node-opcua-pki 3.0.2 → 3.1.1

package/dist/pki/certificate_manager.js

@@ -1,884 +1,884 @@
-"use strict";
-// ---------------------------------------------------------------------------------------------------------------------
-// node-opcua
-// ---------------------------------------------------------------------------------------------------------------------
-// Copyright (c) 2014-2022 - Etienne Rossignon - etienne.rossignon (at) gadz.org
-// Copyright (c) 2022 - Sterfive.com
-// ---------------------------------------------------------------------------------------------------------------------
-//
-// This  project is licensed under the terms of the MIT license.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
-// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
-// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
-// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
-//
-// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
-// Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
-// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
-// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-// ---------------------------------------------------------------------------------------------------------------------
-// tslint:disable:no-shadowed-variable
-// tslint:disable:member-ordering
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CertificateManager = exports.CertificateManagerState = exports.VerificationStatus = void 0;
-const assert = require("assert");
-const async = require("async");
-const chalk = require("chalk");
-const chokidar = require("chokidar");
-const fs = require("fs");
-const path = require("path");
-const util_1 = require("util");
-const node_opcua_crypto_1 = require("node-opcua-crypto");
-const toolbox_1 = require("./toolbox");
-const global_mutex_1 = require("@ster5/global-mutex");
-// tslint:disable:max-line-length
-// tslint:disable:no-var-requires
-// eslint-disable-next-line @typescript-eslint/no-var-requires
-const thenify = require("thenify");
-const fsFileExists = (0, util_1.promisify)(fs.exists);
-const fsWriteFile = (0, util_1.promisify)(fs.writeFile);
-const fsReadFile = (0, util_1.promisify)(fs.readFile);
-const fsRemoveFile = (0, util_1.promisify)(fs.unlink);
-var VerificationStatus;
-(function (VerificationStatus) {
-    /** The certificate provided as a parameter is not valid. */
-    VerificationStatus["BadCertificateInvalid"] = "BadCertificateInvalid";
-    /** An error occurred verifying security. */
-    VerificationStatus["BadSecurityChecksFailed"] = "BadSecurityChecksFailed";
-    /** The certificate does not meet the requirements of the security policy. */
-    VerificationStatus["BadCertificatePolicyCheckFailed"] = "BadCertificatePolicyCheckFailed";
-    /** The certificate has expired or is not yet valid. */
-    VerificationStatus["BadCertificateTimeInvalid"] = "BadCertificateTimeInvalid";
-    /** An issuer certificate has expired or is not yet valid. */
-    VerificationStatus["BadCertificateIssuerTimeInvalid"] = "BadCertificateIssuerTimeInvalid";
-    /** The HostName used to connect to a server does not match a HostName in the certificate. */
-    VerificationStatus["BadCertificateHostNameInvalid"] = "BadCertificateHostNameInvalid";
-    /** The URI specified in the ApplicationDescription does not match the URI in the certificate. */
-    VerificationStatus["BadCertificateUriInvalid"] = "BadCertificateUriInvalid";
-    /** The certificate may not be used for the requested operation. */
-    VerificationStatus["BadCertificateUseNotAllowed"] = "BadCertificateUseNotAllowed";
-    /** The issuer certificate may not be used for the requested operation. */
-    VerificationStatus["BadCertificateIssuerUseNotAllowed"] = "BadCertificateIssuerUseNotAllowed";
-    /** The certificate is not trusted. */
-    VerificationStatus["BadCertificateUntrusted"] = "BadCertificateUntrusted";
-    /** It was not possible to determine if the certificate has been revoked. */
-    VerificationStatus["BadCertificateRevocationUnknown"] = "BadCertificateRevocationUnknown";
-    /** It was not possible to determine if the issuer certificate has been revoked. */
-    VerificationStatus["BadCertificateIssuerRevocationUnknown"] = "BadCertificateIssuerRevocationUnknown";
-    /** The certificate has been revoked. */
-    VerificationStatus["BadCertificateRevoked"] = "BadCertificateRevoked";
-    /** The issuer certificate has been revoked. */
-    VerificationStatus["BadCertificateIssuerRevoked"] = "BadCertificateIssuerRevoked";
-    /** The certificate chain is incomplete. */
-    VerificationStatus["BadCertificateChainIncomplete"] = "BadCertificateChainIncomplete";
-    /** Validation OK. */
-    VerificationStatus["Good"] = "Good";
-})(VerificationStatus = exports.VerificationStatus || (exports.VerificationStatus = {}));
-function makeFingerprint(certificate) {
-    return (0, node_opcua_crypto_1.makeSHA1Thumbprint)(certificate).toString("hex");
-}
-function short(stringToShorten) {
-    return stringToShorten.substr(0, 10);
-}
-function buildIdealCertificateName(certificate) {
-    const fingerprint = makeFingerprint(certificate);
-    try {
-        const commonName = (0, node_opcua_crypto_1.exploreCertificate)(certificate).tbsCertificate.subject.commonName || "";
-        return commonName + "[" + fingerprint + "]";
-    }
-    catch (err) {
-        // make be certificate is incorrect !
-        return "invalid_certificate_[" + fingerprint + "]";
-    }
-}
-function findMatchingIssuerKey(entries, wantedIssuerKey) {
-    const selected = entries.filter(({ certificate }) => {
-        const info = (0, node_opcua_crypto_1.exploreCertificate)(certificate);
-        return info.tbsCertificate.extensions && info.tbsCertificate.extensions.subjectKeyIdentifier === wantedIssuerKey;
-    });
-    return selected;
-}
-function isSelfSigned2(info) {
-    var _a, _b, _c;
-    return (((_a = info.tbsCertificate.extensions) === null || _a === void 0 ? void 0 : _a.subjectKeyIdentifier) ===
-        ((_c = (_b = info.tbsCertificate.extensions) === null || _b === void 0 ? void 0 : _b.authorityKeyIdentifier) === null || _c === void 0 ? void 0 : _c.keyIdentifier));
-}
-function isSelfSigned3(certificate) {
-    const info = (0, node_opcua_crypto_1.exploreCertificate)(certificate);
-    return isSelfSigned2(info);
-}
-var CertificateManagerState;
-(function (CertificateManagerState) {
-    CertificateManagerState[CertificateManagerState["Uninitialized"] = 0] = "Uninitialized";
-    CertificateManagerState[CertificateManagerState["Initializing"] = 1] = "Initializing";
-    CertificateManagerState[CertificateManagerState["Initialized"] = 2] = "Initialized";
-    CertificateManagerState[CertificateManagerState["Disposing"] = 3] = "Disposing";
-    CertificateManagerState[CertificateManagerState["Disposed"] = 4] = "Disposed";
-})(CertificateManagerState = exports.CertificateManagerState || (exports.CertificateManagerState = {}));
-class CertificateManager {
-    constructor(options) {
-        this.untrustUnknownCertificate = true;
-        this.state = CertificateManagerState.Uninitialized;
-        this.folderPoolingInterval = 5000;
-        this._watchers = [];
-        this._readCertificatesCalled = false;
-        this._filenameToHash = {};
-        this._thumbs = {
-            rejected: {},
-            trusted: {},
-            issuers: {
-                certs: {},
-            },
-            crl: {},
-            issuersCrl: {},
-        };
-        this._pending_crl_to_process = 0;
-        this.queue = [];
-        options.keySize = options.keySize || 2048;
-        assert(Object.prototype.hasOwnProperty.call(options, "location"));
-        assert(Object.prototype.hasOwnProperty.call(options, "keySize"));
-        assert(this.state === CertificateManagerState.Uninitialized);
-        this.location = (0, toolbox_1.make_path)(options.location, "");
-        this.keySize = options.keySize;
-        (0, toolbox_1.mkdir)(options.location);
-        // istanbul ignore next
-        if (!fs.existsSync(this.location)) {
-            throw new Error("CertificateManager cannot access location " + this.location);
-        }
-    }
-    get configFile() {
-        return path.join(this.rootDir, "own/openssl.cnf");
-    }
-    get rootDir() {
-        return this.location;
-    }
-    get privateKey() {
-        return path.join(this.rootDir, "own/private/private_key.pem");
-    }
-    get randomFile() {
-        return path.join(this.rootDir, "./random.rnd");
-    }
-    getCertificateStatus(certificate, ...args) {
-        const callback = args[0];
-        this.initialize(() => {
-            this._checkRejectedOrTrusted(certificate, (err, status) => {
-                if (err) {
-                    return callback(err);
-                }
-                if (status === "unknown") {
-                    assert(certificate instanceof Buffer);
-                    const pem = (0, node_opcua_crypto_1.toPem)(certificate, "CERTIFICATE");
-                    const fingerprint = makeFingerprint(certificate);
-                    const filename = path.join(this.rejectedFolder, buildIdealCertificateName(certificate) + ".pem");
-                    fs.writeFile(filename, pem, (err) => {
-                        this._thumbs.rejected[fingerprint] = {
-                            certificate,
-                            filename,
-                        };
-                        if (err) {
-                            return callback(err);
-                        }
-                        status = "rejected";
-                        return callback(null, status);
-                    });
-                    return;
-                }
-                else {
-                    return callback(null, status);
-                }
-            });
-        });
-    }
-    rejectCertificate(certificate, ...args) {
-        const callback = args[0];
-        assert(callback && callback instanceof Function, "expecting callback");
-        this._moveCertificate(certificate, "rejected", callback);
-    }
-    trustCertificate(certificate, ...args) {
-        const callback = args[0];
-        assert(callback && callback instanceof Function, "expecting callback");
-        this._moveCertificate(certificate, "trusted", callback);
-    }
-    get rejectedFolder() {
-        return path.join(this.rootDir, "rejected");
-    }
-    get trustedFolder() {
-        return path.join(this.rootDir, "trusted/certs");
-    }
-    get crlFolder() {
-        return path.join(this.rootDir, "trusted/crl");
-    }
-    get issuersCertFolder() {
-        return path.join(this.rootDir, "issuers/certs");
-    }
-    get issuersCrlFolder() {
-        return path.join(this.rootDir, "issuers/crl");
-    }
-    isCertificateTrusted(certificate) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            const fingerprint = makeFingerprint(certificate);
-            const certificateInTrust = (_a = this._thumbs.trusted[fingerprint]) === null || _a === void 0 ? void 0 : _a.certificate;
-            if (certificateInTrust) {
-                return "Good";
-            }
-            else {
-                const certificateInRejected = this._thumbs.rejected[fingerprint];
-                if (!certificateInRejected) {
-                    const certificateFilenameInRejected = path.join(this.rejectedFolder, buildIdealCertificateName(certificate) + ".pem");
-                    if (!this.untrustUnknownCertificate) {
-                        return "Good";
-                    }
-                    // Certificate should be mark as untrusted
-                    // let's first verify that certificate is valid ,as we don't want to write invalid data
-                    try {
-                        const certificateInfo = (0, node_opcua_crypto_1.exploreCertificateInfo)(certificate);
-                    }
-                    catch (err) {
-                        return "BadCertificateInvalid";
-                    }
-                    (0, toolbox_1.debugLog)("certificate has never been seen before and is now rejected (untrusted) ", certificateFilenameInRejected);
-                    yield fsWriteFile(certificateFilenameInRejected, (0, node_opcua_crypto_1.toPem)(certificate, "CERTIFICATE"));
-                }
-                return "BadCertificateUntrusted";
-            }
-        });
-    }
-    _innerVerifyCertificateAsync(certificate, isIssuer, level) {
-        var _a, _b;
-        return __awaiter(this, void 0, void 0, function* () {
-            if (level >= 5) {
-                // maximum level of certificate in chain reached !
-                return VerificationStatus.BadSecurityChecksFailed;
-            }
-            const chain = (0, node_opcua_crypto_1.split_der)(certificate);
-            (0, toolbox_1.debugLog)("NB CERTIFICATE IN CHAIN = ", chain.length);
-            const info = (0, node_opcua_crypto_1.exploreCertificate)(chain[0]);
-            let hasValidIssuer = false;
-            let hasTrustedIssuer = false;
-            // check if certificate is attached to a issuer
-            const hasIssuerKey = (_b = (_a = info.tbsCertificate.extensions) === null || _a === void 0 ? void 0 : _a.authorityKeyIdentifier) === null || _b === void 0 ? void 0 : _b.keyIdentifier;
-            (0, toolbox_1.debugLog)("Certificate as an Issuer Key", hasIssuerKey);
-            // console.log(inspect(info, { depth: 100 }));
-            if (hasIssuerKey) {
-                const isSelfSigned = isSelfSigned2(info);
-                (0, toolbox_1.debugLog)("Is the Certificate self-signed  ?", isSelfSigned);
-                if (!isSelfSigned) {
-                    const issuerCertificate = yield this.findIssuerCertificate(chain[0]);
-                    // console.log("issuer is found", !!issuerCertificate, info.tbsCertificate.extensions.subjectKeyIdentifier, info.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier);
-                    if (!issuerCertificate) {
-                        // if the certificate is not self-signed we ust have a issuer.
-                        // but no Issuer is not found
-                        return VerificationStatus.BadSecurityChecksFailed;
-                    }
-                    const issuerStatus = yield this._innerVerifyCertificateAsync(issuerCertificate, true, level + 1);
-                    if (issuerStatus === VerificationStatus.BadCertificateRevocationUnknown) {
-                        // the issuer must have a CRL available .... !
-                        return VerificationStatus.BadCertificateIssuerRevocationUnknown;
-                    }
-                    if (issuerStatus === VerificationStatus.BadCertificateIssuerRevocationUnknown) {
-                        // the issuer must have a CRL available .... !
-                        return VerificationStatus.BadCertificateIssuerRevocationUnknown;
-                    }
-                    if (issuerStatus === VerificationStatus.BadCertificateTimeInvalid) {
-                        // the issuer must have valid dates ....
-                        return VerificationStatus.BadCertificateIssuerTimeInvalid;
-                    }
-                    if (issuerStatus !== VerificationStatus.Good && issuerStatus !== VerificationStatus.BadCertificateUntrusted) {
-                        // if the issuer has other issue => let's drop!
-                        return VerificationStatus.BadSecurityChecksFailed;
-                    }
-                    // verify that certificate was signed by issuer
-                    const isCertificateSignatureOK = (0, node_opcua_crypto_1.verifyCertificateSignature)(certificate, issuerCertificate);
-                    if (!isCertificateSignatureOK) {
-                        // the certificate was not signed by the issuer as it claim to be ! Danger
-                        return VerificationStatus.BadSecurityChecksFailed;
-                    }
-                    hasValidIssuer = true;
-                    // let detected if our certificate is in the revocation list
-                    const revokedStatus = yield this.isCertificateRevoked(certificate);
-                    if (revokedStatus === VerificationStatus.BadCertificateRevocationUnknown) {
-                        return VerificationStatus.BadCertificateRevocationUnknown;
-                    }
-                    if (revokedStatus !== VerificationStatus.Good) {
-                        // certificate is revoked !!!
-                        (0, toolbox_1.debugLog)("revokedStatus", revokedStatus);
-                        return revokedStatus;
-                    }
-                    // let check if the issuer is explicitly trusted
-                    const issuerTrustedStatus = yield this._checkRejectedOrTrusted(issuerCertificate);
-                    (0, toolbox_1.debugLog)("issuerTrustedStatus", issuerTrustedStatus);
-                    if (issuerTrustedStatus === "unknown") {
-                        hasTrustedIssuer = false;
-                    }
-                    else if (issuerTrustedStatus === "trusted") {
-                        hasTrustedIssuer = true;
-                    }
-                    else if (issuerTrustedStatus === "rejected") {
-                        // we should never get there: this should have been detected before !!!
-                        return VerificationStatus.BadSecurityChecksFailed;
-                    }
-                }
-                else {
-                    // verify that certificate was signed by issuer (self in this case)
-                    const isCertificateSignatureOK = (0, node_opcua_crypto_1.verifyCertificateSignature)(certificate, certificate);
-                    if (!isCertificateSignatureOK) {
-                        (0, toolbox_1.debugLog)("Self-signed Certificate signature is not valid");
-                        return VerificationStatus.BadSecurityChecksFailed;
-                    }
-                    const revokedStatus = yield this.isCertificateRevoked(certificate);
-                    (0, toolbox_1.debugLog)("revokedStatus of self signed certificate:", revokedStatus);
-                }
-            }
-            const status = yield this._checkRejectedOrTrusted(certificate);
-            if (status === "rejected") {
-                return VerificationStatus.BadCertificateUntrusted;
-            }
-            const c2 = chain[1] ? (0, node_opcua_crypto_1.exploreCertificateInfo)(chain[1]) : "non";
-            // Has SoftwareCertificate passed its issue date and has it not expired ?
-            // check dates
-            const certificateInfo = (0, node_opcua_crypto_1.exploreCertificateInfo)(certificate);
-            const now = new Date();
-            let isTimeInvalid = false;
-            // check that certificate is active
-            if (certificateInfo.notBefore.getTime() > now.getTime()) {
-                // certificate is not active yet
-                (0, toolbox_1.debugLog)(chalk.red("certificate is invalid : certificate is not active yet !") +
-                    "  not before date =" +
-                    certificateInfo.notBefore);
-                isTimeInvalid = true;
-            }
-            //  check that certificate has not expired
-            if (certificateInfo.notAfter.getTime() <= now.getTime()) {
-                // certificate is obsolete
-                (0, toolbox_1.debugLog)(chalk.red("certificate is invalid : certificate has expired !") + " not after date =" + certificateInfo.notAfter);
-                isTimeInvalid = true;
-            }
-            if (status === "trusted") {
-                return isTimeInvalid ? VerificationStatus.BadCertificateTimeInvalid : VerificationStatus.Good;
-            }
-            assert(status === "unknown");
-            if (hasIssuerKey) {
-                if (!hasTrustedIssuer) {
-                    return VerificationStatus.BadCertificateUntrusted;
-                }
-                if (!hasValidIssuer) {
-                    return VerificationStatus.BadCertificateUntrusted;
-                }
-                return isTimeInvalid ? VerificationStatus.BadCertificateTimeInvalid : VerificationStatus.Good;
-            }
-            else {
-                return VerificationStatus.BadCertificateUntrusted;
-            }
-        });
-    }
-    verifyCertificateAsync(certificate) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const status1 = yield this._innerVerifyCertificateAsync(certificate, false, 0);
-            return status1;
-        });
-    }
-    verifyCertificate(certificate, callback) {
-        // Is the  signature on the SoftwareCertificate valid .?
-        if (!certificate) {
-            // missing certificate
-            return callback(null, VerificationStatus.BadSecurityChecksFailed);
-        }
-        (0, util_1.callbackify)(this.verifyCertificateAsync).call(this, certificate, callback);
-    }
-    initialize(...args) {
-        const callback = args[0];
-        assert(callback && callback instanceof Function);
-        if (this.state !== CertificateManagerState.Uninitialized) {
-            return callback();
-        }
-        this.state = CertificateManagerState.Initializing;
-        return this._initialize((err) => {
-            this.state = CertificateManagerState.Initialized;
-            return callback(err);
-        });
-    }
-    _initialize(callback) {
-        assert((this.state = CertificateManagerState.Initializing));
-        const pkiDir = this.location;
-        (0, toolbox_1.mkdir)(pkiDir);
-        (0, toolbox_1.mkdir)(path.join(pkiDir, "own"));
-        (0, toolbox_1.mkdir)(path.join(pkiDir, "own/certs"));
-        (0, toolbox_1.mkdir)(path.join(pkiDir, "own/private"));
-        (0, toolbox_1.mkdir)(path.join(pkiDir, "rejected"));
-        (0, toolbox_1.mkdir)(path.join(pkiDir, "trusted"));
-        (0, toolbox_1.mkdir)(path.join(pkiDir, "trusted/certs"));
-        (0, toolbox_1.mkdir)(path.join(pkiDir, "trusted/crl"));
-        (0, toolbox_1.mkdir)(path.join(pkiDir, "issuers"));
-        (0, toolbox_1.mkdir)(path.join(pkiDir, "issuers/certs")); // contains Trusted CA certificates
-        (0, toolbox_1.mkdir)(path.join(pkiDir, "issuers/crl")); // contains CRL of revoked CA certificates
-        this.withLock((callback) => {
-            assert(this.state !== CertificateManagerState.Disposing);
-            if (this.state === CertificateManagerState.Disposed) {
-                return callback();
-            }
-            assert(this.state === CertificateManagerState.Initializing);
-            fs.writeFileSync(this.configFile, toolbox_1.configurationFileSimpleTemplate);
-            // note : openssl 1.1.1 has a bug that causes a failure if
-            // random file cannot be found. (should be fixed in 1.1.1.a)
-            // if this issue become important we may have to consider checking that rndFile exists and recreate
-            // it if not . this could be achieved with the command :
-            //      "openssl rand -writerand ${this.randomFile}"
-            //
-            // cf: https://github.com/node-opcua/node-opcua/issues/554
-            if (!fs.existsSync(this.privateKey)) {
-                (0, toolbox_1.debugLog)("generating private key ...");
-                (0, toolbox_1.setEnv)("RANDFILE", this.randomFile);
-                (0, toolbox_1.createPrivateKey)(this.privateKey, this.keySize, (err) => {
-                    if (err) {
-                        return callback(err);
-                    }
-                    this._readCertificates(() => callback());
-                });
-            }
-            else {
-                // debugLog("   initialize :  private key already exists ... skipping");
-                this._readCertificates(() => callback());
-            }
-        }, callback);
-    }
-    dispose() {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (this.state === CertificateManagerState.Disposing) {
-                throw new Error("Already disposing");
-            }
-            if (this.state === CertificateManagerState.Uninitialized) {
-                this.state = CertificateManagerState.Disposed;
-                return;
-            }
-            // wait for initialization to be completed
-            if (this.state === CertificateManagerState.Initializing) {
-                yield new Promise((resolve) => setTimeout(resolve, 100));
-                return yield this.dispose();
-            }
-            try {
-                this.state = CertificateManagerState.Disposing;
-                yield Promise.all(this._watchers.map((w) => w.close()));
-                this._watchers.forEach((w) => w.removeAllListeners());
-                this._watchers.splice(0);
-            }
-            finally {
-                this.state = CertificateManagerState.Disposed;
-            }
-        });
-    }
-    // eslint-disable-next-line @typescript-eslint/ban-types
-    withLock(action, callback) {
-        this.withLock2((0, util_1.promisify)(action))
-            .then((t) => callback(null, t))
-            .catch((err) => callback(err));
-    }
-    withLock2(action) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const lockFileName = path.join(this.rootDir, "mutex.lock");
-            return (0, global_mutex_1.withLock)({ lockfile: lockFileName }, () => __awaiter(this, void 0, void 0, function* () {
-                return yield action();
-            }));
-        });
-    }
-    createSelfSignedCertificate(params, ...args) {
-        const callback = args[0];
-        assert(typeof params.applicationUri === "string", "expecting applicationUri");
-        if (!fs.existsSync(this.privateKey)) {
-            return callback(new Error("Cannot find private key " + this.privateKey));
-        }
-        let certificateFilename = path.join(this.rootDir, "own/certs/self_signed_certificate.pem");
-        certificateFilename = params.outputFile || certificateFilename;
-        const _params = params;
-        _params.rootDir = this.rootDir;
-        _params.configFile = this.configFile;
-        _params.privateKey = this.privateKey;
-        this.withLock((callback) => {
-            (0, toolbox_1.createSelfSignCertificate)(certificateFilename, _params, callback);
-        }, callback);
-    }
-    createCertificateRequest(params, callback) {
-        assert(params);
-        const _params = params;
-        if (Object.prototype.hasOwnProperty.call(_params, "rootDir")) {
-            throw new Error("rootDir should not be specified ");
-        }
-        assert(typeof callback === "function");
-        assert(!_params.rootDir);
-        assert(!_params.configFile);
-        assert(!_params.privateKey);
-        _params.rootDir = this.rootDir;
-        _params.configFile = this.configFile;
-        _params.privateKey = this.privateKey;
-        this.withLock((callback) => {
-            // compose a file name for the request
-            const now = new Date();
-            const today = now.toISOString().slice(0, 10) + "_" + now.getTime();
-            const certificateSigningRequestFilename = path.join(this.rootDir, "own/certs", "certificate_" + today + ".csr");
-            (0, toolbox_1.createCertificateSigningRequest)(certificateSigningRequestFilename, _params, (err) => {
-                if (err) {
-                    return callback(err);
-                }
-                return callback(null, certificateSigningRequestFilename);
-            });
-        }, callback);
-    }
-    addIssuer(certificate, validate = false, addInTrustList = false) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (validate) {
-                const status = yield this.verifyCertificate(certificate);
-                if (status !== VerificationStatus.Good && status !== VerificationStatus.BadCertificateUntrusted) {
-                    return status;
-                }
-            }
-            const pemCertificate = (0, node_opcua_crypto_1.toPem)(certificate, "CERTIFICATE");
-            const fingerprint = makeFingerprint(certificate);
-            if (this._thumbs.issuers.certs[fingerprint]) {
-                // already in .. simply ignore
-                return VerificationStatus.Good;
-            }
-            // write certificate
-            const filename = path.join(this.issuersCertFolder, "issuer_" + buildIdealCertificateName(certificate) + ".pem");
-            yield (0, util_1.promisify)(fs.writeFile)(filename, pemCertificate, "ascii");
-            // first time seen, let's save it.
-            this._thumbs.issuers.certs[fingerprint] = { certificate, filename };
-            if (addInTrustList) {
-                // add certificate in the trust list as well
-                yield this.trustCertificate(certificate);
-            }
-            return VerificationStatus.Good;
-        });
-    }
-    addRevocationList(crl) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this.withLock2(() => __awaiter(this, void 0, void 0, function* () {
-                try {
-                    const crlInfo = (0, node_opcua_crypto_1.exploreCertificateRevocationList)(crl);
-                    const key = crlInfo.tbsCertList.issuerFingerprint;
-                    if (!this._thumbs.issuersCrl[key]) {
-                        this._thumbs.issuersCrl[key] = { crls: [], serialNumbers: {} };
-                    }
-                    const pemCertificate = (0, node_opcua_crypto_1.toPem)(crl, "X509 CRL");
-                    const filename = path.join(this.issuersCrlFolder, "crl_" + buildIdealCertificateName(crl) + ".pem");
-                    yield (0, util_1.promisify)(fs.writeFile)(filename, pemCertificate, "ascii");
-                    yield this._on_crl_file_added(this._thumbs.issuersCrl, filename);
-                    yield this.waitAndCheckCRLProcessingStatus();
-                    return VerificationStatus.Good;
-                }
-                catch (err) {
-                    (0, toolbox_1.debugLog)(err);
-                    return VerificationStatus.BadSecurityChecksFailed;
-                }
-            }));
-        });
-    }
-    // find the issuer certificate
-    findIssuerCertificate(certificate) {
-        var _a, _b;
-        return __awaiter(this, void 0, void 0, function* () {
-            const certInfo = (0, node_opcua_crypto_1.exploreCertificate)(certificate);
-            // istanbul ignore next
-            if (isSelfSigned2(certInfo)) {
-                // the certificate is self signed so is it's own issuer.
-                return certificate;
-            }
-            const wantedIssuerKey = (_b = (_a = certInfo.tbsCertificate.extensions) === null || _a === void 0 ? void 0 : _a.authorityKeyIdentifier) === null || _b === void 0 ? void 0 : _b.keyIdentifier;
-            // istanbul ignore next
-            if (!wantedIssuerKey) {
-                // Certificate has no extension 3 ! the certificate might have been generated by an old system
-                (0, toolbox_1.debugLog)("Certificate has no extension 3");
-                return null;
-            }
-            const issuerCertificates = Object.values(this._thumbs.issuers.certs);
-            const selectedIssuerCertificates = findMatchingIssuerKey(issuerCertificates, wantedIssuerKey);
-            if (selectedIssuerCertificates.length > 0) {
-                if (selectedIssuerCertificates.length > 1) {
-                    // tslint:disable-next-line: no-console
-                    console.log("Warning more than one issuer certificate exists with subjectKeyIdentifier ", wantedIssuerKey);
-                }
-                return selectedIssuerCertificates[0].certificate || null;
-            }
-            // check also in trusted  list
-            const trustedCertificates = Object.values(this._thumbs.trusted);
-            const selectedTrustedCertificates = findMatchingIssuerKey(trustedCertificates, wantedIssuerKey);
-            // istanbul ignore next
-            if (selectedTrustedCertificates.length > 1) {
-                // tslint:disable-next-line: no-console
-                console.log("Warning more than one certificate exists with subjectKeyIdentifier in trusted certificate list ", wantedIssuerKey, selectedTrustedCertificates.length);
-                for (const entry of selectedTrustedCertificates) {
-                    (0, toolbox_1.dumpCertificate)(entry.filename, (err, data) => {
-                        (0, toolbox_1.debugLog)("    ", entry.filename);
-                        (0, toolbox_1.debugLog)(data);
-                    });
-                }
-            }
-            return selectedTrustedCertificates.length > 0 ? selectedTrustedCertificates[0].certificate : null;
-        });
-    }
-    _checkRejectedOrTrusted(certificate, ...args) {
-        const callback = args[0];
-        assert(callback && callback instanceof Function);
-        assert(certificate instanceof Buffer);
-        const fingerprint = makeFingerprint(certificate);
-        (0, toolbox_1.debugLog)("_checkRejectedOrTrusted fingerprint ", short(fingerprint));
-        this._readCertificates((err) => {
-            // istanbul ignore next
-            if (err) {
-                return callback(err);
-            }
-            if (Object.prototype.hasOwnProperty.call(this._thumbs.rejected, fingerprint)) {
-                return callback(null, "rejected");
-            }
-            if (Object.prototype.hasOwnProperty.call(this._thumbs.trusted, fingerprint)) {
-                return callback(null, "trusted");
-            }
-            return callback(null, "unknown");
-        });
-    }
-    _moveCertificate(certificate, newStatus, callback) {
-        // a mutex is requested here
-        assert(certificate instanceof Buffer);
-        const fingerprint = makeFingerprint(certificate);
-        this.getCertificateStatus(certificate, (err, status) => {
-            var _a;
-            // istanbul ignore next
-            if (err) {
-                return callback(err);
-            }
-            (0, toolbox_1.debugLog)("_moveCertificate", fingerprint.substr(0, 10), "from", status, "to", newStatus);
-            assert(status === "rejected" || status === "trusted");
-            if (status !== newStatus) {
-                const certificateSrc = (_a = this._thumbs[status][fingerprint]) === null || _a === void 0 ? void 0 : _a.filename;
-                // istanbul ignore next
-                if (!certificateSrc) {
-                    (0, toolbox_1.debugLog)(" cannot find certificate ", fingerprint.substr(0, 10), " in", this._thumbs, [status]);
-                    return callback(new Error("internal"));
-                }
-                const destFolder = newStatus === "rejected"
-                    ? this.rejectedFolder
-                    : newStatus === "trusted"
-                        ? this.trustedFolder
-                        : this.rejectedFolder;
-                const certificateDest = path.join(destFolder, path.basename(certificateSrc));
-                (0, toolbox_1.debugLog)("_moveCertificate1", fingerprint.substr(0, 10), "old name", certificateSrc);
-                (0, toolbox_1.debugLog)("_moveCertificate1", fingerprint.substr(0, 10), "new name", certificateDest);
-                fs.rename(certificateSrc, certificateDest, (err) => {
-                    delete this._thumbs[status][fingerprint];
-                    this._thumbs[newStatus][fingerprint] = {
-                        certificate,
-                        filename: certificateDest,
-                    };
-                    // we do not return the error here
-                    return callback( /*err*/);
-                });
-            }
-            else {
-                return callback();
-            }
-        });
-    }
-    _findAssociatedCRLs(issuerCertificate) {
-        const issuerCertificateInfo = (0, node_opcua_crypto_1.exploreCertificate)(issuerCertificate);
-        const key = issuerCertificateInfo.tbsCertificate.subjectFingerPrint;
-        return this._thumbs.issuersCrl[key] ? this._thumbs.issuersCrl[key] : this._thumbs.crl[key] ? this._thumbs.crl[key] : null;
-    }
-    isCertificateRevoked(certificate, issuerCertificate) {
-        var _a, _b, _c, _d;
-        return __awaiter(this, void 0, void 0, function* () {
-            // istanbul ignore next
-            if (isSelfSigned3(certificate)) {
-                return VerificationStatus.Good;
-            }
-            if (!issuerCertificate) {
-                issuerCertificate = yield this.findIssuerCertificate(certificate);
-            }
-            if (!issuerCertificate) {
-                return VerificationStatus.BadCertificateChainIncomplete;
-            }
-            const crls = this._findAssociatedCRLs(issuerCertificate);
-            if (!crls) {
-                return VerificationStatus.BadCertificateRevocationUnknown;
-            }
-            const certInfo = (0, node_opcua_crypto_1.exploreCertificate)(certificate);
-            const serialNumber = certInfo.tbsCertificate.serialNumber || ((_b = (_a = certInfo.tbsCertificate.extensions) === null || _a === void 0 ? void 0 : _a.authorityKeyIdentifier) === null || _b === void 0 ? void 0 : _b.serial) || "";
-            const key = ((_d = (_c = certInfo.tbsCertificate.extensions) === null || _c === void 0 ? void 0 : _c.authorityKeyIdentifier) === null || _d === void 0 ? void 0 : _d.authorityCertIssuerFingerPrint) || "<unknown>";
-            const crl2 = this._thumbs.crl[key] || null;
-            if (crls.serialNumbers[serialNumber] || (crl2 && crl2.serialNumbers[serialNumber])) {
-                return VerificationStatus.BadCertificateRevoked;
-            }
-            return VerificationStatus.Good;
-        });
-    }
-    _on_crl_file_added(index, filename) {
-        this.queue.push({ index, filename });
-        this._pending_crl_to_process += 1;
-        if (this._pending_crl_to_process === 1) {
-            this._process_next_crl();
-        }
-    }
-    _process_next_crl() {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const { index, filename } = this.queue.shift();
-                const crl = yield (0, node_opcua_crypto_1.readCertificateRevocationList)(filename);
-                const crlInfo = (0, node_opcua_crypto_1.exploreCertificateRevocationList)(crl);
-                (0, toolbox_1.debugLog)(chalk.cyan("add CRL in folder "), filename); // stat);
-                const fingerprint = crlInfo.tbsCertList.issuerFingerprint;
-                index[fingerprint] = index[fingerprint] || {
-                    crls: [],
-                    serialNumbers: {},
-                };
-                index[fingerprint].crls.push({ crlInfo, filename });
-                const serialNumbers = index[fingerprint].serialNumbers;
-                // now inject serial numbers
-                for (const revokedCertificate of crlInfo.tbsCertList.revokedCertificates) {
-                    const serialNumber = revokedCertificate.userCertificate;
-                    if (!serialNumbers[serialNumber]) {
-                        serialNumbers[serialNumber] = revokedCertificate.revocationDate;
-                    }
-                }
-                (0, toolbox_1.debugLog)(chalk.cyan("CRL"), fingerprint, "serial numbers = ", Object.keys(serialNumbers)); // stat);
-            }
-            catch (err) {
-                (0, toolbox_1.debugLog)("CRL filename error =");
-                (0, toolbox_1.debugLog)(err);
-            }
-            this._pending_crl_to_process -= 1;
-            if (this._pending_crl_to_process === 0) {
-                if (this._on_crl_process) {
-                    this._on_crl_process();
-                    this._on_crl_process = undefined;
-                }
-            }
-            else {
-                this._process_next_crl();
-            }
-        });
-    }
-    _readCertificates(callback) {
-        if (this._readCertificatesCalled) {
-            return callback();
-        }
-        this._readCertificatesCalled = true;
-        const options = {
-            usePolling: true,
-            interval: Math.min(10 * 60 * 1000, Math.max(100, this.folderPoolingInterval)),
-            persistent: false,
-            awaitWriteFinish: {
-                stabilityThreshold: 2000,
-                pollInterval: 600,
-            },
-        };
-        function _walkCRLFiles(folder, index, _innerCallback) {
-            const w = chokidar.watch(folder, options);
-            w.on("unlink", (filename, stat) => {
-                // CRL never removed
-            });
-            w.on("add", (filename, stat) => {
-                this._on_crl_file_added(index, filename);
-            });
-            w.on("change", (path, stat) => {
-                (0, toolbox_1.debugLog)("change in folder ", folder, path, stat);
-            });
-            this._watchers.push(w);
-            w.on("ready", () => {
-                _innerCallback();
-            });
-        }
-        function _walkAllFiles(folder, index, _innerCallback) {
-            const w = chokidar.watch(folder, options);
-            w.on("unlink", (filename, stat) => {
-                (0, toolbox_1.debugLog)(chalk.cyan("unlink in folder " + folder), filename);
-                const h = this._filenameToHash[filename];
-                if (h && index[h]) {
-                    delete index[h];
-                }
-            });
-            w.on("add", (filename, stat) => {
-                var _a, _b;
-                (0, toolbox_1.debugLog)(chalk.cyan("add in folder " + folder), filename); // stat);
-                try {
-                    const certificate = (0, node_opcua_crypto_1.readCertificate)(filename);
-                    const info = (0, node_opcua_crypto_1.exploreCertificate)(certificate);
-                    const fingerprint = makeFingerprint(certificate);
-                    index[fingerprint] = {
-                        certificate,
-                        filename,
-                    };
-                    this._filenameToHash[filename] = fingerprint;
-                    (0, toolbox_1.debugLog)(chalk.magenta("CERT"), info.tbsCertificate.subjectFingerPrint, info.tbsCertificate.serialNumber, (_b = (_a = info.tbsCertificate.extensions) === null || _a === void 0 ? void 0 : _a.authorityKeyIdentifier) === null || _b === void 0 ? void 0 : _b.authorityCertIssuerFingerPrint);
-                }
-                catch (err) {
-                    (0, toolbox_1.debugLog)("Walk files in folder " + folder + " with file " + filename);
-                    (0, toolbox_1.debugLog)(err);
-                }
-            });
-            w.on("change", (path, stat) => {
-                (0, toolbox_1.debugLog)("change in folder ", folder, path);
-            });
-            this._watchers.push(w);
-            w.on("ready", () => {
-                _innerCallback();
-                (0, toolbox_1.debugLog)("ready");
-                (0, toolbox_1.debugLog)(Object.entries(index).map((kv) => kv[0].substr(0, 10)));
-            });
-        }
-        async.parallelLimit([
-            _walkAllFiles.bind(this, this.trustedFolder, this._thumbs.trusted),
-            _walkAllFiles.bind(this, this.issuersCertFolder, this._thumbs.issuers.certs),
-            _walkAllFiles.bind(this, this.rejectedFolder, this._thumbs.rejected),
-            _walkCRLFiles.bind(this, this.crlFolder, this._thumbs.crl),
-            _walkCRLFiles.bind(this, this.issuersCrlFolder, this._thumbs.issuersCrl),
-        ], 2, (err) => {
-            // istanbul ignore next
-            if (err) {
-                (0, toolbox_1.debugLog)("Error=", err);
-                return callback(err);
-            }
-            this.waitAndCheckCRLProcessingStatus()
-                .then(() => callback())
-                .catch((err) => callback(err));
-        });
-    }
-    // make sure that all crls have been processed.
-    waitAndCheckCRLProcessingStatus() {
-        return __awaiter(this, void 0, void 0, function* () {
-            return new Promise((resolve, reject) => {
-                if (this._pending_crl_to_process === 0) {
-                    setImmediate(resolve);
-                    return;
-                }
-                // istanbul ignore next
-                if (this._on_crl_process) {
-                    return reject(new Error("Internal Error"));
-                }
-                this._on_crl_process = resolve;
-            });
-        });
-    }
-}
-exports.CertificateManager = CertificateManager;
-const opts = { multiArgs: false };
-CertificateManager.prototype.rejectCertificate = thenify.withCallback(CertificateManager.prototype.rejectCertificate, opts);
-CertificateManager.prototype.trustCertificate = thenify.withCallback(CertificateManager.prototype.trustCertificate, opts);
-CertificateManager.prototype.createSelfSignedCertificate = thenify.withCallback(CertificateManager.prototype.createSelfSignedCertificate, opts);
-CertificateManager.prototype.createCertificateRequest = thenify.withCallback(CertificateManager.prototype.createCertificateRequest, opts);
-CertificateManager.prototype.initialize = thenify.withCallback(CertificateManager.prototype.initialize, opts);
-CertificateManager.prototype.getCertificateStatus = thenify.withCallback(CertificateManager.prototype.getCertificateStatus, opts);
-CertificateManager.prototype._checkRejectedOrTrusted = thenify.withCallback(CertificateManager.prototype._checkRejectedOrTrusted, opts);
-CertificateManager.prototype.verifyCertificate = thenify.withCallback(CertificateManager.prototype.verifyCertificate, opts);
-CertificateManager.prototype.isCertificateTrusted = thenify.withCallback((0, util_1.callbackify)(CertificateManager.prototype.isCertificateTrusted), opts);
+"use strict";
+// ---------------------------------------------------------------------------------------------------------------------
+// node-opcua
+// ---------------------------------------------------------------------------------------------------------------------
+// Copyright (c) 2014-2022 - Etienne Rossignon - etienne.rossignon (at) gadz.org
+// Copyright (c) 2022 - Sterfive.com
+// ---------------------------------------------------------------------------------------------------------------------
+//
+// This  project is licensed under the terms of the MIT license.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+// ---------------------------------------------------------------------------------------------------------------------
+// tslint:disable:no-shadowed-variable
+// tslint:disable:member-ordering
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CertificateManager = exports.CertificateManagerState = exports.VerificationStatus = void 0;
+const assert = require("assert");
+const async = require("async");
+const chalk = require("chalk");
+const chokidar = require("chokidar");
+const fs = require("fs");
+const path = require("path");
+const util_1 = require("util");
+const node_opcua_crypto_1 = require("node-opcua-crypto");
+const toolbox_1 = require("./toolbox");
+const global_mutex_1 = require("@ster5/global-mutex");
+// tslint:disable:max-line-length
+// tslint:disable:no-var-requires
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const thenify = require("thenify");
+const fsFileExists = (0, util_1.promisify)(fs.exists);
+const fsWriteFile = (0, util_1.promisify)(fs.writeFile);
+const fsReadFile = (0, util_1.promisify)(fs.readFile);
+const fsRemoveFile = (0, util_1.promisify)(fs.unlink);
+var VerificationStatus;
+(function (VerificationStatus) {
+    /** The certificate provided as a parameter is not valid. */
+    VerificationStatus["BadCertificateInvalid"] = "BadCertificateInvalid";
+    /** An error occurred verifying security. */
+    VerificationStatus["BadSecurityChecksFailed"] = "BadSecurityChecksFailed";
+    /** The certificate does not meet the requirements of the security policy. */
+    VerificationStatus["BadCertificatePolicyCheckFailed"] = "BadCertificatePolicyCheckFailed";
+    /** The certificate has expired or is not yet valid. */
+    VerificationStatus["BadCertificateTimeInvalid"] = "BadCertificateTimeInvalid";
+    /** An issuer certificate has expired or is not yet valid. */
+    VerificationStatus["BadCertificateIssuerTimeInvalid"] = "BadCertificateIssuerTimeInvalid";
+    /** The HostName used to connect to a server does not match a HostName in the certificate. */
+    VerificationStatus["BadCertificateHostNameInvalid"] = "BadCertificateHostNameInvalid";
+    /** The URI specified in the ApplicationDescription does not match the URI in the certificate. */
+    VerificationStatus["BadCertificateUriInvalid"] = "BadCertificateUriInvalid";
+    /** The certificate may not be used for the requested operation. */
+    VerificationStatus["BadCertificateUseNotAllowed"] = "BadCertificateUseNotAllowed";
+    /** The issuer certificate may not be used for the requested operation. */
+    VerificationStatus["BadCertificateIssuerUseNotAllowed"] = "BadCertificateIssuerUseNotAllowed";
+    /** The certificate is not trusted. */
+    VerificationStatus["BadCertificateUntrusted"] = "BadCertificateUntrusted";
+    /** It was not possible to determine if the certificate has been revoked. */
+    VerificationStatus["BadCertificateRevocationUnknown"] = "BadCertificateRevocationUnknown";
+    /** It was not possible to determine if the issuer certificate has been revoked. */
+    VerificationStatus["BadCertificateIssuerRevocationUnknown"] = "BadCertificateIssuerRevocationUnknown";
+    /** The certificate has been revoked. */
+    VerificationStatus["BadCertificateRevoked"] = "BadCertificateRevoked";
+    /** The issuer certificate has been revoked. */
+    VerificationStatus["BadCertificateIssuerRevoked"] = "BadCertificateIssuerRevoked";
+    /** The certificate chain is incomplete. */
+    VerificationStatus["BadCertificateChainIncomplete"] = "BadCertificateChainIncomplete";
+    /** Validation OK. */
+    VerificationStatus["Good"] = "Good";
+})(VerificationStatus = exports.VerificationStatus || (exports.VerificationStatus = {}));
+function makeFingerprint(certificate) {
+    return (0, node_opcua_crypto_1.makeSHA1Thumbprint)(certificate).toString("hex");
+}
+function short(stringToShorten) {
+    return stringToShorten.substr(0, 10);
+}
+function buildIdealCertificateName(certificate) {
+    const fingerprint = makeFingerprint(certificate);
+    try {
+        const commonName = (0, node_opcua_crypto_1.exploreCertificate)(certificate).tbsCertificate.subject.commonName || "";
+        return commonName + "[" + fingerprint + "]";
+    }
+    catch (err) {
+        // make be certificate is incorrect !
+        return "invalid_certificate_[" + fingerprint + "]";
+    }
+}
+function findMatchingIssuerKey(entries, wantedIssuerKey) {
+    const selected = entries.filter(({ certificate }) => {
+        const info = (0, node_opcua_crypto_1.exploreCertificate)(certificate);
+        return info.tbsCertificate.extensions && info.tbsCertificate.extensions.subjectKeyIdentifier === wantedIssuerKey;
+    });
+    return selected;
+}
+function isSelfSigned2(info) {
+    var _a, _b, _c;
+    return (((_a = info.tbsCertificate.extensions) === null || _a === void 0 ? void 0 : _a.subjectKeyIdentifier) ===
+        ((_c = (_b = info.tbsCertificate.extensions) === null || _b === void 0 ? void 0 : _b.authorityKeyIdentifier) === null || _c === void 0 ? void 0 : _c.keyIdentifier));
+}
+function isSelfSigned3(certificate) {
+    const info = (0, node_opcua_crypto_1.exploreCertificate)(certificate);
+    return isSelfSigned2(info);
+}
+var CertificateManagerState;
+(function (CertificateManagerState) {
+    CertificateManagerState[CertificateManagerState["Uninitialized"] = 0] = "Uninitialized";
+    CertificateManagerState[CertificateManagerState["Initializing"] = 1] = "Initializing";
+    CertificateManagerState[CertificateManagerState["Initialized"] = 2] = "Initialized";
+    CertificateManagerState[CertificateManagerState["Disposing"] = 3] = "Disposing";
+    CertificateManagerState[CertificateManagerState["Disposed"] = 4] = "Disposed";
+})(CertificateManagerState = exports.CertificateManagerState || (exports.CertificateManagerState = {}));
+class CertificateManager {
+    constructor(options) {
+        this.untrustUnknownCertificate = true;
+        this.state = CertificateManagerState.Uninitialized;
+        this.folderPoolingInterval = 5000;
+        this._watchers = [];
+        this._readCertificatesCalled = false;
+        this._filenameToHash = {};
+        this._thumbs = {
+            rejected: {},
+            trusted: {},
+            issuers: {
+                certs: {},
+            },
+            crl: {},
+            issuersCrl: {},
+        };
+        this._pending_crl_to_process = 0;
+        this.queue = [];
+        options.keySize = options.keySize || 2048;
+        assert(Object.prototype.hasOwnProperty.call(options, "location"));
+        assert(Object.prototype.hasOwnProperty.call(options, "keySize"));
+        assert(this.state === CertificateManagerState.Uninitialized);
+        this.location = (0, toolbox_1.make_path)(options.location, "");
+        this.keySize = options.keySize;
+        (0, toolbox_1.mkdir)(options.location);
+        // istanbul ignore next
+        if (!fs.existsSync(this.location)) {
+            throw new Error("CertificateManager cannot access location " + this.location);
+        }
+    }
+    get configFile() {
+        return path.join(this.rootDir, "own/openssl.cnf");
+    }
+    get rootDir() {
+        return this.location;
+    }
+    get privateKey() {
+        return path.join(this.rootDir, "own/private/private_key.pem");
+    }
+    get randomFile() {
+        return path.join(this.rootDir, "./random.rnd");
+    }
+    getCertificateStatus(certificate, ...args) {
+        const callback = args[0];
+        this.initialize(() => {
+            this._checkRejectedOrTrusted(certificate, (err, status) => {
+                if (err) {
+                    return callback(err);
+                }
+                if (status === "unknown") {
+                    assert(certificate instanceof Buffer);
+                    const pem = (0, node_opcua_crypto_1.toPem)(certificate, "CERTIFICATE");
+                    const fingerprint = makeFingerprint(certificate);
+                    const filename = path.join(this.rejectedFolder, buildIdealCertificateName(certificate) + ".pem");
+                    fs.writeFile(filename, pem, (err) => {
+                        this._thumbs.rejected[fingerprint] = {
+                            certificate,
+                            filename,
+                        };
+                        if (err) {
+                            return callback(err);
+                        }
+                        status = "rejected";
+                        return callback(null, status);
+                    });
+                    return;
+                }
+                else {
+                    return callback(null, status);
+                }
+            });
+        });
+    }
+    rejectCertificate(certificate, ...args) {
+        const callback = args[0];
+        assert(callback && callback instanceof Function, "expecting callback");
+        this._moveCertificate(certificate, "rejected", callback);
+    }
+    trustCertificate(certificate, ...args) {
+        const callback = args[0];
+        assert(callback && callback instanceof Function, "expecting callback");
+        this._moveCertificate(certificate, "trusted", callback);
+    }
+    get rejectedFolder() {
+        return path.join(this.rootDir, "rejected");
+    }
+    get trustedFolder() {
+        return path.join(this.rootDir, "trusted/certs");
+    }
+    get crlFolder() {
+        return path.join(this.rootDir, "trusted/crl");
+    }
+    get issuersCertFolder() {
+        return path.join(this.rootDir, "issuers/certs");
+    }
+    get issuersCrlFolder() {
+        return path.join(this.rootDir, "issuers/crl");
+    }
+    isCertificateTrusted(certificate) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const fingerprint = makeFingerprint(certificate);
+            const certificateInTrust = (_a = this._thumbs.trusted[fingerprint]) === null || _a === void 0 ? void 0 : _a.certificate;
+            if (certificateInTrust) {
+                return "Good";
+            }
+            else {
+                const certificateInRejected = this._thumbs.rejected[fingerprint];
+                if (!certificateInRejected) {
+                    const certificateFilenameInRejected = path.join(this.rejectedFolder, buildIdealCertificateName(certificate) + ".pem");
+                    if (!this.untrustUnknownCertificate) {
+                        return "Good";
+                    }
+                    // Certificate should be mark as untrusted
+                    // let's first verify that certificate is valid ,as we don't want to write invalid data
+                    try {
+                        const certificateInfo = (0, node_opcua_crypto_1.exploreCertificateInfo)(certificate);
+                    }
+                    catch (err) {
+                        return "BadCertificateInvalid";
+                    }
+                    (0, toolbox_1.debugLog)("certificate has never been seen before and is now rejected (untrusted) ", certificateFilenameInRejected);
+                    yield fsWriteFile(certificateFilenameInRejected, (0, node_opcua_crypto_1.toPem)(certificate, "CERTIFICATE"));
+                }
+                return "BadCertificateUntrusted";
+            }
+        });
+    }
+    _innerVerifyCertificateAsync(certificate, isIssuer, level) {
+        var _a, _b;
+        return __awaiter(this, void 0, void 0, function* () {
+            if (level >= 5) {
+                // maximum level of certificate in chain reached !
+                return VerificationStatus.BadSecurityChecksFailed;
+            }
+            const chain = (0, node_opcua_crypto_1.split_der)(certificate);
+            (0, toolbox_1.debugLog)("NB CERTIFICATE IN CHAIN = ", chain.length);
+            const info = (0, node_opcua_crypto_1.exploreCertificate)(chain[0]);
+            let hasValidIssuer = false;
+            let hasTrustedIssuer = false;
+            // check if certificate is attached to a issuer
+            const hasIssuerKey = (_b = (_a = info.tbsCertificate.extensions) === null || _a === void 0 ? void 0 : _a.authorityKeyIdentifier) === null || _b === void 0 ? void 0 : _b.keyIdentifier;
+            (0, toolbox_1.debugLog)("Certificate as an Issuer Key", hasIssuerKey);
+            // console.log(inspect(info, { depth: 100 }));
+            if (hasIssuerKey) {
+                const isSelfSigned = isSelfSigned2(info);
+                (0, toolbox_1.debugLog)("Is the Certificate self-signed  ?", isSelfSigned);
+                if (!isSelfSigned) {
+                    const issuerCertificate = yield this.findIssuerCertificate(chain[0]);
+                    // console.log("issuer is found", !!issuerCertificate, info.tbsCertificate.extensions.subjectKeyIdentifier, info.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier);
+                    if (!issuerCertificate) {
+                        // if the certificate is not self-signed we ust have a issuer.
+                        // but no Issuer is not found
+                        return VerificationStatus.BadCertificateChainIncomplete;
+                    }
+                    const issuerStatus = yield this._innerVerifyCertificateAsync(issuerCertificate, true, level + 1);
+                    if (issuerStatus === VerificationStatus.BadCertificateRevocationUnknown) {
+                        // the issuer must have a CRL available .... !
+                        return VerificationStatus.BadCertificateIssuerRevocationUnknown;
+                    }
+                    if (issuerStatus === VerificationStatus.BadCertificateIssuerRevocationUnknown) {
+                        // the issuer must have a CRL available .... !
+                        return VerificationStatus.BadCertificateIssuerRevocationUnknown;
+                    }
+                    if (issuerStatus === VerificationStatus.BadCertificateTimeInvalid) {
+                        // the issuer must have valid dates ....
+                        return VerificationStatus.BadCertificateIssuerTimeInvalid;
+                    }
+                    if (issuerStatus !== VerificationStatus.Good && issuerStatus !== VerificationStatus.BadCertificateUntrusted) {
+                        // if the issuer has other issue => let's drop!
+                        return VerificationStatus.BadSecurityChecksFailed;
+                    }
+                    // verify that certificate was signed by issuer
+                    const isCertificateSignatureOK = (0, node_opcua_crypto_1.verifyCertificateSignature)(certificate, issuerCertificate);
+                    if (!isCertificateSignatureOK) {
+                        // the certificate was not signed by the issuer as it claim to be ! Danger
+                        return VerificationStatus.BadSecurityChecksFailed;
+                    }
+                    hasValidIssuer = true;
+                    // let detected if our certificate is in the revocation list
+                    const revokedStatus = yield this.isCertificateRevoked(certificate);
+                    if (revokedStatus === VerificationStatus.BadCertificateRevocationUnknown) {
+                        return VerificationStatus.BadCertificateRevocationUnknown;
+                    }
+                    if (revokedStatus !== VerificationStatus.Good) {
+                        // certificate is revoked !!!
+                        (0, toolbox_1.debugLog)("revokedStatus", revokedStatus);
+                        return revokedStatus;
+                    }
+                    // let check if the issuer is explicitly trusted
+                    const issuerTrustedStatus = yield this._checkRejectedOrTrusted(issuerCertificate);
+                    (0, toolbox_1.debugLog)("issuerTrustedStatus", issuerTrustedStatus);
+                    if (issuerTrustedStatus === "unknown") {
+                        hasTrustedIssuer = false;
+                    }
+                    else if (issuerTrustedStatus === "trusted") {
+                        hasTrustedIssuer = true;
+                    }
+                    else if (issuerTrustedStatus === "rejected") {
+                        // we should never get there: this should have been detected before !!!
+                        return VerificationStatus.BadSecurityChecksFailed;
+                    }
+                }
+                else {
+                    // verify that certificate was signed by issuer (self in this case)
+                    const isCertificateSignatureOK = (0, node_opcua_crypto_1.verifyCertificateSignature)(certificate, certificate);
+                    if (!isCertificateSignatureOK) {
+                        (0, toolbox_1.debugLog)("Self-signed Certificate signature is not valid");
+                        return VerificationStatus.BadSecurityChecksFailed;
+                    }
+                    const revokedStatus = yield this.isCertificateRevoked(certificate);
+                    (0, toolbox_1.debugLog)("revokedStatus of self signed certificate:", revokedStatus);
+                }
+            }
+            const status = yield this._checkRejectedOrTrusted(certificate);
+            if (status === "rejected") {
+                return VerificationStatus.BadCertificateUntrusted;
+            }
+            const c2 = chain[1] ? (0, node_opcua_crypto_1.exploreCertificateInfo)(chain[1]) : "non";
+            // Has SoftwareCertificate passed its issue date and has it not expired ?
+            // check dates
+            const certificateInfo = (0, node_opcua_crypto_1.exploreCertificateInfo)(certificate);
+            const now = new Date();
+            let isTimeInvalid = false;
+            // check that certificate is active
+            if (certificateInfo.notBefore.getTime() > now.getTime()) {
+                // certificate is not active yet
+                (0, toolbox_1.debugLog)(chalk.red("certificate is invalid : certificate is not active yet !") +
+                    "  not before date =" +
+                    certificateInfo.notBefore);
+                isTimeInvalid = true;
+            }
+            //  check that certificate has not expired
+            if (certificateInfo.notAfter.getTime() <= now.getTime()) {
+                // certificate is obsolete
+                (0, toolbox_1.debugLog)(chalk.red("certificate is invalid : certificate has expired !") + " not after date =" + certificateInfo.notAfter);
+                isTimeInvalid = true;
+            }
+            if (status === "trusted") {
+                return isTimeInvalid ? VerificationStatus.BadCertificateTimeInvalid : VerificationStatus.Good;
+            }
+            assert(status === "unknown");
+            if (hasIssuerKey) {
+                if (!hasTrustedIssuer) {
+                    return VerificationStatus.BadCertificateUntrusted;
+                }
+                if (!hasValidIssuer) {
+                    return VerificationStatus.BadCertificateUntrusted;
+                }
+                return isTimeInvalid ? VerificationStatus.BadCertificateTimeInvalid : VerificationStatus.Good;
+            }
+            else {
+                return VerificationStatus.BadCertificateUntrusted;
+            }
+        });
+    }
+    verifyCertificateAsync(certificate) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const status1 = yield this._innerVerifyCertificateAsync(certificate, false, 0);
+            return status1;
+        });
+    }
+    verifyCertificate(certificate, callback) {
+        // Is the  signature on the SoftwareCertificate valid .?
+        if (!certificate) {
+            // missing certificate
+            return callback(null, VerificationStatus.BadSecurityChecksFailed);
+        }
+        (0, util_1.callbackify)(this.verifyCertificateAsync).call(this, certificate, callback);
+    }
+    initialize(...args) {
+        const callback = args[0];
+        assert(callback && callback instanceof Function);
+        if (this.state !== CertificateManagerState.Uninitialized) {
+            return callback();
+        }
+        this.state = CertificateManagerState.Initializing;
+        return this._initialize((err) => {
+            this.state = CertificateManagerState.Initialized;
+            return callback(err);
+        });
+    }
+    _initialize(callback) {
+        assert((this.state = CertificateManagerState.Initializing));
+        const pkiDir = this.location;
+        (0, toolbox_1.mkdir)(pkiDir);
+        (0, toolbox_1.mkdir)(path.join(pkiDir, "own"));
+        (0, toolbox_1.mkdir)(path.join(pkiDir, "own/certs"));
+        (0, toolbox_1.mkdir)(path.join(pkiDir, "own/private"));
+        (0, toolbox_1.mkdir)(path.join(pkiDir, "rejected"));
+        (0, toolbox_1.mkdir)(path.join(pkiDir, "trusted"));
+        (0, toolbox_1.mkdir)(path.join(pkiDir, "trusted/certs"));
+        (0, toolbox_1.mkdir)(path.join(pkiDir, "trusted/crl"));
+        (0, toolbox_1.mkdir)(path.join(pkiDir, "issuers"));
+        (0, toolbox_1.mkdir)(path.join(pkiDir, "issuers/certs")); // contains Trusted CA certificates
+        (0, toolbox_1.mkdir)(path.join(pkiDir, "issuers/crl")); // contains CRL of revoked CA certificates
+        this.withLock((callback) => {
+            assert(this.state !== CertificateManagerState.Disposing);
+            if (this.state === CertificateManagerState.Disposed) {
+                return callback();
+            }
+            assert(this.state === CertificateManagerState.Initializing);
+            fs.writeFileSync(this.configFile, toolbox_1.configurationFileSimpleTemplate);
+            // note : openssl 1.1.1 has a bug that causes a failure if
+            // random file cannot be found. (should be fixed in 1.1.1.a)
+            // if this issue become important we may have to consider checking that rndFile exists and recreate
+            // it if not . this could be achieved with the command :
+            //      "openssl rand -writerand ${this.randomFile}"
+            //
+            // cf: https://github.com/node-opcua/node-opcua/issues/554
+            if (!fs.existsSync(this.privateKey)) {
+                (0, toolbox_1.debugLog)("generating private key ...");
+                (0, toolbox_1.setEnv)("RANDFILE", this.randomFile);
+                (0, toolbox_1.createPrivateKey)(this.privateKey, this.keySize, (err) => {
+                    if (err) {
+                        return callback(err);
+                    }
+                    this._readCertificates(() => callback());
+                });
+            }
+            else {
+                // debugLog("   initialize :  private key already exists ... skipping");
+                this._readCertificates(() => callback());
+            }
+        }, callback);
+    }
+    dispose() {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this.state === CertificateManagerState.Disposing) {
+                throw new Error("Already disposing");
+            }
+            if (this.state === CertificateManagerState.Uninitialized) {
+                this.state = CertificateManagerState.Disposed;
+                return;
+            }
+            // wait for initialization to be completed
+            if (this.state === CertificateManagerState.Initializing) {
+                yield new Promise((resolve) => setTimeout(resolve, 100));
+                return yield this.dispose();
+            }
+            try {
+                this.state = CertificateManagerState.Disposing;
+                yield Promise.all(this._watchers.map((w) => w.close()));
+                this._watchers.forEach((w) => w.removeAllListeners());
+                this._watchers.splice(0);
+            }
+            finally {
+                this.state = CertificateManagerState.Disposed;
+            }
+        });
+    }
+    // eslint-disable-next-line @typescript-eslint/ban-types
+    withLock(action, callback) {
+        this.withLock2((0, util_1.promisify)(action))
+            .then((t) => callback(null, t))
+            .catch((err) => callback(err));
+    }
+    withLock2(action) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const lockFileName = path.join(this.rootDir, "mutex.lock");
+            return (0, global_mutex_1.withLock)({ lockfile: lockFileName }, () => __awaiter(this, void 0, void 0, function* () {
+                return yield action();
+            }));
+        });
+    }
+    createSelfSignedCertificate(params, ...args) {
+        const callback = args[0];
+        assert(typeof params.applicationUri === "string", "expecting applicationUri");
+        if (!fs.existsSync(this.privateKey)) {
+            return callback(new Error("Cannot find private key " + this.privateKey));
+        }
+        let certificateFilename = path.join(this.rootDir, "own/certs/self_signed_certificate.pem");
+        certificateFilename = params.outputFile || certificateFilename;
+        const _params = params;
+        _params.rootDir = this.rootDir;
+        _params.configFile = this.configFile;
+        _params.privateKey = this.privateKey;
+        this.withLock((callback) => {
+            (0, toolbox_1.createSelfSignCertificate)(certificateFilename, _params, callback);
+        }, callback);
+    }
+    createCertificateRequest(params, callback) {
+        assert(params);
+        const _params = params;
+        if (Object.prototype.hasOwnProperty.call(_params, "rootDir")) {
+            throw new Error("rootDir should not be specified ");
+        }
+        assert(typeof callback === "function");
+        assert(!_params.rootDir);
+        assert(!_params.configFile);
+        assert(!_params.privateKey);
+        _params.rootDir = this.rootDir;
+        _params.configFile = this.configFile;
+        _params.privateKey = this.privateKey;
+        this.withLock((callback) => {
+            // compose a file name for the request
+            const now = new Date();
+            const today = now.toISOString().slice(0, 10) + "_" + now.getTime();
+            const certificateSigningRequestFilename = path.join(this.rootDir, "own/certs", "certificate_" + today + ".csr");
+            (0, toolbox_1.createCertificateSigningRequest)(certificateSigningRequestFilename, _params, (err) => {
+                if (err) {
+                    return callback(err);
+                }
+                return callback(null, certificateSigningRequestFilename);
+            });
+        }, callback);
+    }
+    addIssuer(certificate, validate = false, addInTrustList = false) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (validate) {
+                const status = yield this.verifyCertificate(certificate);
+                if (status !== VerificationStatus.Good && status !== VerificationStatus.BadCertificateUntrusted) {
+                    return status;
+                }
+            }
+            const pemCertificate = (0, node_opcua_crypto_1.toPem)(certificate, "CERTIFICATE");
+            const fingerprint = makeFingerprint(certificate);
+            if (this._thumbs.issuers.certs[fingerprint]) {
+                // already in .. simply ignore
+                return VerificationStatus.Good;
+            }
+            // write certificate
+            const filename = path.join(this.issuersCertFolder, "issuer_" + buildIdealCertificateName(certificate) + ".pem");
+            yield (0, util_1.promisify)(fs.writeFile)(filename, pemCertificate, "ascii");
+            // first time seen, let's save it.
+            this._thumbs.issuers.certs[fingerprint] = { certificate, filename };
+            if (addInTrustList) {
+                // add certificate in the trust list as well
+                yield this.trustCertificate(certificate);
+            }
+            return VerificationStatus.Good;
+        });
+    }
+    addRevocationList(crl) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.withLock2(() => __awaiter(this, void 0, void 0, function* () {
+                try {
+                    const crlInfo = (0, node_opcua_crypto_1.exploreCertificateRevocationList)(crl);
+                    const key = crlInfo.tbsCertList.issuerFingerprint;
+                    if (!this._thumbs.issuersCrl[key]) {
+                        this._thumbs.issuersCrl[key] = { crls: [], serialNumbers: {} };
+                    }
+                    const pemCertificate = (0, node_opcua_crypto_1.toPem)(crl, "X509 CRL");
+                    const filename = path.join(this.issuersCrlFolder, "crl_" + buildIdealCertificateName(crl) + ".pem");
+                    yield (0, util_1.promisify)(fs.writeFile)(filename, pemCertificate, "ascii");
+                    yield this._on_crl_file_added(this._thumbs.issuersCrl, filename);
+                    yield this.waitAndCheckCRLProcessingStatus();
+                    return VerificationStatus.Good;
+                }
+                catch (err) {
+                    (0, toolbox_1.debugLog)(err);
+                    return VerificationStatus.BadSecurityChecksFailed;
+                }
+            }));
+        });
+    }
+    // find the issuer certificate
+    findIssuerCertificate(certificate) {
+        var _a, _b;
+        return __awaiter(this, void 0, void 0, function* () {
+            const certInfo = (0, node_opcua_crypto_1.exploreCertificate)(certificate);
+            // istanbul ignore next
+            if (isSelfSigned2(certInfo)) {
+                // the certificate is self signed so is it's own issuer.
+                return certificate;
+            }
+            const wantedIssuerKey = (_b = (_a = certInfo.tbsCertificate.extensions) === null || _a === void 0 ? void 0 : _a.authorityKeyIdentifier) === null || _b === void 0 ? void 0 : _b.keyIdentifier;
+            // istanbul ignore next
+            if (!wantedIssuerKey) {
+                // Certificate has no extension 3 ! the certificate might have been generated by an old system
+                (0, toolbox_1.debugLog)("Certificate has no extension 3");
+                return null;
+            }
+            const issuerCertificates = Object.values(this._thumbs.issuers.certs);
+            const selectedIssuerCertificates = findMatchingIssuerKey(issuerCertificates, wantedIssuerKey);
+            if (selectedIssuerCertificates.length > 0) {
+                if (selectedIssuerCertificates.length > 1) {
+                    // tslint:disable-next-line: no-console
+                    console.log("Warning more than one issuer certificate exists with subjectKeyIdentifier ", wantedIssuerKey);
+                }
+                return selectedIssuerCertificates[0].certificate || null;
+            }
+            // check also in trusted  list
+            const trustedCertificates = Object.values(this._thumbs.trusted);
+            const selectedTrustedCertificates = findMatchingIssuerKey(trustedCertificates, wantedIssuerKey);
+            // istanbul ignore next
+            if (selectedTrustedCertificates.length > 1) {
+                // tslint:disable-next-line: no-console
+                console.log("Warning more than one certificate exists with subjectKeyIdentifier in trusted certificate list ", wantedIssuerKey, selectedTrustedCertificates.length);
+                for (const entry of selectedTrustedCertificates) {
+                    (0, toolbox_1.dumpCertificate)(entry.filename, (err, data) => {
+                        (0, toolbox_1.debugLog)("    ", entry.filename);
+                        (0, toolbox_1.debugLog)(data);
+                    });
+                }
+            }
+            return selectedTrustedCertificates.length > 0 ? selectedTrustedCertificates[0].certificate : null;
+        });
+    }
+    _checkRejectedOrTrusted(certificate, ...args) {
+        const callback = args[0];
+        assert(callback && callback instanceof Function);
+        assert(certificate instanceof Buffer);
+        const fingerprint = makeFingerprint(certificate);
+        (0, toolbox_1.debugLog)("_checkRejectedOrTrusted fingerprint ", short(fingerprint));
+        this._readCertificates((err) => {
+            // istanbul ignore next
+            if (err) {
+                return callback(err);
+            }
+            if (Object.prototype.hasOwnProperty.call(this._thumbs.rejected, fingerprint)) {
+                return callback(null, "rejected");
+            }
+            if (Object.prototype.hasOwnProperty.call(this._thumbs.trusted, fingerprint)) {
+                return callback(null, "trusted");
+            }
+            return callback(null, "unknown");
+        });
+    }
+    _moveCertificate(certificate, newStatus, callback) {
+        // a mutex is requested here
+        assert(certificate instanceof Buffer);
+        const fingerprint = makeFingerprint(certificate);
+        this.getCertificateStatus(certificate, (err, status) => {
+            var _a;
+            // istanbul ignore next
+            if (err) {
+                return callback(err);
+            }
+            (0, toolbox_1.debugLog)("_moveCertificate", fingerprint.substr(0, 10), "from", status, "to", newStatus);
+            assert(status === "rejected" || status === "trusted");
+            if (status !== newStatus) {
+                const certificateSrc = (_a = this._thumbs[status][fingerprint]) === null || _a === void 0 ? void 0 : _a.filename;
+                // istanbul ignore next
+                if (!certificateSrc) {
+                    (0, toolbox_1.debugLog)(" cannot find certificate ", fingerprint.substr(0, 10), " in", this._thumbs, [status]);
+                    return callback(new Error("internal"));
+                }
+                const destFolder = newStatus === "rejected"
+                    ? this.rejectedFolder
+                    : newStatus === "trusted"
+                        ? this.trustedFolder
+                        : this.rejectedFolder;
+                const certificateDest = path.join(destFolder, path.basename(certificateSrc));
+                (0, toolbox_1.debugLog)("_moveCertificate1", fingerprint.substr(0, 10), "old name", certificateSrc);
+                (0, toolbox_1.debugLog)("_moveCertificate1", fingerprint.substr(0, 10), "new name", certificateDest);
+                fs.rename(certificateSrc, certificateDest, (err) => {
+                    delete this._thumbs[status][fingerprint];
+                    this._thumbs[newStatus][fingerprint] = {
+                        certificate,
+                        filename: certificateDest,
+                    };
+                    // we do not return the error here
+                    return callback( /*err*/);
+                });
+            }
+            else {
+                return callback();
+            }
+        });
+    }
+    _findAssociatedCRLs(issuerCertificate) {
+        const issuerCertificateInfo = (0, node_opcua_crypto_1.exploreCertificate)(issuerCertificate);
+        const key = issuerCertificateInfo.tbsCertificate.subjectFingerPrint;
+        return this._thumbs.issuersCrl[key] ? this._thumbs.issuersCrl[key] : this._thumbs.crl[key] ? this._thumbs.crl[key] : null;
+    }
+    isCertificateRevoked(certificate, issuerCertificate) {
+        var _a, _b, _c, _d;
+        return __awaiter(this, void 0, void 0, function* () {
+            // istanbul ignore next
+            if (isSelfSigned3(certificate)) {
+                return VerificationStatus.Good;
+            }
+            if (!issuerCertificate) {
+                issuerCertificate = yield this.findIssuerCertificate(certificate);
+            }
+            if (!issuerCertificate) {
+                return VerificationStatus.BadCertificateChainIncomplete;
+            }
+            const crls = this._findAssociatedCRLs(issuerCertificate);
+            if (!crls) {
+                return VerificationStatus.BadCertificateRevocationUnknown;
+            }
+            const certInfo = (0, node_opcua_crypto_1.exploreCertificate)(certificate);
+            const serialNumber = certInfo.tbsCertificate.serialNumber || ((_b = (_a = certInfo.tbsCertificate.extensions) === null || _a === void 0 ? void 0 : _a.authorityKeyIdentifier) === null || _b === void 0 ? void 0 : _b.serial) || "";
+            const key = ((_d = (_c = certInfo.tbsCertificate.extensions) === null || _c === void 0 ? void 0 : _c.authorityKeyIdentifier) === null || _d === void 0 ? void 0 : _d.authorityCertIssuerFingerPrint) || "<unknown>";
+            const crl2 = this._thumbs.crl[key] || null;
+            if (crls.serialNumbers[serialNumber] || (crl2 && crl2.serialNumbers[serialNumber])) {
+                return VerificationStatus.BadCertificateRevoked;
+            }
+            return VerificationStatus.Good;
+        });
+    }
+    _on_crl_file_added(index, filename) {
+        this.queue.push({ index, filename });
+        this._pending_crl_to_process += 1;
+        if (this._pending_crl_to_process === 1) {
+            this._process_next_crl();
+        }
+    }
+    _process_next_crl() {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const { index, filename } = this.queue.shift();
+                const crl = yield (0, node_opcua_crypto_1.readCertificateRevocationList)(filename);
+                const crlInfo = (0, node_opcua_crypto_1.exploreCertificateRevocationList)(crl);
+                (0, toolbox_1.debugLog)(chalk.cyan("add CRL in folder "), filename); // stat);
+                const fingerprint = crlInfo.tbsCertList.issuerFingerprint;
+                index[fingerprint] = index[fingerprint] || {
+                    crls: [],
+                    serialNumbers: {},
+                };
+                index[fingerprint].crls.push({ crlInfo, filename });
+                const serialNumbers = index[fingerprint].serialNumbers;
+                // now inject serial numbers
+                for (const revokedCertificate of crlInfo.tbsCertList.revokedCertificates) {
+                    const serialNumber = revokedCertificate.userCertificate;
+                    if (!serialNumbers[serialNumber]) {
+                        serialNumbers[serialNumber] = revokedCertificate.revocationDate;
+                    }
+                }
+                (0, toolbox_1.debugLog)(chalk.cyan("CRL"), fingerprint, "serial numbers = ", Object.keys(serialNumbers)); // stat);
+            }
+            catch (err) {
+                (0, toolbox_1.debugLog)("CRL filename error =");
+                (0, toolbox_1.debugLog)(err);
+            }
+            this._pending_crl_to_process -= 1;
+            if (this._pending_crl_to_process === 0) {
+                if (this._on_crl_process) {
+                    this._on_crl_process();
+                    this._on_crl_process = undefined;
+                }
+            }
+            else {
+                this._process_next_crl();
+            }
+        });
+    }
+    _readCertificates(callback) {
+        if (this._readCertificatesCalled) {
+            return callback();
+        }
+        this._readCertificatesCalled = true;
+        const options = {
+            usePolling: true,
+            interval: Math.min(10 * 60 * 1000, Math.max(100, this.folderPoolingInterval)),
+            persistent: false,
+            awaitWriteFinish: {
+                stabilityThreshold: 2000,
+                pollInterval: 600,
+            },
+        };
+        function _walkCRLFiles(folder, index, _innerCallback) {
+            const w = chokidar.watch(folder, options);
+            w.on("unlink", (filename, stat) => {
+                // CRL never removed
+            });
+            w.on("add", (filename, stat) => {
+                this._on_crl_file_added(index, filename);
+            });
+            w.on("change", (path, stat) => {
+                (0, toolbox_1.debugLog)("change in folder ", folder, path, stat);
+            });
+            this._watchers.push(w);
+            w.on("ready", () => {
+                _innerCallback();
+            });
+        }
+        function _walkAllFiles(folder, index, _innerCallback) {
+            const w = chokidar.watch(folder, options);
+            w.on("unlink", (filename, stat) => {
+                (0, toolbox_1.debugLog)(chalk.cyan("unlink in folder " + folder), filename);
+                const h = this._filenameToHash[filename];
+                if (h && index[h]) {
+                    delete index[h];
+                }
+            });
+            w.on("add", (filename, stat) => {
+                var _a, _b;
+                (0, toolbox_1.debugLog)(chalk.cyan("add in folder " + folder), filename); // stat);
+                try {
+                    const certificate = (0, node_opcua_crypto_1.readCertificate)(filename);
+                    const info = (0, node_opcua_crypto_1.exploreCertificate)(certificate);
+                    const fingerprint = makeFingerprint(certificate);
+                    index[fingerprint] = {
+                        certificate,
+                        filename,
+                    };
+                    this._filenameToHash[filename] = fingerprint;
+                    (0, toolbox_1.debugLog)(chalk.magenta("CERT"), info.tbsCertificate.subjectFingerPrint, info.tbsCertificate.serialNumber, (_b = (_a = info.tbsCertificate.extensions) === null || _a === void 0 ? void 0 : _a.authorityKeyIdentifier) === null || _b === void 0 ? void 0 : _b.authorityCertIssuerFingerPrint);
+                }
+                catch (err) {
+                    (0, toolbox_1.debugLog)("Walk files in folder " + folder + " with file " + filename);
+                    (0, toolbox_1.debugLog)(err);
+                }
+            });
+            w.on("change", (path, stat) => {
+                (0, toolbox_1.debugLog)("change in folder ", folder, path);
+            });
+            this._watchers.push(w);
+            w.on("ready", () => {
+                _innerCallback();
+                (0, toolbox_1.debugLog)("ready");
+                (0, toolbox_1.debugLog)(Object.entries(index).map((kv) => kv[0].substr(0, 10)));
+            });
+        }
+        async.parallelLimit([
+            _walkAllFiles.bind(this, this.trustedFolder, this._thumbs.trusted),
+            _walkAllFiles.bind(this, this.issuersCertFolder, this._thumbs.issuers.certs),
+            _walkAllFiles.bind(this, this.rejectedFolder, this._thumbs.rejected),
+            _walkCRLFiles.bind(this, this.crlFolder, this._thumbs.crl),
+            _walkCRLFiles.bind(this, this.issuersCrlFolder, this._thumbs.issuersCrl),
+        ], 2, (err) => {
+            // istanbul ignore next
+            if (err) {
+                (0, toolbox_1.debugLog)("Error=", err);
+                return callback(err);
+            }
+            this.waitAndCheckCRLProcessingStatus()
+                .then(() => callback())
+                .catch((err) => callback(err));
+        });
+    }
+    // make sure that all crls have been processed.
+    waitAndCheckCRLProcessingStatus() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return new Promise((resolve, reject) => {
+                if (this._pending_crl_to_process === 0) {
+                    setImmediate(resolve);
+                    return;
+                }
+                // istanbul ignore next
+                if (this._on_crl_process) {
+                    return reject(new Error("Internal Error"));
+                }
+                this._on_crl_process = resolve;
+            });
+        });
+    }
+}
+exports.CertificateManager = CertificateManager;
+const opts = { multiArgs: false };
+CertificateManager.prototype.rejectCertificate = thenify.withCallback(CertificateManager.prototype.rejectCertificate, opts);
+CertificateManager.prototype.trustCertificate = thenify.withCallback(CertificateManager.prototype.trustCertificate, opts);
+CertificateManager.prototype.createSelfSignedCertificate = thenify.withCallback(CertificateManager.prototype.createSelfSignedCertificate, opts);
+CertificateManager.prototype.createCertificateRequest = thenify.withCallback(CertificateManager.prototype.createCertificateRequest, opts);
+CertificateManager.prototype.initialize = thenify.withCallback(CertificateManager.prototype.initialize, opts);
+CertificateManager.prototype.getCertificateStatus = thenify.withCallback(CertificateManager.prototype.getCertificateStatus, opts);
+CertificateManager.prototype._checkRejectedOrTrusted = thenify.withCallback(CertificateManager.prototype._checkRejectedOrTrusted, opts);
+CertificateManager.prototype.verifyCertificate = thenify.withCallback(CertificateManager.prototype.verifyCertificate, opts);
+CertificateManager.prototype.isCertificateTrusted = thenify.withCallback((0, util_1.callbackify)(CertificateManager.prototype.isCertificateTrusted), opts);
 //# sourceMappingURL=certificate_manager.js.map