title: Using node.js to verify a X509 certificate with CA cert
body: <p>I am looking for a node.js way to verify a client certificate in X509 format with a CA certificate which was given to me (none of those are created/managed by me, my software only has to verify what is beeing sent to it).</p>
  
  <p>I have found several modules for this job, however I am having issues with each of them:</p>
  
  <ul>
  <li><a href="https://github.com/Southern/node-x509" rel="noreferrer" title="X509">X509</a> is able to do it using <code>x509.verify(cert, CABundlePath, cb)</code>, however it needs to read the certificates from FS, and I am having them in memory already. This is cumbersome as it will be done with each web request which reaches my app.</li>
  <li>It seems like <a href="https://pkijs.org/" rel="noreferrer" title="PKI.js">PKI.js</a> is able to do it, however their examples don't work for me but complain about missing files, so I can't even try it out.</li>
  <li>I tried <a href="https://github.com/digitalbazaar/forge" rel="noreferrer" title="node-forge">node-forge</a>, but while I am unsure if I use it correctly (they don't have any API documentation) its throwing a <code>forge.pki.BadCertificate</code> error from <code>forge.pki.verifyCertificateChain(caStore, [ cer ], cb)</code>.</li>
  <li>When trying <a href="https://www.deineagentur.com/projects/pem/module-pem.html#.verifySigningChain" rel="noreferrer" title="pem">pem</a>, using a simple <code>pem.verifySigningChain(cer, [ ca ], cb)</code> would throw some error complaining about loading a file from <code>/var/...</code>. Even if it would work, I would avoid using this lib as its relying on the <em>openssl command line tool</em>, which I would like to avoid</li>
  </ul>
  
  <p>Now I feel pretty stupid because I failed to get this simple task done with any of the above modules. Could someone point me to a simple solution which will allow me to verify the signature/validity of a X509 certificate using a given CA certificate? :s</p>
  
  <p>[edit] Basically I would need <code>openssl verify -verbose -CAfile ca-crt.pem  client1-crt.pem</code> in <code>Node.js</code> but <strong><em>without</em></strong> dependencies to the openssl command line tool and <strong><em>without</em></strong> temporarily saving the certs to disk.</p>
  
  <p>[edit2] Would it be possible to just use <a href="https://nodejs.org/api/crypto.html#crypto_verify_verify_object_signature_signatureformat" rel="noreferrer">https://nodejs.org/api/crypto.html#crypto_verify_verify_object_signature_signatureformat</a>?</p>