node-opcua-pki 6.10.0 → 6.10.2

package/dist/bin/pki.mjs

@@ -2391,9 +2391,14 @@ keyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, d
 extendedKeyUsage          = critical,serverAuth ,clientAuth
 subjectAltName            = $ENV::ALTNAME
 nsComment                 = "CA Generated by Node-OPCUA Certificate utility using openssl"
+[ v3_ca_req ]
+subjectKeyIdentifier      = hash
+basicConstraints          = CA:TRUE
+keyUsage                  = critical, cRLSign, keyCertSign
+nsComment                 = "CA CSR generated by Node-OPCUA Certificate utility using openssl"
 [ v3_ca ]
 subjectKeyIdentifier      = hash
-authorityKeyIdentifier    = keyid
+authorityKeyIdentifier    = keyid:always,issuer:always
 basicConstraints          = CA:TRUE
 keyUsage                  = critical, cRLSign, keyCertSign
 nsComment                 = "CA Certificate generated by Node-OPCUA Certificate utility using openssl"
@@ -2465,10 +2470,20 @@ async function construct_CertificateAuthority(certificateAuthority) {
     }
   }
   await construct_default_files();
-  if (fs9.existsSync(path6.join(caRootDir, "private/cakey.pem")) && !config3.forceCA) {
-    debugLog("CA private key already exists ... skipping");
+  const caKeyExists = fs9.existsSync(path6.join(caRootDir, "private/cakey.pem"));
+  const caCertExists = fs9.existsSync(path6.join(caRootDir, "public/cacert.pem"));
+  if (caKeyExists && caCertExists && !config3.forceCA) {
+    debugLog("CA private key and certificate already exist ... skipping");
     return;
   }
+  if (caKeyExists && !caCertExists) {
+    debugLog("CA private key exists but cacert.pem is missing \u2014 rebuilding CA");
+    fs9.unlinkSync(path6.join(caRootDir, "private/cakey.pem"));
+    const staleCsr = path6.join(caRootDir, "private/cakey.csr");
+    if (fs9.existsSync(staleCsr)) {
+      fs9.unlinkSync(staleCsr);
+    }
+  }
   displayTitle("Create Certificate Authority (CA)");
   const indexFileAttr = path6.join(caRootDir, "index.txt.attr");
   if (!fs9.existsSync(indexFileAttr)) {
@@ -2492,7 +2507,7 @@ async function construct_CertificateAuthority(certificateAuthority) {
   await generatePrivateKeyFile2(privateKeyFilename, keySize);
   displayTitle("Generate a certificate request for the CA key");
   await execute_openssl(
-    "req -new -sha256  -text  -extensions v3_ca" + configOption + " -key " + q3(n4(privateKeyFilename)) + " -out " + q3(n4(csrFilename)) + " " + subjectOpt,
+    "req -new -sha256  -text  -extensions v3_ca_req" + configOption + " -key " + q3(n4(privateKeyFilename)) + " -out " + q3(n4(csrFilename)) + " " + subjectOpt,
     options
   );
   displayTitle("Generate CA Certificate (self-signed)");