node-opcua-client 2.180.0 → 2.181.1

package/source/private/client_session_impl.ts

@@ -131,22 +131,22 @@ import type {
     SetMonitoringModeRequestLike,
     SubscriptionId,
     TransferSubscriptionsRequestLike
-} from "../client_session";
-import { ClientSessionKeepAliveManager } from "../client_session_keepalive_manager";
-import type { ClientSubscription } from "../client_subscription";
-import type { Request, Response } from "../common";
-import type { UserIdentityInfo } from "../user_identity_info";
+} from "../client_session.js";
+import { ClientSessionKeepAliveManager } from "../client_session_keepalive_manager.js";
+import type { ClientSubscription } from "../client_subscription.js";
+import type { Request, Response } from "../common.js";
+import type { UserIdentityInfo } from "../user_identity_info.js";
 
-import { ClientSidePublishEngine } from "./client_publish_engine";
-import { ClientSubscriptionImpl } from "./client_subscription_impl";
-import type { IClientBase } from "./i_private_client";
-import { repair_client_session } from "./reconnection/reconnection";
+import { ClientSidePublishEngine } from "./client_publish_engine.js";
+import { ClientSubscriptionImpl } from "./client_subscription_impl.js";
+import type { IClientBase } from "./i_private_client.js";
+import { repair_client_session } from "./reconnection/reconnection.js";
 
 const helpAPIChange = process.env.DEBUG?.match(/API/);
-const debugLog = make_debugLog(__filename);
-const doDebug = checkDebugFlag(__filename);
-const warningLog = make_warningLog(__filename);
-const _errorLog = make_errorLog(__filename);
+const debugLog = make_debugLog("client_session_impl");
+const doDebug = checkDebugFlag("client_session_impl");
+const warningLog = make_warningLog("client_session_impl");
+const _errorLog = make_errorLog("client_session_impl");
 
 let pendingTransactionMessageDisplayed = false;
 

package/source/private/client_subscription_impl.ts

@@ -29,11 +29,11 @@ import {
 } from "node-opcua-service-subscription";
 import { type Callback, type ErrorCallback, type StatusCode, StatusCodes } from "node-opcua-status-code";
 import { isNullOrUndefined } from "node-opcua-utils";
-import type { ClientMonitoredItem } from "../client_monitored_item";
-import type { ClientMonitoredItemBase } from "../client_monitored_item_base";
-import type { ClientMonitoredItemGroup } from "../client_monitored_item_group";
-import { ClientMonitoredItemToolbox } from "../client_monitored_item_toolbox";
-import type { ClientSession, MonitoredItemData, SubscriptionId } from "../client_session";
+import type { ClientMonitoredItem } from "../client_monitored_item.js";
+import type { ClientMonitoredItemBase } from "../client_monitored_item_base.js";
+import type { ClientMonitoredItemGroup } from "../client_monitored_item_group.js";
+import { ClientMonitoredItemToolbox } from "../client_monitored_item_toolbox.js";
+import type { ClientSession, MonitoredItemData, SubscriptionId } from "../client_session.js";
 import {
     type ClientHandle,
     type ClientMonitoredItemBaseMap,
@@ -41,17 +41,17 @@ import {
     type ClientSubscriptionOptions,
     type ModifySubscriptionOptions,
     type ModifySubscriptionResult
-} from "../client_subscription";
-import { ClientMonitoredItemGroupImpl } from "./client_monitored_item_group_impl";
-import { ClientMonitoredItemImpl } from "./client_monitored_item_impl";
-import type { ClientSidePublishEngine } from "./client_publish_engine";
-import type { ClientSessionImpl } from "./client_session_impl";
+} from "../client_subscription.js";
+import { ClientMonitoredItemGroupImpl } from "./client_monitored_item_group_impl.js";
+import { ClientMonitoredItemImpl } from "./client_monitored_item_impl.js";
+import type { ClientSidePublishEngine } from "./client_publish_engine.js";
+import type { ClientSessionImpl } from "./client_session_impl.js";
 
 interface ModifySubscriptionOptionsEx extends ModifySubscriptionOptions {
     subscriptionId?: SubscriptionId;
 }
 
-import { detectLongOperation } from "./performance";
+import { detectLongOperation } from "./performance.js";
 
 const debugLog = make_debugLog("CLIENT_SUBSCRIPTION");
 const doDebug = checkDebugFlag("CLIENT_SUBSCRIPTION");

package/source/private/i_private_client.ts

@@ -2,10 +2,10 @@ import type { IBasicTransportSettings, ResponseCallback } from "node-opcua-pseud
 import type { ClientSecureChannelLayer } from "node-opcua-secure-channel";
 import type { EndpointDescription } from "node-opcua-service-endpoints";
 
-import type { ClientSession } from "../client_session";
-import type { Request, Response } from "../common";
-import type { UserIdentityInfo } from "../user_identity_info";
-import type { ClientSessionImpl } from "./client_session_impl";
+import type { ClientSession } from "../client_session.js";
+import type { Request, Response } from "../common.js";
+import type { UserIdentityInfo } from "../user_identity_info.js";
+import type { ClientSessionImpl } from "./client_session_impl.js";
 
 export interface IClientBase {
     __createSession_step2(session: ClientSessionImpl, callback: (err: Error | null, session?: ClientSessionImpl) => void): void;

package/source/private/opcua_client_impl.ts

@@ -13,6 +13,7 @@ import {
     combine_der,
     exploreCertificate,
     extractPublicKeyFromCertificateSync,
+    type IKeyOperations,
     makePrivateKeyFromPem,
     type Nonce,
     type PrivateKey,
@@ -25,7 +26,7 @@ import type { NodeId } from "node-opcua-nodeid";
 import { readNamespaceArray } from "node-opcua-pseudo-session";
 import {
     type ClientSecureChannelLayer,
-    computeSignature,
+    computeSignatureAsync,
     fromURI,
     getCryptoFactory,
     SecurityPolicy
@@ -49,32 +50,45 @@ import {
 import { type Callback, type CallbackT, type StatusCode, StatusCodes } from "node-opcua-status-code";
 import type { SignatureDataOptions, UserIdentityToken } from "node-opcua-types";
 import { isNullOrUndefined, matchUri, randomBytes } from "node-opcua-utils";
-import type { OPCUAClientBaseEvents } from "../client_base";
-import type { ClientSession } from "../client_session";
-import type { ClientSubscriptionOptions } from "../client_subscription";
-import type { Response } from "../common";
+import type { OPCUAClientBaseEvents } from "../client_base.js";
+import type { ClientSession } from "../client_session.js";
+import type { ClientSubscriptionOptions } from "../client_subscription.js";
+import type { Response } from "../common.js";
 import {
     type EndpointWithUserIdentity,
     OPCUAClient,
     type OPCUAClientOptions,
     type WithSessionFuncP,
     type WithSubscriptionFuncP
-} from "../opcua_client";
-import type { AnonymousIdentity, UserIdentityInfo, UserIdentityInfoUserName, UserIdentityInfoX509 } from "../user_identity_info";
-import { ClientBaseImpl } from "./client_base_impl";
-import { ClientSessionImpl } from "./client_session_impl";
-import type { IClientBase } from "./i_private_client";
-import { repair_client_sessions } from "./reconnection/reconnection";
+} from "../opcua_client.js";
+import type { AnonymousIdentity, UserIdentityInfo, UserIdentityInfoUserName, UserIdentityInfoX509 } from "../user_identity_info.js";
+import { ClientBaseImpl } from "./client_base_impl.js";
+import { ClientSessionImpl } from "./client_session_impl.js";
+import type { IClientBase } from "./i_private_client.js";
+import { repair_client_sessions } from "./reconnection/reconnection.js";
 
 interface TokenAndSignature {
     userIdentityToken: UserIdentityToken | null;
     userTokenSignature: SignatureDataOptions;
 }
 
-const doDebug = checkDebugFlag(__filename);
-const debugLog = make_debugLog(__filename);
-const errorLog = make_errorLog(__filename);
-const warningLog = make_warningLog(__filename);
+const doDebug = checkDebugFlag("opcua_client_impl");
+const debugLog = make_debugLog("opcua_client_impl");
+const errorLog = make_errorLog("opcua_client_impl");
+const warningLog = make_warningLog("opcua_client_impl");
+
+let x509PemPrivateKeyWarningEmitted = false;
+function warnOnceAboutX509PemPrivateKey() {
+    if (x509PemPrivateKeyWarningEmitted) {
+        return;
+    }
+    x509PemPrivateKeyWarningEmitted = true;
+    warningLog(
+        "[NODE-OPCUA-W37] UserIdentityInfoX509.privateKey (raw PEM) is deprecated: pass keyOperations instead" +
+            " — keyOperationsFromPrivateKey(readPrivateKey(file)) from node-opcua-crypto is a one-line migration," +
+            " and an HSM/smartcard-held user key becomes possible."
+    );
+}
 
 function validateServerNonce(serverNonce: Nonce | null): boolean {
     return !(serverNonce && serverNonce.length < 32) || (serverNonce && serverNonce.length === 0);
@@ -191,13 +205,14 @@ interface X509TokenAndSignature {
  *
  * @param context
  * @param certificate - the user certificate
- * @param privateKey  - the private key associated with the user certificate
+ * @param userKey     - the key associated with the user certificate: raw
+ *                      material, or an opaque IKeyOperations (HSM/smartcard)
  */
-function createX509IdentityToken(
+async function createX509IdentityToken(
     context: IdentityTokenContext,
     certificate: Certificate,
-    privateKey: PrivateKey
-): X509TokenAndSignature {
+    userKey: PrivateKey | IKeyOperations
+): Promise<X509TokenAndSignature> {
     const endpoint = context.endpoint;
     assert(endpoint instanceof EndpointDescription);
     const userTokenPolicy = findUserTokenPolicy(endpoint, UserTokenType.Certificate);
@@ -260,8 +275,14 @@ function createX509IdentityToken(
     // now create the proof of possession, by creating a signature
     // The data to sign is created by appending the last serverNonce to the serverCertificate
 
-    // The signature generated with private key associated with the User Certificate
-    const userTokenSignature = computeSignature(serverCertificate, serverNonce, privateKey, securityPolicy) as SignatureDataOptions;
+    // The signature generated with the key associated with the User Certificate —
+    // possibly produced inside an HSM/smartcard, when the user supplied keyOperations
+    const userTokenSignature = (await computeSignatureAsync(
+        serverCertificate,
+        serverNonce,
+        userKey,
+        securityPolicy
+    )) as SignatureDataOptions;
 
     return { userIdentityToken, userTokenSignature };
 }
@@ -965,12 +986,28 @@ export class OPCUAClientImpl extends ClientBaseImpl<OPCUAClientBaseEvents> {
             serverNonce: serverNonce as Buffer // please check this !
         };
 
-        this.createUserIdentityToken(context, userIdentityInfo, (err: Error | null, data?: TokenAndSignature | null) => {
+        this.createUserIdentityToken(context, userIdentityInfo, async (err: Error | null, data?: TokenAndSignature | null) => {
             if (err) {
                 session._client = _old_client;
                 return callback(err);
             }
 
+            // the client application signature is asynchronous now (the key
+            // may be HSM/KMS-held), so it is computed before the request
+            // object is assembled
+            let clientSignature: SignatureDataOptions | undefined;
+            try {
+                clientSignature =
+                    (await this.computeClientSignature(
+                        this._secureChannel as ClientSecureChannelLayer,
+                        serverCertificate,
+                        serverNonce
+                    )) || undefined;
+            } catch (signatureError) {
+                session._client = _old_client;
+                return callback(signatureError as Error);
+            }
+
             data = data as TokenAndSignature;
             const userIdentityToken: UserIdentityToken = data.userIdentityToken as UserIdentityToken;
             const userTokenSignature: SignatureDataOptions = data.userTokenSignature as SignatureDataOptions;
@@ -981,9 +1018,7 @@ export class OPCUAClientImpl extends ClientBaseImpl<OPCUAClientBaseEvents> {
                 // clientCertificate. The SignatureAlgorithm shall be the AsymmetricSignatureAlgorithm
                 // specified in the SecurityPolicy for the Endpoint. The SignatureData type is defined in 7.30.
 
-                clientSignature:
-                    this.computeClientSignature(this._secureChannel as ClientSecureChannelLayer, serverCertificate, serverNonce) ||
-                    undefined,
+                clientSignature,
 
                 // These are the SoftwareCertificates which have been issued to the Client application.
                 // The productUri contained in the SoftwareCertificates shall match the productUri in the
@@ -1218,7 +1253,14 @@ export class OPCUAClientImpl extends ClientBaseImpl<OPCUAClientBaseEvents> {
      * @private
      */
     private computeClientSignature(channel: ClientSecureChannelLayer, serverCertificate: Buffer, serverNonce: Nonce | undefined) {
-        return computeSignature(serverCertificate, serverNonce || Buffer.alloc(0), this.getPrivateKey(), channel.securityPolicy);
+        // through the opaque key-operations path: works whether the client's
+        // application instance key is local or HSM/KMS-held
+        return computeSignatureAsync(
+            serverCertificate,
+            serverNonce || Buffer.alloc(0),
+            this.getKeyOperations(),
+            channel.securityPolicy
+        );
     }
     /**
      *
@@ -1261,7 +1303,7 @@ export class OPCUAClientImpl extends ClientBaseImpl<OPCUAClientBaseEvents> {
 
         let userIdentityToken: UserIdentityToken;
 
-        let userTokenSignature: SignatureDataOptions = {
+        const userTokenSignature: SignatureDataOptions = {
             algorithm: undefined,
             signature: undefined
         };
@@ -1281,9 +1323,22 @@ export class OPCUAClientImpl extends ClientBaseImpl<OPCUAClientBaseEvents> {
 
                 case UserTokenType.Certificate: {
                     const certificate = userIdentityInfo.certificateData;
-                    const privateKey = makePrivateKeyFromPem(userIdentityInfo.privateKey);
-                    ({ userIdentityToken, userTokenSignature } = createX509IdentityToken(context, certificate, privateKey));
-                    break;
+                    if (!userIdentityInfo.privateKey === !userIdentityInfo.keyOperations) {
+                        return callback(
+                            new Error("CLIENT: a X509 user identity requires exactly one of 'privateKey' (PEM) or 'keyOperations'")
+                        );
+                    }
+                    if (userIdentityInfo.privateKey) {
+                        warnOnceAboutX509PemPrivateKey();
+                    }
+                    const userKey: PrivateKey | IKeyOperations = userIdentityInfo.keyOperations
+                        ? userIdentityInfo.keyOperations
+                        : makePrivateKeyFromPem(userIdentityInfo.privateKey as string);
+                    createX509IdentityToken(context, certificate, userKey).then(
+                        (x509Data) => callback(null, x509Data),
+                        (err: Error) => callback(err)
+                    );
+                    return;
                 }
 
                 default:

package/source/private/reconnection/client_publish_engine_reconnection.ts

@@ -3,11 +3,11 @@ import assert from "node-opcua-assert";
 import { checkDebugFlag, make_debugLog } from "node-opcua-debug";
 import { type StatusCode, StatusCodes } from "node-opcua-status-code";
 import { RepublishRequest, type RepublishResponse } from "node-opcua-types";
-import type { ClientSidePublishEngine } from "../client_publish_engine";
-import type { ClientSessionImpl } from "../client_session_impl";
-import type { ClientSubscriptionImpl } from "../client_subscription_impl";
-import { recreateSubscriptionAndMonitoredItem } from "./client_subscription_reconnection";
-import { _shouldNotContinue2 } from "./reconnection";
+import type { ClientSidePublishEngine } from "../client_publish_engine.js";
+import type { ClientSessionImpl } from "../client_session_impl.js";
+import type { ClientSubscriptionImpl } from "../client_subscription_impl.js";
+import { recreateSubscriptionAndMonitoredItem } from "./client_subscription_reconnection.js";
+import { _shouldNotContinue2 } from "./reconnection.js";
 
 const debugLog = make_debugLog("RECONNECTION");
 const doDebug = checkDebugFlag("RECONNECTION");

package/source/private/reconnection/client_reconnection.ts

@@ -1,4 +1,4 @@
-import type { ClientBaseImpl } from "../client_base_impl";
+import type { ClientBaseImpl } from "../client_base_impl.js";
 
 export function waitUntilReconnectionIsCanceled(client: ClientBaseImpl, callback: () => void) {
     const interval = 100;

package/source/private/reconnection/client_subscription_reconnection.ts

@@ -13,10 +13,10 @@ import {
     type CreateMonitoredItemsResponse,
     type MonitoredItemCreateRequestOptions
 } from "node-opcua-types";
-import type { ClientMonitoredItemBaseMap, ClientSubscription } from "../../client_subscription";
-import type { ClientMonitoredItemImpl } from "../client_monitored_item_impl";
-import { __create_subscription, type ClientSubscriptionImpl, TERMINATED_SUBSCRIPTION_ID } from "../client_subscription_impl";
-import { _shouldNotContinue } from "./reconnection";
+import type { ClientMonitoredItemBaseMap, ClientSubscription } from "../../client_subscription.js";
+import type { ClientMonitoredItemImpl } from "../client_monitored_item_impl.js";
+import { __create_subscription, type ClientSubscriptionImpl, TERMINATED_SUBSCRIPTION_ID } from "../client_subscription_impl.js";
+import { _shouldNotContinue } from "./reconnection.js";
 
 const debugLog = make_debugLog("RECONNECTION");
 const doDebug = checkDebugFlag("RECONNECTION");
@@ -65,6 +65,10 @@ export async function recreateSubscriptionAndMonitoredItem(_subscription: Client
         throw _err;
     }
 
+    if (subscription.subscriptionId !== oldSubscriptionId) {
+        subscription.emit("subscriptionId_changed", subscription.subscriptionId, oldSubscriptionId);
+    }
+
     const _test = subscription.publishEngine.getSubscription(subscription.subscriptionId);
 
     // c8 ignore next

package/source/private/reconnection/reconnection.ts

@@ -8,11 +8,11 @@ import { invalidateExtraDataTypeManager } from "node-opcua-client-dynamic-extens
 import { checkDebugFlag, make_debugLog, make_errorLog, make_warningLog } from "node-opcua-debug";
 import { TransferSubscriptionsRequest, type TransferSubscriptionsResponse } from "node-opcua-service-subscription";
 import { CloseSessionRequest } from "node-opcua-types";
-import type { ClientSessionImpl, Reconnectable } from "../client_session_impl";
-import type { ClientSubscriptionImpl } from "../client_subscription_impl";
-import type { IClientBase } from "../i_private_client";
-import { republish } from "./client_publish_engine_reconnection";
-import { recreateSubscriptionAndMonitoredItem } from "./client_subscription_reconnection";
+import type { ClientSessionImpl, Reconnectable } from "../client_session_impl.js";
+import type { ClientSubscriptionImpl } from "../client_subscription_impl.js";
+import type { IClientBase } from "../i_private_client.js";
+import { republish } from "./client_publish_engine_reconnection.js";
+import { recreateSubscriptionAndMonitoredItem } from "./client_subscription_reconnection.js";
 
 const debugLog = make_debugLog("RECONNECTION");
 const doDebug = checkDebugFlag("RECONNECTION");

package/source/tools/findservers.ts

@@ -5,7 +5,7 @@
 import type { ServerOnNetwork } from "node-opcua-service-discovery";
 import type { ApplicationDescription, EndpointDescription } from "node-opcua-service-endpoints";
 
-import { ClientBaseImpl } from "../private/client_base_impl";
+import { ClientBaseImpl } from "../private/client_base_impl.js";
 
 export interface FindServerResults {
     servers: ApplicationDescription[];

package/source/tools/read_history_server_capabilities.ts

@@ -11,7 +11,7 @@ import { type BrowsePath, type BrowsePathResult, makeBrowsePath } from "node-opc
 import { lowerFirstLetter } from "node-opcua-utils";
 import type { Variant } from "node-opcua-variant";
 
-import type { ClientSession } from "../client_session";
+import type { ClientSession } from "../client_session.js";
 
 export interface HistoryServerCapabilities {
     [key: string]: Variant;

package/source/verify.ts

@@ -1,12 +1,50 @@
+import { createPublicKey } from "node:crypto";
 import type { ICertificateStore, OPCUASecureObject } from "node-opcua-common";
 
-import { type Certificate, exploreCertificate, explorePrivateKey, publicKeyAndPrivateKeyMatches } from "node-opcua-crypto/web";
+import { PrivateKeyUnavailableError } from "node-opcua-crypto";
+import {
+    type Certificate,
+    exploreCertificate,
+    explorePrivateKey,
+    extractPublicKeyFromCertificateSync,
+    type PrivateKey,
+    publicKeyAndPrivateKeyMatches
+} from "node-opcua-crypto/web";
 import { checkDebugFlag, make_debugLog, make_errorLog, make_warningLog } from "node-opcua-debug";
 
-const _doDebug = checkDebugFlag(__filename);
-const _debugLog = make_debugLog(__filename);
-const errorLog = make_errorLog(__filename);
-const warningLog = make_warningLog(__filename);
+const _doDebug = checkDebugFlag("verify");
+const _debugLog = make_debugLog("verify");
+const errorLog = make_errorLog("verify");
+const warningLog = make_warningLog("verify");
+
+/**
+ * The opaque-key variant of the certificate/key match check: compares the
+ * certificate's SPKI against the one the key-operations provider reports.
+ * A provider without `getPublicKey` cannot be checked — that is worth a
+ * warning, not a refusal to start (the first real handshake will tell).
+ */
+async function verifyOpaqueKeyMatchesCertificate(secureObject: OPCUASecureObject, certificate: Certificate): Promise<void> {
+    const keyOperations = secureObject.getKeyOperations();
+    if (!keyOperations.getPublicKey) {
+        warningLog(
+            "[NODE-OPCUA-W36] the key-operations provider does not implement getPublicKey():" +
+                " cannot verify that the certificate matches the (opaque) private key"
+        );
+        return;
+    }
+    const providerSpki = Buffer.from(await keyOperations.getPublicKey());
+    const certificateSpki = createPublicKey(extractPublicKeyFromCertificateSync(certificate)).export({
+        type: "spki",
+        format: "der"
+    });
+    if (!providerSpki.equals(certificateSpki)) {
+        errorLog("[NODE-OPCUA-E01] Configuration error : the certificate and the (opaque) private key do not match !");
+        errorLog("               certificateFile= ", secureObject.certificateFile);
+        throw new Error(
+            "[NODE-OPCUA-E01] Configuration error : the certificate does not carry the key-operations provider's public key ! please fix your configuration"
+        );
+    }
+}
 
 export function verifyIsOPCUAValidCertificate(
     certificate: Certificate,
@@ -120,26 +158,39 @@ export async function performCertificateSanityCheck(
 ): Promise<void> {
     // verify that certificate is matching private key, and inform the developer if not
     const certificate = secureObject.getCertificate();
-    const privateKey = secureObject.getPrivateKey();
-    //
-    if (!publicKeyAndPrivateKeyMatches(certificate, privateKey)) {
-        errorLog("[NODE-OPCUA-E01] Configuration error : the certificate and the private key do not match !");
-        errorLog("                  please check the configuration of the OPCUA Server");
-        errorLog("                    privateKey= ", secureObject.privateKeyFile);
-        errorLog("               certificateFile= ", secureObject.certificateFile);
-        throw new Error(
-            "[NODE-OPCUA-E01] Configuration error : the certificate and the private key do not match ! please fix your configuration"
-        );
+    let privateKey: PrivateKey | undefined;
+    try {
+        privateKey = secureObject.getPrivateKey();
+    } catch (err) {
+        if (!(err instanceof PrivateKeyUnavailableError)) {
+            throw err;
+        }
+        // The key is opaque (HSM/KMS-held): no material to compare or
+        // measure. Check what can be checked without it — that the
+        // certificate carries the provider's public key — and warn (not
+        // fail) when the provider cannot even produce that.
+        await verifyOpaqueKeyMatchesCertificate(secureObject, certificate);
     }
-    // verify that the certificate provided has the right key length ( at least 2048)
-    const privateKeyInfo = explorePrivateKey(privateKey);
-    const keyLengthInBits = privateKeyInfo.modulus.length * 8;
-    if (keyLengthInBits <= 1024) {
-        warningLog(
-            `[NODE-OPCUA-W04] The public/private key pair uses a key length which is equal or lower than 1024 bits. ( key length was ${keyLengthInBits} )\n` +
-                `OPCUA version 1.04 requires that security key length are greater or equal to 2048 bits.\n` +
-                `The ${serverOrClient} is operating at risk.                                             `
-        );
+    if (privateKey) {
+        if (!publicKeyAndPrivateKeyMatches(certificate, privateKey)) {
+            errorLog("[NODE-OPCUA-E01] Configuration error : the certificate and the private key do not match !");
+            errorLog("                  please check the configuration of the OPCUA Server");
+            errorLog("                    privateKey= ", secureObject.privateKeyFile);
+            errorLog("               certificateFile= ", secureObject.certificateFile);
+            throw new Error(
+                "[NODE-OPCUA-E01] Configuration error : the certificate and the private key do not match ! please fix your configuration"
+            );
+        }
+        // verify that the certificate provided has the right key length ( at least 2048)
+        const privateKeyInfo = explorePrivateKey(privateKey);
+        const keyLengthInBits = privateKeyInfo.modulus.length * 8;
+        if (keyLengthInBits <= 1024) {
+            warningLog(
+                `[NODE-OPCUA-W04] The public/private key pair uses a key length which is equal or lower than 1024 bits. ( key length was ${keyLengthInBits} )\n` +
+                    `OPCUA version 1.04 requires that security key length are greater or equal to 2048 bits.\n` +
+                    `The ${serverOrClient} is operating at risk.                                             `
+            );
+        }
     }
 
     const options = {