node-opcua-pki 6.10.0 → 6.10.2

package/dist/index.js

@@ -753,9 +753,14 @@ keyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, d
 extendedKeyUsage          = critical,serverAuth ,clientAuth
 subjectAltName            = $ENV::ALTNAME
 nsComment                 = "CA Generated by Node-OPCUA Certificate utility using openssl"
+[ v3_ca_req ]
+subjectKeyIdentifier      = hash
+basicConstraints          = CA:TRUE
+keyUsage                  = critical, cRLSign, keyCertSign
+nsComment                 = "CA CSR generated by Node-OPCUA Certificate utility using openssl"
 [ v3_ca ]
 subjectKeyIdentifier      = hash
-authorityKeyIdentifier    = keyid
+authorityKeyIdentifier    = keyid:always,issuer:always
 basicConstraints          = CA:TRUE
 keyUsage                  = critical, cRLSign, keyCertSign
 nsComment                 = "CA Certificate generated by Node-OPCUA Certificate utility using openssl"
@@ -820,10 +825,20 @@ async function construct_CertificateAuthority(certificateAuthority) {
     }
   }
   await construct_default_files();
-  if (import_node_fs6.default.existsSync(import_node_path5.default.join(caRootDir, "private/cakey.pem")) && !config2.forceCA) {
-    debugLog("CA private key already exists ... skipping");
+  const caKeyExists = import_node_fs6.default.existsSync(import_node_path5.default.join(caRootDir, "private/cakey.pem"));
+  const caCertExists = import_node_fs6.default.existsSync(import_node_path5.default.join(caRootDir, "public/cacert.pem"));
+  if (caKeyExists && caCertExists && !config2.forceCA) {
+    debugLog("CA private key and certificate already exist ... skipping");
     return;
   }
+  if (caKeyExists && !caCertExists) {
+    debugLog("CA private key exists but cacert.pem is missing \u2014 rebuilding CA");
+    import_node_fs6.default.unlinkSync(import_node_path5.default.join(caRootDir, "private/cakey.pem"));
+    const staleCsr = import_node_path5.default.join(caRootDir, "private/cakey.csr");
+    if (import_node_fs6.default.existsSync(staleCsr)) {
+      import_node_fs6.default.unlinkSync(staleCsr);
+    }
+  }
   displayTitle("Create Certificate Authority (CA)");
   const indexFileAttr = import_node_path5.default.join(caRootDir, "index.txt.attr");
   if (!import_node_fs6.default.existsSync(indexFileAttr)) {
@@ -847,7 +862,7 @@ async function construct_CertificateAuthority(certificateAuthority) {
   await (0, import_node_opcua_crypto2.generatePrivateKeyFile)(privateKeyFilename, keySize);
   displayTitle("Generate a certificate request for the CA key");
   await execute_openssl(
-    "req -new -sha256  -text  -extensions v3_ca" + configOption + " -key " + q(n2(privateKeyFilename)) + " -out " + q(n2(csrFilename)) + " " + subjectOpt,
+    "req -new -sha256  -text  -extensions v3_ca_req" + configOption + " -key " + q(n2(privateKeyFilename)) + " -out " + q(n2(csrFilename)) + " " + subjectOpt,
     options
   );
   displayTitle("Generate CA Certificate (self-signed)");