node-opcua-pki 5.5.0 → 5.7.0

package/bin/crypto_create_CA.cjs

@@ -1,35 +1,35 @@
-#!/usr/bin/env node
-/* eslint-disable @typescript-eslint/no-var-requires */
-// ---------------------------------------------------------------------------------------------------------------------
-// node-opcua-pki
-// ---------------------------------------------------------------------------------------------------------------------
-// Copyright (c) 2014-2020 - Etienne Rossignon - etienne.rossignon (at) gadz.org
-// ---------------------------------------------------------------------------------------------------------------------
-//
-// This  project is licensed under the terms of the MIT license.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
-// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
-// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
-// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
-//
-// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
-// Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
-// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
-// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-// ---------------------------------------------------------------------------------------------------------------------
-"use strict";
-
-// note: we remove use of update-notifier as it is  ESM now and 
-//       old version have reported vulnerabilities
-//xx const updateNotifier = require("update-notifier");
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-const _pkg = require("../package.json");
-
-// eslint-disable-next-line no-undef
-const { main } = require("../dist/lib/ca/crypto_create_CA.js");
-
-main(process.argv.splice(2));
+#!/usr/bin/env node
+/* eslint-disable @typescript-eslint/no-var-requires */
+// ---------------------------------------------------------------------------------------------------------------------
+// node-opcua-pki
+// ---------------------------------------------------------------------------------------------------------------------
+// Copyright (c) 2014-2020 - Etienne Rossignon - etienne.rossignon (at) gadz.org
+// ---------------------------------------------------------------------------------------------------------------------
+//
+// This  project is licensed under the terms of the MIT license.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+// ---------------------------------------------------------------------------------------------------------------------
+"use strict";
+
+// note: we remove use of update-notifier as it is  ESM now and 
+//       old version have reported vulnerabilities
+//xx const updateNotifier = require("update-notifier");
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+const _pkg = require("../package.json");
+
+// eslint-disable-next-line no-undef
+const { main } = require("../dist/lib/ca/crypto_create_CA.js");
+
+main(process.argv.splice(2));

package/dist/test/helpers.d.ts

@@ -0,0 +1,6 @@
+export declare function grep(data: string, regExp: RegExp): string;
+interface TestData {
+    tmpFolder: string;
+}
+export declare function beforeTest(self: Mocha.Suite, nextFunction?: () => Promise<void>): TestData;
+export {};

package/dist/test/helpers.js

@@ -0,0 +1,60 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.grep = grep;
+exports.beforeTest = beforeTest;
+const path_1 = __importDefault(require("path"));
+const rimraf_1 = __importDefault(require("rimraf"));
+const index_1 = require("../lib/index");
+const tmpFolder = path_1.default.join(__dirname, "../tmp");
+index_1.g_config.silent = !process.env.VERBOSE;
+function grep(data, regExp) {
+    return data
+        .split("\n")
+        .filter((l) => l.match(regExp))
+        .join("\n");
+}
+let doneOnce = false;
+function beforeTest(self, nextFunction) {
+    self.timeout("5 minutes");
+    const testData = {
+        tmpFolder,
+    };
+    before(() => __awaiter(this, void 0, void 0, function* () {
+        if (process.env.PKITEST === "NOCLEAN") {
+            doneOnce = true;
+        }
+        // tslint:disable-next-line: no-console
+        function next() {
+            return __awaiter(this, void 0, void 0, function* () {
+                if (nextFunction) {
+                    yield nextFunction();
+                }
+            });
+        }
+        testData.tmpFolder = tmpFolder;
+        if (!doneOnce) {
+            doneOnce = true;
+            // tslint:disable-next-line: no-console
+            (0, index_1.warningLog)("    .... cleaning temporary folders ...", tmpFolder);
+            yield (0, rimraf_1.default)(tmpFolder);
+            (0, index_1.warningLog)("    .....  folder cleaned");
+            (0, index_1.mkdirRecursiveSync)(tmpFolder);
+            (0, index_1.warningLog)("    .....  creating empty folder", tmpFolder);
+        }
+        yield next();
+    }));
+    return testData;
+}
+//# sourceMappingURL=helpers.js.map

package/dist/test/test_advanced_certificate_validation.d.ts

@@ -0,0 +1 @@
+import "should";

package/dist/test/test_advanced_certificate_validation.js

@@ -0,0 +1,95 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+const sinon_1 = __importDefault(require("sinon"));
+require("should");
+const lib_1 = require("../lib");
+const helpers_1 = require("./helpers");
+const node_opcua_crypto_1 = require("node-opcua-crypto");
+describe("Check Validate Certificate", function () {
+    const testData = (0, helpers_1.beforeTest)(this);
+    let clock;
+    before(() => {
+        clock = sinon_1.default.useFakeTimers({
+            shouldAdvanceTime: true,
+            now: new Date(2020, 1, 12).getTime(),
+        });
+    });
+    after(() => {
+        clock.restore();
+    });
+    it("should verifyCertificateAsync", () => __awaiter(this, void 0, void 0, function* () {
+        const options = {
+            location: path_1.default.join(testData.tmpFolder, "PKI"),
+        };
+        const certificateManager = new lib_1.CertificateManager(options);
+        yield certificateManager.initialize();
+        const caCertificateFilename = path_1.default.join(__dirname, "fixtures/CTT_sample_certificates/CA/certs/ctt_ca1I.der");
+        const crlFilename = path_1.default.join(__dirname, "fixtures/CTT_sample_certificates/CA/crl/ctt_ca1I.crl");
+        const cert1Filename = path_1.default.join(__dirname, "fixtures/CTT_sample_certificates/CA/certs/ctt_ca1I_appT.der");
+        const cert2Filename = path_1.default.join(__dirname, "fixtures/CTT_sample_certificates/CA/certs/ctt_ca1I_appTR.der");
+        // installing the CA certificate
+        const caCert = (0, node_opcua_crypto_1.readCertificate)(caCertificateFilename);
+        let caCertStatus = yield certificateManager.verifyCertificate(caCert);
+        caCertStatus.should.eql("BadCertificateUntrusted");
+        // installing the 1st cer
+        const cert1 = fs_1.default.readFileSync(cert1Filename);
+        const cert2 = fs_1.default.readFileSync(cert2Filename);
+        yield certificateManager.trustCertificate(cert1);
+        yield certificateManager.trustCertificate(cert2);
+        {
+            const cert1Status = yield certificateManager.verifyCertificate(cert1);
+            // should be -BadCertificateChainIncomplete because the issuer cert is not in the issuer list
+            cert1Status.should.eql("BadCertificateChainIncomplete");
+        }
+        // installing the 2nd cert
+        {
+            const cert2Status = yield certificateManager.verifyCertificate(cert2);
+            // should be -BadCertificateChainIncomplete because the issuer cert is not in the issuer list
+            cert2Status.should.eql("BadCertificateChainIncomplete");
+        }
+        // now move the caCert to the issue list
+        const status = yield certificateManager.addIssuer(caCert, true);
+        status.should.eql("Good");
+        caCertStatus = yield certificateManager.verifyCertificate(caCert);
+        caCertStatus.should.eql("BadCertificateUntrusted");
+        {
+            const cert1Status = yield certificateManager.verifyCertificate(cert1);
+            cert1Status.should.eql("BadCertificateRevocationUnknown");
+            const cert1Status1 = yield certificateManager.verifyCertificate(cert1, {});
+            cert1Status1.should.eql("BadCertificateRevocationUnknown");
+            const cert1Status2 = yield certificateManager.verifyCertificate(cert1, { ignoreMissingRevocationList: true });
+            cert1Status2.should.eql("Good");
+        }
+        //
+        {
+            const certEStatus = yield certificateManager.verifyCertificate(cert2);
+            certEStatus.should.eql("BadCertificateRevocationUnknown");
+        }
+        // now move the crl to the crl list
+        const crl = fs_1.default.readFileSync(crlFilename);
+        yield certificateManager.addRevocationList(crl);
+        {
+            const cert1Status = yield certificateManager.verifyCertificate(cert1);
+            cert1Status.should.eql("Good");
+        }
+        {
+            const cert2Status = yield certificateManager.verifyCertificate(cert2);
+            cert2Status.should.eql("BadCertificateRevoked");
+        }
+    }));
+});
+//# sourceMappingURL=test_advanced_certificate_validation.js.map

package/dist/test/test_certificate_authority.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/test_certificate_authority.js

@@ -0,0 +1,261 @@
+"use strict";
+// tslint:disable:no-console
+// tslint:disable:no-shadowed-variable
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const node_opcua_crypto_1 = require("node-opcua-crypto");
+const index_1 = require("../lib/index");
+const with_openssl_1 = require("../lib/toolbox/with_openssl");
+const certificate_authority_1 = require("../lib/ca/certificate_authority");
+const helpers_1 = require("./helpers");
+const doDebug = !!process.env.DEBUG;
+describe("Certificate Authority", function () {
+    const testData = (0, helpers_1.beforeTest)(this);
+    let options = {};
+    before(() => {
+        options = {
+            keySize: 2048,
+            location: path_1.default.join(testData.tmpFolder, "CA"),
+        };
+    });
+    it("should read openssl version", () => __awaiter(this, void 0, void 0, function* () {
+        let output = yield (0, with_openssl_1.execute_openssl)("version", { cwd: "." });
+        output = output.trim();
+        index_1.g_config.opensslVersion.should.eql(output);
+    }));
+    it("should create a CertificateAuthority", () => __awaiter(this, void 0, void 0, function* () {
+        const ca = new certificate_authority_1.CertificateAuthority(options);
+        yield ca.initialize();
+    }));
+});
+describe("Signing Certificate with Certificate Authority", function () {
+    const testData = (0, helpers_1.beforeTest)(this);
+    let theCertificateAuthority;
+    let someCertificateManager;
+    before(() => __awaiter(this, void 0, void 0, function* () {
+        theCertificateAuthority = new certificate_authority_1.CertificateAuthority({
+            keySize: 2048,
+            location: path_1.default.join(testData.tmpFolder, "CA"),
+        });
+        someCertificateManager = new index_1.CertificateManager({
+            location: path_1.default.join(testData.tmpFolder, "PI"),
+        });
+        yield someCertificateManager.initialize();
+        yield theCertificateAuthority.initialize();
+        yield someCertificateManager.dispose();
+    }));
+    function createCertificateRequest() {
+        return __awaiter(this, void 0, void 0, function* () {
+            // let create a certificate request from the certificate manager
+            const params = {
+                applicationUri: "MY:APPLICATION:URI",
+                dns: ["localhost", "my.domain.com"],
+                ip: ["192.123.145.121"],
+                subject: "/CN=MyCommonName",
+                // can only be TODAY due to openssl limitation : startDate: new Date(2010,2,2),
+                validity: 365 * 7,
+            };
+            const certificateSigningRequestFilename = yield someCertificateManager.createCertificateRequest(params);
+            return certificateSigningRequestFilename;
+        });
+    }
+    function verifyCertificateAgainstPrivateKey(certificate) {
+        return __awaiter(this, void 0, void 0, function* () {
+            console.log("someCertificateManager.privateKey=", someCertificateManager.privateKey);
+            const privateKey = (0, node_opcua_crypto_1.readPrivateKey)(someCertificateManager.privateKey);
+            const rsaLength = (0, node_opcua_crypto_1.rsaLengthPrivateKey)(privateKey);
+            if (!(0, node_opcua_crypto_1.certificateMatchesPrivateKey)(certificate, privateKey)) {
+                throw new Error("Certificate and private key do not match !!!");
+            }
+        });
+    }
+    it("T0 - should have a CA Certificate", () => __awaiter(this, void 0, void 0, function* () {
+        fs_1.default.existsSync(theCertificateAuthority.caCertificate).should.eql(true);
+    }));
+    it("T1 - should have a CA Certificate with a CRL", () => __awaiter(this, void 0, void 0, function* () {
+        yield theCertificateAuthority.constructCACertificateWithCRL();
+        fs_1.default.existsSync(theCertificateAuthority.caCertificateWithCrl).should.eql(true);
+    }));
+    it("T2 - should sign a Certificate Request", () => __awaiter(this, void 0, void 0, function* () {
+        const self = {
+            certificateRequest: "",
+        };
+        // create a Certificate Signing Request
+        self.certificateRequest = yield createCertificateRequest();
+        fs_1.default.existsSync(self.certificateRequest).should.eql(true);
+        const certificateFilename = path_1.default.join(testData.tmpFolder, "sample_certificate.pem");
+        const params = {
+            applicationUri: "BAD SHOULD BE IN REQUEST",
+            startDate: new Date(2011, 25, 12),
+            validity: 10 * 365,
+        };
+        yield theCertificateAuthority.signCertificateRequest(certificateFilename, self.certificateRequest, params);
+        fs_1.default.existsSync(certificateFilename).should.eql(true, "certificate file " + certificateFilename + " must exist");
+        // Serial Number: 4096 (0x1000)
+        const certificateChain = (0, node_opcua_crypto_1.readCertificate)(certificateFilename);
+        const elements = (0, node_opcua_crypto_1.split_der)(certificateChain);
+        elements.length.should.eql(2);
+        // should have 2 x -----BEGIN CERTIFICATE----- in the chain
+        // should verify that certificate is valid
+        // verify the subject Alternative Name
+        const csr = (0, node_opcua_crypto_1.readCertificate)(self.certificateRequest);
+        const infoCSR = (0, node_opcua_crypto_1.exploreCertificateSigningRequest)(csr);
+        const info = (0, node_opcua_crypto_1.exploreCertificate)(certificateChain);
+        if (doDebug) {
+            console.log(infoCSR.extensionRequest.basicConstraints);
+            console.log(info.tbsCertificate.extensions.basicConstraints);
+            console.log(infoCSR.extensionRequest.keyUsage);
+            console.log(info.tbsCertificate.extensions.keyUsage);
+            console.log(infoCSR.extensionRequest.subjectAltName);
+            console.log(info.tbsCertificate.extensions.subjectAltName);
+        }
+        infoCSR.extensionRequest.subjectAltName.should.eql(info.tbsCertificate.extensions.subjectAltName);
+        // todo
+        yield verifyCertificateAgainstPrivateKey(elements[0]);
+    }));
+    function sign(certificateRequest, startDate, validity) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const a = (0, with_openssl_1.x509Date)(startDate) + "_" + validity;
+            fs_1.default.existsSync(certificateRequest).should.eql(true, "certificate request " + certificateRequest + " must exist");
+            const certificateFilename = path_1.default.join(testData.tmpFolder, "sample_certificate" + a + ".pem");
+            const params = {
+                applicationUri: "BAD SHOULD BE IN REQUEST",
+                startDate,
+                validity,
+            };
+            if (fs_1.default.existsSync(certificateFilename)) {
+                fs_1.default.unlinkSync(certificateFilename);
+            }
+            const certificate = yield theCertificateAuthority.signCertificateRequest(certificateFilename, certificateRequest, params);
+            fs_1.default.existsSync(certificate).should.eql(true, "certificate: " + certificateFilename + " should exists");
+            // Serial Number: 4096 (0x1000)
+            // should have 2 x -----BEGIN CERTIFICATE----- in the chain
+            return certificate;
+        });
+    }
+    const now = new Date();
+    const lastYear = new Date();
+    lastYear.setFullYear(now.getFullYear() - 1);
+    const nextYear = new Date();
+    nextYear.setFullYear(now.getFullYear() + 1);
+    it("T3 - should create various Certificates signed by the CA authority", () => __awaiter(this, void 0, void 0, function* () {
+        // create a Certificate Signing Request
+        const certificateRequest = yield createCertificateRequest();
+        fs_1.default.existsSync(certificateRequest).should.eql(true, "certificate request " + certificateRequest + " must exist");
+        yield sign(certificateRequest, lastYear, 200);
+        yield sign(certificateRequest, lastYear, 10 * 365); // valid
+        yield sign(certificateRequest, nextYear, 365); // not started yet
+    }));
+    it("T4 - should create various self-signed Certificates using the CA", () => __awaiter(this, void 0, void 0, function* () {
+        // using a CA to construct self-signed certificates provides the following benefits:
+        //    - startDate can be easily specified in the past or the future
+        //    - certificate can be revoked ??? to be checked.
+        const privateKey = someCertificateManager.privateKey;
+        const certificate = path_1.default.join(testData.tmpFolder, "sample_self_signed_certificate.pem");
+        fs_1.default.existsSync(certificate).should.eql(false, certificate + " must not exist");
+        yield theCertificateAuthority.createSelfSignedCertificate(certificate, privateKey, {
+            applicationUri: "SomeUri",
+        });
+        fs_1.default.existsSync(certificate).should.eql(true);
+        yield verifyCertificateAgainstPrivateKey((0, node_opcua_crypto_1.readCertificate)(certificate));
+    }));
+    /**
+     *
+     * @param certificate  {String} certificate to create
+     */
+    function createSelfSignedCertificate(certificate, privateKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const startDate = new Date();
+            const validity = 1000;
+            const params = {
+                applicationUri: "BAD SHOULD BE IN REQUEST",
+                startDate,
+                validity,
+            };
+            yield theCertificateAuthority.createSelfSignedCertificate(certificate, privateKey, params);
+            // console.log("signed_certificate = signed_certificate", certificate);
+            return certificate;
+        });
+    }
+    it("T5 - should revoke a self-signed certificate", () => __awaiter(this, void 0, void 0, function* () {
+        const privateKey = someCertificateManager.privateKey;
+        const certificate = path_1.default.join(testData.tmpFolder, "certificate_to_be_revoked1.pem");
+        yield createSelfSignedCertificate(certificate, privateKey);
+        fs_1.default.existsSync(certificate).should.eql(true);
+        yield theCertificateAuthority.revokeCertificate(certificate, {});
+    }));
+    function createCertificateFromCA() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const certificateRequest = yield createCertificateRequest();
+            const signedCertificate = yield sign(certificateRequest, lastYear, 10 * 365 + 10);
+            return signedCertificate;
+        });
+    }
+    it("T6 - should revoke a certificate emitted by the CA", () => __awaiter(this, void 0, void 0, function* () {
+        // g_config.silent = false;
+        const caCertificateFilename = theCertificateAuthority.caCertificate;
+        const caCRLFilename = theCertificateAuthority.revocationList;
+        const caCertificate = yield (0, node_opcua_crypto_1.readCertificate)(caCertificateFilename);
+        const caCRLBefore = yield (0, node_opcua_crypto_1.readCertificateRevocationList)(caCRLFilename);
+        const certificateFilename = yield createCertificateFromCA();
+        fs_1.default.existsSync(certificateFilename).should.eql(true);
+        const certificate = yield (0, node_opcua_crypto_1.readCertificate)(certificateFilename);
+        // ---- lets create a
+        const pkiLocation = path_1.default.join(testData.tmpFolder, "somePKI");
+        const cm = new index_1.CertificateManager({
+            location: pkiLocation,
+        });
+        yield cm.initialize();
+        const status1 = yield cm.addIssuer(caCertificate, true, true);
+        status1.should.eql(index_1.VerificationStatus.Good);
+        const status4 = yield cm.addRevocationList(caCRLBefore);
+        status4.should.eql(index_1.VerificationStatus.Good);
+        // check status before revocation...
+        const validate1 = yield cm.verifyCertificate(certificate);
+        validate1.should.eql(index_1.VerificationStatus.Good);
+        // now revoke certificate
+        yield theCertificateAuthority.revokeCertificate(certificateFilename, {});
+        const caCRLAfter = yield (0, node_opcua_crypto_1.readCertificateRevocationList)(caCRLFilename);
+        const status3 = yield cm.addRevocationList(caCRLAfter);
+        status3.should.eql(index_1.VerificationStatus.Good);
+        const validate2 = yield cm.verifyCertificate(certificate);
+        validate2.should.eql(index_1.VerificationStatus.BadCertificateRevoked);
+        yield cm.dispose();
+    }));
+    it("T7 - it should automatically accept Certificate issued by a trusted issuer that is not in the CRL", () => __awaiter(this, void 0, void 0, function* () {
+        const caCertificateFilename = theCertificateAuthority.caCertificate;
+        const caCRLFilename = theCertificateAuthority.revocationList;
+        const caCertificate = yield (0, node_opcua_crypto_1.readCertificate)(caCertificateFilename);
+        const caCRLBefore = yield (0, node_opcua_crypto_1.readCertificateRevocationList)(caCRLFilename);
+        const certificateFilename = yield createCertificateFromCA();
+        fs_1.default.existsSync(certificateFilename).should.eql(true);
+        const certificate = yield (0, node_opcua_crypto_1.readCertificate)(certificateFilename);
+        // ---- lets create a
+        const pkiLocation = path_1.default.join(testData.tmpFolder, "somePKI1");
+        const cm = new index_1.CertificateManager({
+            location: pkiLocation,
+        });
+        yield cm.initialize();
+        const validate0 = yield cm.verifyCertificate(certificate);
+        validate0.should.eql(index_1.VerificationStatus.BadCertificateChainIncomplete);
+        const status1 = yield cm.addIssuer(caCertificate);
+        const status2 = yield cm.addRevocationList(caCRLBefore);
+        const validate1 = yield cm.verifyCertificate(certificate);
+        validate1.should.eql(index_1.VerificationStatus.BadCertificateUntrusted);
+        yield cm.dispose();
+    }));
+});
+//# sourceMappingURL=test_certificate_authority.js.map

package/dist/test/test_certificate_manager.d.ts

@@ -0,0 +1 @@
+import "should";