node-opcua-pki 6.10.1 → 6.11.0

package/dist/bin/pki.mjs

@@ -1070,7 +1070,8 @@ var init_certificate_manager = __esm({
               index.set(key, { crls: [], serialNumbers: {} });
             }
             const pemCertificate = toPem(crl, "X509 CRL");
-            const filename = path2.join(folder, `crl_${buildIdealCertificateName(crl)}.pem`);
+            const sanitizedKey = key.replace(/:/g, "");
+            const filename = path2.join(folder, `crl_[${sanitizedKey}].pem`);
             await fs4.promises.writeFile(filename, pemCertificate, "ascii");
             await this.#onCrlFileAdded(index, filename);
             await this.#waitAndCheckCRLProcessingStatus();
@@ -2285,6 +2286,39 @@ var init_with_openssl = __esm({
   }
 });
 
+// packages/node-opcua-pki/lib/pki/toolbox_pfx.ts
+import assert9 from "assert";
+import fs9 from "fs";
+async function createPFX(options) {
+  const { certificateFile, privateKeyFile, outputFile, passphrase = "", caCertificateFiles } = options;
+  assert9(fs9.existsSync(certificateFile), `Certificate file does not exist: ${certificateFile}`);
+  assert9(fs9.existsSync(privateKeyFile), `Private key file does not exist: ${privateKeyFile}`);
+  let cmd = `pkcs12 -export`;
+  cmd += ` -in ${q3(n4(certificateFile))}`;
+  cmd += ` -inkey ${q3(n4(privateKeyFile))}`;
+  if (caCertificateFiles) {
+    for (const caFile of caCertificateFiles) {
+      assert9(fs9.existsSync(caFile), `CA certificate file does not exist: ${caFile}`);
+      cmd += ` -certfile ${q3(n4(caFile))}`;
+    }
+  }
+  cmd += ` -out ${q3(n4(outputFile))}`;
+  cmd += ` -passout pass:${passphrase}`;
+  await execute_openssl(cmd, {});
+}
+var q3, n4;
+var init_toolbox_pfx = __esm({
+  "packages/node-opcua-pki/lib/pki/toolbox_pfx.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_common();
+    init_common2();
+    init_execute_openssl();
+    q3 = quote;
+    n4 = makePath;
+  }
+});
+
 // packages/node-opcua-pki/lib/ca/templates/ca_config_template.cnf.ts
 var config2, ca_config_template_cnf_default;
 var init_ca_config_template_cnf = __esm({
@@ -2425,18 +2459,21 @@ authorityKeyIdentifier    = keyid:always,issuer:always
 });
 
 // packages/node-opcua-pki/lib/ca/certificate_authority.ts
-import assert9 from "assert";
-import fs9 from "fs";
+import assert10 from "assert";
+import fs10 from "fs";
 import os4 from "os";
 import path6 from "path";
 import chalk6 from "chalk";
 import {
+  CertificatePurpose as CertificatePurpose2,
+  certificateMatchesPrivateKey,
   convertPEMtoDER,
   exploreCertificate as exploreCertificate2,
   exploreCertificateSigningRequest,
   generatePrivateKeyFile as generatePrivateKeyFile2,
   readCertificatePEM,
   readCertificateSigningRequest,
+  readPrivateKey,
   Subject as Subject4,
   toPem as toPem2
 } from "node-opcua-crypto";
@@ -2457,39 +2494,49 @@ async function construct_CertificateAuthority(certificateAuthority) {
   await make_folders();
   async function construct_default_files() {
     const serial = path6.join(caRootDir, "serial");
-    if (!fs9.existsSync(serial)) {
-      await fs9.promises.writeFile(serial, "1000");
+    if (!fs10.existsSync(serial)) {
+      await fs10.promises.writeFile(serial, "1000");
     }
     const crlNumber = path6.join(caRootDir, "crlnumber");
-    if (!fs9.existsSync(crlNumber)) {
-      await fs9.promises.writeFile(crlNumber, "1000");
+    if (!fs10.existsSync(crlNumber)) {
+      await fs10.promises.writeFile(crlNumber, "1000");
     }
     const indexFile = path6.join(caRootDir, "index.txt");
-    if (!fs9.existsSync(indexFile)) {
-      await fs9.promises.writeFile(indexFile, "");
+    if (!fs10.existsSync(indexFile)) {
+      await fs10.promises.writeFile(indexFile, "");
     }
   }
   await construct_default_files();
-  if (fs9.existsSync(path6.join(caRootDir, "private/cakey.pem")) && !config3.forceCA) {
-    debugLog("CA private key already exists ... skipping");
+  const caKeyExists = fs10.existsSync(path6.join(caRootDir, "private/cakey.pem"));
+  const caCertExists = fs10.existsSync(path6.join(caRootDir, "public/cacert.pem"));
+  if (caKeyExists && caCertExists && !config3.forceCA) {
+    debugLog("CA private key and certificate already exist ... skipping");
     return;
   }
+  if (caKeyExists && !caCertExists) {
+    debugLog("CA private key exists but cacert.pem is missing \u2014 rebuilding CA");
+    fs10.unlinkSync(path6.join(caRootDir, "private/cakey.pem"));
+    const staleCsr = path6.join(caRootDir, "private/cakey.csr");
+    if (fs10.existsSync(staleCsr)) {
+      fs10.unlinkSync(staleCsr);
+    }
+  }
   displayTitle("Create Certificate Authority (CA)");
   const indexFileAttr = path6.join(caRootDir, "index.txt.attr");
-  if (!fs9.existsSync(indexFileAttr)) {
-    await fs9.promises.writeFile(indexFileAttr, "unique_subject = no");
+  if (!fs10.existsSync(indexFileAttr)) {
+    await fs10.promises.writeFile(indexFileAttr, "unique_subject = no");
   }
   const caConfigFile = certificateAuthority.configFile;
   if (1) {
     let data = configurationFileTemplate;
     data = makePath(data.replace(/%%ROOT_FOLDER%%/, caRootDir));
-    await fs9.promises.writeFile(caConfigFile, data);
+    await fs10.promises.writeFile(caConfigFile, data);
   }
   const subjectOpt = ` -subj "${subject.toString()}" `;
   processAltNames({});
   const options = { cwd: caRootDir };
   const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-  const configOption = ` -config ${q3(n4(configFile))}`;
+  const configOption = ` -config ${q4(n5(configFile))}`;
   const keySize = certificateAuthority.keySize;
   const privateKeyFilename = path6.join(caRootDir, "private/cakey.pem");
   const csrFilename = path6.join(caRootDir, "private/cakey.csr");
@@ -2497,14 +2544,26 @@ async function construct_CertificateAuthority(certificateAuthority) {
   await generatePrivateKeyFile2(privateKeyFilename, keySize);
   displayTitle("Generate a certificate request for the CA key");
   await execute_openssl(
-    "req -new -sha256  -text  -extensions v3_ca_req" + configOption + " -key " + q3(n4(privateKeyFilename)) + " -out " + q3(n4(csrFilename)) + " " + subjectOpt,
-    options
-  );
-  displayTitle("Generate CA Certificate (self-signed)");
-  await execute_openssl(
-    " x509 -sha256 -req -days 3650  -text  -extensions v3_ca -extfile " + q3(n4(configFile)) + " -in private/cakey.csr  -signkey " + q3(n4(privateKeyFilename)) + " -out public/cacert.pem",
+    "req -new -sha256  -text  -extensions v3_ca_req" + configOption + " -key " + q4(n5(privateKeyFilename)) + " -out " + q4(n5(csrFilename)) + " " + subjectOpt,
     options
   );
+  const issuerCA = certificateAuthority._issuerCA;
+  if (issuerCA) {
+    displayTitle("Generate CA Certificate (signed by issuer CA)");
+    const issuerCert = path6.resolve(issuerCA.caCertificate);
+    const issuerKey = path6.resolve(issuerCA.rootDir, "private/cakey.pem");
+    const issuerSerial = path6.resolve(issuerCA.rootDir, "serial");
+    await execute_openssl(
+      " x509 -sha256 -req -days 3650  -text  -extensions v3_ca -extfile " + q4(n5(configFile)) + " -in private/cakey.csr  -CA " + q4(n5(issuerCert)) + " -CAkey " + q4(n5(issuerKey)) + " -CAserial " + q4(n5(issuerSerial)) + " -out public/cacert.pem",
+      options
+    );
+  } else {
+    displayTitle("Generate CA Certificate (self-signed)");
+    await execute_openssl(
+      " x509 -sha256 -req -days 3650  -text  -extensions v3_ca -extfile " + q4(n5(configFile)) + " -in private/cakey.csr  -signkey " + q4(n5(privateKeyFilename)) + " -out public/cacert.pem",
+      options
+    );
+  }
   displaySubtitle("generate initial CRL (Certificate Revocation List)");
   await regenerateCrl(certificateAuthority.revocationList, configOption, options);
   displayTitle("Create Certificate Authority (CA) ---> DONE");
@@ -2514,7 +2573,7 @@ async function regenerateCrl(revocationList, configOption, options) {
   await execute_openssl(`ca -gencrl ${configOption} -out crl/revocation_list.crl`, options);
   await execute_openssl("crl  -in  crl/revocation_list.crl -out  crl/revocation_list.der  -outform der", options);
   displaySubtitle("Display (Certificate Revocation List)");
-  await execute_openssl(`crl  -in ${q3(n4(revocationList))} -text  -noout`, options);
+  await execute_openssl(`crl  -in ${q4(n5(revocationList))} -text  -noout`, options);
 }
 function parseOpenSSLDate(dateStr) {
   const raw = dateStr?.split(",")[0] ?? "";
@@ -2528,24 +2587,27 @@ function parseOpenSSLDate(dateStr) {
   const sec = raw.substring(10, 12);
   return `${year}-${month}-${day}T${hour}:${min}:${sec}Z`;
 }
-var defaultSubject, configurationFileTemplate, config3, n4, q3, CertificateAuthority;
+var defaultSubject, configurationFileTemplate, configurationFileSimpleTemplate2, config3, n5, q4, CertificateAuthority;
 var init_certificate_authority = __esm({
   "packages/node-opcua-pki/lib/ca/certificate_authority.ts"() {
     "use strict";
     init_esm_shims();
+    init_toolbox_pfx();
     init_toolbox();
     init_with_openssl();
+    init_simple_config_template_cnf();
     init_ca_config_template_cnf();
     defaultSubject = "/C=FR/ST=IDF/L=Paris/O=Local NODE-OPCUA Certificate Authority/CN=NodeOPCUA-CA";
     configurationFileTemplate = ca_config_template_cnf_default;
+    configurationFileSimpleTemplate2 = simple_config_template_cnf_default;
     config3 = {
       certificateDir: "INVALID",
       forceCA: false,
       pkiDir: "INVALID"
     };
-    n4 = makePath;
-    q3 = quote;
-    assert9(octetStringToIpAddress("c07b9179") === "192.123.145.121");
+    n5 = makePath;
+    q4 = quote;
+    assert10(octetStringToIpAddress("c07b9179") === "192.123.145.121");
     CertificateAuthority = class {
       /** RSA key size used when generating the CA private key. */
       keySize;
@@ -2553,12 +2615,15 @@ var init_certificate_authority = __esm({
       location;
       /** X.500 subject of the CA certificate. */
       subject;
+      /** @internal Parent CA (undefined for root CAs). */
+      _issuerCA;
       constructor(options) {
-        assert9(Object.prototype.hasOwnProperty.call(options, "location"));
-        assert9(Object.prototype.hasOwnProperty.call(options, "keySize"));
+        assert10(Object.prototype.hasOwnProperty.call(options, "location"));
+        assert10(Object.prototype.hasOwnProperty.call(options, "keySize"));
         this.location = options.location;
         this.keySize = options.keySize || 2048;
         this.subject = new Subject4(options.subject || defaultSubject);
+        this._issuerCA = options.issuerCA;
       }
       /** Absolute path to the CA root directory (alias for {@link location}). */
       get rootDir() {
@@ -2572,6 +2637,18 @@ var init_certificate_authority = __esm({
       get caCertificate() {
         return makePath(this.rootDir, "./public/cacert.pem");
       }
+      /**
+       * Path to the issuer certificate chain (`public/issuer_chain.pem`).
+       *
+       * This file is created by {@link installCACertificate} when the
+       * provided cert file contains additional issuer certificates
+       * (e.g. intermediate + root). It is appended to signed certs
+       * by {@link constructCertificateChain} to produce a full chain
+       * per OPC UA Part 6 §6.2.6.
+       */
+      get issuerCertificateChain() {
+        return makePath(this.rootDir, "./public/issuer_chain.pem");
+      }
       /**
        * Path to the current Certificate Revocation List in DER format.
        * (`crl/revocation_list.der`)
@@ -2629,10 +2706,10 @@ var init_certificate_authority = __esm({
        */
       getCRLDER() {
         const crlPath = this.revocationListDER;
-        if (!fs9.existsSync(crlPath)) {
+        if (!fs10.existsSync(crlPath)) {
           return Buffer.alloc(0);
         }
-        return fs9.readFileSync(crlPath);
+        return fs10.readFileSync(crlPath);
       }
       /**
        * Return the current Certificate Revocation List as a
@@ -2642,10 +2719,10 @@ var init_certificate_authority = __esm({
        */
       getCRLPEM() {
         const crlPath = this.revocationList;
-        if (!fs9.existsSync(crlPath)) {
+        if (!fs10.existsSync(crlPath)) {
           return "";
         }
-        const raw = fs9.readFileSync(crlPath, "utf-8");
+        const raw = fs10.readFileSync(crlPath, "utf-8");
         const beginMarker = "-----BEGIN X509 CRL-----";
         const idx = raw.indexOf(beginMarker);
         if (idx > 0) {
@@ -2698,7 +2775,7 @@ var init_certificate_authority = __esm({
       getCertificateBySerial(serial) {
         const upper = serial.toUpperCase();
         const certFile = path6.join(this.rootDir, "certs", `${upper}.pem`);
-        if (!fs9.existsSync(certFile)) {
+        if (!fs10.existsSync(certFile)) {
           return void 0;
         }
         const pem = readCertificatePEM(certFile);
@@ -2727,10 +2804,10 @@ var init_certificate_authority = __esm({
        */
       _parseIndexTxt() {
         const indexPath = this.indexFile;
-        if (!fs9.existsSync(indexPath)) {
+        if (!fs10.existsSync(indexPath)) {
           return [];
         }
-        const content = fs9.readFileSync(indexPath, "utf-8");
+        const content = fs10.readFileSync(indexPath, "utf-8");
         const lines = content.split("\n").filter((l) => l.trim().length > 0);
         const records = [];
         for (const line of lines) {
@@ -2784,25 +2861,145 @@ var init_certificate_authority = __esm({
        * internally so that callers can work with in-memory
        * buffers only.
        *
+       * The CA can override fields from the CSR by passing
+       * `options.dns`, `options.ip`, `options.applicationUri`,
+       * `options.startDate`, or `options.subject`.
+       *
        * @param csrDer - the CSR as a DER-encoded buffer
-       * @param options - signing options
-       * @param options.validity - certificate validity in days
-       *   (default: 365)
+       * @param options - signing options and CA overrides
        * @returns the signed certificate as a DER-encoded buffer
        */
       async signCertificateRequestFromDER(csrDer, options) {
         const validity = options?.validity ?? 365;
-        const tmpDir = await fs9.promises.mkdtemp(path6.join(os4.tmpdir(), "pki-sign-"));
+        const tmpDir = await fs10.promises.mkdtemp(path6.join(os4.tmpdir(), "pki-sign-"));
         try {
           const csrFile = path6.join(tmpDir, "request.csr");
           const certFile = path6.join(tmpDir, "certificate.pem");
           const csrPem = toPem2(csrDer, "CERTIFICATE REQUEST");
-          await fs9.promises.writeFile(csrFile, csrPem, "utf-8");
-          await this.signCertificateRequest(certFile, csrFile, { validity });
+          await fs10.promises.writeFile(csrFile, csrPem, "utf-8");
+          const signingParams = { validity };
+          if (options?.startDate) signingParams.startDate = options.startDate;
+          if (options?.dns) signingParams.dns = options.dns;
+          if (options?.ip) signingParams.ip = options.ip;
+          if (options?.applicationUri) signingParams.applicationUri = options.applicationUri;
+          if (options?.subject) signingParams.subject = options.subject;
+          await this.signCertificateRequest(certFile, csrFile, signingParams);
           const certPem = readCertificatePEM(certFile);
           return convertPEMtoDER(certPem);
         } finally {
-          await fs9.promises.rm(tmpDir, {
+          await fs10.promises.rm(tmpDir, {
+            recursive: true,
+            force: true
+          });
+        }
+      }
+      /**
+       * Generate a new RSA key pair, create an internal CSR, sign it
+       * with this CA, and return both the certificate and private key
+       * as DER-encoded buffers.
+       *
+       * The private key is **never stored** by the CA — it exists only
+       * in a temporary directory that is cleaned up after the operation.
+       *
+       * This is used by `StartNewKeyPairRequest` (OPC UA Part 12) for
+       * constrained devices that cannot generate their own keys.
+       *
+       * @param options - key generation and certificate parameters
+       * @returns `{ certificateDer, privateKey }` — certificate as DER,
+       *   private key as a branded `PrivateKey` buffer
+       */
+      async generateKeyPairAndSignDER(options) {
+        const keySize = options.keySize ?? 2048;
+        const validity = options.validity ?? 365;
+        const startDate = options.startDate ?? /* @__PURE__ */ new Date();
+        const tmpDir = await fs10.promises.mkdtemp(path6.join(os4.tmpdir(), "pki-keygen-"));
+        try {
+          const privateKeyFile = path6.join(tmpDir, "private_key.pem");
+          await generatePrivateKeyFile2(privateKeyFile, keySize);
+          const configFile = path6.join(tmpDir, "openssl.cnf");
+          await fs10.promises.writeFile(configFile, configurationFileSimpleTemplate2, "utf-8");
+          const csrFile = path6.join(tmpDir, "request.csr");
+          await createCertificateSigningRequestWithOpenSSL(csrFile, {
+            rootDir: tmpDir,
+            configFile,
+            privateKey: privateKeyFile,
+            applicationUri: options.applicationUri,
+            subject: options.subject,
+            dns: options.dns ?? [],
+            ip: options.ip ?? [],
+            purpose: CertificatePurpose2.ForApplication
+          });
+          const certFile = path6.join(tmpDir, "certificate.pem");
+          await this.signCertificateRequest(certFile, csrFile, {
+            applicationUri: options.applicationUri,
+            dns: options.dns,
+            ip: options.ip,
+            startDate,
+            validity
+          });
+          const certPem = readCertificatePEM(certFile);
+          const certificateDer = convertPEMtoDER(certPem);
+          const privateKey = readPrivateKey(privateKeyFile);
+          return { certificateDer, privateKey };
+        } finally {
+          await fs10.promises.rm(tmpDir, {
+            recursive: true,
+            force: true
+          });
+        }
+      }
+      /**
+       * Generate a new RSA key pair, create an internal CSR, sign it
+       * with this CA, and return the result as a PKCS#12 (PFX)
+       * buffer bundling the certificate, private key, and CA chain.
+       *
+       * The private key is **never stored** by the CA — it exists only
+       * in a temporary directory that is cleaned up after the operation.
+       *
+       * @param options - key generation, certificate, and PFX options
+       * @returns the PFX as a `Buffer`
+       */
+      async generateKeyPairAndSignPFX(options) {
+        const keySize = options.keySize ?? 2048;
+        const validity = options.validity ?? 365;
+        const startDate = options.startDate ?? /* @__PURE__ */ new Date();
+        const passphrase = options.passphrase ?? "";
+        const tmpDir = await fs10.promises.mkdtemp(path6.join(os4.tmpdir(), "pki-keygen-pfx-"));
+        try {
+          const privateKeyFile = path6.join(tmpDir, "private_key.pem");
+          await generatePrivateKeyFile2(privateKeyFile, keySize);
+          const configFile = path6.join(tmpDir, "openssl.cnf");
+          await fs10.promises.writeFile(configFile, configurationFileSimpleTemplate2, "utf-8");
+          const csrFile = path6.join(tmpDir, "request.csr");
+          await createCertificateSigningRequestWithOpenSSL(csrFile, {
+            rootDir: tmpDir,
+            configFile,
+            privateKey: privateKeyFile,
+            applicationUri: options.applicationUri,
+            subject: options.subject,
+            dns: options.dns ?? [],
+            ip: options.ip ?? [],
+            purpose: CertificatePurpose2.ForApplication
+          });
+          const certFile = path6.join(tmpDir, "certificate.pem");
+          await this.signCertificateRequest(certFile, csrFile, {
+            applicationUri: options.applicationUri,
+            dns: options.dns,
+            ip: options.ip,
+            startDate,
+            validity
+          });
+          const pfxFile = path6.join(tmpDir, "bundle.pfx");
+          await createPFX({
+            certificateFile: certFile,
+            privateKeyFile,
+            outputFile: pfxFile,
+            passphrase,
+            caCertificateFiles: [this.caCertificate]
+          });
+          return await fs10.promises.readFile(pfxFile);
+        } finally {
+          await fs10.promises.rm(tmpDir, {
             recursive: true,
             force: true
           });
@@ -2824,7 +3021,7 @@ var init_certificate_authority = __esm({
         const info = exploreCertificate2(certDer);
         const serial = info.tbsCertificate.serialNumber.replace(/:/g, "").toUpperCase();
         const storedCertFile = path6.join(this.rootDir, "certs", `${serial}.pem`);
-        if (!fs9.existsSync(storedCertFile)) {
+        if (!fs10.existsSync(storedCertFile)) {
           throw new Error(`Cannot revoke: no stored certificate found for serial ${serial} at ${storedCertFile}`);
         }
         await this.revokeCertificate(storedCertFile, {
@@ -2839,6 +3036,204 @@ var init_certificate_authority = __esm({
       async initialize() {
         await construct_CertificateAuthority(this);
       }
+      /**
+       * Initialize the CA directory structure and generate the
+       * private key + CSR **without signing**.
+       *
+       * Use this when the CA certificate will be signed by an
+       * external (third-party) root CA.  After receiving the signed
+       * certificate, call {@link installCACertificate} to complete
+       * the setup.
+       *
+       * **Idempotent / restart-safe:**
+       * - If the CA certificate exists and is valid → `{ status: "ready" }`
+       * - If the CA certificate has expired → `{ status: "expired", csrPath, expiryDate }`
+       *   (a new CSR is generated, preserving the existing private key)
+       * - If key + CSR exist but no cert (restart before install) →
+       *   `{ status: "pending", csrPath }` without regenerating
+       * - Otherwise → generates key + CSR → `{ status: "created", csrPath }`
+       *
+       * @returns an {@link InitializeCSRResult} describing the CA state
+       */
+      async initializeCSR() {
+        const caRootDir = path6.resolve(this.rootDir);
+        mkdirRecursiveSync(caRootDir);
+        for (const dir of ["private", "public", "certs", "crl", "conf"]) {
+          mkdirRecursiveSync(path6.join(caRootDir, dir));
+        }
+        const caCertFile = this.caCertificate;
+        const privateKeyFile = path6.join(caRootDir, "private/cakey.pem");
+        const csrFile = path6.join(caRootDir, "private/cakey.csr");
+        if (fs10.existsSync(caCertFile)) {
+          const certDer = convertPEMtoDER(readCertificatePEM(caCertFile));
+          const certInfo = exploreCertificate2(certDer);
+          const notAfter = certInfo.tbsCertificate.validity.notAfter;
+          if (notAfter.getTime() < Date.now()) {
+            debugLog("CA certificate has expired \u2014 generating renewal CSR");
+            await this._generateCSR(caRootDir, privateKeyFile, csrFile);
+            return { status: "expired", csrPath: csrFile, expiryDate: notAfter };
+          }
+          debugLog("CA certificate already exists and is valid \u2014 ready");
+          return { status: "ready" };
+        }
+        if (fs10.existsSync(privateKeyFile) && fs10.existsSync(csrFile)) {
+          debugLog("CA key + CSR already exist \u2014 pending external signing");
+          return { status: "pending", csrPath: csrFile };
+        }
+        const serial = path6.join(caRootDir, "serial");
+        if (!fs10.existsSync(serial)) {
+          await fs10.promises.writeFile(serial, "1000");
+        }
+        const crlNumber = path6.join(caRootDir, "crlnumber");
+        if (!fs10.existsSync(crlNumber)) {
+          await fs10.promises.writeFile(crlNumber, "1000");
+        }
+        const indexFile = path6.join(caRootDir, "index.txt");
+        if (!fs10.existsSync(indexFile)) {
+          await fs10.promises.writeFile(indexFile, "");
+        }
+        const indexFileAttr = path6.join(caRootDir, "index.txt.attr");
+        if (!fs10.existsSync(indexFileAttr)) {
+          await fs10.promises.writeFile(indexFileAttr, "unique_subject = no");
+        }
+        const caConfigFile = this.configFile;
+        let data = configurationFileTemplate;
+        data = makePath(data.replace(/%%ROOT_FOLDER%%/, caRootDir));
+        await fs10.promises.writeFile(caConfigFile, data);
+        if (!fs10.existsSync(privateKeyFile)) {
+          await generatePrivateKeyFile2(privateKeyFile, this.keySize);
+        }
+        await this._generateCSR(caRootDir, privateKeyFile, csrFile);
+        return { status: "created", csrPath: csrFile };
+      }
+      /**
+       * Check whether the CA certificate needs renewal and, if so,
+       * generate a new CSR for re-signing by the external root CA.
+       *
+       * Use this while the CA is running to detect upcoming expiry
+       * **before** it actually expires. The existing private key is
+       * preserved so previously issued certs remain valid.
+       *
+       * @param thresholdDays - number of days before expiry at which
+       *   to trigger renewal (default: 30)
+       * @returns an {@link InitializeCSRResult} — `"expired"` if
+       *   renewal is needed, `"ready"` if the cert is still valid
+       */
+      async renewCSR(thresholdDays = 30) {
+        const caRootDir = path6.resolve(this.rootDir);
+        const caCertFile = this.caCertificate;
+        const privateKeyFile = path6.join(caRootDir, "private/cakey.pem");
+        const csrFile = path6.join(caRootDir, "private/cakey.csr");
+        if (!fs10.existsSync(caCertFile)) {
+          return this.initializeCSR();
+        }
+        const certDer = convertPEMtoDER(readCertificatePEM(caCertFile));
+        const certInfo = exploreCertificate2(certDer);
+        const notAfter = certInfo.tbsCertificate.validity.notAfter;
+        const thresholdMs = thresholdDays * 24 * 60 * 60 * 1e3;
+        if (notAfter.getTime() - Date.now() < thresholdMs) {
+          debugLog(`CA certificate expires within ${thresholdDays} days \u2014 generating renewal CSR`);
+          await this._generateCSR(caRootDir, privateKeyFile, csrFile);
+          return { status: "expired", csrPath: csrFile, expiryDate: notAfter };
+        }
+        return { status: "ready" };
+      }
+      /**
+       * Generate a CSR using the existing private key.
+       * @internal
+       */
+      async _generateCSR(caRootDir, privateKeyFile, csrFile) {
+        const subjectOpt = ` -subj "${this.subject.toString()}" `;
+        processAltNames({});
+        const options = { cwd: caRootDir };
+        const configFile = generateStaticConfig("conf/caconfig.cnf", options);
+        const configOption = ` -config ${q4(n5(configFile))}`;
+        await execute_openssl(
+          "req -new -sha256  -text  -extensions v3_ca_req" + configOption + " -key " + q4(n5(privateKeyFile)) + " -out " + q4(n5(csrFile)) + " " + subjectOpt,
+          options
+        );
+      }
+      /**
+       * Install an externally-signed CA certificate and generate
+       * the initial CRL.
+       *
+       * Call this after {@link initializeCSR} once the external
+       * root CA has signed the CSR.
+       *
+       * **Safety checks:**
+       * - Verifies that the certificate's public key matches the
+       *   CA private key before installing.
+       *
+       * @param signedCertFile - path to the PEM-encoded signed
+       *   CA certificate (issued by the external root CA)
+       * @returns an {@link InstallCACertificateResult} with
+       *   `status: "success"` or `status: "error"` and a `reason`
+       */
+      async installCACertificate(signedCertFile) {
+        const caRootDir = path6.resolve(this.rootDir);
+        const caCertFile = this.caCertificate;
+        const privateKeyFile = path6.join(caRootDir, "private/cakey.pem");
+        const fullPem = await fs10.promises.readFile(signedCertFile, "utf8");
+        const pemBlocks = fullPem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
+        if (!pemBlocks || pemBlocks.length === 0) {
+          return {
+            status: "error",
+            reason: "no_certificate_found",
+            message: "The provided file does not contain any PEM-encoded certificate."
+          };
+        }
+        const certDer = convertPEMtoDER(pemBlocks[0]);
+        const privateKey = readPrivateKey(privateKeyFile);
+        if (!certificateMatchesPrivateKey(certDer, privateKey)) {
+          return {
+            status: "error",
+            reason: "certificate_key_mismatch",
+            message: "The provided certificate does not match the CA private key. Ensure the certificate was signed from the CSR generated by initializeCSR()."
+          };
+        }
+        await fs10.promises.writeFile(caCertFile, `${pemBlocks[0]}
+`);
+        const issuerChainFile = this.issuerCertificateChain;
+        if (pemBlocks.length > 1) {
+          const issuerPem = `${pemBlocks.slice(1).join("\n")}
+`;
+          await fs10.promises.writeFile(issuerChainFile, issuerPem);
+          debugLog(`Stored ${pemBlocks.length - 1} issuer certificate(s) in issuer_chain.pem`);
+        } else {
+          if (fs10.existsSync(issuerChainFile)) {
+            await fs10.promises.unlink(issuerChainFile);
+          }
+        }
+        const options = { cwd: caRootDir };
+        const configFile = generateStaticConfig("conf/caconfig.cnf", options);
+        const configOption = ` -config ${q4(n5(configFile))}`;
+        await regenerateCrl(this.revocationList, configOption, options);
+        return { status: "success" };
+      }
+      /**
+       * Sign a CSR with CA extensions (`v3_ca`), producing a
+       * subordinate CA certificate.
+       *
+       * Unlike {@link signCertificateRequest} which signs with
+       * end-entity extensions (SANs, etc.), this method signs
+       * with `basicConstraints = CA:TRUE` and `keyUsage =
+       * keyCertSign, cRLSign`.
+       *
+       * @param certFile - output path for the signed CA cert (PEM)
+       * @param csrFile - path to the subordinate CA's CSR
+       * @param params - signing parameters
+       */
+      async signCACertificateRequest(certFile, csrFile, params) {
+        const caRootDir = path6.resolve(this.rootDir);
+        const options = { cwd: caRootDir };
+        const configFile = generateStaticConfig("conf/caconfig.cnf", options);
+        const validity = params.validity ?? 3650;
+        await execute_openssl(
+          ` x509 -sha256 -req -days ${validity} -text  -extensions v3_ca -extfile ` + q4(n5(configFile)) + " -in " + q4(n5(csrFile)) + " -CA " + q4(n5(this.caCertificate)) + " -CAkey " + q4(n5(path6.join(caRootDir, "private/cakey.pem"))) + " -CAserial " + q4(n5(path6.join(caRootDir, "serial"))) + " -out " + q4(n5(certFile)),
+          options
+        );
+        await this.constructCertificateChain(certFile);
+      }
       /**
        * Rebuild the combined CA certificate + CRL file.
        *
@@ -2848,13 +3243,13 @@ var init_certificate_authority = __esm({
        */
       async constructCACertificateWithCRL() {
         const cacertWithCRL = this.caCertificateWithCrl;
-        if (fs9.existsSync(this.revocationList)) {
-          await fs9.promises.writeFile(
+        if (fs10.existsSync(this.revocationList)) {
+          await fs10.promises.writeFile(
             cacertWithCRL,
-            fs9.readFileSync(this.caCertificate, "utf8") + fs9.readFileSync(this.revocationList, "utf8")
+            fs10.readFileSync(this.caCertificate, "utf8") + fs10.readFileSync(this.revocationList, "utf8")
           );
         } else {
-          await fs9.promises.writeFile(cacertWithCRL, fs9.readFileSync(this.caCertificate));
+          await fs10.promises.writeFile(cacertWithCRL, fs10.readFileSync(this.caCertificate));
         }
       }
       /**
@@ -2864,14 +3259,15 @@ var init_certificate_authority = __esm({
        * @param certificate - path to the certificate file to extend
        */
       async constructCertificateChain(certificate) {
-        assert9(fs9.existsSync(certificate));
-        assert9(fs9.existsSync(this.caCertificate));
+        assert10(fs10.existsSync(certificate));
+        assert10(fs10.existsSync(this.caCertificate));
         debugLog(chalk6.yellow("        certificate file :"), chalk6.cyan(certificate));
-        await fs9.promises.writeFile(
-          certificate,
-          await fs9.promises.readFile(certificate, "utf8") + await fs9.promises.readFile(this.caCertificate, "utf8")
-          //   + fs.readFileSync(this.revocationList)
-        );
+        let chain = await fs10.promises.readFile(certificate, "utf8");
+        chain += await fs10.promises.readFile(this.caCertificate, "utf8");
+        if (fs10.existsSync(this.issuerCertificateChain)) {
+          chain += await fs10.promises.readFile(this.issuerCertificateChain, "utf8");
+        }
+        await fs10.promises.writeFile(certificate, chain);
       }
       /**
        * Create a self-signed certificate using OpenSSL.
@@ -2881,8 +3277,8 @@ var init_certificate_authority = __esm({
        * @param params - certificate parameters (subject, validity, SANs)
        */
       async createSelfSignedCertificate(certificateFile, privateKey, params) {
-        assert9(typeof privateKey === "string");
-        assert9(fs9.existsSync(privateKey));
+        assert10(typeof privateKey === "string");
+        assert10(fs10.existsSync(privateKey));
         if (!certificateFileExist(certificateFile)) {
           return;
         }
@@ -2890,7 +3286,7 @@ var init_certificate_authority = __esm({
         adjustApplicationUri(params);
         processAltNames(params);
         const csrFile = `${certificateFile}_csr`;
-        assert9(csrFile);
+        assert10(csrFile);
         const configFile = generateStaticConfig(this.configFile, { cwd: this.rootDir });
         const options = {
           cwd: this.rootDir,
@@ -2901,19 +3297,19 @@ var init_certificate_authority = __esm({
         const subjectOptions = subject && subject.length > 1 ? ` -subj ${subject} ` : "";
         displaySubtitle("- the certificate signing request");
         await execute_openssl(
-          "req  -new -sha256 -text " + configOption + subjectOptions + " -batch -key " + q3(n4(privateKey)) + " -out " + q3(n4(csrFile)),
+          "req  -new -sha256 -text " + configOption + subjectOptions + " -batch -key " + q4(n5(privateKey)) + " -out " + q4(n5(csrFile)),
           options
         );
         displaySubtitle("- creating the self-signed certificate");
         await execute_openssl(
-          "ca  -selfsign  -keyfile " + q3(n4(privateKey)) + " -startdate " + x509Date(params.startDate) + " -enddate " + x509Date(params.endDate) + " -batch -out " + q3(n4(certificateFile)) + " -in " + q3(n4(csrFile)),
+          "ca  -selfsign  -keyfile " + q4(n5(privateKey)) + " -startdate " + x509Date(params.startDate) + " -enddate " + x509Date(params.endDate) + " -batch -out " + q4(n5(certificateFile)) + " -in " + q4(n5(csrFile)),
           options
         );
         displaySubtitle("- dump the certificate for a check");
-        await execute_openssl(`x509 -in ${q3(n4(certificateFile))}  -dates -fingerprint -purpose -noout`, {});
+        await execute_openssl(`x509 -in ${q4(n5(certificateFile))}  -dates -fingerprint -purpose -noout`, {});
         displaySubtitle("- verify self-signed certificate");
-        await execute_openssl_no_failure(`verify -verbose -CAfile ${q3(n4(certificateFile))} ${q3(n4(certificateFile))}`, options);
-        await fs9.promises.unlink(csrFile);
+        await execute_openssl_no_failure(`verify -verbose -CAfile ${q4(n5(certificateFile))} ${q4(n5(certificateFile))}`, options);
+        await fs10.promises.unlink(csrFile);
       }
       /**
        * Revoke a certificate and regenerate the CRL.
@@ -2942,22 +3338,22 @@ var init_certificate_authority = __esm({
         setEnv("ALTNAME", "");
         const randomFile = path6.join(this.rootDir, "random.rnd");
         setEnv("RANDFILE", randomFile);
-        const configOption = ` -config ${q3(n4(configFile))}`;
+        const configOption = ` -config ${q4(n5(configFile))}`;
         const reason = params.reason || "keyCompromise";
-        assert9(crlReasons.indexOf(reason) >= 0);
+        assert10(crlReasons.indexOf(reason) >= 0);
         displayTitle(`Revoking certificate  ${certificate}`);
         displaySubtitle("Revoke certificate");
-        await execute_openssl_no_failure(`ca -verbose ${configOption} -revoke ${q3(certificate)} -crl_reason ${reason}`, options);
+        await execute_openssl_no_failure(`ca -verbose ${configOption} -revoke ${q4(certificate)} -crl_reason ${reason}`, options);
         await regenerateCrl(this.revocationList, configOption, options);
         displaySubtitle("Verify that certificate is revoked");
         await execute_openssl_no_failure(
-          "verify -verbose -CRLfile " + q3(n4(this.revocationList)) + " -CAfile " + q3(n4(this.caCertificate)) + " -crl_check " + q3(n4(certificate)),
+          "verify -verbose -CRLfile " + q4(n5(this.revocationList)) + " -CAfile " + q4(n5(this.caCertificate)) + " -crl_check " + q4(n5(certificate)),
           options
         );
         displaySubtitle("Produce CRL in DER form ");
-        await execute_openssl(`crl  -in ${q3(n4(this.revocationList))} -out crl/revocation_list.der  -outform der`, options);
+        await execute_openssl(`crl  -in ${q4(n5(this.revocationList))} -out crl/revocation_list.der  -outform der`, options);
         displaySubtitle("Produce CRL in PEM form ");
-        await execute_openssl(`crl  -in ${q3(n4(this.revocationList))} -out crl/revocation_list.pem  -outform pem -text `, options);
+        await execute_openssl(`crl  -in ${q4(n5(this.revocationList))} -out crl/revocation_list.pem  -outform pem -text `, options);
       }
       /**
        * Sign a Certificate Signing Request (CSR) with this CA.
@@ -2973,7 +3369,7 @@ var init_certificate_authority = __esm({
        */
       async signCertificateRequest(certificate, certificateSigningRequestFilename, params1) {
         await ensure_openssl_installed();
-        assert9(fs9.existsSync(certificateSigningRequestFilename));
+        assert10(fs10.existsSync(certificateSigningRequestFilename));
         if (!certificateFileExist(certificate)) {
           return "";
         }
@@ -3000,11 +3396,11 @@ var init_certificate_authority = __esm({
         displaySubtitle("- then we ask the authority to sign the certificate signing request");
         const configOption = ` -config ${configFile}`;
         await execute_openssl(
-          "ca " + configOption + " -startdate " + x509Date(params1.startDate) + " -enddate " + x509Date(params1.endDate) + " -batch -out " + q3(n4(certificate)) + " -in " + q3(n4(certificateSigningRequestFilename)),
+          "ca " + configOption + " -startdate " + x509Date(params1.startDate) + " -enddate " + x509Date(params1.endDate) + " -batch -out " + q4(n5(certificate)) + " -in " + q4(n5(certificateSigningRequestFilename)),
           options
         );
         displaySubtitle("- dump the certificate for a check");
-        await execute_openssl(`x509 -in ${q3(n4(certificate))}  -dates -fingerprint -purpose -noout`, options);
+        await execute_openssl(`x509 -in ${q4(n5(certificate))}  -dates -fingerprint -purpose -noout`, options);
         displaySubtitle("- construct CA certificate with CRL");
         await this.constructCACertificateWithCRL();
         displaySubtitle("- construct certificate chain");
@@ -3027,7 +3423,7 @@ var init_certificate_authority = __esm({
           const _configOption = ` -config ${configFile}`;
           _configOption;
           await execute_openssl_no_failure(
-            `verify -verbose  -CAfile ${q3(n4(this.caCertificateWithCrl))} ${q3(n4(certificate))}`,
+            `verify -verbose  -CAfile ${q4(n5(this.caCertificateWithCrl))} ${q4(n5(certificate))}`,
             options
           );
         }
@@ -3037,13 +3433,13 @@ var init_certificate_authority = __esm({
 });
 
 // packages/node-opcua-pki/lib/ca/crypto_create_CA.ts
-import assert10 from "assert";
-import fs10 from "fs";
+import assert11 from "assert";
+import fs11 from "fs";
 import { createRequire } from "module";
 import os5 from "os";
 import path7 from "path";
 import chalk7 from "chalk";
-import { CertificatePurpose as CertificatePurpose2, generatePrivateKeyFile as generatePrivateKeyFile3, Subject as Subject5 } from "node-opcua-crypto";
+import { CertificatePurpose as CertificatePurpose3, generatePrivateKeyFile as generatePrivateKeyFile3, Subject as Subject5 } from "node-opcua-crypto";
 import commandLineArgs from "command-line-args";
 import commandLineUsage from "command-line-usage";
 function get_offset_date(date, nbDays) {
@@ -3052,8 +3448,8 @@ function get_offset_date(date, nbDays) {
   return d;
 }
 async function construct_CertificateAuthority2(subject) {
-  assert10(typeof gLocalConfig.CAFolder === "string", "expecting a CAFolder in config");
-  assert10(typeof gLocalConfig.keySize === "number", "expecting a keySize in config");
+  assert11(typeof gLocalConfig.CAFolder === "string", "expecting a CAFolder in config");
+  assert11(typeof gLocalConfig.keySize === "number", "expecting a keySize in config");
   if (!g_certificateAuthority) {
     g_certificateAuthority = new CertificateAuthority({
       keySize: gLocalConfig.keySize,
@@ -3064,7 +3460,7 @@ async function construct_CertificateAuthority2(subject) {
   }
 }
 async function construct_CertificateManager() {
-  assert10(typeof gLocalConfig.PKIFolder === "string", "expecting a PKIFolder in config");
+  assert11(typeof gLocalConfig.PKIFolder === "string", "expecting a PKIFolder in config");
   if (!certificateManager) {
     certificateManager = new CertificateManager({
       keySize: gLocalConfig.keySize,
@@ -3075,35 +3471,35 @@ async function construct_CertificateManager() {
 }
 function default_template_content() {
   if (process.pkg?.entrypoint) {
-    const a = fs10.readFileSync(path7.join(__dirname, "../../bin/pki_config.example.js"), "utf8");
+    const a = fs11.readFileSync(path7.join(__dirname, "../../bin/pki_config.example.js"), "utf8");
     return a;
   }
   function find_default_config_template() {
     const rootFolder = find_module_root_folder();
     const configName = "pki_config.example.js";
     let default_config_template2 = path7.join(rootFolder, "bin", configName);
-    if (!fs10.existsSync(default_config_template2)) {
+    if (!fs11.existsSync(default_config_template2)) {
       default_config_template2 = path7.join(__dirname, "..", configName);
-      if (!fs10.existsSync(default_config_template2)) {
+      if (!fs11.existsSync(default_config_template2)) {
         default_config_template2 = path7.join(__dirname, `../bin/${configName}`);
       }
     }
     return default_config_template2;
   }
   const default_config_template = find_default_config_template();
-  assert10(fs10.existsSync(default_config_template));
-  const default_config_template_content = fs10.readFileSync(default_config_template, "utf8");
+  assert11(fs11.existsSync(default_config_template));
+  const default_config_template_content = fs11.readFileSync(default_config_template, "utf8");
   return default_config_template_content;
 }
 function find_module_root_folder() {
   let rootFolder = path7.join(__dirname);
   for (let i = 0; i < 4; i++) {
-    if (fs10.existsSync(path7.join(rootFolder, "package.json"))) {
+    if (fs11.existsSync(path7.join(rootFolder, "package.json"))) {
       return rootFolder;
     }
     rootFolder = path7.join(rootFolder, "..");
   }
-  assert10(fs10.existsSync(path7.join(rootFolder, "package.json")), "root folder must have a package.json file");
+  assert11(fs11.existsSync(path7.join(rootFolder, "package.json")), "root folder must have a package.json file");
   return rootFolder;
 }
 async function readConfiguration(argv) {
@@ -3132,19 +3528,19 @@ async function readConfiguration(argv) {
     return makePath(tmp);
   }
   certificateDir = argv.root;
-  assert10(typeof certificateDir === "string");
+  assert11(typeof certificateDir === "string");
   certificateDir = prepare(certificateDir);
   mkdirRecursiveSync(certificateDir);
-  assert10(fs10.existsSync(certificateDir));
+  assert11(fs11.existsSync(certificateDir));
   const default_config = path7.join(certificateDir, "config.js");
-  if (!fs10.existsSync(default_config)) {
+  if (!fs11.existsSync(default_config)) {
     debugLog(chalk7.yellow(" Creating default g_config file "), chalk7.cyan(default_config));
     const default_config_template_content = default_template_content();
-    fs10.writeFileSync(default_config, default_config_template_content);
+    fs11.writeFileSync(default_config, default_config_template_content);
   } else {
     debugLog(chalk7.yellow(" using  g_config file "), chalk7.cyan(default_config));
   }
-  if (!fs10.existsSync(default_config)) {
+  if (!fs11.existsSync(default_config)) {
     debugLog(chalk7.redBright(" cannot find config file ", default_config));
   }
   const defaultRandomFile = path7.join(path7.dirname(default_config), "random.rnd");
@@ -3200,7 +3596,7 @@ async function readConfiguration(argv) {
   }
 }
 async function createDefaultCertificate(base_name, prefix, key_length, applicationUri, dev) {
-  assert10(key_length === 1024 || key_length === 2048 || key_length === 3072 || key_length === 4096);
+  assert11(key_length === 1024 || key_length === 2048 || key_length === 3072 || key_length === 4096);
   const private_key_file = makePath(base_name, `${prefix}key_${key_length}.pem`);
   const public_key_file = makePath(base_name, `${prefix}public_key_${key_length}.pub`);
   const certificate_file = makePath(base_name, `${prefix}cert_${key_length}.pem`);
@@ -3220,7 +3616,7 @@ async function createDefaultCertificate(base_name, prefix, key_length, applicati
   }
   const ip = [];
   async function createCertificateIfNotExist(certificate, private_key, applicationUri2, startDate, validity) {
-    if (fs10.existsSync(certificate)) {
+    if (fs11.existsSync(certificate)) {
       warningLog(chalk7.yellow("         certificate"), chalk7.cyan(certificate), chalk7.yellow(" already exists => skipping"));
       return "";
     } else {
@@ -3239,7 +3635,7 @@ async function createDefaultCertificate(base_name, prefix, key_length, applicati
       configFile,
       dns: dns3,
       ip: ip2,
-      purpose: CertificatePurpose2.ForApplication
+      purpose: CertificatePurpose3.ForApplication
     };
     await createCertificateSigningRequestWithOpenSSL(certificateSigningRequestFile, params);
     return await g_certificateAuthority.signCertificateRequest(certificate, certificateSigningRequestFile, {
@@ -3263,7 +3659,7 @@ async function createDefaultCertificate(base_name, prefix, key_length, applicati
     await g_certificateAuthority.revokeCertificate(certificate, {});
   }
   async function createPrivateKeyIfNotExist(privateKey, keyLength) {
-    if (fs10.existsSync(privateKey)) {
+    if (fs11.existsSync(privateKey)) {
       warningLog(chalk7.yellow("         privateKey"), chalk7.cyan(privateKey), chalk7.yellow(" already exists => skipping"));
       return;
     } else {
@@ -3277,14 +3673,14 @@ async function createDefaultCertificate(base_name, prefix, key_length, applicati
   displaySubtitle(` create Certificate ${certificate_file}`);
   await createCertificateIfNotExist(certificate_file, private_key_file, applicationUri, yesterday, 365);
   displaySubtitle(` create self signed Certificate ${self_signed_certificate_file}`);
-  if (fs10.existsSync(self_signed_certificate_file)) {
+  if (fs11.existsSync(self_signed_certificate_file)) {
     return;
   }
   await createSelfSignedCertificate2(self_signed_certificate_file, private_key_file, applicationUri, yesterday, 365);
   if (dev) {
     await createCertificateIfNotExist(certificate_file_outofdate, private_key_file, applicationUri, two_years_ago, 365);
     await createCertificateIfNotExist(certificate_file_not_active_yet, private_key_file, applicationUri, next_year, 365);
-    if (!fs10.existsSync(certificate_revoked)) {
+    if (!fs11.existsSync(certificate_revoked)) {
       const certificate = await createCertificateIfNotExist(
         certificate_revoked,
         private_key_file,
@@ -3306,9 +3702,9 @@ async function wrap(func) {
   }
 }
 async function create_default_certificates(dev) {
-  assert10(gLocalConfig);
+  assert11(gLocalConfig);
   const base_name = gLocalConfig.certificateDir || "";
-  assert10(fs10.existsSync(base_name));
+  assert11(fs11.existsSync(base_name));
   let clientURN;
   let serverURN;
   let discoveryServerURN;
@@ -3405,7 +3801,7 @@ ${epilog}`
   }
   if (command === "version") {
     const rootFolder = find_module_root_folder();
-    const pkg = JSON.parse(fs10.readFileSync(path7.join(rootFolder, "package.json"), "utf-8"));
+    const pkg = JSON.parse(fs11.readFileSync(path7.join(rootFolder, "package.json"), "utf-8"));
     console.log(pkg.version);
     return;
   }
@@ -3430,12 +3826,12 @@ ${epilog}`
       await readConfiguration(local_argv);
       if (local_argv.clean) {
         displayTitle("Cleaning old certificates");
-        assert10(gLocalConfig);
+        assert11(gLocalConfig);
         const certificateDir = gLocalConfig.certificateDir || "";
-        const files = await fs10.promises.readdir(certificateDir);
+        const files = await fs11.promises.readdir(certificateDir);
         for (const file of files) {
           if (file.includes(".pem") || file.includes(".pub")) {
-            await fs10.promises.unlink(path7.join(certificateDir, file));
+            await fs11.promises.unlink(path7.join(certificateDir, file));
           }
         }
         mkdirRecursiveSync(certificateDir);
@@ -3542,7 +3938,7 @@ ${epilog}`
       await readConfiguration(local_argv2);
       await construct_CertificateManager();
       await construct_CertificateAuthority2("");
-      assert10(fs10.existsSync(gLocalConfig.CAFolder || ""), " CA folder must exist");
+      assert11(fs11.existsSync(gLocalConfig.CAFolder || ""), " CA folder must exist");
       gLocalConfig.privateKey = void 0;
       gLocalConfig.subject = local_argv2.subject && local_argv2.subject.length > 1 ? local_argv2.subject : gLocalConfig.subject;
       const csr_file = await certificateManager.createCertificateRequest(
@@ -3553,7 +3949,7 @@ ${epilog}`
       }
       warningLog(" csr_file = ", csr_file);
       const certificate = csr_file.replace(".csr", ".pem");
-      if (fs10.existsSync(certificate)) {
+      if (fs11.existsSync(certificate)) {
         throw new Error(` File ${certificate} already exist`);
       }
       await g_certificateAuthority.signCertificateRequest(
@@ -3561,8 +3957,8 @@ ${epilog}`
         csr_file,
         gLocalConfig
       );
-      assert10(typeof gLocalConfig.outputFile === "string");
-      fs10.writeFileSync(gLocalConfig.outputFile || "", fs10.readFileSync(certificate, "ascii"));
+      assert11(typeof gLocalConfig.outputFile === "string");
+      fs11.writeFileSync(gLocalConfig.outputFile || "", fs11.readFileSync(certificate, "ascii"));
     }
     await wrap(async () => await command_certificate(local_argv));
     return;
@@ -3583,7 +3979,7 @@ ${epilog}`
     await wrap(async () => {
       const certificate = path7.resolve(local_argv.certificateFile);
       warningLog(chalk7.yellow(" Certificate to revoke : "), chalk7.cyan(certificate));
-      if (!fs10.existsSync(certificate)) {
+      if (!fs11.existsSync(certificate)) {
         throw new Error(`cannot find certificate to revoke ${certificate}`);
       }
       await readConfiguration(local_argv);
@@ -3630,11 +4026,11 @@ ${epilog}`
     if (local_argv.help) return showHelp("csr", "create a certificate signing request", optionsDef);
     await wrap(async () => {
       await readConfiguration(local_argv);
-      if (!fs10.existsSync(gLocalConfig.PKIFolder || "")) {
+      if (!fs11.existsSync(gLocalConfig.PKIFolder || "")) {
         warningLog("PKI folder must exist");
       }
       await construct_CertificateManager();
-      if (!gLocalConfig.outputFile || fs10.existsSync(gLocalConfig.outputFile)) {
+      if (!gLocalConfig.outputFile || fs11.existsSync(gLocalConfig.outputFile)) {
         throw new Error(` File ${gLocalConfig.outputFile} already exist`);
       }
       gLocalConfig.privateKey = void 0;
@@ -3649,8 +4045,8 @@ ${epilog}`
         warningLog("please specify a output file");
         return;
       }
-      const csr = await fs10.promises.readFile(internal_csr_file, "utf-8");
-      fs10.writeFileSync(gLocalConfig.outputFile || "", csr, "utf-8");
+      const csr = await fs11.promises.readFile(internal_csr_file, "utf-8");
+      fs11.writeFileSync(gLocalConfig.outputFile || "", csr, "utf-8");
       warningLog("Subject        = ", gLocalConfig.subject);
       warningLog("applicationUri = ", gLocalConfig.applicationUri);
       warningLog("altNames       = ", gLocalConfig.altNames);
@@ -3678,16 +4074,16 @@ ${epilog}`
       return showHelp("sign", "validate a certificate signing request and generate a certificate", optionsDef);
     await wrap(async () => {
       await readConfiguration(local_argv);
-      if (!fs10.existsSync(gLocalConfig.CAFolder || "")) {
+      if (!fs11.existsSync(gLocalConfig.CAFolder || "")) {
         throw new Error(`CA folder must exist:${gLocalConfig.CAFolder}`);
       }
       await construct_CertificateAuthority2("");
       const csr_file = path7.resolve(local_argv.csr || "");
-      if (!fs10.existsSync(csr_file)) {
+      if (!fs11.existsSync(csr_file)) {
         throw new Error(`Certificate signing request doesn't exist: ${csr_file}`);
       }
       const certificate = path7.resolve(local_argv.output || csr_file.replace(".csr", ".pem"));
-      if (fs10.existsSync(certificate)) {
+      if (fs11.existsSync(certificate)) {
         throw new Error(` File ${certificate} already exist`);
       }
       await g_certificateAuthority.signCertificateRequest(
@@ -3695,8 +4091,8 @@ ${epilog}`
         csr_file,
         gLocalConfig
       );
-      assert10(typeof gLocalConfig.outputFile === "string");
-      fs10.writeFileSync(gLocalConfig.outputFile || "", fs10.readFileSync(certificate, "ascii"));
+      assert11(typeof gLocalConfig.outputFile === "string");
+      fs11.writeFileSync(gLocalConfig.outputFile || "", fs11.readFileSync(certificate, "ascii"));
     });
     return;
   }