...this.trustedCerts);
+    localCerts.push(...this.certs);
+    //#endregion
+
+    //#region Check all certificates for been unique
+    for (let i = 0; i < localCerts.length; i++) {
+      for (let j = 0; j < localCerts.length; j++) {
+        if (i === j)
+          continue;
+
+        if (pvtsutils.BufferSourceConverter.isEqual(localCerts[i].tbsView, localCerts[j].tbsView)) {
+          localCerts.splice(j, 1);
+          i = 0;
+          break;
+        }
+      }
+    }
+    //#endregion
+
+    const leafCert = localCerts[localCerts.length - 1];
+
+    //#region Initial variables
+    let result;
+    const certificatePath = [leafCert]; // The "end entity" certificate must be the least in CERTS array
+    //#endregion
+
+    //#region Build path for "end entity" certificate
+    result = await buildPath(leafCert, crypto);
+    if (result.length === 0) {
+      throw new ChainValidationError(ChainValidationCode.noPath, "Unable to find certificate path");
+    }
+    //#endregion
+
+    //#region Exclude certificate paths not ended with "trusted roots"
+    for (let i = 0; i < result.length; i++) {
+      let found = false;
+
+      for (let j = 0; j < (result[i]).length; j++) {
+        const certificate = (result[i])[j];
+
+        for (let k = 0; k < this.trustedCerts.length; k++) {
+          if (pvtsutils.BufferSourceConverter.isEqual(certificate.tbsView, this.trustedCerts[k].tbsView)) {
+            found = true;
+            break;
+          }
+        }
+
+        if (found)
+          break;
+      }
+
+      if (!found) {
+        result.splice(i, 1);
+        i = 0;
+      }
+    }
+
+    if (result.length === 0) {
+      throw new ChainValidationError(ChainValidationCode.noValidPath, "No valid certificate paths found");
+    }
+    //#endregion
+
+    //#region Find shortest certificate path (for the moment it is the only criteria)
+    let shortestLength = result[0].length;
+    let shortestIndex = 0;
+
+    for (let i = 0; i < result.length; i++) {
+      if (result[i].length < shortestLength) {
+        shortestLength = result[i].length;
+        shortestIndex = i;
+      }
+    }
+    //#endregion
+
+    //#region Create certificate path for basic check
+    for (let i = 0; i < result[shortestIndex].length; i++)
+      certificatePath.push((result[shortestIndex])[i]);
+    //#endregion
+
+    //#region Perform basic checking for all certificates in the path
+    result = await basicCheck(certificatePath, this.checkDate);
+    if (result.result === false)
+      throw result;
+    //#endregion
+
+    return certificatePath;
+    //#endregion
+  }
+
+  /**
+   * Major verification function for certificate chain.
+   * @param parameters
+   * @param crypto Crypto engine
+   * @returns
+   */
+  async verify(parameters: CertificateChainValidationEngineVerifyParams = {}, crypto = common.getCrypto(true)): Promise<CertificateChainValidationEngineVerifyResult> {
+    //#region Auxiliary functions for name constraints checking
+    /**
+     * Compare two dNSName values
+     * @param name DNS from name
+     * @param constraint Constraint for DNS from name
+     * @returns Boolean result - valid or invalid the "name" against the "constraint"
+     */
+    function compareDNSName(name: string, constraint: string): boolean {
+      //#region Make a "string preparation" for both name and constrain
+      const namePrepared = Helpers.stringPrep(name);
+      const constraintPrepared = Helpers.stringPrep(constraint);
+      //#endregion
+
+      //#region Make a "splitted" versions of "constraint" and "name"
+      const nameSplitted = namePrepared.split(".");
+      const constraintSplitted = constraintPrepared.split(".");
+      //#endregion
+
+      //#region Length calculation and additional check
+      const nameLen = nameSplitted.length;
+      const constrLen = constraintSplitted.length;
+
+      if ((nameLen === 0) || (constrLen === 0) || (nameLen < constrLen)) {
+        return false;
+      }
+      //#endregion
+
+      //#region Check that no part of "name" has zero length
+      for (let i = 0; i < nameLen; i++) {
+        if (nameSplitted[i].length === 0) {
+          return false;
+        }
+      }
+      //#endregion
+
+      //#region Check that no part of "constraint" has zero length
+      for (let i = 0; i < constrLen; i++) {
+        if (constraintSplitted[i].length === 0) {
+          if (i === 0) {
+            if (constrLen === 1) {
+              return false;
+            }
+
+            continue;
+          }
+
+          return false;
+        }
+      }
+      //#endregion
+
+      //#region Check that "name" has a tail as "constraint"
+
+      for (let i = 0; i < constrLen; i++) {
+        if (constraintSplitted[constrLen - 1 - i].length === 0) {
+          continue;
+        }
+
+        if (nameSplitted[nameLen - 1 - i].localeCompare(constraintSplitted[constrLen - 1 - i]) !== 0) {
+          return false;
+        }
+      }
+      //#endregion
+
+      return true;
+    }
+
+    /**
+     * Compare two rfc822Name values
+     * @param name E-mail address from name
+     * @param constraint Constraint for e-mail address from name
+     * @returns Boolean result - valid or invalid the "name" against the "constraint"
+     */
+    function compareRFC822Name(name: string, constraint: string): boolean {
+      //#region Make a "string preparation" for both name and constrain
+      const namePrepared = Helpers.stringPrep(name);
+      const constraintPrepared = Helpers.stringPrep(constraint);
+      //#endregion
+
+      //#region Make a "splitted" versions of "constraint" and "name"
+      const nameSplitted = namePrepared.split("@");
+      const constraintSplitted = constraintPrepared.split("@");
+      //#endregion
+
+      //#region Splitted array length checking
+      if ((nameSplitted.length === 0) || (constraintSplitted.length === 0) || (nameSplitted.length < constraintSplitted.length))
+        return false;
+      //#endregion
+
+      if (constraintSplitted.length === 1) {
+        const result = compareDNSName(nameSplitted[1], constraintSplitted[0]);
+
+        if (result) {
+          //#region Make a "splitted" versions of domain name from "constraint" and "name"
+          const ns = nameSplitted[1].split(".");
+          const cs = constraintSplitted[0].split(".");
+          //#endregion
+
+          if (cs[0].length === 0)
+            return true;
+
+          return ns.length === cs.length;
+        }
+
+        return false;
+      }
+
+      return (namePrepared.localeCompare(constraintPrepared) === 0);
+    }
+
+    /**
+     * Compare two uniformResourceIdentifier values
+     * @param name uniformResourceIdentifier from name
+     * @param constraint Constraint for uniformResourceIdentifier from name
+     * @returns Boolean result - valid or invalid the "name" against the "constraint"
+     */
+    function compareUniformResourceIdentifier(name: string, constraint: string): boolean {
+      //#region Make a "string preparation" for both name and constrain
+      let namePrepared = Helpers.stringPrep(name);
+      const constraintPrepared = Helpers.stringPrep(constraint);
+      //#endregion
+
+      //#region Find out a major URI part to compare with
+      const ns = namePrepared.split("/");
+      const cs = constraintPrepared.split("/");
+
+      if (cs.length > 1) // Malformed constraint
+        return false;
+
+      if (ns.length > 1) // Full URI string
+      {
+        for (let i = 0; i < ns.length; i++) {
+          if ((ns[i].length > 0) && (ns[i].charAt(ns[i].length - 1) !== ":")) {
+            const nsPort = ns[i].split(":");
+            namePrepared = nsPort[0];
+            break;
+          }
+        }
+      }
+      //#endregion
+
+      const result = compareDNSName(namePrepared, constraintPrepared);
+
+      if (result) {
+        //#region Make a "splitted" versions of "constraint" and "name"
+        const nameSplitted = namePrepared.split(".");
+        const constraintSplitted = constraintPrepared.split(".");
+        //#endregion
+
+        if (constraintSplitted[0].length === 0)
+          return true;
+
+        return nameSplitted.length === constraintSplitted.length;
+      }
+
+      return false;
+    }
+
+    /**
+     * Compare two iPAddress values
+     * @param name iPAddress from name
+     * @param constraint Constraint for iPAddress from name
+     * @returns Boolean result - valid or invalid the "name" against the "constraint"
+     */
+    function compareIPAddress(name: asn1js.OctetString, constraint: asn1js.OctetString): boolean {
+      //#region Common variables
+      const nameView = name.valueBlock.valueHexView;
+      const constraintView = constraint.valueBlock.valueHexView;
+      //#endregion
+
+      //#region Work with IPv4 addresses
+      if ((nameView.length === 4) && (constraintView.length === 8)) {
+        for (let i = 0; i < 4; i++) {
+          if ((nameView[i] ^ constraintView[i]) & constraintView[i + 4])
+            return false;
+        }
+
+        return true;
+      }
+      //#endregion
+
+      //#region Work with IPv6 addresses
+      if ((nameView.length === 16) && (constraintView.length === 32)) {
+        for (let i = 0; i < 16; i++) {
+          if ((nameView[i] ^ constraintView[i]) & constraintView[i + 16])
+            return false;
+        }
+
+        return true;
+      }
+      //#endregion
+
+      return false;
+    }
+
+    /**
+     * Compare two directoryName values
+     * @param name directoryName from name
+     * @param constraint Constraint for directoryName from name
+     * @returns Boolean result - valid or invalid the "name" against the "constraint"
+     */
+    function compareDirectoryName(name: RelativeDistinguishedNames, constraint: RelativeDistinguishedNames): boolean {
+      //#region Initial check
+      if ((name.typesAndValues.length === 0) || (constraint.typesAndValues.length === 0))
+        return true;
+
+      if (name.typesAndValues.length < constraint.typesAndValues.length)
+        return false;
+      //#endregion
+
+      //#region Initial variables
+      let result = true;
+      let nameStart = 0;
+      //#endregion
+
+      for (let i = 0; i < constraint.typesAndValues.length; i++) {
+        let localResult = false;
+
+        for (let j = nameStart; j < name.typesAndValues.length; j++) {
+          localResult = name.typesAndValues[j].isEqual(constraint.typesAndValues[i]);
+
+          if (name.typesAndValues[j].type === constraint.typesAndValues[i].type)
+            result = result && localResult;
+
+          if (localResult === true) {
+            if ((nameStart === 0) || (nameStart === j)) {
+              nameStart = j + 1;
+              break;
+            }
+            else // Structure of "name" must be the same with "constraint"
+              return false;
+          }
+        }
+
+        if (localResult === false)
+          return false;
+      }
+
+      return (nameStart === 0) ? false : result;
+    }
+    //#endregion
+
+    try {
+      //#region Initial checks
+      if (this.certs.length === 0)
+        throw new Error("Empty certificate array");
+      //#endregion
+
+      //#region Get input variables
+      const passedWhenNotRevValues = parameters.passedWhenNotRevValues || false;
+
+      const initialPolicySet = parameters.initialPolicySet || [id_AnyPolicy];
+
+      const initialExplicitPolicy = parameters.initialExplicitPolicy || false;
+      const initialPolicyMappingInhibit = parameters.initialPolicyMappingInhibit || false;
+      const initialInhibitPolicy = parameters.initialInhibitPolicy || false;
+
+      const initialPermittedSubtreesSet = parameters.initialPermittedSubtreesSet || [];
+      const initialExcludedSubtreesSet = parameters.initialExcludedSubtreesSet || [];
+      const initialRequiredNameForms = parameters.initialRequiredNameForms || [];
+
+      let explicitPolicyIndicator = initialExplicitPolicy;
+      let policyMappingInhibitIndicator = initialPolicyMappingInhibit;
+      let inhibitAnyPolicyIndicator = initialInhibitPolicy;
+
+      const pendingConstraints = [
+        false, // For "explicitPolicyPending"
+        false, // For "policyMappingInhibitPending"
+        false, // For "inhibitAnyPolicyPending"
+      ];
+
+      let explicitPolicyPending = 0;
+      let policyMappingInhibitPending = 0;
+      let inhibitAnyPolicyPending = 0;
+
+      let permittedSubtrees = initialPermittedSubtreesSet;
+      let excludedSubtrees = initialExcludedSubtreesSet;
+      const requiredNameForms = initialRequiredNameForms;
+
+      let pathDepth = 1;
+      //#endregion
+
+      //#region Sorting certificates in the chain array
+      this.certs = await this.sort(passedWhenNotRevValues, crypto);
+      //#endregion
+
+      //#region Work with policies
+      //#region Support variables
+      const allPolicies: string[] = []; // Array of all policies (string values)
+      allPolicies.push(id_AnyPolicy); // Put "anyPolicy" at first place
+
+      const policiesAndCerts = []; // In fact "array of array" where rows are for each specific policy, column for each certificate and value is "true/false"
+
+      const anyPolicyArray = new Array(this.certs.length - 1); // Minus "trusted anchor"
+      for (let ii = 0; ii < (this.certs.length - 1); ii++)
+        anyPolicyArray[ii] = true;
+
+      policiesAndCerts.push(anyPolicyArray);
+
+      const policyMappings = new Array(this.certs.length - 1); // Array of "PolicyMappings" for each certificate
+      const certPolicies = new Array(this.certs.length - 1); // Array of "CertificatePolicies" for each certificate
+
+      let explicitPolicyStart = (explicitPolicyIndicator) ? (this.certs.length - 1) : (-1);
+      //#endregion
+
+      //#region Gather all necessary information from certificate chain
+      for (let i = (this.certs.length - 2); i >= 0; i--, pathDepth++) {
+        const cert = this.certs[i];
+        if (cert.extensions) {
+          //#region Get information about certificate extensions
+          for (let j = 0; j < cert.extensions.length; j++) {
+            const extension = cert.extensions[j];
+            //#region CertificatePolicies
+            if (extension.extnID === id_CertificatePolicies) {
+              certPolicies[i] = extension.parsedValue;
+
+              //#region Remove entry from "anyPolicies" for the certificate
+              for (let s = 0; s < allPolicies.length; s++) {
+                if (allPolicies[s] === id_AnyPolicy) {
+                  delete (policiesAndCerts[s])[i];
+                  break;
+                }
+              }
+              //#endregion
+
+              for (let k = 0; k < extension.parsedValue.certificatePolicies.length; k++) {
+                let policyIndex = (-1);
+                const policyId = extension.parsedValue.certificatePolicies[k].policyIdentifier;
+
+                //#region Try to find extension in "allPolicies" array
+                for (let s = 0; s < allPolicies.length; s++) {
+                  if (policyId === allPolicies[s]) {
+                    policyIndex = s;
+                    break;
+                  }
+                }
+                //#endregion
+
+                if (policyIndex === (-1)) {
+                  allPolicies.push(policyId);
+
+                  const certArray = new Array(this.certs.length - 1);
+                  certArray[i] = true;
+
+                  policiesAndCerts.push(certArray);
+                }
+                else
+                  (policiesAndCerts[policyIndex])[i] = true;
+              }
+            }
+            //#endregion
+
+            //#region PolicyMappings
+            if (extension.extnID === id_PolicyMappings) {
+              if (policyMappingInhibitIndicator) {
+                return {
+                  result: false,
+                  resultCode: 98,
+                  resultMessage: "Policy mapping prohibited"
+                };
+              }
+
+              policyMappings[i] = extension.parsedValue;
+            }
+            //#endregion
+
+            //#region PolicyConstraints
+            if (extension.extnID === id_PolicyConstraints) {
+              if (explicitPolicyIndicator === false) {
+                //#region requireExplicitPolicy
+                if (extension.parsedValue.requireExplicitPolicy === 0) {
+                  explicitPolicyIndicator = true;
+                  explicitPolicyStart = i;
+                }
+                else {
+                  if (pendingConstraints[0] === false) {
+                    pendingConstraints[0] = true;
+                    explicitPolicyPending = extension.parsedValue.requireExplicitPolicy;
+                  }
+                  else
+                    explicitPolicyPending = (explicitPolicyPending > extension.parsedValue.requireExplicitPolicy) ? extension.parsedValue.requireExplicitPolicy : explicitPolicyPending;
+                }
+                //#endregion
+
+                //#region inhibitPolicyMapping
+                if (extension.parsedValue.inhibitPolicyMapping === 0)
+                  policyMappingInhibitIndicator = true;
+                else {
+                  if (pendingConstraints[1] === false) {
+                    pendingConstraints[1] = true;
+                    policyMappingInhibitPending = extension.parsedValue.inhibitPolicyMapping + 1;
+                  }
+                  else
+                    policyMappingInhibitPending = (policyMappingInhibitPending > (extension.parsedValue.inhibitPolicyMapping + 1)) ? (extension.parsedValue.inhibitPolicyMapping + 1) : policyMappingInhibitPending;
+                }
+                //#endregion
+              }
+            }
+            //#endregion
+
+            //#region InhibitAnyPolicy
+            if (extension.extnID === id_InhibitAnyPolicy) {
+              if (inhibitAnyPolicyIndicator === false) {
+                if (extension.parsedValue.valueBlock.valueDec === 0)
+                  inhibitAnyPolicyIndicator = true;
+                else {
+                  if (pendingConstraints[2] === false) {
+                    pendingConstraints[2] = true;
+                    inhibitAnyPolicyPending = extension.parsedValue.valueBlock.valueDec;
+                  }
+                  else
+                    inhibitAnyPolicyPending = (inhibitAnyPolicyPending > extension.parsedValue.valueBlock.valueDec) ? extension.parsedValue.valueBlock.valueDec : inhibitAnyPolicyPending;
+                }
+              }
+            }
+            //#endregion
+          }
+          //#endregion
+
+          //#region Check "inhibitAnyPolicyIndicator"
+          if (inhibitAnyPolicyIndicator === true) {
+            let policyIndex = (-1);
+
+            //#region Find "anyPolicy" index
+            for (let searchAnyPolicy = 0; searchAnyPolicy < allPolicies.length; searchAnyPolicy++) {
+              if (allPolicies[searchAnyPolicy] === id_AnyPolicy) {
+                policyIndex = searchAnyPolicy;
+                break;
+              }
+            }
+            //#endregion
+
+            if (policyIndex !== (-1))
+              delete (policiesAndCerts[0])[i]; // Unset value to "undefined" for "anyPolicies" value for current certificate
+          }
+          //#endregion
+
+          //#region Process with "pending constraints"
+          if (explicitPolicyIndicator === false) {
+            if (pendingConstraints[0] === true) {
+              explicitPolicyPending--;
+              if (explicitPolicyPending === 0) {
+                explicitPolicyIndicator = true;
+                explicitPolicyStart = i;
+
+                pendingConstraints[0] = false;
+              }
+            }
+          }
+
+          if (policyMappingInhibitIndicator === false) {
+            if (pendingConstraints[1] === true) {
+              policyMappingInhibitPending--;
+              if (policyMappingInhibitPending === 0) {
+                policyMappingInhibitIndicator = true;
+                pendingConstraints[1] = false;
+              }
+            }
+          }
+
+          if (inhibitAnyPolicyIndicator === false) {
+            if (pendingConstraints[2] === true) {
+              inhibitAnyPolicyPending--;
+              if (inhibitAnyPolicyPending === 0) {
+                inhibitAnyPolicyIndicator = true;
+                pendingConstraints[2] = false;
+              }
+            }
+          }
+          //#endregion
+        }
+      }
+      //#endregion
+
+      //#region Working with policy mappings
+      for (let i = 0; i < (this.certs.length - 1); i++) {
+        //#region Check that there is "policy mapping" for level "i + 1"
+        if ((i < (this.certs.length - 2)) && (typeof policyMappings[i + 1] !== "undefined")) {
+          for (let k = 0; k < policyMappings[i + 1].mappings.length; k++) {
+            //#region Check that we do not have "anyPolicy" in current mapping
+            if ((policyMappings[i + 1].mappings[k].issuerDomainPolicy === id_AnyPolicy) || (policyMappings[i + 1].mappings[k].subjectDomainPolicy === id_AnyPolicy)) {
+              return {
+                result: false,
+                resultCode: 99,
+                resultMessage: "The \"anyPolicy\" should not be a part of policy mapping scheme"
+              };
+            }
+            //#endregion
+
+            //#region Initial variables
+            let issuerDomainPolicyIndex = (-1);
+            let subjectDomainPolicyIndex = (-1);
+            //#endregion
+
+            //#region Search for index of policies indexes
+            for (let n = 0; n < allPolicies.length; n++) {
+              if (allPolicies[n] === policyMappings[i + 1].mappings[k].issuerDomainPolicy)
+                issuerDomainPolicyIndex = n;
+
+              if (allPolicies[n] === policyMappings[i + 1].mappings[k].subjectDomainPolicy)
+                subjectDomainPolicyIndex = n;
+            }
+            //#endregion
+
+            //#region Delete existing "issuerDomainPolicy" because on the level we mapped the policy to another one
+            if (typeof (policiesAndCerts[issuerDomainPolicyIndex])[i] !== "undefined")
+              delete (policiesAndCerts[issuerDomainPolicyIndex])[i];
+            //#endregion
+
+            //#region Check all policies for the certificate
+            for (let j = 0; j < certPolicies[i].certificatePolicies.length; j++) {
+              if (policyMappings[i + 1].mappings[k].subjectDomainPolicy === certPolicies[i].certificatePolicies[j].policyIdentifier) {
+                //#region Set mapped policy for current certificate
+                if ((issuerDomainPolicyIndex !== (-1)) && (subjectDomainPolicyIndex !== (-1))) {
+                  for (let m = 0; m <= i; m++) {
+                    if (typeof (policiesAndCerts[subjectDomainPolicyIndex])[m] !== "undefined") {
+                      (policiesAndCerts[issuerDomainPolicyIndex])[m] = true;
+                      delete (policiesAndCerts[subjectDomainPolicyIndex])[m];
+                    }
+                  }
+                }
+                //#endregion
+              }
+            }
+            //#endregion
+          }
+        }
+        //#endregion
+      }
+      //#endregion
+
+      //#region Working with "explicitPolicyIndicator" and "anyPolicy"
+      for (let i = 0; i < allPolicies.length; i++) {
+        if (allPolicies[i] === id_AnyPolicy) {
+          for (let j = 0; j < explicitPolicyStart; j++)
+            delete (policiesAndCerts[i])[j];
+        }
+      }
+      //#endregion
+
+      //#region Create "set of authorities-constrained policies"
+      const authConstrPolicies = [];
+
+      for (let i = 0; i < policiesAndCerts.length; i++) {
+        let found = true;
+
+        for (let j = 0; j < (this.certs.length - 1); j++) {
+          let anyPolicyFound = false;
+
+          if ((j < explicitPolicyStart) && (allPolicies[i] === id_AnyPolicy) && (allPolicies.length > 1)) {
+            found = false;
+            break;
+          }
+
+          if (typeof (policiesAndCerts[i])[j] === "undefined") {
+            if (j >= explicitPolicyStart) {
+              //#region Search for "anyPolicy" in the policy set
+              for (let k = 0; k < allPolicies.length; k++) {
+                if (allPolicies[k] === id_AnyPolicy) {
+                  if ((policiesAndCerts[k])[j] === true)
+                    anyPolicyFound = true;
+
+                  break;
+                }
+              }
+              //#endregion
+            }
+
+            if (!anyPolicyFound) {
+              found = false;
+              break;
+            }
+          }
+        }
+
+        if (found === true)
+          authConstrPolicies.push(allPolicies[i]);
+      }
+      //#endregion
+
+      //#region Create "set of user-constrained policies"
+      let userConstrPolicies: string[] = [];
+
+      if ((initialPolicySet.length === 1) && (initialPolicySet[0] === id_AnyPolicy) && (explicitPolicyIndicator === false))
+        userConstrPolicies = initialPolicySet;
+      else {
+        if ((authConstrPolicies.length === 1) && (authConstrPolicies[0] === id_AnyPolicy))
+          userConstrPolicies = initialPolicySet;
+        else {
+          for (let i = 0; i < authConstrPolicies.length; i++) {
+            for (let j = 0; j < initialPolicySet.length; j++) {
+              if ((initialPolicySet[j] === authConstrPolicies[i]) || (initialPolicySet[j] === id_AnyPolicy)) {
+                userConstrPolicies.push(authConstrPolicies[i]);
+                break;
+              }
+            }
+          }
+        }
+      }
+
+      //#endregion
+
+      //#region Combine output object
+      const policyResult: CertificateChainValidationEngineVerifyResult = {
+        result: (userConstrPolicies.length > 0),
+        resultCode: 0,
+        resultMessage: (userConstrPolicies.length > 0) ? EMPTY_STRING : "Zero \"userConstrPolicies\" array, no intersections with \"authConstrPolicies\"",
+        authConstrPolicies,
+        userConstrPolicies,
+        explicitPolicyIndicator,
+        policyMappings,
+        certificatePath: this.certs
+      };
+
+      if (userConstrPolicies.length === 0)
+        return policyResult;
+      //#endregion
+      //#endregion
+
+      //#region Work with name constraints
+      //#region Check a result from "policy checking" part
+      if (policyResult.result === false)
+        return policyResult;
+      //#endregion
+
+      //#region Check all certificates, excluding "trust anchor"
+      pathDepth = 1;
+
+      for (let i = (this.certs.length - 2); i >= 0; i--, pathDepth++) {
+        const cert = this.certs[i];
+        //#region Support variables
+        let subjectAltNames: GeneralName[] = [];
+
+        let certPermittedSubtrees: GeneralSubtree[] = [];
+        let certExcludedSubtrees: GeneralSubtree[] = [];
+        //#endregion
+
+        if (cert.extensions) {
+          for (let j = 0; j < cert.extensions.length; j++) {
+            const extension = cert.extensions[j];
+            //#region NameConstraints
+            if (extension.extnID === id_NameConstraints) {
+              if ("permittedSubtrees" in extension.parsedValue)
+                certPermittedSubtrees = certPermittedSubtrees.concat(extension.parsedValue.permittedSubtrees);
+
+              if ("excludedSubtrees" in extension.parsedValue)
+                certExcludedSubtrees = certExcludedSubtrees.concat(extension.parsedValue.excludedSubtrees);
+            }
+            //#endregion
+
+            //#region SubjectAltName
+            if (extension.extnID === id_SubjectAltName)
+              subjectAltNames = subjectAltNames.concat(extension.parsedValue.altNames);
+            //#endregion
+          }
+        }
+
+        //#region Checking for "required name forms"
+        let formFound = (requiredNameForms.length <= 0);
+
+        for (let j = 0; j < requiredNameForms.length; j++) {
+          switch (requiredNameForms[j].base.type) {
+            case 4: // directoryName
+              {
+                if (requiredNameForms[j].base.value.typesAndValues.length !== cert.subject.typesAndValues.length)
+                  continue;
+
+                formFound = true;
+
+                for (let k = 0; k < cert.subject.typesAndValues.length; k++) {
+                  if (cert.subject.typesAndValues[k].type !== requiredNameForms[j].base.value.typesAndValues[k].type) {
+                    formFound = false;
+                    break;
+                  }
+                }
+
+                if (formFound === true)
+                  break;
+              }
+              break;
+            default: // ??? Probably here we should reject the certificate ???
+          }
+        }
+
+        if (formFound === false) {
+          policyResult.result = false;
+          policyResult.resultCode = 21;
+          policyResult.resultMessage = "No necessary name form found";
+
+          throw policyResult;
+        }
+        //#endregion
+
+        //#region Checking for "permited sub-trees"
+        //#region Make groups for all types of constraints
+        const constrGroups: GeneralSubtree[][] = [ // Array of array for groupped constraints
+          [], // rfc822Name
+          [], // dNSName
+          [], // directoryName
+          [], // uniformResourceIdentifier
+          [], // iPAddress
+        ];
+
+        for (let j = 0; j < permittedSubtrees.length; j++) {
+          switch (permittedSubtrees[j].base.type) {
+            //#region rfc822Name
+            case 1:
+              constrGroups[0].push(permittedSubtrees[j]);
+              break;
+            //#endregion
+            //#region dNSName
+            case 2:
+              constrGroups[1].push(permittedSubtrees[j]);
+              break;
+            //#endregion
+            //#region directoryName
+            case 4:
+              constrGroups[2].push(permittedSubtrees[j]);
+              break;
+            //#endregion
+            //#region uniformResourceIdentifier
+            case 6:
+              constrGroups[3].push(permittedSubtrees[j]);
+              break;
+            //#endregion
+            //#region iPAddress
+            case 7:
+              constrGroups[4].push(permittedSubtrees[j]);
+              break;
+            //#endregion
+            //#region default
+            default:
+            //#endregion
+          }
+        }
+        //#endregion
+
+        //#region Check name constraints groupped by type, one-by-one
+        for (let p = 0; p < 5; p++) {
+          let groupPermitted = false;
+          let valueExists = false;
+          const group = constrGroups[p];
+
+          for (let j = 0; j < group.length; j++) {
+            switch (p) {
+              //#region rfc822Name
+              case 0:
+                if (subjectAltNames.length > 0) {
+                  for (let k = 0; k < subjectAltNames.length; k++) {
+                    if (subjectAltNames[k].type === 1) // rfc822Name
+                    {
+                      valueExists = true;
+                      groupPermitted = groupPermitted || compareRFC822Name(subjectAltNames[k].value, group[j].base.value);
+                    }
+                  }
+                }
+                else // Try to find out "emailAddress" inside "subject"
+                {
+                  for (let k = 0; k < cert.subject.typesAndValues.length; k++) {
+                    if ((cert.subject.typesAndValues[k].type === "1.2.840.113549.1.9.1") ||    // PKCS#9 e-mail address
+                      (cert.subject.typesAndValues[k].type === "0.9.2342.19200300.100.1.3")) // RFC1274 "rfc822Mailbox" e-mail address
+                    {
+                      valueExists = true;
+                      groupPermitted = groupPermitted || compareRFC822Name(cert.subject.typesAndValues[k].value.valueBlock.value, group[j].base.value);
+                    }
+                  }
+                }
+                break;
+              //#endregion
+              //#region dNSName
+              case 1:
+                if (subjectAltNames.length > 0) {
+                  for (let k = 0; k < subjectAltNames.length; k++) {
+                    if (subjectAltNames[k].type === 2) // dNSName
+                    {
+                      valueExists = true;
+                      groupPermitted = groupPermitted || compareDNSName(subjectAltNames[k].value, group[j].base.value);
+                    }
+                  }
+                }
+                break;
+              //#endregion
+              //#region directoryName
+              case 2:
+                valueExists = true;
+                groupPermitted = compareDirectoryName(cert.subject, group[j].base.value);
+                break;
+              //#endregion
+              //#region uniformResourceIdentifier
+              case 3:
+                if (subjectAltNames.length > 0) {
+                  for (let k = 0; k < subjectAltNames.length; k++) {
+                    if (subjectAltNames[k].type === 6) // uniformResourceIdentifier
+                    {
+                      valueExists = true;
+                      groupPermitted = groupPermitted || compareUniformResourceIdentifier(subjectAltNames[k].value, group[j].base.value);
+                    }
+                  }
+                }
+                break;
+              //#endregion
+              //#region iPAddress
+              case 4:
+                if (subjectAltNames.length > 0) {
+                  for (let k = 0; k < subjectAltNames.length; k++) {
+                    if (subjectAltNames[k].type === 7) // iPAddress
+                    {
+                      valueExists = true;
+                      groupPermitted = groupPermitted || compareIPAddress(subjectAltNames[k].value, group[j].base.value);
+                    }
+                  }
+                }
+                break;
+              //#endregion
+              //#region default
+              default:
+              //#endregion
+            }
+
+            if (groupPermitted)
+              break;
+          }
+
+          if ((groupPermitted === false) && (group.length > 0) && valueExists) {
+            policyResult.result = false;
+            policyResult.resultCode = 41;
+            policyResult.resultMessage = "Failed to meet \"permitted sub-trees\" name constraint";
+
+            throw policyResult;
+          }
+        }
+        //#endregion
+        //#endregion
+
+        //#region Checking for "excluded sub-trees"
+        let excluded = false;
+
+        for (let j = 0; j < excludedSubtrees.length; j++) {
+          switch (excludedSubtrees[j].base.type) {
+            //#region rfc822Name
+            case 1:
+              if (subjectAltNames.length >= 0) {
+                for (let k = 0; k < subjectAltNames.length; k++) {
+                  if (subjectAltNames[k].type === 1) // rfc822Name
+                    excluded = excluded || compareRFC822Name(subjectAltNames[k].value, excludedSubtrees[j].base.value);
+                }
+              }
+              else // Try to find out "emailAddress" inside "subject"
+              {
+                for (let k = 0; k < cert.subject.typesAndValues.length; k++) {
+                  if ((cert.subject.typesAndValues[k].type === "1.2.840.113549.1.9.1") ||    // PKCS#9 e-mail address
+                    (cert.subject.typesAndValues[k].type === "0.9.2342.19200300.100.1.3")) // RFC1274 "rfc822Mailbox" e-mail address
+                    excluded = excluded || compareRFC822Name(cert.subject.typesAndValues[k].value.valueBlock.value, excludedSubtrees[j].base.value);
+                }
+              }
+              break;
+            //#endregion
+            //#region dNSName
+            case 2:
+              if (subjectAltNames.length > 0) {
+                for (let k = 0; k < subjectAltNames.length; k++) {
+                  if (subjectAltNames[k].type === 2) // dNSName
+                    excluded = excluded || compareDNSName(subjectAltNames[k].value, excludedSubtrees[j].base.value);
+                }
+              }
+              break;
+            //#endregion
+            //#region directoryName
+            case 4:
+              excluded = excluded || compareDirectoryName(cert.subject, excludedSubtrees[j].base.value);
+              break;
+            //#endregion
+            //#region uniformResourceIdentifier
+            case 6:
+              if (subjectAltNames.length > 0) {
+                for (let k = 0; k < subjectAltNames.length; k++) {
+                  if (subjectAltNames[k].type === 6) // uniformResourceIdentifier
+                    excluded = excluded || compareUniformResourceIdentifier(subjectAltNames[k].value, excludedSubtrees[j].base.value);
+                }
+              }
+              break;
+            //#endregion
+            //#region iPAddress
+            case 7:
+              if (subjectAltNames.length > 0) {
+                for (let k = 0; k < subjectAltNames.length; k++) {
+                  if (subjectAltNames[k].type === 7) // iPAddress
+                    excluded = excluded || compareIPAddress(subjectAltNames[k].value, excludedSubtrees[j].base.value);
+                }
+              }
+              break;
+            //#endregion
+            //#region default
+            default: // No action, but probably here we need to create a warning for "malformed constraint"
+            //#endregion
+          }
+
+          if (excluded)
+            break;
+        }
+
+        if (excluded === true) {
+          policyResult.result = false;
+          policyResult.resultCode = 42;
+          policyResult.resultMessage = "Failed to meet \"excluded sub-trees\" name constraint";
+
+          throw policyResult;
+        }
+        //#endregion
+
+        //#region Append "cert_..._subtrees" to "..._subtrees"
+        permittedSubtrees = permittedSubtrees.concat(certPermittedSubtrees);
+        excludedSubtrees = excludedSubtrees.concat(certExcludedSubtrees);
+        //#endregion
+      }
+      //#endregion
+
+      return policyResult;
+      //#endregion
+    } catch (error) {
+      if (error instanceof Error) {
+        if (error instanceof ChainValidationError) {
+          return {
+            result: false,
+            resultCode: error.code,
+            resultMessage: error.message,
+            error: error,
+          };
+        }
+
+        return {
+          result: false,
+          resultCode: ChainValidationCode.unknown,
+          resultMessage: error.message,
+          error: error,
+        };
+      }
+
+      if (error && typeof error === "object" && "resultMessage" in error) {
+        return error as CertificateChainValidationEngineVerifyResult;
+      }
+
+      return {
+        result: false,
+        resultCode: -1,
+        resultMessage: `${error}`,
+      };
+    }
+  }
+
+}