World Monitor
Real-time global intelligence on conflict, markets, energy, trade, shipping and cyber. 102 tools.
Runs in the cloud✓ service owner · worldmonitor.app
pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le…
What it does
PKI MCP server: inspect, verify, issue, sign X.509, CSR, CRL, OCSP, CMS, TSP, PKCS#12. 34 tools
- Connects Runs on your computer
- Account or key Needs PKINATIVE_MCP_HTTP_TOKEN, PKINATIVE_MCP_PASSWORD
- Category Other
Install
Pick the AI app you use, then copy the settings.
Passed 3/3 checks · Runs on your computer
First: which AI do you use?
Pick your app and the steps appear below.
Works with Claude, with some setup first
You need a pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… key (create it on the maker’s site) · Install Node.js on your computer first (one time) · Only the Claude desktop app (Windows or Mac), not the web or phone
Install Node.js
One time only; it works for every server that needs Node.js
Sign up and create a pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… key
Open the maker’s site, sign up and create an API key for the next step. Check the maker’s site for pricing and free plans.
Open the pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… site ↗
Open the Claude desktop app’s settings file
SettingsDeveloperEdit Config
Paste these settings and save the file
Checking the commands · copy buttons appear once they pass
Paste the key only into the app’s field, never into a chat or to anyone
Quit Claude and open it again
Try it
Use pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… and tell me what you can do for me, then show me one thing✓ If Claude says it is using pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… or shows a pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… tool in the answer, you are connected
Menu names checked against Anthropic’s help page on Nov 11, 2026 · your screen may differ slightly by app version
ChatGPT cannot connect pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… yet
pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… runs on your computer, but ChatGPT can only connect servers that run on the web
What you can do instead
A · Use an app that can connect pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le…
- You need a pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… key (create it on the maker’s site) · Install Node.js on your computer first (one time) · Only the Claude desktop app (Windows or Mac), not the web or phone
- You need a pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… key (create it on the maker’s site) · Install Node.js on your computer first (one time)
- You need a pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… key (create it on the maker’s site) · Install Node.js on your computer first (one time)
- You need a pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… key (create it on the maker’s site) · Install Node.js on your computer first (one time)
B · Others in Other that work with ChatGPT
Picked from the most used in the same category, only ones that connect by address with no key
- Hostinger✓ ChatGPT
- World Monitor✓ ChatGPT
- Svelte MCP✓ ChatGPT
Works with Claude Code, with some setup first
You need a pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… key (create it on the maker’s site) · Install Node.js on your computer first (one time)
Install Node.js
One time only; it works for every server that needs Node.js
Sign up and create a pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… key
Open the maker’s site, sign up and create an API key for the next step. Check the maker’s site for pricing and free plans.
Open the pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… site ↗
Open Terminal
Mac: press Command+Space and type Terminal · Windows: open PowerShell
Paste this command and press Enter
Checking the commands · copy buttons appear once they pass
Replace “your-value” with your key before pressing Enter
Paste the key only into the app’s field, never into a chat or to anyone
Type /mcp in Claude Code
You should see pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… listed as connected
Try it
Use pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… and tell me what you can do for me, then show me one thing✓ If Claude Code says it is using pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… or shows a pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… tool in the answer, you are connected
Menu names checked against Anthropic’s help page on Nov 11, 2026 · your screen may differ slightly by app version
Works with Cursor, with some setup first
You need a pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… key (create it on the maker’s site) · Install Node.js on your computer first (one time)
Install Node.js
One time only; it works for every server that needs Node.js
Sign up and create a pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… key
Open the maker’s site, sign up and create an API key for the next step. Check the maker’s site for pricing and free plans.
Open the pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… site ↗
Click this button to open Cursor
Checking the commands · copy buttons appear once they pass
Fill in your key
In the pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… settings, PKINATIVE_MCP_OUTPUT_DIR, PKINATIVE_MCP_CACHE_DIR, PKINATIVE_MCP_PORT, PKINATIVE_MCP_HTTP_TOKEN, PKINATIVE_MCP_PASSWORD, PKINATIVE_MCP_AT, PKINATIVE_MCP_MAX_INPUT_BYTES, PKINATIVE_MCP_MAX_KDF_ITERATIONS, PKINATIVE_MCP_MAX_PATHS_EXPLORED is empty; add your key and save
Paste the key only into the app’s field, never into a chat or to anyone
Open the AI chat in Cursor in Agent mode
Try it
Use pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… and tell me what you can do for me, then show me one thing✓ If Cursor says it is using pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… or shows a pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… tool in the answer, you are connected
Menu names checked against Cursor’s help page on Nov 11, 2026 · your screen may differ slightly by app version
Works with VS Code, with some setup first
You need a pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… key (create it on the maker’s site) · Install Node.js on your computer first (one time)
Install Node.js
One time only; it works for every server that needs Node.js
Sign up and create a pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… key
Open the maker’s site, sign up and create an API key for the next step. Check the maker’s site for pricing and free plans.
Open the pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… site ↗
Click this button to open VS Code
Checking the commands · copy buttons appear once they pass
Fill in your key
In the pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… settings, PKINATIVE_MCP_OUTPUT_DIR, PKINATIVE_MCP_CACHE_DIR, PKINATIVE_MCP_PORT, PKINATIVE_MCP_HTTP_TOKEN, PKINATIVE_MCP_PASSWORD, PKINATIVE_MCP_AT, PKINATIVE_MCP_MAX_INPUT_BYTES, PKINATIVE_MCP_MAX_KDF_ITERATIONS, PKINATIVE_MCP_MAX_PATHS_EXPLORED is empty; add your key and save
Paste the key only into the app’s field, never into a chat or to anyone
Open the AI chat in VS Code in Agent mode
Try it
Use pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… and tell me what you can do for me, then show me one thing✓ If VS Code says it is using pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… or shows a pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… tool in the answer, you are connected
Menu names checked against VS Code’s help page on Nov 11, 2026 · your screen may differ slightly by app version
Other apps that use MCP, such as Windsurf, Zed or Gemini CLI, each add servers differently. See how in the app list.
JSON settings are under “For developers” below
For developers: Terminal commands and JSON settings
Installed on your computer
Claude Code
Checking the commands · copy buttons appear once they pass
Claude Desktop (claude_desktop_config.json)
Checking the commands · copy buttons appear once they pass
Cursor (~/.cursor/mcp.json)
Checking the commands · copy buttons appear once they pass
VS Code (mcp.json)
Checking the commands · copy buttons appear once they pass
Values you fill in
PKINATIVE_MCP_OUTPUT_DIRenvAbsolute path of the one sandbox directory: path inputs are read from it and outputMode='file' outputs are written under it (never overwritten; the real path of every file read and of every parent wr…PKINATIVE_MCP_CACHE_DIRenvOpt-in content-addressed response cache directory (SHA-256 keyed, 1h TTL, 256 MiB LRU, plaintext at rest). Never caches path inputs, file output, a call carrying a password or a signer, a clock-depen…PKINATIVE_MCP_PORTenvServe Streamable HTTP on this loopback port (POST /mcp) instead of stdio (MCP 2026-07-28, stateless, legacy fallback). Unauthenticated unless PKINATIVE_MCP_HTTP_TOKEN is set.PKINATIVE_MCP_HTTP_TOKENsecret envOpt-in bearer token for the HTTP transport (>= 16 chars, no whitespace; a weaker value refuses to start). When set, /mcp requires 'Authorization: Bearer ' or answers 401. Compared constant-time, neve…PKINATIVE_MCP_PASSWORDsecret envOperator-side password of the encrypted PKCS#8 key or PKCS#12 file the tools open (keeps the secret out of the model transcript). Exclusive with the per-call password input (both at once is VALIDATIO…PKINATIVE_MCP_ATenvPinned instant (ISO 8601 or epoch milliseconds) every omitted at / notBefore / signingTime falls back to, for reproducible verdicts and artefacts. Unset: the wall clock (a clock-dependent result is n…PKINATIVE_MCP_MAX_INPUT_BYTESenvOperator ceiling for limits.maxInputBytes and the decoded size of one PKI object (default 67108864 = 64 MiB, the engine default). Integer >= 1024, read once at startup; an invalid value refuses to st…PKINATIVE_MCP_MAX_KDF_ITERATIONSenvOperator ceiling for limits.maxKdfIterations and limits.maxPkcs12KdfIterations (default 10000000, the engine default): the CPU bound of a hostile PBES2 key or PKCS#12 file. Integer >= 1, read once at…PKINATIVE_MCP_MAX_PATHS_EXPLOREDenvOperator ceiling for limits.maxPathsExplored (default 1000, the engine default): the RFC 5280 section 6 path-building work bound. Integer >= 1, read once at startup; an invalid value refuses to start.
These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.
At a glance
Which apps can use it
Based on how this server connects and on each app’s own docs, checked Nov 10, 2026.
Run on your computer in
ClaudeGooseLM StudioMsty StudioCherry StudioCursorVS Code + GitHub CopilotVisual StudioWindsurf (Devin Desktop)ZedKiroClineContinueJetBrains AI AssistantClaude CodeCodex CLIGemini CLIOpenCodenodecodeWarpLibreChatRaycast
Related guides
What it can do
Runs on your computer; the tool list appears in your AI app after you install it.
Basic checksi
We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 13, 2026
- ✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account Nizoka, which owns the repo
- ✓ Pass
Still maintained
Code last changed 8 days ago
- ✓ Pass
Has a licence
Uses MIT
- – Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
- – Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
- … Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints
Discussion
Ask, share a tip or report that it does not work. Sorted by what people marked helpful.
No posts yet. Be the first to ask or share.
Posts here are written by users, not the PopNx team.
User reviews
No reviews yet
Compared with others in Otheri
- More stars than 0% of the other 19608 servers in this category
- Published to the registry more recently than 62% of the other 19608 servers in this category
- Basic checks equal to or better than 100% of the other 19608 servers in this category
Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.
Common questions
Is pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte le… safe?
It passed 3 of 3 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.
What keys or codes does it need?
You need to fill in: PKINATIVE_MCP_HTTP_TOKEN, PKINATIVE_MCP_PASSWORD
Does it run on my computer or in the cloud?
It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).
Is it still maintained?
The GitHub repo last changed 8 days ago, and the latest version (1.0.0) reached the registry 27 days ago.
Which apps can use it?
Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.
What can I use instead?
In the same category: World Monitor, Claude Flow, Windmill
Others in the same category
Servers in the same category from other makers, sorted by stars.
Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi
Claude Flow
AI orchestration with hive-mind swarms, neural networks, and 87 MCP tools for enterprise dev.
Runs on your computer
README from the maker
Open the README
Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.
pkinative-mcp
MCP server for PKI — inspect and verify X.509 certificates, CSRs, CRLs, OCSP responses, CMS SignedData and RFC 3161 time-stamps; build and validate certificate chains (RFC 5280 path validation, name and purpose checks, offline CRL and OCSP revocation); create certificates, CSRs, CMS signatures, OCSP and time-stamp requests; open PKCS#8 and PKCS#12 without ever returning a key byte; decode ASN.1, PEM and OIDs — 34 tools and 7 prompts on the pkinative engine (zero-dependency, pure TypeScript, Web Crypto for every signature; OpenSSL 3 interoperability validated in CI), for Claude Desktop, Cursor, ChatGPT and any Model Context Protocol client. No network, ever.
✨ Features
pkinative-mcp exposes 34 tools to any MCP host, in six groups. The kind says how the result is shaped: a *read* tool returns facts (structuredContent, projectable with verbosity / fields); a *verdict* tool returns valid + reasons[] and is never `isError` for a negative verdict; an *artefact* tool delivers DER or PEM once, inline or into the sandbox. The last column names the refusal codes an agent branches on (the full table is in docs/AGENT_CONTRACT.md).
Encodings
| Tool | Kind | What it does | Key refusal codes |
|---|---|---|---|
convert_pem | read | mode: 'decode' lists every block of a PEM text (label, DER size, offset, SHA-256) and extractIndex delivers one as DER / PEM / hex; mode: 'encode' wraps exactly one DER value into one strict RFC 7468 block under label. A private-key block is listed, never extracted and never produced; key material anywhere in the input is refused. | SECURITY_VIOLATION, NOT_FOUND, VALIDATION_ERROR, PKI_PEM_UNEXPECTED_LABEL, PKI_PEM_* |
resolve_oid | read | Object identifiers in one call: name (registered names, ≤ 1000 per call), validate (X.660 grammar, reported never thrown), list (the engine registry, paged 200 / 2000), encode (dotted → hex, content or whole TLV, RELATIVE-OID), decode (hex → dotted + name). | VALIDATION_ERROR, PKI_OID_INVALID, PKI_ASN1_* |
compute_fingerprint | read | fingerprint of the exact DER (SHA-256 default; SHA-1 / 384 / 512), key-id (the RFC 5280 §4.2.1.2 identifier of the public key of a certificate, CSR or PUBLIC KEY), shake256 (outputLength bytes, the Ed448 CMS digest). Any object may be digested; no input byte is returned. | VALIDATION_ERROR, PKI_X509_*, PKI_ASN1_* |
decode_asn1 | read | The X.690 node tree of any DER (BER with encodingRules: 'ber'): offsets, tags, previews, OID names, ≤ 20 000 nodes; nodePath narrows to a subtree, read applies a typed reader, reencode: true re-encodes the node as an artefact. Refuses a private key or a PKCS#12 (by label, or when the DER parses as one). | SECURITY_VIOLATION, NOT_FOUND, PKI_ASN1_UNEXPECTED_TAG, PKI_API_MISUSE, PKI_ASN1_* |
encode_asn1 | artefact | A JSON node spec (boolean, integer, bit-string, octet-string, oid, string, time, sequence / set / set-of, explicit / implicit, tlv, der) encoded to DER through the engine's own encoders — deterministic; the inverse of decode_asn1. | VALIDATION_ERROR (naming the JSON path), SECURITY_VIOLATION, PKI_LIMIT_EXCEEDED, PKI_ASN1_*, PKI_OID_INVALID |
Certificates and requests
| Tool | Kind | What it does | Key refusal codes |
|---|---|---|---|
inspect_certificate | read | The RFC 5280 report of one certificate: serial, algorithms, issuer / subject (RFC 4514 + RDNs), validity, public key, the 19 extension kinds decoded (rawExtensions: true keeps them raw), fingerprints, diagnostics; extension returns one; issuer / checkSelfSignature adds one signature check — which is not trust. | NOT_FOUND, PKI_PEM_UNEXPECTED_LABEL, PKI_X509_*, PKI_CRYPTO_ALGORITHM_REFUSED |
create_certificate | artefact | Issue an X.509 v3 certificate from spec (subject, validity, extensions), signed by signer (a PKCS#8 key or a PKCS#12 file imported as a non-extractable Web Crypto key): self-signed CA, or a leaf issued from a certificate / CSR / PUBLIC KEY. Serial 'random' by default; verified against the issuer before the bytes return. | KEY_MISMATCH, RSA_SCHEME_REQUIRED, KEY_TYPE_REQUIRED, SECRET_REQUIRED, UNSUPPORTED_KEY, VALIDATION_ERROR |
encode_x509_structure | artefact | One X.509 building block (name, validity, spki, algorithm-identifier, extension(s), basic-constraints, key-usage, extended-key-usage, subject-alt-name, SKI / AKI, signature-algorithm) encoded deterministically from a closed spec; hex by default. Nothing here signs. | VALIDATION_ERROR (naming the member), KEY_TYPE_REQUIRED, SECRET_REQUIRED, RSA_SCHEME_REQUIRED |
decode_extension | read | One extnValue content (hex or DER) decoded by its OID exactly as inspect_certificate would; critical is checked against the kind's RFC 5280 rule (a diagnostic, not a refusal). | PKI_X509_EXTENSION_MALFORMED, VALIDATION_ERROR |
check_certificate_name | verdict | The RFC 6125 identity verdict: certificate + host / ip (SAN dNSName / iPAddress, wildcards, an opt-in CN fallback held to the chain's name constraints), or the match form presented + reference with no certificate. | PKI_REASON_NAME_MISMATCH (in reasons[]), VALIDATION_ERROR |
check_certificate_purpose | verdict | May certificate be used for purpose (serverAuth, clientAuth, codeSigning, emailProtection, timeStamping, ocspSigning, any, or an OID) along [certificate, ...chain]? restrictIssuers (default true) applies a CA's own EKU to what it issued. | PKI_REASON_PURPOSE_NOT_PERMITTED (in reasons[]), VALIDATION_ERROR |
inspect_csr | read | The RFC 2986 report of one PKCS#10 request: subject, key, attributes, the extensions requested, whether a challengePassword is present (never its text), and by default the proof of possession (signature.valid). | PKI_REASON_SIGNATURE_NOT_CHECKED (in reasons[]), PKI_X509_*, PKI_PEM_UNEXPECTED_LABEL |
create_csr | artefact | A PKCS#10 request from spec (subject, the extensions to request) signed by signer; the public key is derived from a plain key, taken from the PKCS#12 certificate or given as subjectPublicKey; the proof of possession is verified before the bytes return. | KEY_MISMATCH, RSA_SCHEME_REQUIRED, SECRET_REQUIRED, KEY_TYPE_REQUIRED, VALIDATION_ERROR |
Paths, CRLs and OCSP
| Tool | Kind | What it does | Key refusal codes |
|---|---|---|---|
verify_certificate_chain | verdict | The one-call trust verdict: a path from leaf through candidates to one of your trustAnchors, every signature verified, RFC 5280 §6 validation at at (validity, constraints, key usage, names, policies), serverName (RFC 6125) and purposes, and revocation from the CRL / OCSP bytes you supply (requireRevocation demands evidence for the end-entity certificate). | PKI_REASON_* in reasons[] (NO_TRUST_ANCHOR, EXPIRED, NOT_YET_VALID, REVOKED, REVOCATION_UNKNOWN, NAME_MISMATCH, …), VALIDATION_ERROR |
build_certificate_path | verdict | Path discovery only: which intermediates lead from leaf to an anchor under the structural rules at at. No signature is checked — valid is always false, the verdict is found and structuralReasons. | PKI_REASON_SIGNATURE_NOT_CHECKED (always), PKI_REASON_NO_TRUST_ANCHOR |
validate_certificate_path | verdict | RFC 5280 §6.1 validation of a path you ordered (leaf first) against your anchors at at; every link signature verified first (checkSignatures: false gives the structural verdict with failingReasons). No revocation here. | PKI_REASON_SIGNATURE_INVALID, PKI_REASON_SIGNATURE_NOT_CHECKED, VALIDATION_ERROR |
inspect_crl | read | The RFC 5280 §5 report of one CRL: issuer, updates, CRL number, delta indicator, IDP, entry count (walked, never all decoded), extensions; find looks one serial up; issuer adds one signature check. | VALIDATION_ERROR, PKI_X509_*, PKI_CRYPTO_ALGORITHM_REFUSED |
check_crl_revocation | verdict | One certificate against one base crl (and an optional delta) you fetched, at at: scope, freshness (staleTolerance), the signature verified against issuer, the serial looked up. A delta whose signature does not verify against issuer is not applied: valid: false with PKI_REASON_REVOCATION_UNKNOWN on delta. | PKI_REASON_REVOKED, PKI_REASON_REVOCATION_UNKNOWN (in reasons[]), VALIDATION_ERROR (a delta without deltaCRLIndicator) |
create_ocsp_request | artefact | The DER OCSPRequest (RFC 6960) for certificate under issuer: CertID with SHA-1 (default) or SHA-256, an RFC 8954 nonce ('random' or hex), certIdOnly. You POST the bytes to the responder; summary.nonceHex / certIdHex match the answer. | VALIDATION_ERROR |
inspect_ocsp_response | read | The RFC 6960 report of one response: status, responder id, producedAt, every SingleResponse (CertID, status, updates), extensions, embedded certificates, nonce presence; responder adds one signature check. | PKI_* (PKI_ASN1_*, PKI_X509_*), VALIDATION_ERROR |
check_ocsp_status | verdict | One response for one certificate: the CertID recomputed from issuer, the signature verified (responder, the embedded certificates or the issuer), the signer authorised (RFC 6960 §4.2.2.2), status, freshness at at, nonce (nonce, requireNonce). | PKI_REASON_REVOKED and the other PKI_REASON_* in reasons[], VALIDATION_ERROR |
CMS and time-stamps
| Tool | Kind | What it does | Key refusal codes |
|---|---|---|---|
sign_cms | artefact | An RFC 5652 SignedData over content (attached or detached) or a precomputed contentDigest, one signer (PKCS#8 key or PKCS#12), certificate, chain and crls parsed then embedded; signed attributes always written (contentType, messageDigest, signingTime, SigningCertificateV2, CMSAlgorithmProtection); verified against the signer certificate before the bytes return. | KEY_MISMATCH, RSA_SCHEME_REQUIRED, SECRET_REQUIRED, VALIDATION_ERROR, PKI_API_MISUSE, ENGINE_ERROR |
| verify_cms | verdict | The one-call verdict on a SignedData: for every signer the signed attributes, the content digest (att