node-opcua-pki 5.2.0 → 5.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +15 -0
- package/LICENSE +22 -22
- package/bin/crypto_create_CA.js +0 -0
- package/bin/crypto_create_CA_config.example.js +18 -18
- package/bin/install_prerequisite.js +9 -9
- package/dist/lib/ca/certificate_authority.js +1 -1
- package/dist/lib/toolbox/with_openssl/install_prerequisite.js +1 -4
- package/package.json +7 -9
- package/readme.md +230 -230
- package/dist/lib/toolbox/without_openssl/deprecated_create_private_key.d.ts +0 -0
- package/dist/lib/toolbox/without_openssl/deprecated_create_private_key.js +0 -2
package/CHANGELOG.md
CHANGED
|
@@ -4,8 +4,23 @@ All notable changes to this project will be documented in this file. Dates are d
|
|
|
4
4
|
|
|
5
5
|
Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
|
|
6
6
|
|
|
7
|
+
#### [5.4.0](https://github.com/node-opcua/node-opcua-pki/compare/5.3.0...5.4.0)
|
|
8
|
+
|
|
9
|
+
- update packages [`4eea782`](https://github.com/node-opcua/node-opcua-pki/commit/4eea7820d1f56f26fdb49497b72d73e224ff6ef9)
|
|
10
|
+
- update packages [`72339cc`](https://github.com/node-opcua/node-opcua-pki/commit/72339cc34c506fd5bd8fc6ba893fbadab614e158)
|
|
11
|
+
|
|
12
|
+
#### [5.3.0](https://github.com/node-opcua/node-opcua-pki/compare/5.2.0...5.3.0)
|
|
13
|
+
|
|
14
|
+
> 5 April 2025
|
|
15
|
+
|
|
16
|
+
- update packages [`f0a315c`](https://github.com/node-opcua/node-opcua-pki/commit/f0a315c48209b0a12e53804929223e354e5639b3)
|
|
17
|
+
- fix certificate generation when uniformResourceIdentifier is not present [`8e287ed`](https://github.com/node-opcua/node-opcua-pki/commit/8e287ed5ddc51cf86c4679f2ce0cc944d2e374de)
|
|
18
|
+
- remove cli-table dependency [`b37726d`](https://github.com/node-opcua/node-opcua-pki/commit/b37726d843dbea92718a1f529b60e4a59deab66c)
|
|
19
|
+
|
|
7
20
|
#### [5.2.0](https://github.com/node-opcua/node-opcua-pki/compare/5.1.0...5.2.0)
|
|
8
21
|
|
|
22
|
+
> 9 March 2025
|
|
23
|
+
|
|
9
24
|
- generate signing request without openssl in CA [`399a051`](https://github.com/node-opcua/node-opcua-pki/commit/399a0511da935be24b95ac8ed69de6c513745781)
|
|
10
25
|
- fix openssl issue that could cause command to fail when rootDir is a relative path [`b0f6425`](https://github.com/node-opcua/node-opcua-pki/commit/b0f642598746ab93add7fd772eaa817285a2e1d5)
|
|
11
26
|
- chore: minor cleanup [`34d173e`](https://github.com/node-opcua/node-opcua-pki/commit/34d173e598a2c6a3eef114d60433dcd09c638874)
|
package/LICENSE
CHANGED
|
@@ -1,22 +1,22 @@
|
|
|
1
|
-
The MIT License (MIT)
|
|
2
|
-
|
|
3
|
-
Copyright (c) 2014-2022 - Etienne Rossignon - etienne.rossignon (at) gadz.org
|
|
4
|
-
Copyright (c) 2022-2024 - Sterfive.com
|
|
5
|
-
|
|
6
|
-
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
7
|
-
of this software and associated documentation files (the "Software"), to deal
|
|
8
|
-
in the Software without restriction, including without limitation the rights
|
|
9
|
-
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
10
|
-
copies of the Software, and to permit persons to whom the Software is
|
|
11
|
-
furnished to do so, subject to the following conditions:
|
|
12
|
-
|
|
13
|
-
The above copyright notice and this permission notice shall be included in all
|
|
14
|
-
copies or substantial portions of the Software.
|
|
15
|
-
|
|
16
|
-
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
17
|
-
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
18
|
-
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
19
|
-
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
20
|
-
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
21
|
-
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
22
|
-
SOFTWARE.
|
|
1
|
+
The MIT License (MIT)
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2014-2022 - Etienne Rossignon - etienne.rossignon (at) gadz.org
|
|
4
|
+
Copyright (c) 2022-2024 - Sterfive.com
|
|
5
|
+
|
|
6
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
7
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
8
|
+
in the Software without restriction, including without limitation the rights
|
|
9
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
10
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
11
|
+
furnished to do so, subject to the following conditions:
|
|
12
|
+
|
|
13
|
+
The above copyright notice and this permission notice shall be included in all
|
|
14
|
+
copies or substantial portions of the Software.
|
|
15
|
+
|
|
16
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
17
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
18
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
19
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
20
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
21
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
22
|
+
SOFTWARE.
|
package/bin/crypto_create_CA.js
CHANGED
|
File without changes
|
|
@@ -1,18 +1,18 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
// ---------------------------------------------------------------------------------------------------------------------
|
|
3
|
-
module.exports = {
|
|
4
|
-
|
|
5
|
-
subject: {
|
|
6
|
-
commonName: "NodeOPCUA-TEST",
|
|
7
|
-
organization: "NodeOPCUA",
|
|
8
|
-
organizationalUnit: "Unit",
|
|
9
|
-
locality: "Paris",
|
|
10
|
-
state: "IDF",
|
|
11
|
-
country: "FR" // Two letters
|
|
12
|
-
},
|
|
13
|
-
|
|
14
|
-
validity: 365 * 15, // 15 years
|
|
15
|
-
|
|
16
|
-
keySize: 2048 // default private key size : 2048, 3072 or 4096 (avoid 1024 too weak)
|
|
17
|
-
};
|
|
18
|
-
|
|
1
|
+
"use strict";
|
|
2
|
+
// ---------------------------------------------------------------------------------------------------------------------
|
|
3
|
+
module.exports = {
|
|
4
|
+
|
|
5
|
+
subject: {
|
|
6
|
+
commonName: "NodeOPCUA-TEST",
|
|
7
|
+
organization: "NodeOPCUA",
|
|
8
|
+
organizationalUnit: "Unit",
|
|
9
|
+
locality: "Paris",
|
|
10
|
+
state: "IDF",
|
|
11
|
+
country: "FR" // Two letters
|
|
12
|
+
},
|
|
13
|
+
|
|
14
|
+
validity: 365 * 15, // 15 years
|
|
15
|
+
|
|
16
|
+
keySize: 2048 // default private key size : 2048, 3072 or 4096 (avoid 1024 too weak)
|
|
17
|
+
};
|
|
18
|
+
|
|
@@ -1,9 +1,9 @@
|
|
|
1
|
-
#!/usr/bin/env node
|
|
2
|
-
"use strict";
|
|
3
|
-
// eslint-disable-next-line @typescript-eslint/no-var-requires
|
|
4
|
-
const install_prerequisite = require("../dist/lib/misc/install_prerequisite").install_prerequisite;
|
|
5
|
-
install_prerequisite(function(err){
|
|
6
|
-
if (err) {
|
|
7
|
-
console.log("err = ",err.message);
|
|
8
|
-
}
|
|
9
|
-
});
|
|
1
|
+
#!/usr/bin/env node
|
|
2
|
+
"use strict";
|
|
3
|
+
// eslint-disable-next-line @typescript-eslint/no-var-requires
|
|
4
|
+
const install_prerequisite = require("../dist/lib/misc/install_prerequisite").install_prerequisite;
|
|
5
|
+
install_prerequisite(function(err){
|
|
6
|
+
if (err) {
|
|
7
|
+
console.log("err = ",err.message);
|
|
8
|
+
}
|
|
9
|
+
});
|
|
@@ -391,7 +391,7 @@ class CertificateAuthority {
|
|
|
391
391
|
// see https://github.com/openssl/openssl/issues/10458
|
|
392
392
|
const csr = yield (0, node_opcua_crypto_1.readCertificateSigningRequest)(certificateSigningRequestFilename);
|
|
393
393
|
const csrInfo = (0, node_opcua_crypto_1.exploreCertificateSigningRequest)(csr);
|
|
394
|
-
const applicationUri = csrInfo.extensionRequest.subjectAltName.uniformResourceIdentifier[0];
|
|
394
|
+
const applicationUri = csrInfo.extensionRequest.subjectAltName.uniformResourceIdentifier ? csrInfo.extensionRequest.subjectAltName.uniformResourceIdentifier[0] : undefined;
|
|
395
395
|
if (typeof applicationUri !== "string") {
|
|
396
396
|
throw new Error("Cannot find applicationUri in CSR");
|
|
397
397
|
}
|
|
@@ -48,7 +48,6 @@ const chalk_1 = __importDefault(require("chalk"));
|
|
|
48
48
|
const child_process_1 = __importDefault(require("child_process"));
|
|
49
49
|
const progress_1 = __importDefault(require("progress"));
|
|
50
50
|
const yauzl_1 = __importDefault(require("yauzl"));
|
|
51
|
-
const Table = require("cli-table");
|
|
52
51
|
const debug_1 = require("../debug");
|
|
53
52
|
const doDebug = process.env.NODEOPCUAPKIDEBUG || false;
|
|
54
53
|
// tslint:disable-next-line:no-var-requires
|
|
@@ -154,9 +153,7 @@ function check_system_openssl_version() {
|
|
|
154
153
|
chalk_1.default.cyan("\nplease refer to :") +
|
|
155
154
|
chalk_1.default.yellow(" https://github.com/node-opcua/node-opcua/" + "wiki/installing-node-opcua-or-node-red-on-MacOS");
|
|
156
155
|
}
|
|
157
|
-
|
|
158
|
-
table.push([message]);
|
|
159
|
-
console.error(table.toString());
|
|
156
|
+
console.log(message);
|
|
160
157
|
}
|
|
161
158
|
return output;
|
|
162
159
|
});
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "node-opcua-pki",
|
|
3
|
-
"version": "5.
|
|
3
|
+
"version": "5.4.0",
|
|
4
4
|
"description": "PKI management for node-opcua",
|
|
5
5
|
"type": "commonjs",
|
|
6
6
|
"main": "./dist/lib/index.js",
|
|
@@ -41,7 +41,6 @@
|
|
|
41
41
|
"byline": "^5.0.0",
|
|
42
42
|
"chalk": "4.1.2",
|
|
43
43
|
"chokidar": "4.0.3",
|
|
44
|
-
"cli-table": "^0.3.11",
|
|
45
44
|
"node-opcua-crypto": "4.16.0",
|
|
46
45
|
"progress": "^2.0.3",
|
|
47
46
|
"rimraf": "4.4.1",
|
|
@@ -52,23 +51,22 @@
|
|
|
52
51
|
"devDependencies": {
|
|
53
52
|
"@types/async": "^3.2.24",
|
|
54
53
|
"@types/byline": "^4.2.36",
|
|
55
|
-
"@types/cli-table": "^0.3.4",
|
|
56
54
|
"@types/mocha": "^10.0.10",
|
|
57
|
-
"@types/node": "^
|
|
55
|
+
"@types/node": "^24.0.10",
|
|
58
56
|
"@types/node-dir": "0.0.37",
|
|
59
57
|
"@types/progress": "^2.0.7",
|
|
60
58
|
"@types/rimraf": "^4.0.5",
|
|
61
|
-
"@types/sinon": "^17.0.
|
|
59
|
+
"@types/sinon": "^17.0.4",
|
|
62
60
|
"@types/yargs": "^17.0.33",
|
|
63
61
|
"@types/yauzl": "^2.10.3",
|
|
64
|
-
"eslint": "^9.
|
|
65
|
-
"mocha": "^11.1
|
|
62
|
+
"eslint": "^9.30.1",
|
|
63
|
+
"mocha": "^11.7.1",
|
|
66
64
|
"node-dir": "^0.1.17",
|
|
67
65
|
"should": "^13.2.3",
|
|
68
|
-
"sinon": "^
|
|
66
|
+
"sinon": "^21.0.0",
|
|
69
67
|
"source-map-support": "^0.5.21",
|
|
70
68
|
"ts-node": "^10.9.2",
|
|
71
|
-
"typescript": "^5.
|
|
69
|
+
"typescript": "^5.8.3"
|
|
72
70
|
},
|
|
73
71
|
"bin": {
|
|
74
72
|
"pki": "./bin/crypto_create_CA.js"
|
package/readme.md
CHANGED
|
@@ -1,230 +1,230 @@
|
|
|
1
|
-
### node-opcua-pki
|
|
2
|
-
|
|
3
|
-
[](https://www.npmtrends.com/node-opcua-pki)
|
|
4
|
-
[](https://www.npmjs.com/package/node-opcua-pki?activeTab=versions)
|
|
5
|
-
[](https://github.com/node-opcua/node-opcua-pki/actions/workflows/ci.yml)
|
|
6
|
-
[](https://coveralls.io/github/node-opcua/node-opcua-pki?branch=master)
|
|
7
|
-
[](https://packagephobia.com/result?p=node-opcua-pki)
|
|
8
|
-
[](https://app.fossa.com/projects/custom%2B20248%2Fgithub.com%2Fnode-opcua%2Fnode-opcua-pki?ref=badge_shield)
|
|
9
|
-
|
|
10
|
-
## Installation
|
|
11
|
-
|
|
12
|
-
##### install globally
|
|
13
|
-
|
|
14
|
-
```
|
|
15
|
-
$ npm install -g node-opcua-pki
|
|
16
|
-
$ crypto_create_CA --help
|
|
17
|
-
```
|
|
18
|
-
|
|
19
|
-
##### use with npx
|
|
20
|
-
|
|
21
|
-
```
|
|
22
|
-
npx node-opcua-pki --help
|
|
23
|
-
npx node-opcua-pki certificate --help
|
|
24
|
-
```
|
|
25
|
-
|
|
26
|
-
Note: see https://reference.opcfoundation.org/GDS/docs/F.1/
|
|
27
|
-
|
|
28
|
-
# commands
|
|
29
|
-
|
|
30
|
-
| command | Help |
|
|
31
|
-
| ----------- | ----------------------------------------------- |
|
|
32
|
-
| demo | create default certificate for node-opcua demos |
|
|
33
|
-
| createCA | create a Certificate Authority |
|
|
34
|
-
| createPKI | create a Public Key Infrastructure |
|
|
35
|
-
| certificate | create a new certificate |
|
|
36
|
-
| csr | create a new certificate signing request(CSR) |
|
|
37
|
-
| sign | sign a CSR and generate a certificate |
|
|
38
|
-
| revoke | revoke an existing certificate |
|
|
39
|
-
| dump | display a certificate |
|
|
40
|
-
| toder | convert a certificate to a DER format |
|
|
41
|
-
| fingerprint | print the certificate fingerprint |
|
|
42
|
-
|
|
43
|
-
Options:
|
|
44
|
-
--help display help
|
|
45
|
-
|
|
46
|
-
## create a PKI
|
|
47
|
-
|
|
48
|
-
```
|
|
49
|
-
node-opcua-pki createPKI
|
|
50
|
-
```
|
|
51
|
-
|
|
52
|
-
### Options:
|
|
53
|
-
|
|
54
|
-
| option | description | type | default |
|
|
55
|
-
| -------------------------- | -------------------------------------------------- | --------- | ------------------------------- |
|
|
56
|
-
| -r, --root | the location of the Certificate folder | [string] | [default: "{CWD}/certificates"] |
|
|
57
|
-
| --PKIFolder | the location of the Public Key Infrastructure | [string] | [default: "{root}/PKI"] |
|
|
58
|
-
| -k, --keySize, --keyLength | the private key size in bits (1024,2048,3072,4096) | [number] | [default: 2048] |
|
|
59
|
-
| -s, --silent | minimize output | [boolean] | [default: false] |
|
|
60
|
-
|
|
61
|
-
The result
|
|
62
|
-
|
|
63
|
-
```
|
|
64
|
-
└─ 📂certificates
|
|
65
|
-
└─📂PKI
|
|
66
|
-
├─📂issuers
|
|
67
|
-
│ ├─📂certs contains known Certificate Authorities' certificates
|
|
68
|
-
│ └─📂crl contains Certificate Revocation List associates with the CA Certificates
|
|
69
|
-
├─📂own
|
|
70
|
-
│ ├─📂certs where to store generated public certificates generated for the private key.
|
|
71
|
-
│ └─📂private
|
|
72
|
-
│ └─🔐private_key.pem the private key in PEM format
|
|
73
|
-
├─📂rejected contains certificates that have been rejected.
|
|
74
|
-
└─📂trusted
|
|
75
|
-
├─📂certs contains the X.509 v3 Certificates that are trusted.
|
|
76
|
-
└─📂crl contains the X.509 v3 CRLs for any Certificates in the ./certs directory.
|
|
77
|
-
```
|
|
78
|
-
|
|
79
|
-
## create a Certificate Signing Request (CSR)
|
|
80
|
-
|
|
81
|
-
Options:
|
|
82
|
-
| option | description | type | default |
|
|
83
|
-
|---------------------|-------------------------------------------------|--------|-----------------------------------------------|
|
|
84
|
-
|-a, --applicationUri |the application URI |[string]|[default: "urn:{hostname}:Node-OPCUA-Server"] |
|
|
85
|
-
|-o, --output | the name of the generated signing_request |[string]|[default: "my_certificate_signing_request.csr"]|
|
|
86
|
-
|--dns | the list of valid domain name (comma separated) |[string]|[default: "{hostname}"] |
|
|
87
|
-
|--ip | the list of valid IPs (comma separated) |[string]|[default: ""] |
|
|
88
|
-
|--subject | the certificate subject ( for instance /C=FR/ST=Centre/L=Orleans/O=SomeOrganization/CN=Hello )|[string]| [default: "/CN=Certificate"]|
|
|
89
|
-
|-r, --root | the location of the Certificate folder |[string]|[default: "{CWD}/certificates"] |
|
|
90
|
-
|--PKIFolder | the location of the Public Key Infrastructure |[string]|[default: "{root}/PKI"] |
|
|
91
|
-
|
|
92
|
-
## Create a certificate authority
|
|
93
|
-
|
|
94
|
-
| | | default value |
|
|
95
|
-
| -------------------------------- | ------------------------------------------------ | ------------------------------------------------------------------------------- |
|
|
96
|
-
| `--subject` | the CA certificate subject | "/C=FR/ST=IDF/L=Paris/O=Local NODE-OPCUA Certificate Authority/CN=NodeOPCUA-CA" |
|
|
97
|
-
| `--root`, `-r` | the location of the Certificate folder | "{CWD}/certificates" |
|
|
98
|
-
| ` --CAFolder`, `-c` | the location of the Certificate Authority folder | "{root}/CA"] |
|
|
99
|
-
| `--keySize`, `-k`, `--keyLength` | the private key size in bits (1024, 2048 ,3072, 4096)| |
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
The result
|
|
103
|
-
|
|
104
|
-
```
|
|
105
|
-
└─ 📂certificates
|
|
106
|
-
└─📂PKI
|
|
107
|
-
├─📂CA Certificate Authority
|
|
108
|
-
├─📂rejected The Certificate store contains certificates that have been rejected.
|
|
109
|
-
│ ├─📂certs Contains the X.509 v3 Certificates which have been rejected.
|
|
110
|
-
├─📂trusted The Certificate store contains trusted Certificates.
|
|
111
|
-
│ ├─📂certs Contains the X.509 v3 Certificates that are trusted.
|
|
112
|
-
│ └─📂crl Contains the X.509 v3 CRLs for any Certificates in the ./certs directory.
|
|
113
|
-
├─📂issuers The Certificate store contains the CA Certificates needed for validation.
|
|
114
|
-
│ ├─📂certs Contains the X.509 v3 Certificates that are needed for validation.
|
|
115
|
-
│ ├─📂crl Contains the X.509 v3 CRLs for any Certificates in the ./certs directory.
|
|
116
|
-
```
|
|
117
|
-
|
|
118
|
-
## sign a signing request (requires a CA)
|
|
119
|
-
|
|
120
|
-
| option | description | type | default |
|
|
121
|
-
| -------------- | ------------------------------------------------ | ------------------- | ----------------------------------------------- |
|
|
122
|
-
| -i, --csr | the csr | [string] [required] | [default: "my_certificate_signing_request.csr"] |
|
|
123
|
-
| -o, --output | the name of the generated certificate | [string] [required] | [default: "my_certificate.pem"] |
|
|
124
|
-
| -v, --validity | the certificate validity in days | [number] | [default: 365] |
|
|
125
|
-
| -r, --root | the location of the Certificate folder | [string] | [default: "{CWD}/certificates"] |
|
|
126
|
-
| -c, --CAFolder | the location of the Certificate Authority folder | [string] | [default: "{root}/CA"] |
|
|
127
|
-
|
|
128
|
-
## demo command
|
|
129
|
-
|
|
130
|
-
this command creates a bunch of certificates with various characteristics for demo and testing purposes.
|
|
131
|
-
|
|
132
|
-
```
|
|
133
|
-
crypto_create_CA demo [--dev] [--silent] [--clean]
|
|
134
|
-
```
|
|
135
|
-
|
|
136
|
-
Options:
|
|
137
|
-
|
|
138
|
-
| | | |
|
|
139
|
-
| ------------ | -------------------------------------------------------------- | ------------------ |
|
|
140
|
-
| --help | display help | |
|
|
141
|
-
| --dev | create all sort of fancy certificates for dev testing purposes | |
|
|
142
|
-
| --clean | Purge existing directory [use with care!] | |
|
|
143
|
-
| --silent, -s | minimize output | |
|
|
144
|
-
| --root, -r | the location of the Certificate folder | {CWD}/certificates |
|
|
145
|
-
|
|
146
|
-
Example:
|
|
147
|
-
|
|
148
|
-
```
|
|
149
|
-
$crypto_create_CA demo --dev
|
|
150
|
-
```
|
|
151
|
-
|
|
152
|
-
##### certificate command
|
|
153
|
-
|
|
154
|
-
```
|
|
155
|
-
$crypto_create_CA certificate --help
|
|
156
|
-
```
|
|
157
|
-
|
|
158
|
-
Options:
|
|
159
|
-
|
|
160
|
-
| | | |
|
|
161
|
-
| -------------------- | ---------------------------------------------------------------------------------------------- | -------------------------------- |
|
|
162
|
-
| --help | display help | |
|
|
163
|
-
| --applicationUri, -a | the application URI | urn:{hostname}:Node-OPCUA-Server |
|
|
164
|
-
| --output, -o | the name of the generated certificate | my_certificate.pem |
|
|
165
|
-
| --selfSigned, -s | if true, the certificate will be self-signed | false |
|
|
166
|
-
| --validity, -v | the certificate validity in days | |
|
|
167
|
-
| --silent, -s | minimize output | |
|
|
168
|
-
| --root, -r | the location of the Certificate folder | {CWD}/certificates |
|
|
169
|
-
| --CAFolder, -c | the location of the Certificate Authority folder | {root}/CA |
|
|
170
|
-
| --PKIFolder, -p | the location of the Public Key Infrastructure | {root}/PKI |
|
|
171
|
-
| --privateKey, -p | optional:the private key to use to generate certificate | |
|
|
172
|
-
| --subject | the certificate subject ( for instance /C=FR/ST=Centre/L=Orleans/O=SomeOrganization/CN=Hello ) | |
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
|
|
176
|
-
###### examples
|
|
177
|
-
|
|
178
|
-
* create a self-signed certificate
|
|
179
|
-
|
|
180
|
-
```
|
|
181
|
-
npx node-opcua-pki certificate --dns=machine1.com,machine2.com --ip="192.1.2.3;192.3.4.5" -a 'urn:{hostname}:My-OPCUA-Server' --selfSigned -o my_self_signed_certificate.pem
|
|
182
|
-
```
|
|
183
|
-
|
|
184
|
-
#### References
|
|
185
|
-
|
|
186
|
-
- https://www.entrust.com/wp-content/uploads/2013/05/pathvalidation_wp.pdf
|
|
187
|
-
- https://en.wikipedia.org/wiki/Certification_path_validation_algorithm
|
|
188
|
-
- https://tools.ietf.org/html/rfc5280
|
|
189
|
-
|
|
190
|
-
#### prerequisite:
|
|
191
|
-
|
|
192
|
-
This module requires OpenSSL or LibreSSL to be installed.
|
|
193
|
-
|
|
194
|
-
On Windows, a version of OpenSSL is automatically downloaded and installed at run time, if not present. You will need an internet connection open.
|
|
195
|
-
|
|
196
|
-
You need to install it on Linux, (or in your docker image), or on macOS
|
|
197
|
-
|
|
198
|
-
- on ubuntu/Debian:
|
|
199
|
-
|
|
200
|
-
```
|
|
201
|
-
apt install openssl
|
|
202
|
-
```
|
|
203
|
-
|
|
204
|
-
or alpine:
|
|
205
|
-
|
|
206
|
-
```
|
|
207
|
-
apk add openssl
|
|
208
|
-
```
|
|
209
|
-
|
|
210
|
-
# Support
|
|
211
|
-
Sterfive provides this module free of charge, “as is,” with the hope that it will be useful to you. However, any support requests, bug fixes, or enhancements are handled exclusively through our paid services. We believe strongly that independent open-source companies should be fairly compensated for their contributions to the community.
|
|
212
|
-
|
|
213
|
-
We highly recommend subscribing to our [support program](https://support.sterfive.com) to ensure your requests are addressed and resolved. Please note that we only consider requests from members of our support program or sponsors.
|
|
214
|
-
|
|
215
|
-
|
|
216
|
-
## Getting professional support
|
|
217
|
-
|
|
218
|
-
NodeOPCUA PKI is developed and maintained by sterfive.com.
|
|
219
|
-
|
|
220
|
-
To get professional support, consider subscribing to the node-opcua membership community:
|
|
221
|
-
|
|
222
|
-
[](https://support.sterfive.com)
|
|
223
|
-
|
|
224
|
-
or contact [sterfive](https://www.sterfive.com) for dedicated consulting and more advanced support.
|
|
225
|
-
|
|
226
|
-
## :heart: Supporting the development effort - Sponsors & Backers</span>
|
|
227
|
-
|
|
228
|
-
If you like node-opcua-pki and if you are relying on it in one of your projects, please consider becoming a backer and [sponsoring us](https://github.com/sponsors/node-opcua), this will help us to maintain a high-quality stack and constant evolution of this module.
|
|
229
|
-
|
|
230
|
-
If your company would like to participate and influence the development of future versions of node-opcua please contact [sterfive](mailto:contact@sterfive.com).
|
|
1
|
+
### node-opcua-pki
|
|
2
|
+
|
|
3
|
+
[](https://www.npmtrends.com/node-opcua-pki)
|
|
4
|
+
[](https://www.npmjs.com/package/node-opcua-pki?activeTab=versions)
|
|
5
|
+
[](https://github.com/node-opcua/node-opcua-pki/actions/workflows/ci.yml)
|
|
6
|
+
[](https://coveralls.io/github/node-opcua/node-opcua-pki?branch=master)
|
|
7
|
+
[](https://packagephobia.com/result?p=node-opcua-pki)
|
|
8
|
+
[](https://app.fossa.com/projects/custom%2B20248%2Fgithub.com%2Fnode-opcua%2Fnode-opcua-pki?ref=badge_shield)
|
|
9
|
+
|
|
10
|
+
## Installation
|
|
11
|
+
|
|
12
|
+
##### install globally
|
|
13
|
+
|
|
14
|
+
```
|
|
15
|
+
$ npm install -g node-opcua-pki
|
|
16
|
+
$ crypto_create_CA --help
|
|
17
|
+
```
|
|
18
|
+
|
|
19
|
+
##### use with npx
|
|
20
|
+
|
|
21
|
+
```
|
|
22
|
+
npx node-opcua-pki --help
|
|
23
|
+
npx node-opcua-pki certificate --help
|
|
24
|
+
```
|
|
25
|
+
|
|
26
|
+
Note: see https://reference.opcfoundation.org/GDS/docs/F.1/
|
|
27
|
+
|
|
28
|
+
# commands
|
|
29
|
+
|
|
30
|
+
| command | Help |
|
|
31
|
+
| ----------- | ----------------------------------------------- |
|
|
32
|
+
| demo | create default certificate for node-opcua demos |
|
|
33
|
+
| createCA | create a Certificate Authority |
|
|
34
|
+
| createPKI | create a Public Key Infrastructure |
|
|
35
|
+
| certificate | create a new certificate |
|
|
36
|
+
| csr | create a new certificate signing request(CSR) |
|
|
37
|
+
| sign | sign a CSR and generate a certificate |
|
|
38
|
+
| revoke | revoke an existing certificate |
|
|
39
|
+
| dump | display a certificate |
|
|
40
|
+
| toder | convert a certificate to a DER format |
|
|
41
|
+
| fingerprint | print the certificate fingerprint |
|
|
42
|
+
|
|
43
|
+
Options:
|
|
44
|
+
--help display help
|
|
45
|
+
|
|
46
|
+
## create a PKI
|
|
47
|
+
|
|
48
|
+
```
|
|
49
|
+
node-opcua-pki createPKI
|
|
50
|
+
```
|
|
51
|
+
|
|
52
|
+
### Options:
|
|
53
|
+
|
|
54
|
+
| option | description | type | default |
|
|
55
|
+
| -------------------------- | -------------------------------------------------- | --------- | ------------------------------- |
|
|
56
|
+
| -r, --root | the location of the Certificate folder | [string] | [default: "{CWD}/certificates"] |
|
|
57
|
+
| --PKIFolder | the location of the Public Key Infrastructure | [string] | [default: "{root}/PKI"] |
|
|
58
|
+
| -k, --keySize, --keyLength | the private key size in bits (1024,2048,3072,4096) | [number] | [default: 2048] |
|
|
59
|
+
| -s, --silent | minimize output | [boolean] | [default: false] |
|
|
60
|
+
|
|
61
|
+
The result
|
|
62
|
+
|
|
63
|
+
```
|
|
64
|
+
└─ 📂certificates
|
|
65
|
+
└─📂PKI
|
|
66
|
+
├─📂issuers
|
|
67
|
+
│ ├─📂certs contains known Certificate Authorities' certificates
|
|
68
|
+
│ └─📂crl contains Certificate Revocation List associates with the CA Certificates
|
|
69
|
+
├─📂own
|
|
70
|
+
│ ├─📂certs where to store generated public certificates generated for the private key.
|
|
71
|
+
│ └─📂private
|
|
72
|
+
│ └─🔐private_key.pem the private key in PEM format
|
|
73
|
+
├─📂rejected contains certificates that have been rejected.
|
|
74
|
+
└─📂trusted
|
|
75
|
+
├─📂certs contains the X.509 v3 Certificates that are trusted.
|
|
76
|
+
└─📂crl contains the X.509 v3 CRLs for any Certificates in the ./certs directory.
|
|
77
|
+
```
|
|
78
|
+
|
|
79
|
+
## create a Certificate Signing Request (CSR)
|
|
80
|
+
|
|
81
|
+
Options:
|
|
82
|
+
| option | description | type | default |
|
|
83
|
+
|---------------------|-------------------------------------------------|--------|-----------------------------------------------|
|
|
84
|
+
|-a, --applicationUri |the application URI |[string]|[default: "urn:{hostname}:Node-OPCUA-Server"] |
|
|
85
|
+
|-o, --output | the name of the generated signing_request |[string]|[default: "my_certificate_signing_request.csr"]|
|
|
86
|
+
|--dns | the list of valid domain name (comma separated) |[string]|[default: "{hostname}"] |
|
|
87
|
+
|--ip | the list of valid IPs (comma separated) |[string]|[default: ""] |
|
|
88
|
+
|--subject | the certificate subject ( for instance /C=FR/ST=Centre/L=Orleans/O=SomeOrganization/CN=Hello )|[string]| [default: "/CN=Certificate"]|
|
|
89
|
+
|-r, --root | the location of the Certificate folder |[string]|[default: "{CWD}/certificates"] |
|
|
90
|
+
|--PKIFolder | the location of the Public Key Infrastructure |[string]|[default: "{root}/PKI"] |
|
|
91
|
+
|
|
92
|
+
## Create a certificate authority
|
|
93
|
+
|
|
94
|
+
| | | default value |
|
|
95
|
+
| -------------------------------- | ------------------------------------------------ | ------------------------------------------------------------------------------- |
|
|
96
|
+
| `--subject` | the CA certificate subject | "/C=FR/ST=IDF/L=Paris/O=Local NODE-OPCUA Certificate Authority/CN=NodeOPCUA-CA" |
|
|
97
|
+
| `--root`, `-r` | the location of the Certificate folder | "{CWD}/certificates" |
|
|
98
|
+
| ` --CAFolder`, `-c` | the location of the Certificate Authority folder | "{root}/CA"] |
|
|
99
|
+
| `--keySize`, `-k`, `--keyLength` | the private key size in bits (1024, 2048 ,3072, 4096)| |
|
|
100
|
+
|
|
101
|
+
|
|
102
|
+
The result
|
|
103
|
+
|
|
104
|
+
```
|
|
105
|
+
└─ 📂certificates
|
|
106
|
+
└─📂PKI
|
|
107
|
+
├─📂CA Certificate Authority
|
|
108
|
+
├─📂rejected The Certificate store contains certificates that have been rejected.
|
|
109
|
+
│ ├─📂certs Contains the X.509 v3 Certificates which have been rejected.
|
|
110
|
+
├─📂trusted The Certificate store contains trusted Certificates.
|
|
111
|
+
│ ├─📂certs Contains the X.509 v3 Certificates that are trusted.
|
|
112
|
+
│ └─📂crl Contains the X.509 v3 CRLs for any Certificates in the ./certs directory.
|
|
113
|
+
├─📂issuers The Certificate store contains the CA Certificates needed for validation.
|
|
114
|
+
│ ├─📂certs Contains the X.509 v3 Certificates that are needed for validation.
|
|
115
|
+
│ ├─📂crl Contains the X.509 v3 CRLs for any Certificates in the ./certs directory.
|
|
116
|
+
```
|
|
117
|
+
|
|
118
|
+
## sign a signing request (requires a CA)
|
|
119
|
+
|
|
120
|
+
| option | description | type | default |
|
|
121
|
+
| -------------- | ------------------------------------------------ | ------------------- | ----------------------------------------------- |
|
|
122
|
+
| -i, --csr | the csr | [string] [required] | [default: "my_certificate_signing_request.csr"] |
|
|
123
|
+
| -o, --output | the name of the generated certificate | [string] [required] | [default: "my_certificate.pem"] |
|
|
124
|
+
| -v, --validity | the certificate validity in days | [number] | [default: 365] |
|
|
125
|
+
| -r, --root | the location of the Certificate folder | [string] | [default: "{CWD}/certificates"] |
|
|
126
|
+
| -c, --CAFolder | the location of the Certificate Authority folder | [string] | [default: "{root}/CA"] |
|
|
127
|
+
|
|
128
|
+
## demo command
|
|
129
|
+
|
|
130
|
+
this command creates a bunch of certificates with various characteristics for demo and testing purposes.
|
|
131
|
+
|
|
132
|
+
```
|
|
133
|
+
crypto_create_CA demo [--dev] [--silent] [--clean]
|
|
134
|
+
```
|
|
135
|
+
|
|
136
|
+
Options:
|
|
137
|
+
|
|
138
|
+
| | | |
|
|
139
|
+
| ------------ | -------------------------------------------------------------- | ------------------ |
|
|
140
|
+
| --help | display help | |
|
|
141
|
+
| --dev | create all sort of fancy certificates for dev testing purposes | |
|
|
142
|
+
| --clean | Purge existing directory [use with care!] | |
|
|
143
|
+
| --silent, -s | minimize output | |
|
|
144
|
+
| --root, -r | the location of the Certificate folder | {CWD}/certificates |
|
|
145
|
+
|
|
146
|
+
Example:
|
|
147
|
+
|
|
148
|
+
```
|
|
149
|
+
$crypto_create_CA demo --dev
|
|
150
|
+
```
|
|
151
|
+
|
|
152
|
+
##### certificate command
|
|
153
|
+
|
|
154
|
+
```
|
|
155
|
+
$crypto_create_CA certificate --help
|
|
156
|
+
```
|
|
157
|
+
|
|
158
|
+
Options:
|
|
159
|
+
|
|
160
|
+
| | | |
|
|
161
|
+
| -------------------- | ---------------------------------------------------------------------------------------------- | -------------------------------- |
|
|
162
|
+
| --help | display help | |
|
|
163
|
+
| --applicationUri, -a | the application URI | urn:{hostname}:Node-OPCUA-Server |
|
|
164
|
+
| --output, -o | the name of the generated certificate | my_certificate.pem |
|
|
165
|
+
| --selfSigned, -s | if true, the certificate will be self-signed | false |
|
|
166
|
+
| --validity, -v | the certificate validity in days | |
|
|
167
|
+
| --silent, -s | minimize output | |
|
|
168
|
+
| --root, -r | the location of the Certificate folder | {CWD}/certificates |
|
|
169
|
+
| --CAFolder, -c | the location of the Certificate Authority folder | {root}/CA |
|
|
170
|
+
| --PKIFolder, -p | the location of the Public Key Infrastructure | {root}/PKI |
|
|
171
|
+
| --privateKey, -p | optional:the private key to use to generate certificate | |
|
|
172
|
+
| --subject | the certificate subject ( for instance /C=FR/ST=Centre/L=Orleans/O=SomeOrganization/CN=Hello ) | |
|
|
173
|
+
|
|
174
|
+
|
|
175
|
+
|
|
176
|
+
###### examples
|
|
177
|
+
|
|
178
|
+
* create a self-signed certificate
|
|
179
|
+
|
|
180
|
+
```
|
|
181
|
+
npx node-opcua-pki certificate --dns=machine1.com,machine2.com --ip="192.1.2.3;192.3.4.5" -a 'urn:{hostname}:My-OPCUA-Server' --selfSigned -o my_self_signed_certificate.pem
|
|
182
|
+
```
|
|
183
|
+
|
|
184
|
+
#### References
|
|
185
|
+
|
|
186
|
+
- https://www.entrust.com/wp-content/uploads/2013/05/pathvalidation_wp.pdf
|
|
187
|
+
- https://en.wikipedia.org/wiki/Certification_path_validation_algorithm
|
|
188
|
+
- https://tools.ietf.org/html/rfc5280
|
|
189
|
+
|
|
190
|
+
#### prerequisite:
|
|
191
|
+
|
|
192
|
+
This module requires OpenSSL or LibreSSL to be installed.
|
|
193
|
+
|
|
194
|
+
On Windows, a version of OpenSSL is automatically downloaded and installed at run time, if not present. You will need an internet connection open.
|
|
195
|
+
|
|
196
|
+
You need to install it on Linux, (or in your docker image), or on macOS
|
|
197
|
+
|
|
198
|
+
- on ubuntu/Debian:
|
|
199
|
+
|
|
200
|
+
```
|
|
201
|
+
apt install openssl
|
|
202
|
+
```
|
|
203
|
+
|
|
204
|
+
or alpine:
|
|
205
|
+
|
|
206
|
+
```
|
|
207
|
+
apk add openssl
|
|
208
|
+
```
|
|
209
|
+
|
|
210
|
+
# Support
|
|
211
|
+
Sterfive provides this module free of charge, “as is,” with the hope that it will be useful to you. However, any support requests, bug fixes, or enhancements are handled exclusively through our paid services. We believe strongly that independent open-source companies should be fairly compensated for their contributions to the community.
|
|
212
|
+
|
|
213
|
+
We highly recommend subscribing to our [support program](https://support.sterfive.com) to ensure your requests are addressed and resolved. Please note that we only consider requests from members of our support program or sponsors.
|
|
214
|
+
|
|
215
|
+
|
|
216
|
+
## Getting professional support
|
|
217
|
+
|
|
218
|
+
NodeOPCUA PKI is developed and maintained by sterfive.com.
|
|
219
|
+
|
|
220
|
+
To get professional support, consider subscribing to the node-opcua membership community:
|
|
221
|
+
|
|
222
|
+
[](https://support.sterfive.com)
|
|
223
|
+
|
|
224
|
+
or contact [sterfive](https://www.sterfive.com) for dedicated consulting and more advanced support.
|
|
225
|
+
|
|
226
|
+
## :heart: Supporting the development effort - Sponsors & Backers</span>
|
|
227
|
+
|
|
228
|
+
If you like node-opcua-pki and if you are relying on it in one of your projects, please consider becoming a backer and [sponsoring us](https://github.com/sponsors/node-opcua), this will help us to maintain a high-quality stack and constant evolution of this module.
|
|
229
|
+
|
|
230
|
+
If your company would like to participate and influence the development of future versions of node-opcua please contact [sterfive](mailto:contact@sterfive.com).
|
|
File without changes
|