node-opcua-pki 4.18.0 → 5.0.0

package/CHANGELOG.md

@@ -4,9 +4,19 @@ All notable changes to this project will be documented in this file. Dates are d
 
 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 
+#### [5.0.0](https://github.com/node-opcua/node-opcua-pki/compare/4.18.0...5.0.0)
+
+- BREAKING CHANGE: remove callback support to favor async/await [`85a6262`](https://github.com/node-opcua/node-opcua-pki/commit/85a6262d05a15e5ddf007eac78279582c2d1a908)
+- chore: formatting [`4e0af65`](https://github.com/node-opcua/node-opcua-pki/commit/4e0af65d6d576a2b8f0f6b07d9f27de440fcd382)
+- update copyright year [`6eadac5`](https://github.com/node-opcua/node-opcua-pki/commit/6eadac5e5d2ff0f80cab8e3df174ec05971e0fd4)
+
 #### [4.18.0](https://github.com/node-opcua/node-opcua-pki/compare/4.17.0...4.18.0)
 
-- .adjust release-it.json [`094a11e`](https://github.com/node-opcua/node-opcua-pki/commit/094a11e430ce0285b595d47e63daa2deacc8a4d7)
+> 16 December 2024
+
+- chore: release v4.18.0 [`65ef098`](https://github.com/node-opcua/node-opcua-pki/commit/65ef0986a9e8937fb5d7d2ae3ed68649875ca09c)
+- replace deprecate string.substr with string.substring [`735ebe3`](https://github.com/node-opcua/node-opcua-pki/commit/735ebe322089c380321e39d16b60a440d3487fef)
+- buildIdealCertificateName now replace / or \ with _ to avoid building invalid filename from certificate CN [`20aee24`](https://github.com/node-opcua/node-opcua-pki/commit/20aee24f1a3a0950cb206aa9570ba6b6b8f16a97)
 
 #### [4.17.0](https://github.com/node-opcua/node-opcua-pki/compare/4.16.0...4.17.0)
 

package/bin/crypto_create_CA.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 /* eslint-disable @typescript-eslint/no-var-requires */
 // ---------------------------------------------------------------------------------------------------------------------
 // node-opcua-pki
@@ -30,8 +30,6 @@
 const _pkg = require("../package.json");
 
 // eslint-disable-next-line no-undef
-require("../dist/lib/ca/crypto_create_CA.js").main(process.argv.splice(2), () => {
-    /* empty */
-    // xx updateNotifier({pkg}).notify();
-    
-});
+const { main } = require("../dist/lib/ca/crypto_create_CA.js");
+
+main(process.argv.splice(2));

package/certificates/CA/conf/caconfig.cnf

@@ -0,0 +1,125 @@
+#.........DO NOT MODIFY BY HAND .........................
+[ ca ]
+default_ca               = CA_default
+[ CA_default ]
+dir                      = /home/etienne/projects/node-opcua-pki/certificates/CA            # the main CA folder
+certs                    = $dir/certs                 # where to store certificates
+new_certs_dir            = $dir/certs                 #
+database                 = $dir/index.txt             # the certificate database
+serial                   = $dir/serial                # the serial number counter
+certificate              = $dir/public/cacert.pem     # The root CA certificate
+private_key              = $dir/private/cakey.pem     # the CA private key
+x509_extensions          = usr_cert                   #
+default_days             = 3650                       # default validity : 10 years
+
+# default_md               = sha1
+
+default_md                = sha256                      # The default digest algorithm
+
+preserve                 = no
+policy                   = policy_match
+# randfile                 = $dir/random.rnd
+# default_startdate        = YYMMDDHHMMSSZ
+# default_enddate          = YYMMDDHHMMSSZ
+crl_dir                  = $dir/crl
+crl_extensions           = crl_ext
+crl                      = $dir/revocation_list.crl # the Revocation list
+crlnumber                = $dir/crlnumber           # CRL number file
+default_crl_days         = 30
+default_crl_hours        = 24
+#msie_hack
+
+[ policy_match ]
+countryName              = optional
+stateOrProvinceName      = optional
+localityName             = optional
+organizationName         = optional
+organizationalUnitName   = optional
+commonName               = optional
+emailAddress             = optional
+
+[ req ]
+default_bits             = 4096                     # Size of keys
+default_keyfile          = key.pem                  # name of generated keys
+distinguished_name       = req_distinguished_name
+attributes               = req_attributes
+x509_extensions          = v3_ca
+#input_password
+#output_password
+string_mask              = nombstr                  # permitted characters
+req_extensions           = v3_req
+
+[ req_distinguished_name ]
+
+#0 countryName             = Country Name (2 letter code)
+# countryName_default     = FR
+# countryName_min         = 2
+# countryName_max         = 2
+# stateOrProvinceName     = State or Province Name (full name)
+# stateOrProvinceName_default = Ile de France
+# localityName            = Locality Name (city, district)
+# localityName_default    = Paris
+organizationName          = Organization Name (company)
+organizationName_default  = NodeOPCUA
+# organizationalUnitName  = Organizational Unit Name (department, division)
+# organizationalUnitName_default = R&D
+commonName                = Common Name (hostname, FQDN, IP, or your name)
+commonName_max            = 256
+commonName_default        = NodeOPCUA
+# emailAddress            = Email Address
+# emailAddress_max        = 40
+# emailAddress_default    = node-opcua (at) node-opcua (dot) com
+
+[ req_attributes ]
+#challengePassword        = A challenge password
+#challengePassword_min    = 4
+#challengePassword_max    = 20
+#unstructuredName         = An optional company name
+[ usr_cert ]
+basicConstraints          = critical, CA:FALSE
+subjectKeyIdentifier      = hash
+authorityKeyIdentifier    = keyid,issuer:always
+#authorityKeyIdentifier    = keyid
+subjectAltName            = $ENV::ALTNAME
+# issuerAltName            = issuer:copy
+nsComment                 = ''OpenSSL Generated Certificate''
+#nsCertType               = client, email, objsign for ''everything including object signing''
+#nsCaRevocationUrl        = http://www.domain.dom/ca-crl.pem
+#nsBaseUrl                =
+#nsRenewalUrl             =
+#nsCaPolicyUrl            =
+#nsSslServerName          =
+keyUsage                  = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign
+extendedKeyUsage          = critical,serverAuth ,clientAuth
+
+[ v3_req ]
+basicConstraints          = critical, CA:FALSE
+keyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyAgreement
+extendedKeyUsage          = critical,serverAuth ,clientAuth
+subjectAltName            = $ENV::ALTNAME
+nsComment                 = "CA Generated by Node-OPCUA Certificate utility using openssl"
+[ v3_ca ]
+subjectKeyIdentifier      = hash
+authorityKeyIdentifier    = keyid:always,issuer:always
+# authorityKeyIdentifier    = keyid
+basicConstraints          = CA:TRUE
+keyUsage                  = critical, cRLSign, keyCertSign
+nsComment                 = "CA Certificate generated by Node-OPCUA Certificate utility using openssl"
+#nsCertType                 = sslCA, emailCA
+#subjectAltName             = email:copy
+#issuerAltName              = issuer:copy
+#obj                        = DER:02:03
+crlDistributionPoints     = @crl_info
+[ crl_info ]
+URI.0                     = http://localhost:8900/crl.pem
+[ v3_selfsigned]
+basicConstraints          = critical, CA:FALSE
+keyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyAgreement
+extendedKeyUsage          = critical,serverAuth ,clientAuth
+nsComment                 = "Self-signed certificate, generated by NodeOPCUA"
+subjectAltName            = $ENV::ALTNAME
+
+[ crl_ext ]
+#issuerAltName            = issuer:copy
+authorityKeyIdentifier    = keyid:always,issuer:always
+#authorityInfoAccess       = @issuer_info

package/certificates/CA/conf/caconfig.cnf.tmp

@@ -0,0 +1,125 @@
+#.........DO NOT MODIFY BY HAND .........................
+[ ca ]
+default_ca               = CA_default
+[ CA_default ]
+dir                      = /home/etienne/projects/node-opcua-pki/certificates/CA            # the main CA folder
+certs                    = $dir/certs                 # where to store certificates
+new_certs_dir            = $dir/certs                 #
+database                 = $dir/index.txt             # the certificate database
+serial                   = $dir/serial                # the serial number counter
+certificate              = $dir/public/cacert.pem     # The root CA certificate
+private_key              = $dir/private/cakey.pem     # the CA private key
+x509_extensions          = usr_cert                   #
+default_days             = 3650                       # default validity : 10 years
+
+# default_md               = sha1
+
+default_md                = sha256                      # The default digest algorithm
+
+preserve                 = no
+policy                   = policy_match
+# randfile                 = $dir/random.rnd
+# default_startdate        = YYMMDDHHMMSSZ
+# default_enddate          = YYMMDDHHMMSSZ
+crl_dir                  = $dir/crl
+crl_extensions           = crl_ext
+crl                      = $dir/revocation_list.crl # the Revocation list
+crlnumber                = $dir/crlnumber           # CRL number file
+default_crl_days         = 30
+default_crl_hours        = 24
+#msie_hack
+
+[ policy_match ]
+countryName              = optional
+stateOrProvinceName      = optional
+localityName             = optional
+organizationName         = optional
+organizationalUnitName   = optional
+commonName               = optional
+emailAddress             = optional
+
+[ req ]
+default_bits             = 4096                     # Size of keys
+default_keyfile          = key.pem                  # name of generated keys
+distinguished_name       = req_distinguished_name
+attributes               = req_attributes
+x509_extensions          = v3_ca
+#input_password
+#output_password
+string_mask              = nombstr                  # permitted characters
+req_extensions           = v3_req
+
+[ req_distinguished_name ]
+
+#0 countryName             = Country Name (2 letter code)
+# countryName_default     = FR
+# countryName_min         = 2
+# countryName_max         = 2
+# stateOrProvinceName     = State or Province Name (full name)
+# stateOrProvinceName_default = Ile de France
+# localityName            = Locality Name (city, district)
+# localityName_default    = Paris
+organizationName          = Organization Name (company)
+organizationName_default  = NodeOPCUA
+# organizationalUnitName  = Organizational Unit Name (department, division)
+# organizationalUnitName_default = R&D
+commonName                = Common Name (hostname, FQDN, IP, or your name)
+commonName_max            = 256
+commonName_default        = NodeOPCUA
+# emailAddress            = Email Address
+# emailAddress_max        = 40
+# emailAddress_default    = node-opcua (at) node-opcua (dot) com
+
+[ req_attributes ]
+#challengePassword        = A challenge password
+#challengePassword_min    = 4
+#challengePassword_max    = 20
+#unstructuredName         = An optional company name
+[ usr_cert ]
+basicConstraints          = critical, CA:FALSE
+subjectKeyIdentifier      = hash
+authorityKeyIdentifier    = keyid,issuer:always
+#authorityKeyIdentifier    = keyid
+subjectAltName            = URI:urn:ramses-linux:NodeOPCUA-DiscoveryServer, DNS:ramses-linux
+# issuerAltName            = issuer:copy
+nsComment                 = ''OpenSSL Generated Certificate''
+#nsCertType               = client, email, objsign for ''everything including object signing''
+#nsCaRevocationUrl        = http://www.domain.dom/ca-crl.pem
+#nsBaseUrl                =
+#nsRenewalUrl             =
+#nsCaPolicyUrl            =
+#nsSslServerName          =
+keyUsage                  = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign
+extendedKeyUsage          = critical,serverAuth ,clientAuth
+
+[ v3_req ]
+basicConstraints          = critical, CA:FALSE
+keyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyAgreement
+extendedKeyUsage          = critical,serverAuth ,clientAuth
+subjectAltName            = URI:urn:ramses-linux:NodeOPCUA-DiscoveryServer, DNS:ramses-linux
+nsComment                 = "CA Generated by Node-OPCUA Certificate utility using openssl"
+[ v3_ca ]
+subjectKeyIdentifier      = hash
+authorityKeyIdentifier    = keyid:always,issuer:always
+# authorityKeyIdentifier    = keyid
+basicConstraints          = CA:TRUE
+keyUsage                  = critical, cRLSign, keyCertSign
+nsComment                 = "CA Certificate generated by Node-OPCUA Certificate utility using openssl"
+#nsCertType                 = sslCA, emailCA
+#subjectAltName             = email:copy
+#issuerAltName              = issuer:copy
+#obj                        = DER:02:03
+crlDistributionPoints     = @crl_info
+[ crl_info ]
+URI.0                     = http://localhost:8900/crl.pem
+[ v3_selfsigned]
+basicConstraints          = critical, CA:FALSE
+keyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyAgreement
+extendedKeyUsage          = critical,serverAuth ,clientAuth
+nsComment                 = "Self-signed certificate, generated by NodeOPCUA"
+subjectAltName            = URI:urn:ramses-linux:NodeOPCUA-DiscoveryServer, DNS:ramses-linux
+
+[ crl_ext ]
+#issuerAltName            = issuer:copy
+authorityKeyIdentifier    = keyid:always,issuer:always
+#authorityInfoAccess       = @issuer_info

package/certificates/CA/crl/revocation_list.crl

@@ -0,0 +1,16 @@
+-----BEGIN X509 CRL-----
+MIICgzCCAWsCAQEwDQYJKoZIhvcNAQELBQAwczELMAkGA1UEBhMCRlIxDDAKBgNV
+BAgTA0lERjEOMAwGA1UEBxMFUGFyaXMxLzAtBgNVBAoTJkxvY2FsIE5PREUtT1BD
+VUEgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MRUwEwYDVQQDEwxOb2RlT1BDVUEtQ0EX
+DTIzMDUxNDE2MDIwMloXDTIzMDYxNDE2MDIwMlqggcMwgcAwgbAGA1UdIwSBqDCB
+pYAUex7icExQU+y3djszE73AQfg1e4Whd6R1MHMxCzAJBgNVBAYTAkZSMQwwCgYD
+VQQIEwNJREYxDjAMBgNVBAcTBVBhcmlzMS8wLQYDVQQKEyZMb2NhbCBOT0RFLU9Q
+Q1VBIENlcnRpZmljYXRlIEF1dGhvcml0eTEVMBMGA1UEAxMMTm9kZU9QQ1VBLUNB
+ghRDFnHt5x7dihSBPb5/5MxySlgoZDALBgNVHRQEBAICEAAwDQYJKoZIhvcNAQEL
+BQADggEBAFp54aI/z8Wqt5PA6dRzznQDt8ThjuFR6cgiwnJ0CjJF5/sES7elX1zA
+zLPdR8cuEAKNzIfx224BUFONp5wVWJzfCIieqnrf1iZfWcsIp9eAjnyK4MBDK6zD
+HxESAHFPooUhpIgUktuIQ3rz6xf++kVZPxer5CD/YEEDLv82bRqXOIdTAl2+gfNJ
+Yx/YT4S66nzsUkUBo2KptO4xIaeKOMmdcbsqGArb5ekj65sKz3Up8X9J1Cwurz6s
+PKqCkp0hYl357oacqHbkCCWi7QKidgvVuyRlgs6voqDGoR5Bs66oCK/Iy1tdd0kJ
+sgzWFPUXsm1enRfxNUUov1jav5vwwXs=
+-----END X509 CRL-----

package/certificates/CA/crlnumber

@@ -0,0 +1 @@
+1001

package/certificates/CA/crlnumber.old

@@ -0,0 +1 @@
+1000

package/certificates/CA/index.txt

@@ -0,0 +1,24 @@
+V	240512192440Z		1000	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1001	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1002	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1003	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1004	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1005	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1006	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1007	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1008	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1009	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		100A	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		100B	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		100C	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		100D	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		100E	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		100F	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1010	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1011	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1012	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1013	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1014	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1015	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1016	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1017	unknown	/O=NodeOPCUA/CN=NodeOPCUA

package/certificates/CA/index.txt.attr

@@ -0,0 +1 @@
+unique_subject = no

package/certificates/CA/index.txt.attr.old

@@ -0,0 +1 @@
+unique_subject = no

package/certificates/CA/index.txt.old

@@ -0,0 +1,23 @@
+V	240512192440Z		1000	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1001	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1002	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1003	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1004	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1005	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1006	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1007	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1008	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1009	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		100A	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		100B	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		100C	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		100D	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		100E	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		100F	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1010	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1011	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1012	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1013	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1014	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1015	unknown	/O=NodeOPCUA/CN=NodeOPCUA
+V	240512192440Z		1016	unknown	/C=FR/O=NodeOPCUA/CN=NodeOPCUA

package/certificates/CA/private/cakey.csr

@@ -0,0 +1,77 @@
+Certificate Request:
+    Data:
+        Version: 1 (0x0)
+        Subject: C = FR, ST = IDF, L = Paris, O = Local NODE-OPCUA Certificate Authority, CN = NodeOPCUA-CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:cc:3f:75:41:5a:01:c5:35:c0:d5:27:19:17:6b:
+                    9f:e7:3d:1a:36:ad:77:e5:3e:3f:e1:c4:e3:f0:37:
+                    c4:ff:53:b9:21:0a:17:b2:f4:e4:4c:0c:fd:26:3b:
+                    83:0f:82:40:b7:a9:cd:5e:e6:85:de:14:17:49:2b:
+                    8c:8e:65:63:a6:7e:24:01:fa:a5:c0:d2:99:1c:b4:
+                    1d:7a:5d:56:ab:26:82:f1:b7:8c:85:6f:9b:6a:34:
+                    08:e6:51:06:63:02:25:07:19:25:7e:03:6f:99:c1:
+                    76:47:b6:60:31:f8:9f:34:5a:36:c9:1a:fa:4e:85:
+                    53:29:65:93:86:aa:10:16:72:72:0e:d2:f6:f4:99:
+                    3b:18:90:d6:92:e1:55:6f:11:9a:2d:9b:7a:b2:96:
+                    79:cd:0c:13:6c:a6:9e:cf:a8:9d:5d:fe:9c:19:83:
+                    34:09:e8:95:6a:b5:fd:8e:3b:3a:cd:c2:fd:73:7e:
+                    5a:49:9b:63:01:a5:7e:90:b0:d5:99:a8:f7:2a:ff:
+                    33:e1:c2:b5:37:5a:83:4a:a1:09:01:b3:3f:78:51:
+                    be:ae:bf:e1:bb:51:ce:7a:4e:22:91:02:69:ef:fb:
+                    f8:75:d8:7d:26:69:6d:8c:6f:d0:64:f7:4d:36:82:
+                    37:ed:50:87:6c:50:d4:83:34:5a:4f:91:7e:01:2d:
+                    e7:07
+                Exponent: 65537 (0x10001)
+        Attributes:
+            Requested Extensions:
+                X509v3 Basic Constraints: critical
+                    CA:FALSE
+                X509v3 Key Usage: 
+                    Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement
+                X509v3 Extended Key Usage: critical
+                    TLS Web Server Authentication, TLS Web Client Authentication
+                X509v3 Subject Alternative Name: 
+                    URI:undefined
+                Netscape Comment: 
+                    CA Generated by Node-OPCUA Certificate utility using openssl
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        71:47:73:4c:ac:d9:54:6a:5f:ca:a3:b5:1f:05:62:c3:cd:20:
+        56:02:67:da:ac:e4:e6:e9:90:84:f0:a7:89:07:02:0f:38:41:
+        c9:3b:be:23:13:a4:1d:d8:f6:06:58:4c:91:5f:2b:a7:fc:e7:
+        0d:3f:c1:3f:24:e7:21:f9:c4:36:4c:34:7e:2a:8f:66:79:4a:
+        ea:21:ca:37:23:68:40:08:c6:ba:f0:fe:de:76:55:a4:f5:dc:
+        f3:78:cb:85:9f:e6:46:eb:7f:39:43:e3:69:ff:70:72:92:ae:
+        d9:97:93:78:ac:34:7e:97:63:72:a9:65:66:f4:e7:ec:56:6c:
+        b5:46:9f:d8:fe:1c:32:48:65:81:a5:c2:b3:7c:e1:4b:ed:d0:
+        ac:f8:22:f9:87:36:49:e8:fc:b1:7e:de:b5:8e:f7:da:ac:1c:
+        26:47:33:25:77:34:84:e0:f0:c3:ad:77:e2:38:87:4a:a0:35:
+        43:17:c5:a5:19:64:e9:29:cf:13:90:f6:86:71:28:ff:13:a6:
+        ec:95:a0:f0:19:d4:8f:12:1d:c1:a2:10:c2:20:16:e6:ba:ec:
+        56:75:58:5e:05:b1:69:00:85:81:90:6e:ca:34:0d:dd:64:1e:
+        cf:4f:9d:6d:e0:1b:75:33:89:ac:16:e3:72:40:ec:e1:46:3e:
+        52:30:b6:5d
+-----BEGIN CERTIFICATE REQUEST-----
+MIIDbTCCAlUCAQAwczELMAkGA1UEBhMCRlIxDDAKBgNVBAgTA0lERjEOMAwGA1UE
+BxMFUGFyaXMxLzAtBgNVBAoTJkxvY2FsIE5PREUtT1BDVUEgQ2VydGlmaWNhdGUg
+QXV0aG9yaXR5MRUwEwYDVQQDEwxOb2RlT1BDVUEtQ0EwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDMP3VBWgHFNcDVJxkXa5/nPRo2rXflPj/hxOPwN8T/
+U7khChey9ORMDP0mO4MPgkC3qc1e5oXeFBdJK4yOZWOmfiQB+qXA0pkctB16XVar
+JoLxt4yFb5tqNAjmUQZjAiUHGSV+A2+ZwXZHtmAx+J80WjbJGvpOhVMpZZOGqhAW
+cnIO0vb0mTsYkNaS4VVvEZotm3qylnnNDBNspp7PqJ1d/pwZgzQJ6JVqtf2OOzrN
+wv1zflpJm2MBpX6QsNWZqPcq/zPhwrU3WoNKoQkBsz94Ub6uv+G7Uc56TiKRAmnv
++/h12H0maW2Mb9Bk9002gjftUIdsUNSDNFpPkX4BLecHAgMBAAGggbQwgbEGCSqG
+SIb3DQEJDjGBozCBoDAMBgNVHRMBAf8EAjAAMAsGA1UdDwQEAwID+DAgBgNVHSUB
+Af8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwFAYDVR0RBA0wC4YJdW5kZWZpbmVk
+MEsGCWCGSAGG+EIBDQQ+FjxDQSBHZW5lcmF0ZWQgYnkgTm9kZS1PUENVQSBDZXJ0
+aWZpY2F0ZSB1dGlsaXR5IHVzaW5nIG9wZW5zc2wwDQYJKoZIhvcNAQELBQADggEB
+AHFHc0ys2VRqX8qjtR8FYsPNIFYCZ9qs5ObpkITwp4kHAg84Qck7viMTpB3Y9gZY
+TJFfK6f85w0/wT8k5yH5xDZMNH4qj2Z5SuohyjcjaEAIxrrw/t52VaT13PN4y4Wf
+5kbrfzlD42n/cHKSrtmXk3isNH6XY3KpZWb05+xWbLVGn9j+HDJIZYGlwrN84Uvt
+0Kz4IvmHNkno/LF+3rWO99qsHCZHMyV3NITg8MOtd+I4h0qgNUMXxaUZZOkpzxOQ
+9oZxKP8TpuyVoPAZ1I8SHcGiEMIgFua67FZ1WF4FsWkAhYGQbso0Dd1kHs9PnW3g
+G3UziawW43JA7OFGPlIwtl0=
+-----END CERTIFICATE REQUEST-----

package/certificates/CA/serial

@@ -0,0 +1 @@
+1018

package/certificates/CA/serial.old

@@ -0,0 +1 @@
+1017

package/certificates/PKI/own/openssl.cnf

@@ -0,0 +1,72 @@
+##################################################################################################
+## SIMPLE OPENSSL CONFIG FILE FOR SELF-SIGNED CERTIFICATE GENERATION
+################################################################################################################
+
+distinguished_name       = req_distinguished_name
+default_md               = sha1
+
+default_md                = sha256                      # The default digest algorithm
+
+[ v3_ca ]
+subjectKeyIdentifier        = hash
+authorityKeyIdentifier      = keyid:always,issuer:always
+
+# authorityKeyIdentifier    = keyid
+basicConstraints            = CA:TRUE
+keyUsage                    = critical, cRLSign, keyCertSign
+nsComment                   = "Self-signed Certificate for CA generated by Node-OPCUA Certificate utility"
+#nsCertType                 = sslCA, emailCA
+#subjectAltName             = email:copy
+#issuerAltName              = issuer:copy
+#obj                        = DER:02:03
+# crlDistributionPoints       = @crl_info
+# [ crl_info ]
+# URI.0                     = http://localhost:8900/crl.pem
+subjectAltName              = $ENV::ALTNAME
+
+[ req ]
+days                      = 390
+req_extensions            = v3_req
+x509_extensions           = v3_ca
+
+[v3_req]
+basicConstraints       = CA:false
+keyUsage               = critical, cRLSign, keyCertSign
+subjectAltName         = $ENV::ALTNAME
+
+[ v3_ca_signed]
+subjectKeyIdentifier      = hash
+authorityKeyIdentifier    = keyid,issuer
+basicConstraints          = critical, CA:FALSE
+keyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign
+extendedKeyUsage          = clientAuth,serverAuth 
+nsComment                 = "certificate generated by Node-OPCUA Certificate utility and signed by a CA"
+subjectAltName            = $ENV::ALTNAME
+[ v3_selfsigned]
+subjectKeyIdentifier      = hash
+authorityKeyIdentifier    = keyid,issuer
+basicConstraints          = critical, CA:FALSE
+keyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign
+extendedKeyUsage          = clientAuth,serverAuth 
+nsComment                 = "Self-signed certificate generated by Node-OPCUA Certificate utility"
+subjectAltName            = $ENV::ALTNAME
+[ req_distinguished_name ]
+countryName             = Country Name (2 letter code)
+countryName_default     = FR
+countryName_min         = 2
+countryName_max         = 2
+# stateOrProvinceName     = State or Province Name (full name)
+# stateOrProvinceName_default = Ile de France
+# localityName            = Locality Name (city, district)
+# localityName_default    = Paris
+organizationName          = Organization Name (company)
+organizationName_default  = NodeOPCUA
+# organizationalUnitName  = Organizational Unit Name (department, division)
+# organizationalUnitName_default = R&D
+commonName                = Common Name (hostname, FQDN, IP, or your name)
+commonName_max            = 256
+commonName_default        = NodeOPCUA
+# emailAddress            = Email Address
+# emailAddress_max        = 40
+# emailAddress_default    = node-opcua (at) node-opcua (dot) com
+subjectAltName            = $ENV::ALTNAME

package/certificates/PKI/own/openssl.cnf.tmp

@@ -0,0 +1,72 @@
+##################################################################################################
+## SIMPLE OPENSSL CONFIG FILE FOR SELF-SIGNED CERTIFICATE GENERATION
+################################################################################################################
+
+distinguished_name       = req_distinguished_name
+default_md               = sha1
+
+default_md                = sha256                      # The default digest algorithm
+
+[ v3_ca ]
+subjectKeyIdentifier        = hash
+authorityKeyIdentifier      = keyid:always,issuer:always
+
+# authorityKeyIdentifier    = keyid
+basicConstraints            = CA:TRUE
+keyUsage                    = critical, cRLSign, keyCertSign
+nsComment                   = "Self-signed Certificate for CA generated by Node-OPCUA Certificate utility"
+#nsCertType                 = sslCA, emailCA
+#subjectAltName             = email:copy
+#issuerAltName              = issuer:copy
+#obj                        = DER:02:03
+# crlDistributionPoints       = @crl_info
+# [ crl_info ]
+# URI.0                     = http://localhost:8900/crl.pem
+subjectAltName              = URI:urn:ramses-linux:NodeOPCUA-DiscoveryServer, DNS:ramses-linux, IP:127.0.0.1
+
+[ req ]
+days                      = 390
+req_extensions            = v3_req
+x509_extensions           = v3_ca
+
+[v3_req]
+basicConstraints       = CA:false
+keyUsage               = critical, cRLSign, keyCertSign
+subjectAltName         = URI:urn:ramses-linux:NodeOPCUA-DiscoveryServer, DNS:ramses-linux, IP:127.0.0.1
+
+[ v3_ca_signed]
+subjectKeyIdentifier      = hash
+authorityKeyIdentifier    = keyid,issuer
+basicConstraints          = critical, CA:FALSE
+keyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign
+extendedKeyUsage          = clientAuth,serverAuth 
+nsComment                 = "certificate generated by Node-OPCUA Certificate utility and signed by a CA"
+subjectAltName            = URI:urn:ramses-linux:NodeOPCUA-DiscoveryServer, DNS:ramses-linux, IP:127.0.0.1
+[ v3_selfsigned]
+subjectKeyIdentifier      = hash
+authorityKeyIdentifier    = keyid,issuer
+basicConstraints          = critical, CA:FALSE
+keyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign
+extendedKeyUsage          = clientAuth,serverAuth 
+nsComment                 = "Self-signed certificate generated by Node-OPCUA Certificate utility"
+subjectAltName            = URI:urn:ramses-linux:NodeOPCUA-DiscoveryServer, DNS:ramses-linux, IP:127.0.0.1
+[ req_distinguished_name ]
+countryName             = Country Name (2 letter code)
+countryName_default     = FR
+countryName_min         = 2
+countryName_max         = 2
+# stateOrProvinceName     = State or Province Name (full name)
+# stateOrProvinceName_default = Ile de France
+# localityName            = Locality Name (city, district)
+# localityName_default    = Paris
+organizationName          = Organization Name (company)
+organizationName_default  = NodeOPCUA
+# organizationalUnitName  = Organizational Unit Name (department, division)
+# organizationalUnitName_default = R&D
+commonName                = Common Name (hostname, FQDN, IP, or your name)
+commonName_max            = 256
+commonName_default        = NodeOPCUA
+# emailAddress            = Email Address
+# emailAddress_max        = 40
+# emailAddress_default    = node-opcua (at) node-opcua (dot) com
+subjectAltName            = URI:urn:ramses-linux:NodeOPCUA-DiscoveryServer, DNS:ramses-linux, IP:127.0.0.1

package/certificates/client_cert_1024.pem.csr

@@ -0,0 +1,49 @@
+Certificate Request:
+    Data:
+        Version: 1 (0x0)
+        Subject: C = FR, O = NodeOPCUA, CN = NodeOPCUA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (1024 bit)
+                Modulus:
+                    00:ba:96:4d:11:a8:03:26:bd:d4:1e:d6:37:a3:f2:
+                    46:9f:84:a1:a7:0f:7f:68:26:cc:15:89:37:45:79:
+                    a3:e0:94:7c:18:32:65:86:b1:a5:f3:46:f9:0f:9d:
+                    27:86:e2:04:87:7b:5a:01:b5:9c:87:7c:b0:02:f1:
+                    06:8b:16:49:13:57:ed:f9:e2:59:fb:0a:fd:db:6e:
+                    90:be:7c:7e:8c:a5:57:20:d7:84:49:5c:a6:d3:b2:
+                    9f:94:6d:c1:39:a7:b7:0b:48:8b:b2:a4:d6:16:40:
+                    05:f8:c5:9f:cd:91:14:c9:d8:cc:c2:b6:91:f1:08:
+                    5f:ff:55:2f:99:bf:de:1c:e1
+                Exponent: 65537 (0x10001)
+        Attributes:
+            Requested Extensions:
+                X509v3 Basic Constraints: 
+                    CA:FALSE
+                X509v3 Key Usage: critical
+                    Certificate Sign, CRL Sign
+                X509v3 Subject Alternative Name: 
+                    URI:urn:ramses-linux:NodeOPCUA-Client, DNS:ramses-linux, IP Address:127.0.0.1
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        6b:7b:71:fe:2d:15:46:be:75:71:f2:60:43:ff:52:17:70:9c:
+        59:0b:cc:30:2d:71:cc:4c:ac:d1:88:f4:fb:6a:e2:15:0f:30:
+        bc:f6:bd:bd:1c:d7:ca:d8:ee:ab:f2:27:30:da:54:a8:5a:b7:
+        cc:7a:a1:65:47:b4:9e:a0:51:91:9a:89:2e:64:6a:60:f1:6c:
+        d1:76:07:82:d2:a8:43:7c:50:2d:58:df:ff:3a:82:70:f6:6e:
+        99:10:74:4e:34:0d:14:13:c6:54:8e:56:0b:a5:3a:7b:18:20:
+        53:4b:33:be:fa:81:ee:7a:76:05:de:af:1e:7c:a3:7c:f2:be:
+        91:c1
+-----BEGIN CERTIFICATE REQUEST-----
+MIIB4zCCAUwCAQAwNTELMAkGA1UEBhMCRlIxEjAQBgNVBAoMCU5vZGVPUENVQTES
+MBAGA1UEAwwJTm9kZU9QQ1VBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC6
+lk0RqAMmvdQe1jej8kafhKGnD39oJswViTdFeaPglHwYMmWGsaXzRvkPnSeG4gSH
+e1oBtZyHfLAC8QaLFkkTV+354ln7Cv3bbpC+fH6MpVcg14RJXKbTsp+UbcE5p7cL
+SIuypNYWQAX4xZ/NkRTJ2MzCtpHxCF//VS+Zv94c4QIDAQABoG4wbAYJKoZIhvcN
+AQkOMV8wXTAJBgNVHRMEAjAAMA4GA1UdDwEB/wQEAwIBBjBABgNVHREEOTA3hiF1
+cm46cmFtc2VzLWxpbnV4Ok5vZGVPUENVQS1DbGllbnSCDHJhbXNlcy1saW51eIcE
+fwAAATANBgkqhkiG9w0BAQsFAAOBgQBre3H+LRVGvnVx8mBD/1IXcJxZC8wwLXHM
+TKzRiPT7auIVDzC89r29HNfK2O6r8icw2lSoWrfMeqFlR7SeoFGRmokuZGpg8WzR
+dgeC0qhDfFAtWN//OoJw9m6ZEHRONA0UE8ZUjlYLpTp7GCBTSzO++oHuenYF3q8e
+fKN88r6RwQ==
+-----END CERTIFICATE REQUEST-----