import type { NobjcObject } from "objc-js";
import type { _NSArray } from "../Foundation/NSArray.js";
import type { _NSData } from "../Foundation/NSData.js";
import type { _NSDateInterval } from "../Foundation/NSDateInterval.js";
import type { _NSNumber } from "../Foundation/NSNumber.js";
import type { _NSObject } from "../Foundation/NSObject.js";
import type { _NSSet } from "../Foundation/NSSet.js";
import type { _MTRKeypair } from "./MTRKeypair.js";
export declare class _MTRCertificates extends _NSObject {
    static alloc(): _MTRCertificates;
    static new(): _MTRCertificates;
    init(): _MTRCertificates;
    /**
     * Create a root (self-signed) X.509 DER encoded certificate that has the right fields to be a valid Matter root certificate. If issuerID is not nil, it's unsignedLongLongValue will be used for the matter-rcac-id attribute in the subject distinguished name of the resulting certificate. If issuerID is nil, a random value will be generated for matter-rcac-id. If fabricID is not nil, it will be included in the subject DN of the certificate. In this case it must be a valid Matter fabric id. validityPeriod specifies when the certificate will be valid. Note that there is currently no mechanism available in Matter to update or rotate the root certificate of a fabric installed on a device. A certificate with no expiration time can be created by specifying [NSDate distantFuture] for the end of the period. On failure returns nil and if "error" is not null sets *error to the relevant error.
     */
    static createRootCertificate$issuerID$fabricID$validityPeriod$error$(keypair: _MTRKeypair, issuerID: _NSNumber | null, fabricID: _NSNumber | null, validityPeriod: _NSDateInterval, error: NobjcObject | null): _NSData | null;
    /** As above, but defaults to no expiration time. */
    static createRootCertificate$issuerID$fabricID$error$(keypair: _MTRKeypair, issuerID: _NSNumber | null, fabricID: _NSNumber | null, error: NobjcObject | null): _NSData | null;
    /**
     * Create an intermediate X.509 DER encoded certificate that has the right fields to be a valid Matter intermediate certificate. If issuerID is not nil, it's unsignedLongLongValue will be used for the matter-icac-id attribute in the subject distinguished name of the resulting certificate. If issuerID is nil, a random value will be generated for matter-icac-id. If fabricID is not nil, it will be included in the subject DN of the certificate. In this case it must be a valid Matter fabric id. validityPeriod specifies when the certificate will be valid. A certificate with no expiration time can be created by specifying [NSDate distantFuture] for the end of the period. On failure returns nil and if "error" is not null sets *error to the relevant error.
     */
    static createIntermediateCertificate$rootCertificate$intermediatePublicKey$issuerID$fabricID$validityPeriod$error$(rootKeypair: _MTRKeypair, rootCertificate: _NSData, intermediatePublicKey: NobjcObject, issuerID: _NSNumber | null, fabricID: _NSNumber | null, validityPeriod: _NSDateInterval, error: NobjcObject | null): _NSData | null;
    /** As above, but defaults to no expiration time. */
    static createIntermediateCertificate$rootCertificate$intermediatePublicKey$issuerID$fabricID$error$(rootKeypair: _MTRKeypair, rootCertificate: _NSData, intermediatePublicKey: NobjcObject, issuerID: _NSNumber | null, fabricID: _NSNumber | null, error: NobjcObject | null): _NSData | null;
    /**
     * Create an X.509 DER encoded certificate that has the right fields to be a valid Matter operational certificate. signingKeypair and signingCertificate are the root or intermediate that is signing the operational certificate. nodeID and fabricID are expected to be 64-bit unsigned integers. nodeID must be a valid Matter operational node id. fabricID must be a valid Matter fabric id. caseAuthenticatedTags may be nil to indicate no CASE Authenticated Tags should be used. If caseAuthenticatedTags is not nil, it must contain at most 3 numbers, which are expected to be 32-bit unsigned Case Authenticated Tag values. validityPeriod specifies when the certificate will be valid. A certificate with no expiration time can be created by specifying [NSDate distantFuture] for the end of the period. On failure returns nil and if "error" is not null sets *error to the relevant error.
     */
    static createOperationalCertificate$signingCertificate$operationalPublicKey$fabricID$nodeID$caseAuthenticatedTags$validityPeriod$error$(signingKeypair: _MTRKeypair, signingCertificate: _NSData, operationalPublicKey: NobjcObject, fabricID: _NSNumber, nodeID: _NSNumber, caseAuthenticatedTags: _NSSet | null, validityPeriod: _NSDateInterval, error: NobjcObject | null): _NSData | null;
    /** As above, but defaults to no expiration time. */
    static createOperationalCertificate$signingCertificate$operationalPublicKey$fabricID$nodeID$caseAuthenticatedTags$error$(signingKeypair: _MTRKeypair, signingCertificate: _NSData, operationalPublicKey: NobjcObject, fabricID: _NSNumber, nodeID: _NSNumber, caseAuthenticatedTags: _NSSet | null, error: NobjcObject | null): _NSData | null;
    /**
     * Check whether the given keypair's public key matches the given certificate's public key. The certificate is expected to be an X.509 DER encoded certificate. Will return NO on failures to extract public keys from the objects.
     */
    static keypair$matchesCertificate$(keypair: _MTRKeypair, certificate: _NSData): boolean;
    /**
     * Check whether two X.509 DER encoded certificates are equivalent, in the sense of having the same public key and the same subject DN. Returns NO if public keys or subject DNs cannot be extracted from the certificates.
     */
    static isCertificate$equalTo$(certificate1: _NSData, certificate2: _NSData): boolean;
    /**
     * Generate a PKCS#10 certificate signing request from a MTRKeypair. This can then be used to request an operational or ICA certificate from an external certificate authority. The CSR will have the subject OU DN set to 'CSA', because omitting all identifying information altogether often trips up CSR parsing code. The CA being used should expect this and ignore the request subject, producing a subject that matches the rules for Matter certificates. On failure returns nil and if "error" is not null sets *error to the relevant error.
     */
    static createCertificateSigningRequest$error$(keypair: _MTRKeypair, error: NobjcObject | null): _NSData | null;
    /**
     * Convert the given X.509v3 DER encoded certificate to the Matter certificate format. Returns nil if the conversion fails (e.g. if the input data cannot be parsed as a DER encoded X.509 certificate, or if the certificate cannot be represented in the Matter certificate format).
     */
    static convertX509Certificate$(x509Certificate: _NSData): _NSData | null;
    /**
     * Convert the given Matter TLV encoded certificate to the X.509v3 DER encoded format. Returns nil if the conversion fails (e.g. if the input data cannot be parsed as a Matter TLV encoded certificate, or if the certificate cannot be represented in the X.509v3 DER format).
     */
    static convertMatterCertificate$(matterCertificate: _NSData): _NSData | null;
    /**
     * Extract the public key from the given PKCS#10 certificate signing request. This is the public key that a certificate issued in response to the request would need to have.
     */
    static publicKeyFromCSR$error$(csr: _NSData, error: NobjcObject | null): _NSData | null;
    static generateRootCertificate$issuerId$fabricId$error$(keypair: _MTRKeypair, issuerId: _NSNumber | null, fabricId: _NSNumber | null, error: NobjcObject | null): _NSData | null;
    static generateIntermediateCertificate$rootCertificate$intermediatePublicKey$issuerId$fabricId$error$(rootKeypair: _MTRKeypair, rootCertificate: _NSData, intermediatePublicKey: NobjcObject, issuerId: _NSNumber | null, fabricId: _NSNumber | null, error: NobjcObject | null): _NSData | null;
    static generateOperationalCertificate$signingCertificate$operationalPublicKey$fabricId$nodeId$caseAuthenticatedTags$error$(signingKeypair: _MTRKeypair, signingCertificate: _NSData, operationalPublicKey: NobjcObject, fabricId: _NSNumber, nodeId: _NSNumber, caseAuthenticatedTags: _NSArray | null, error: NobjcObject | null): _NSData | null;
    static generateCertificateSigningRequest$error$(keypair: _MTRKeypair, error: NobjcObject | null): _NSData | null;
}
