1# Certificate Extension Development 2 3<!--Kit: Device Certificate Kit--> 4<!--Subsystem: Security--> 5<!--Owner: @zxz--3--> 6<!--Designer: @lanming--> 7<!--Tester: @PAFT--> 8<!--Adviser: @zengyawen--> 9 10This topic walks you through on how to create a certificate extension (**CertExtension**) object, obtain the certificate extension information based on an object identifier (OID), and check whether the certificate is a CA certificate. 11 12## How to Develop 13 141. Import the [cert](../../reference/apis-device-certificate-kit/js-apis-cert.md) module. 15 ```ts 16 import { cert } from '@kit.DeviceCertificateKit'; 17 ``` 18 192. Use [cert.createCertExtension](../../reference/apis-device-certificate-kit/js-apis-cert.md#certcreatecertextension10) to create a **CertExtension** instance. 20 213. Use [CertExtension.getEntry](../../reference/apis-device-certificate-kit/js-apis-cert.md#getentry10) to obtain the certificate extension of the specified OID. 22 234. Use [CertExtension.checkCA](../../reference/apis-device-certificate-kit/js-apis-cert.md#checkca10) to check whether the certificate is a CA certificate. 24 25```ts 26import { cert } from '@kit.DeviceCertificateKit'; 27import { BusinessError } from '@kit.BasicServicesKit'; 28import { util } from '@kit.ArkTS'; 29 30// Certificate extension data. The following is only an example. The value needs to be assigned based on the specific service. 31let extData = new Uint8Array([ 32 0x30, 0x40, 0x30, 0x0F, 0x06, 0x03, 0x55, 0x1D, 33 0x13, 0x01, 0x01, 0xFF, 0x04, 0x05, 0x30, 0x03, 34 0x01, 0x01, 0xFF, 0x30, 0x0E, 0x06, 0x03, 0x55, 35 0x1D, 0x0F, 0x01, 0x01, 0xFF, 0x04, 0x04, 0x03, 36 0x02, 0x01, 0xC6, 0x30, 0x1D, 0x06, 0x03, 0x55, 37 0x1D, 0x0E, 0x04, 0x16, 0x04, 0x14, 0xE0, 0x8C, 38 0x9B, 0xDB, 0x25, 0x49, 0xB3, 0xF1, 0x7C, 0x86, 39 0xD6, 0xB2, 0x42, 0x87, 0x0B, 0xD0, 0x6B, 0xA0, 40 0xD9, 0xE4 41]); 42 43// Certificate extension example. 44function certExtensionSample(): void { 45 let textEncoder = new util.TextEncoder(); 46 let encodingBlob: cert.EncodingBlob = { 47 data: extData, 48 // Certificate extension format. Currently, only the DER format is supported. 49 encodingFormat: cert.EncodingFormat.FORMAT_DER 50 }; 51 52 // Create a CertExtension object. 53 cert.createCertExtension(encodingBlob, (err, certExtension) => { 54 if (err != null) { 55 // The CertExtension object fails to be created. 56 console.error(`createCertExtension failed, errCode:${err.code}, errMsg:${err.message} `); 57 return; 58 } 59 // The CertExtension object is created. 60 console.log('createCertExtension success'); 61 62 try { 63 // Obtain the certificate extension information based on an OID. 64 let oidData = '2.5.29.14'; 65 let oid: cert.DataBlob = { 66 data: textEncoder.encodeInto(oidData), 67 } 68 let entry = certExtension.getEntry(cert.ExtensionEntryType.EXTENSION_ENTRY_TYPE_ENTRY, oid); 69 70 // Check whether the certificate is a CA certificate. 71 let pathLen = certExtension.checkCA(); 72 console.log('test cert extension success'); 73 } catch (err) { 74 let e: BusinessError = err as BusinessError; 75 console.error(`operation failed, message:${e.message} ,code:${e.code} `); 76 } 77 }); 78} 79``` 80