node-opcua-pki 6.10.2 → 6.11.0

package/dist/index.js

@@ -51,13 +51,17 @@ __export(lib_exports, {
 module.exports = __toCommonJS(lib_exports);
 
 // packages/node-opcua-pki/lib/ca/certificate_authority.ts
-var import_node_assert6 = __toESM(require("assert"));
-var import_node_fs6 = __toESM(require("fs"));
+var import_node_assert7 = __toESM(require("assert"));
+var import_node_fs7 = __toESM(require("fs"));
 var import_node_os3 = __toESM(require("os"));
 var import_node_path5 = __toESM(require("path"));
 var import_chalk5 = __toESM(require("chalk"));
 var import_node_opcua_crypto2 = require("node-opcua-crypto");
 
+// packages/node-opcua-pki/lib/pki/toolbox_pfx.ts
+var import_node_assert4 = __toESM(require("assert"));
+var import_node_fs4 = __toESM(require("fs"));
+
 // packages/node-opcua-pki/lib/toolbox/common.ts
 var import_node_assert = __toESM(require("assert"));
 function quote(str) {
@@ -134,30 +138,13 @@ function makePath(folderName, filename) {
   return s;
 }
 
-// packages/node-opcua-pki/lib/toolbox/display.ts
-var import_chalk2 = __toESM(require("chalk"));
-function displayTitle(str) {
-  if (!g_config.silent) {
-    warningLog("");
-    warningLog(import_chalk2.default.yellowBright(str));
-    warningLog(import_chalk2.default.yellow(new Array(str.length + 1).join("=")), "\n");
-  }
-}
-function displaySubtitle(str) {
-  if (!g_config.silent) {
-    warningLog("");
-    warningLog(`    ${import_chalk2.default.yellowBright(str)}`);
-    warningLog(`    ${import_chalk2.default.white(new Array(str.length + 1).join("-"))}`, "\n");
-  }
-}
-function display(str) {
-  if (!g_config.silent) {
-    warningLog(`       ${str}`);
-  }
-}
-
-// packages/node-opcua-pki/lib/toolbox/with_openssl/index.ts
-var import_node_constants = __toESM(require("constants"));
+// packages/node-opcua-pki/lib/toolbox/with_openssl/execute_openssl.ts
+var import_node_assert3 = __toESM(require("assert"));
+var import_node_child_process2 = __toESM(require("child_process"));
+var import_node_fs3 = __toESM(require("fs"));
+var import_node_os2 = __toESM(require("os"));
+var import_byline2 = __toESM(require("byline"));
+var import_chalk3 = __toESM(require("chalk"));
 
 // packages/node-opcua-pki/lib/toolbox/with_openssl/_env.ts
 var exportedEnvVars = {};
@@ -198,22 +185,6 @@ function processAltNames(params) {
   setEnv("ALTNAME", subjectAltNameString);
 }
 
-// packages/node-opcua-pki/lib/toolbox/with_openssl/create_certificate_signing_request.ts
-var import_node_assert5 = __toESM(require("assert"));
-var import_node_fs5 = __toESM(require("fs"));
-var import_node_path4 = __toESM(require("path"));
-
-// packages/node-opcua-pki/lib/misc/subject.ts
-var import_node_opcua_crypto = require("node-opcua-crypto");
-
-// packages/node-opcua-pki/lib/toolbox/with_openssl/execute_openssl.ts
-var import_node_assert3 = __toESM(require("assert"));
-var import_node_child_process2 = __toESM(require("child_process"));
-var import_node_fs3 = __toESM(require("fs"));
-var import_node_os2 = __toESM(require("os"));
-var import_byline2 = __toESM(require("byline"));
-var import_chalk4 = __toESM(require("chalk"));
-
 // packages/node-opcua-pki/lib/toolbox/with_openssl/install_prerequisite.ts
 var import_node_child_process = __toESM(require("child_process"));
 var import_node_fs2 = __toESM(require("fs"));
@@ -221,7 +192,7 @@ var import_node_os = __toESM(require("os"));
 var import_node_path2 = __toESM(require("path"));
 var import_node_url = __toESM(require("url"));
 var import_byline = __toESM(require("byline"));
-var import_chalk3 = __toESM(require("chalk"));
+var import_chalk2 = __toESM(require("chalk"));
 var import_progress = __toESM(require("progress"));
 var import_wget_improved_2 = __toESM(require("wget-improved-2"));
 var import_yauzl = __toESM(require("yauzl"));
@@ -239,7 +210,7 @@ function makeOptions() {
         proxyAuth: auth
       }
     };
-    warningLog(import_chalk3.default.green("- using proxy "), proxy);
+    warningLog(import_chalk2.default.green("- using proxy "), proxy);
     warningLog(options);
     return options;
   }
@@ -268,7 +239,7 @@ async function execute(cmd, cwd) {
       output += `${line}
 `;
       if (doDebug2) {
-        process.stdout.write(`        stdout ${import_chalk3.default.yellow(line)}
+        process.stdout.write(`        stdout ${import_chalk2.default.yellow(line)}
 `);
       }
     });
@@ -291,8 +262,8 @@ async function getopensslExecPath() {
   const exitCode = result1?.exitCode;
   const output = result1?.output;
   if (exitCode !== 0) {
-    warningLog(import_chalk3.default.yellow(" it seems that ") + import_chalk3.default.cyan("openssl") + import_chalk3.default.yellow(" is not installed on your computer "));
-    warningLog(import_chalk3.default.yellow("Please install it before running this programs"));
+    warningLog(import_chalk2.default.yellow(" it seems that ") + import_chalk2.default.cyan("openssl") + import_chalk2.default.yellow(" is not installed on your computer "));
+    warningLog(import_chalk2.default.yellow("Please install it before running this programs"));
     throw new Error("Cannot find openssl");
   }
   const opensslExecPath = output.replace(/\n\r/g, "").trim();
@@ -302,7 +273,7 @@ async function check_system_openssl_version() {
   const opensslExecPath = await getopensslExecPath();
   const q_opensslExecPath = quote2(opensslExecPath);
   if (doDebug2) {
-    warningLog(`              OpenSSL found in : ${import_chalk3.default.yellow(opensslExecPath)}`);
+    warningLog(`              OpenSSL found in : ${import_chalk2.default.yellow(opensslExecPath)}`);
   }
   const result = await execute(`${q_opensslExecPath} version`);
   const exitCode = result?.exitCode;
@@ -310,9 +281,9 @@ async function check_system_openssl_version() {
   const version = output.trim();
   const versionOK = exitCode === 0 && is_expected_openssl_version(version);
   if (!versionOK) {
-    let message = import_chalk3.default.whiteBright("Warning !!!!!!!!!!!! ") + "\nyour version of openssl is " + version + ". It doesn't match the expected version";
+    let message = import_chalk2.default.whiteBright("Warning !!!!!!!!!!!! ") + "\nyour version of openssl is " + version + ". It doesn't match the expected version";
     if (process.platform === "darwin") {
-      message += import_chalk3.default.cyan("\nplease refer to :") + import_chalk3.default.yellow(" https://github.com/node-opcua/node-opcua/wiki/installing-node-opcua-or-node-red-on-MacOS");
+      message += import_chalk2.default.cyan("\nplease refer to :") + import_chalk2.default.yellow(" https://github.com/node-opcua/node-opcua/wiki/installing-node-opcua-or-node-red-on-MacOS");
     }
     console.log(message);
   }
@@ -338,7 +309,7 @@ async function install_and_check_win32_openssl_version() {
     const exists = import_node_fs2.default.existsSync(opensslExecPath2);
     if (!exists) {
       warningLog("checking presence of ", opensslExecPath2);
-      warningLog(import_chalk3.default.red(" cannot find file ") + opensslExecPath2);
+      warningLog(import_chalk2.default.red(" cannot find file ") + opensslExecPath2);
       return {
         opensslOk: false,
         version: `cannot find file ${opensslExecPath2}`
@@ -372,12 +343,12 @@ async function install_and_check_win32_openssl_version() {
   async function download_openssl() {
     const url2 = win32or64() === 64 ? "https://github.com/node-opcua/node-opcua-pki/releases/download/2.14.2/openssl-1.0.2u-x64_86-win64.zip" : "https://github.com/node-opcua/node-opcua-pki/releases/download/2.14.2/openssl-1.0.2u-i386-win32.zip";
     const outputFilename = import_node_path2.default.join(downloadFolder, import_node_path2.default.basename(url2));
-    warningLog(`downloading ${import_chalk3.default.yellow(url2)} to ${outputFilename}`);
+    warningLog(`downloading ${import_chalk2.default.yellow(url2)} to ${outputFilename}`);
     if (import_node_fs2.default.existsSync(outputFilename)) {
       return { downloadedFile: outputFilename };
     }
     const options = makeOptions();
-    const bar = new import_progress.default(import_chalk3.default.cyan("[:bar]") + import_chalk3.default.cyan(" :percent ") + import_chalk3.default.white(":etas"), {
+    const bar = new import_progress.default(import_chalk2.default.cyan("[:bar]") + import_chalk2.default.cyan(" :percent ") + import_chalk2.default.white(":etas"), {
       complete: "=",
       incomplete: " ",
       total: 100,
@@ -459,21 +430,21 @@ async function install_and_check_win32_openssl_version() {
   }
   const { opensslOk, version: _version } = await check_openssl_win32();
   if (!opensslOk) {
-    warningLog(import_chalk3.default.yellow("openssl seems to be missing and need to be installed"));
+    warningLog(import_chalk2.default.yellow("openssl seems to be missing and need to be installed"));
     const { downloadedFile } = await download_openssl();
     if (doDebug2) {
-      warningLog("deflating ", import_chalk3.default.yellow(downloadedFile));
+      warningLog("deflating ", import_chalk2.default.yellow(downloadedFile));
     }
     await unzip_openssl(downloadedFile);
     const opensslExists = !!import_node_fs2.default.existsSync(opensslExecPath);
     if (doDebug2) {
-      warningLog("verifying ", opensslExists, opensslExists ? import_chalk3.default.green("OK ") : import_chalk3.default.red(" Error"), opensslExecPath);
+      warningLog("verifying ", opensslExists, opensslExists ? import_chalk2.default.green("OK ") : import_chalk2.default.red(" Error"), opensslExecPath);
     }
     const _opensslExecPath2 = await check_openssl_win32();
     return opensslExecPath;
   } else {
     if (doDebug2) {
-      warningLog(import_chalk3.default.green("openssl is already installed and have the expected version."));
+      warningLog(import_chalk2.default.green("openssl is already installed and have the expected version."));
     }
     return opensslExecPath;
   }
@@ -504,7 +475,7 @@ async function execute2(cmd, options) {
   const from = new Error();
   options.cwd = options.cwd || process.cwd();
   if (!g_config.silent) {
-    warningLog(import_chalk4.default.cyan("                  CWD         "), options.cwd);
+    warningLog(import_chalk3.default.cyan("                  CWD         "), options.cwd);
   }
   const outputs = [];
   return await new Promise((resolve, reject) => {
@@ -518,10 +489,10 @@ async function execute2(cmd, options) {
         if (err) {
           if (!options.hideErrorMessage) {
             const fence = "###########################################";
-            console.error(import_chalk4.default.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
-            console.error(import_chalk4.default.bgWhiteBright.redBright(`CWD = ${options.cwd}`));
-            console.error(import_chalk4.default.bgWhiteBright.redBright(err.message));
-            console.error(import_chalk4.default.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
+            console.error(import_chalk3.default.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
+            console.error(import_chalk3.default.bgWhiteBright.redBright(`CWD = ${options.cwd}`));
+            console.error(import_chalk3.default.bgWhiteBright.redBright(err.message));
+            console.error(import_chalk3.default.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
             console.error(from.stack);
           }
           reject(new Error(err.message));
@@ -540,7 +511,7 @@ async function execute2(cmd, options) {
         stream2.on("data", (line) => {
           line = line.toString();
           if (doDebug) {
-            process.stdout.write(`${import_chalk4.default.white("        stdout ") + import_chalk4.default.whiteBright(line)}
+            process.stdout.write(`${import_chalk3.default.white("        stdout ") + import_chalk3.default.whiteBright(line)}
 `);
           }
         });
@@ -552,7 +523,7 @@ async function execute2(cmd, options) {
         stream1.on("data", (line) => {
           line = line.toString();
           if (displayError) {
-            process.stdout.write(`${import_chalk4.default.white("        stderr ") + import_chalk4.default.red(line)}
+            process.stdout.write(`${import_chalk3.default.white("        stderr ") + import_chalk3.default.red(line)}
 `);
           }
         });
@@ -596,17 +567,107 @@ async function execute_openssl(cmd, options) {
   (0, import_node_assert3.default)(options.openssl_conf);
   setEnv("OPENSSL_CONF", options.openssl_conf);
   if (!g_config.silent) {
-    warningLog(import_chalk4.default.cyan("                  OPENSSL_CONF"), process.env.OPENSSL_CONF);
-    warningLog(import_chalk4.default.cyan("                  RANDFILE    "), process.env.RANDFILE);
-    warningLog(import_chalk4.default.cyan("                  CMD         openssl "), import_chalk4.default.cyanBright(cmd));
+    warningLog(import_chalk3.default.cyan("                  OPENSSL_CONF"), process.env.OPENSSL_CONF);
+    warningLog(import_chalk3.default.cyan("                  RANDFILE    "), process.env.RANDFILE);
+    warningLog(import_chalk3.default.cyan("                  CMD         openssl "), import_chalk3.default.cyanBright(cmd));
   }
   await ensure_openssl_installed();
   return await execute2(`${quote(opensslPath)} ${cmd}`, options);
 }
 
+// packages/node-opcua-pki/lib/pki/toolbox_pfx.ts
+var q = quote;
+var n2 = makePath;
+async function createPFX(options) {
+  const { certificateFile, privateKeyFile, outputFile, passphrase = "", caCertificateFiles } = options;
+  (0, import_node_assert4.default)(import_node_fs4.default.existsSync(certificateFile), `Certificate file does not exist: ${certificateFile}`);
+  (0, import_node_assert4.default)(import_node_fs4.default.existsSync(privateKeyFile), `Private key file does not exist: ${privateKeyFile}`);
+  let cmd = `pkcs12 -export`;
+  cmd += ` -in ${q(n2(certificateFile))}`;
+  cmd += ` -inkey ${q(n2(privateKeyFile))}`;
+  if (caCertificateFiles) {
+    for (const caFile of caCertificateFiles) {
+      (0, import_node_assert4.default)(import_node_fs4.default.existsSync(caFile), `CA certificate file does not exist: ${caFile}`);
+      cmd += ` -certfile ${q(n2(caFile))}`;
+    }
+  }
+  cmd += ` -out ${q(n2(outputFile))}`;
+  cmd += ` -passout pass:${passphrase}`;
+  await execute_openssl(cmd, {});
+}
+async function extractCertificateFromPFX(options) {
+  const { pfxFile, passphrase = "" } = options;
+  (0, import_node_assert4.default)(import_node_fs4.default.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
+  const cmd = `pkcs12 -in ${q(n2(pfxFile))} -clcerts -nokeys -nodes -passin pass:${passphrase}`;
+  return await execute_openssl(cmd, {});
+}
+async function extractPrivateKeyFromPFX(options) {
+  const { pfxFile, passphrase = "" } = options;
+  (0, import_node_assert4.default)(import_node_fs4.default.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
+  const cmd = `pkcs12 -in ${q(n2(pfxFile))} -nocerts -nodes -passin pass:${passphrase}`;
+  return await execute_openssl(cmd, {});
+}
+async function extractCACertificatesFromPFX(options) {
+  const { pfxFile, passphrase = "" } = options;
+  (0, import_node_assert4.default)(import_node_fs4.default.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
+  const cmd = `pkcs12 -in ${q(n2(pfxFile))} -cacerts -nokeys -nodes -passin pass:${passphrase}`;
+  return await execute_openssl(cmd, {});
+}
+async function extractAllFromPFX(options) {
+  const [certificate, privateKey, caCertificates] = await Promise.all([
+    extractCertificateFromPFX(options),
+    extractPrivateKeyFromPFX(options),
+    extractCACertificatesFromPFX(options)
+  ]);
+  return { certificate, privateKey, caCertificates };
+}
+async function convertPFXtoPEM(pfxFile, pemFile, passphrase = "") {
+  (0, import_node_assert4.default)(import_node_fs4.default.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
+  const cmd = `pkcs12 -in ${q(n2(pfxFile))} -out ${q(n2(pemFile))} -nodes -passin pass:${passphrase}`;
+  await execute_openssl(cmd, {});
+}
+async function dumpPFX(pfxFile, passphrase = "") {
+  (0, import_node_assert4.default)(import_node_fs4.default.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
+  const cmd = `pkcs12 -in ${q(n2(pfxFile))} -info -nodes -passin pass:${passphrase}`;
+  return await execute_openssl(cmd, {});
+}
+
+// packages/node-opcua-pki/lib/toolbox/display.ts
+var import_chalk4 = __toESM(require("chalk"));
+function displayTitle(str) {
+  if (!g_config.silent) {
+    warningLog("");
+    warningLog(import_chalk4.default.yellowBright(str));
+    warningLog(import_chalk4.default.yellow(new Array(str.length + 1).join("=")), "\n");
+  }
+}
+function displaySubtitle(str) {
+  if (!g_config.silent) {
+    warningLog("");
+    warningLog(`    ${import_chalk4.default.yellowBright(str)}`);
+    warningLog(`    ${import_chalk4.default.white(new Array(str.length + 1).join("-"))}`, "\n");
+  }
+}
+function display(str) {
+  if (!g_config.silent) {
+    warningLog(`       ${str}`);
+  }
+}
+
+// packages/node-opcua-pki/lib/toolbox/with_openssl/index.ts
+var import_node_constants = __toESM(require("constants"));
+
+// packages/node-opcua-pki/lib/toolbox/with_openssl/create_certificate_signing_request.ts
+var import_node_assert6 = __toESM(require("assert"));
+var import_node_fs6 = __toESM(require("fs"));
+var import_node_path4 = __toESM(require("path"));
+
+// packages/node-opcua-pki/lib/misc/subject.ts
+var import_node_opcua_crypto = require("node-opcua-crypto");
+
 // packages/node-opcua-pki/lib/toolbox/with_openssl/toolbox.ts
-var import_node_assert4 = __toESM(require("assert"));
-var import_node_fs4 = __toESM(require("fs"));
+var import_node_assert5 = __toESM(require("assert"));
+var import_node_fs5 = __toESM(require("fs"));
 var import_node_path3 = __toESM(require("path"));
 function openssl_require2DigitYearInDate() {
   if (!g_config.opensslVersion) {
@@ -621,13 +682,13 @@ var _counter = 0;
 function generateStaticConfig(configPath, options) {
   const prePath = options?.cwd || "";
   const originalFilename = !import_node_path3.default.isAbsolute(configPath) ? import_node_path3.default.join(prePath, configPath) : configPath;
-  let staticConfig = import_node_fs4.default.readFileSync(originalFilename, { encoding: "utf8" });
+  let staticConfig = import_node_fs5.default.readFileSync(originalFilename, { encoding: "utf8" });
   for (const envVar of getEnvironmentVarNames()) {
     staticConfig = staticConfig.replace(new RegExp(envVar.pattern, "gi"), getEnv(envVar.key));
   }
   const staticConfigPath = `${configPath}.${process.pid}-${_counter++}.tmp`;
   const temporaryConfigPath = !import_node_path3.default.isAbsolute(configPath) ? import_node_path3.default.join(prePath, staticConfigPath) : staticConfigPath;
-  import_node_fs4.default.writeFileSync(temporaryConfigPath, staticConfig);
+  import_node_fs5.default.writeFileSync(temporaryConfigPath, staticConfig);
   if (options?.cwd) {
     return import_node_path3.default.relative(options.cwd, temporaryConfigPath);
   } else {
@@ -652,8 +713,38 @@ function x509Date(date) {
   }
 }
 
+// packages/node-opcua-pki/lib/toolbox/with_openssl/create_certificate_signing_request.ts
+var q2 = quote;
+var n3 = makePath;
+async function createCertificateSigningRequestWithOpenSSL(certificateSigningRequestFilename, params) {
+  (0, import_node_assert6.default)(params);
+  (0, import_node_assert6.default)(params.rootDir);
+  (0, import_node_assert6.default)(params.configFile);
+  (0, import_node_assert6.default)(params.privateKey);
+  (0, import_node_assert6.default)(typeof params.privateKey === "string");
+  (0, import_node_assert6.default)(import_node_fs6.default.existsSync(params.configFile), `config file must exist ${params.configFile}`);
+  (0, import_node_assert6.default)(import_node_fs6.default.existsSync(params.privateKey), `Private key must exist${params.privateKey}`);
+  (0, import_node_assert6.default)(import_node_fs6.default.existsSync(params.rootDir), "RootDir key must exist");
+  (0, import_node_assert6.default)(typeof certificateSigningRequestFilename === "string");
+  processAltNames(params);
+  const configFile = generateStaticConfig(params.configFile, { cwd: params.rootDir });
+  const options = { cwd: params.rootDir, openssl_conf: import_node_path4.default.relative(params.rootDir, configFile) };
+  const configOption = ` -config ${q2(n3(configFile))}`;
+  const subject = params.subject ? new import_node_opcua_crypto.Subject(params.subject).toString() : void 0;
+  const subjectOptions = subject ? ` -subj "${subject}"` : "";
+  displaySubtitle("- Creating a Certificate Signing Request with openssl");
+  await execute_openssl(
+    "req -new  -sha256  -batch  -text " + configOption + " -key " + q2(n3(params.privateKey)) + subjectOptions + " -out " + q2(n3(certificateSigningRequestFilename)),
+    options
+  );
+}
+
+// packages/node-opcua-pki/lib/pki/templates/simple_config_template.cnf.ts
+var config = '##################################################################################################\n## SIMPLE OPENSSL CONFIG FILE FOR SELF-SIGNED CERTIFICATE GENERATION\n################################################################################################################\n\ndistinguished_name       = req_distinguished_name\ndefault_md               = sha1\n\ndefault_md                = sha256                      # The default digest algorithm\n\n[ v3_ca ]\nsubjectKeyIdentifier        = hash\nauthorityKeyIdentifier      = keyid:always,issuer:always\n\n# authorityKeyIdentifier    = keyid\nbasicConstraints            = CA:TRUE\nkeyUsage                    = critical, cRLSign, keyCertSign\nnsComment                   = "Self-signed Certificate for CA generated by Node-OPCUA Certificate utility"\n#nsCertType                 = sslCA, emailCA\n#subjectAltName             = email:copy\n#issuerAltName              = issuer:copy\n#obj                        = DER:02:03\n# crlDistributionPoints       = @crl_info\n# [ crl_info ]\n# URI.0                     = http://localhost:8900/crl.pem\nsubjectAltName              = $ENV::ALTNAME\n\n[ req ]\ndays                      = 390\nreq_extensions            = v3_req\nx509_extensions           = v3_ca\n\n[v3_req]\nbasicConstraints       = CA:false\nkeyUsage               = critical, cRLSign, keyCertSign\nsubjectAltName         = $ENV::ALTNAME\n\n[ v3_ca_signed]\nsubjectKeyIdentifier      = hash\nauthorityKeyIdentifier    = keyid,issuer\nbasicConstraints          = critical, CA:FALSE\nkeyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign\nextendedKeyUsage          = clientAuth,serverAuth \nnsComment                 = "certificate generated by Node-OPCUA Certificate utility and signed by a CA"\nsubjectAltName            = $ENV::ALTNAME\n[ v3_selfsigned]\nsubjectKeyIdentifier      = hash\nauthorityKeyIdentifier    = keyid,issuer\nbasicConstraints          = critical, CA:FALSE\nkeyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign\nextendedKeyUsage          = clientAuth,serverAuth \nnsComment                 = "Self-signed certificate generated by Node-OPCUA Certificate utility"\nsubjectAltName            = $ENV::ALTNAME\n[ req_distinguished_name ]\ncountryName             = Country Name (2 letter code)\ncountryName_default     = FR\ncountryName_min         = 2\ncountryName_max         = 2\n# stateOrProvinceName     = State or Province Name (full name)\n# stateOrProvinceName_default = Ile de France\n# localityName            = Locality Name (city, district)\n# localityName_default    = Paris\norganizationName          = Organization Name (company)\norganizationName_default  = NodeOPCUA\n# organizationalUnitName  = Organizational Unit Name (department, division)\n# organizationalUnitName_default = R&D\ncommonName                = Common Name (hostname, FQDN, IP, or your name)\ncommonName_max            = 256\ncommonName_default        = NodeOPCUA\n# emailAddress            = Email Address\n# emailAddress_max        = 40\n# emailAddress_default    = node-opcua (at) node-opcua (dot) com\nsubjectAltName            = $ENV::ALTNAME';
+var simple_config_template_cnf_default = config;
+
 // packages/node-opcua-pki/lib/ca/templates/ca_config_template.cnf.ts
-var config = `#.........DO NOT MODIFY BY HAND .........................
+var config2 = `#.........DO NOT MODIFY BY HAND .........................
 [ ca ]
 default_ca               = CA_default
 [ CA_default ]
@@ -782,22 +873,23 @@ subjectAltName            = $ENV::ALTNAME
 #issuerAltName            = issuer:copy
 authorityKeyIdentifier    = keyid:always,issuer:always
 #authorityInfoAccess       = @issuer_info`;
-var ca_config_template_cnf_default = config;
+var ca_config_template_cnf_default = config2;
 
 // packages/node-opcua-pki/lib/ca/certificate_authority.ts
 var defaultSubject = "/C=FR/ST=IDF/L=Paris/O=Local NODE-OPCUA Certificate Authority/CN=NodeOPCUA-CA";
 var configurationFileTemplate = ca_config_template_cnf_default;
-var config2 = {
+var configurationFileSimpleTemplate = simple_config_template_cnf_default;
+var config3 = {
   certificateDir: "INVALID",
   forceCA: false,
   pkiDir: "INVALID"
 };
-var n2 = makePath;
-var q = quote;
+var n4 = makePath;
+var q3 = quote;
 function octetStringToIpAddress(a) {
   return parseInt(a.substring(0, 2), 16).toString() + "." + parseInt(a.substring(2, 4), 16).toString() + "." + parseInt(a.substring(4, 6), 16).toString() + "." + parseInt(a.substring(6, 8), 16).toString();
 }
-(0, import_node_assert6.default)(octetStringToIpAddress("c07b9179") === "192.123.145.121");
+(0, import_node_assert7.default)(octetStringToIpAddress("c07b9179") === "192.123.145.121");
 async function construct_CertificateAuthority(certificateAuthority) {
   const subject = certificateAuthority.subject;
   const caRootDir = import_node_path5.default.resolve(certificateAuthority.rootDir);
@@ -812,49 +904,49 @@ async function construct_CertificateAuthority(certificateAuthority) {
   await make_folders();
   async function construct_default_files() {
     const serial = import_node_path5.default.join(caRootDir, "serial");
-    if (!import_node_fs6.default.existsSync(serial)) {
-      await import_node_fs6.default.promises.writeFile(serial, "1000");
+    if (!import_node_fs7.default.existsSync(serial)) {
+      await import_node_fs7.default.promises.writeFile(serial, "1000");
     }
     const crlNumber = import_node_path5.default.join(caRootDir, "crlnumber");
-    if (!import_node_fs6.default.existsSync(crlNumber)) {
-      await import_node_fs6.default.promises.writeFile(crlNumber, "1000");
+    if (!import_node_fs7.default.existsSync(crlNumber)) {
+      await import_node_fs7.default.promises.writeFile(crlNumber, "1000");
     }
     const indexFile = import_node_path5.default.join(caRootDir, "index.txt");
-    if (!import_node_fs6.default.existsSync(indexFile)) {
-      await import_node_fs6.default.promises.writeFile(indexFile, "");
+    if (!import_node_fs7.default.existsSync(indexFile)) {
+      await import_node_fs7.default.promises.writeFile(indexFile, "");
     }
   }
   await construct_default_files();
-  const caKeyExists = import_node_fs6.default.existsSync(import_node_path5.default.join(caRootDir, "private/cakey.pem"));
-  const caCertExists = import_node_fs6.default.existsSync(import_node_path5.default.join(caRootDir, "public/cacert.pem"));
-  if (caKeyExists && caCertExists && !config2.forceCA) {
+  const caKeyExists = import_node_fs7.default.existsSync(import_node_path5.default.join(caRootDir, "private/cakey.pem"));
+  const caCertExists = import_node_fs7.default.existsSync(import_node_path5.default.join(caRootDir, "public/cacert.pem"));
+  if (caKeyExists && caCertExists && !config3.forceCA) {
     debugLog("CA private key and certificate already exist ... skipping");
     return;
   }
   if (caKeyExists && !caCertExists) {
     debugLog("CA private key exists but cacert.pem is missing \u2014 rebuilding CA");
-    import_node_fs6.default.unlinkSync(import_node_path5.default.join(caRootDir, "private/cakey.pem"));
+    import_node_fs7.default.unlinkSync(import_node_path5.default.join(caRootDir, "private/cakey.pem"));
     const staleCsr = import_node_path5.default.join(caRootDir, "private/cakey.csr");
-    if (import_node_fs6.default.existsSync(staleCsr)) {
-      import_node_fs6.default.unlinkSync(staleCsr);
+    if (import_node_fs7.default.existsSync(staleCsr)) {
+      import_node_fs7.default.unlinkSync(staleCsr);
     }
   }
   displayTitle("Create Certificate Authority (CA)");
   const indexFileAttr = import_node_path5.default.join(caRootDir, "index.txt.attr");
-  if (!import_node_fs6.default.existsSync(indexFileAttr)) {
-    await import_node_fs6.default.promises.writeFile(indexFileAttr, "unique_subject = no");
+  if (!import_node_fs7.default.existsSync(indexFileAttr)) {
+    await import_node_fs7.default.promises.writeFile(indexFileAttr, "unique_subject = no");
   }
   const caConfigFile = certificateAuthority.configFile;
   if (1) {
     let data = configurationFileTemplate;
     data = makePath(data.replace(/%%ROOT_FOLDER%%/, caRootDir));
-    await import_node_fs6.default.promises.writeFile(caConfigFile, data);
+    await import_node_fs7.default.promises.writeFile(caConfigFile, data);
   }
   const subjectOpt = ` -subj "${subject.toString()}" `;
   processAltNames({});
   const options = { cwd: caRootDir };
   const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-  const configOption = ` -config ${q(n2(configFile))}`;
+  const configOption = ` -config ${q3(n4(configFile))}`;
   const keySize = certificateAuthority.keySize;
   const privateKeyFilename = import_node_path5.default.join(caRootDir, "private/cakey.pem");
   const csrFilename = import_node_path5.default.join(caRootDir, "private/cakey.csr");
@@ -862,14 +954,26 @@ async function construct_CertificateAuthority(certificateAuthority) {
   await (0, import_node_opcua_crypto2.generatePrivateKeyFile)(privateKeyFilename, keySize);
   displayTitle("Generate a certificate request for the CA key");
   await execute_openssl(
-    "req -new -sha256  -text  -extensions v3_ca_req" + configOption + " -key " + q(n2(privateKeyFilename)) + " -out " + q(n2(csrFilename)) + " " + subjectOpt,
-    options
-  );
-  displayTitle("Generate CA Certificate (self-signed)");
-  await execute_openssl(
-    " x509 -sha256 -req -days 3650  -text  -extensions v3_ca -extfile " + q(n2(configFile)) + " -in private/cakey.csr  -signkey " + q(n2(privateKeyFilename)) + " -out public/cacert.pem",
+    "req -new -sha256  -text  -extensions v3_ca_req" + configOption + " -key " + q3(n4(privateKeyFilename)) + " -out " + q3(n4(csrFilename)) + " " + subjectOpt,
     options
   );
+  const issuerCA = certificateAuthority._issuerCA;
+  if (issuerCA) {
+    displayTitle("Generate CA Certificate (signed by issuer CA)");
+    const issuerCert = import_node_path5.default.resolve(issuerCA.caCertificate);
+    const issuerKey = import_node_path5.default.resolve(issuerCA.rootDir, "private/cakey.pem");
+    const issuerSerial = import_node_path5.default.resolve(issuerCA.rootDir, "serial");
+    await execute_openssl(
+      " x509 -sha256 -req -days 3650  -text  -extensions v3_ca -extfile " + q3(n4(configFile)) + " -in private/cakey.csr  -CA " + q3(n4(issuerCert)) + " -CAkey " + q3(n4(issuerKey)) + " -CAserial " + q3(n4(issuerSerial)) + " -out public/cacert.pem",
+      options
+    );
+  } else {
+    displayTitle("Generate CA Certificate (self-signed)");
+    await execute_openssl(
+      " x509 -sha256 -req -days 3650  -text  -extensions v3_ca -extfile " + q3(n4(configFile)) + " -in private/cakey.csr  -signkey " + q3(n4(privateKeyFilename)) + " -out public/cacert.pem",
+      options
+    );
+  }
   displaySubtitle("generate initial CRL (Certificate Revocation List)");
   await regenerateCrl(certificateAuthority.revocationList, configOption, options);
   displayTitle("Create Certificate Authority (CA) ---> DONE");
@@ -879,7 +983,7 @@ async function regenerateCrl(revocationList, configOption, options) {
   await execute_openssl(`ca -gencrl ${configOption} -out crl/revocation_list.crl`, options);
   await execute_openssl("crl  -in  crl/revocation_list.crl -out  crl/revocation_list.der  -outform der", options);
   displaySubtitle("Display (Certificate Revocation List)");
-  await execute_openssl(`crl  -in ${q(n2(revocationList))} -text  -noout`, options);
+  await execute_openssl(`crl  -in ${q3(n4(revocationList))} -text  -noout`, options);
 }
 function parseOpenSSLDate(dateStr) {
   const raw = dateStr?.split(",")[0] ?? "";
@@ -900,12 +1004,15 @@ var CertificateAuthority = class {
   location;
   /** X.500 subject of the CA certificate. */
   subject;
+  /** @internal Parent CA (undefined for root CAs). */
+  _issuerCA;
   constructor(options) {
-    (0, import_node_assert6.default)(Object.prototype.hasOwnProperty.call(options, "location"));
-    (0, import_node_assert6.default)(Object.prototype.hasOwnProperty.call(options, "keySize"));
+    (0, import_node_assert7.default)(Object.prototype.hasOwnProperty.call(options, "location"));
+    (0, import_node_assert7.default)(Object.prototype.hasOwnProperty.call(options, "keySize"));
     this.location = options.location;
     this.keySize = options.keySize || 2048;
     this.subject = new import_node_opcua_crypto2.Subject(options.subject || defaultSubject);
+    this._issuerCA = options.issuerCA;
   }
   /** Absolute path to the CA root directory (alias for {@link location}). */
   get rootDir() {
@@ -919,6 +1026,18 @@ var CertificateAuthority = class {
   get caCertificate() {
     return makePath(this.rootDir, "./public/cacert.pem");
   }
+  /**
+   * Path to the issuer certificate chain (`public/issuer_chain.pem`).
+   *
+   * This file is created by {@link installCACertificate} when the
+   * provided cert file contains additional issuer certificates
+   * (e.g. intermediate + root). It is appended to signed certs
+   * by {@link constructCertificateChain} to produce a full chain
+   * per OPC UA Part 6 §6.2.6.
+   */
+  get issuerCertificateChain() {
+    return makePath(this.rootDir, "./public/issuer_chain.pem");
+  }
   /**
    * Path to the current Certificate Revocation List in DER format.
    * (`crl/revocation_list.der`)
@@ -976,10 +1095,10 @@ var CertificateAuthority = class {
    */
   getCRLDER() {
     const crlPath = this.revocationListDER;
-    if (!import_node_fs6.default.existsSync(crlPath)) {
+    if (!import_node_fs7.default.existsSync(crlPath)) {
       return Buffer.alloc(0);
     }
-    return import_node_fs6.default.readFileSync(crlPath);
+    return import_node_fs7.default.readFileSync(crlPath);
   }
   /**
    * Return the current Certificate Revocation List as a
@@ -989,10 +1108,10 @@ var CertificateAuthority = class {
    */
   getCRLPEM() {
     const crlPath = this.revocationList;
-    if (!import_node_fs6.default.existsSync(crlPath)) {
+    if (!import_node_fs7.default.existsSync(crlPath)) {
       return "";
     }
-    const raw = import_node_fs6.default.readFileSync(crlPath, "utf-8");
+    const raw = import_node_fs7.default.readFileSync(crlPath, "utf-8");
     const beginMarker = "-----BEGIN X509 CRL-----";
     const idx = raw.indexOf(beginMarker);
     if (idx > 0) {
@@ -1045,7 +1164,7 @@ var CertificateAuthority = class {
   getCertificateBySerial(serial) {
     const upper = serial.toUpperCase();
     const certFile = import_node_path5.default.join(this.rootDir, "certs", `${upper}.pem`);
-    if (!import_node_fs6.default.existsSync(certFile)) {
+    if (!import_node_fs7.default.existsSync(certFile)) {
       return void 0;
     }
     const pem = (0, import_node_opcua_crypto2.readCertificatePEM)(certFile);
@@ -1074,10 +1193,10 @@ var CertificateAuthority = class {
    */
   _parseIndexTxt() {
     const indexPath = this.indexFile;
-    if (!import_node_fs6.default.existsSync(indexPath)) {
+    if (!import_node_fs7.default.existsSync(indexPath)) {
       return [];
     }
-    const content = import_node_fs6.default.readFileSync(indexPath, "utf-8");
+    const content = import_node_fs7.default.readFileSync(indexPath, "utf-8");
     const lines = content.split("\n").filter((l) => l.trim().length > 0);
     const records = [];
     for (const line of lines) {
@@ -1131,25 +1250,145 @@ var CertificateAuthority = class {
    * internally so that callers can work with in-memory
    * buffers only.
    *
+   * The CA can override fields from the CSR by passing
+   * `options.dns`, `options.ip`, `options.applicationUri`,
+   * `options.startDate`, or `options.subject`.
+   *
    * @param csrDer - the CSR as a DER-encoded buffer
-   * @param options - signing options
-   * @param options.validity - certificate validity in days
-   *   (default: 365)
+   * @param options - signing options and CA overrides
    * @returns the signed certificate as a DER-encoded buffer
    */
   async signCertificateRequestFromDER(csrDer, options) {
     const validity = options?.validity ?? 365;
-    const tmpDir = await import_node_fs6.default.promises.mkdtemp(import_node_path5.default.join(import_node_os3.default.tmpdir(), "pki-sign-"));
+    const tmpDir = await import_node_fs7.default.promises.mkdtemp(import_node_path5.default.join(import_node_os3.default.tmpdir(), "pki-sign-"));
     try {
       const csrFile = import_node_path5.default.join(tmpDir, "request.csr");
       const certFile = import_node_path5.default.join(tmpDir, "certificate.pem");
       const csrPem = (0, import_node_opcua_crypto2.toPem)(csrDer, "CERTIFICATE REQUEST");
-      await import_node_fs6.default.promises.writeFile(csrFile, csrPem, "utf-8");
-      await this.signCertificateRequest(certFile, csrFile, { validity });
+      await import_node_fs7.default.promises.writeFile(csrFile, csrPem, "utf-8");
+      const signingParams = { validity };
+      if (options?.startDate) signingParams.startDate = options.startDate;
+      if (options?.dns) signingParams.dns = options.dns;
+      if (options?.ip) signingParams.ip = options.ip;
+      if (options?.applicationUri) signingParams.applicationUri = options.applicationUri;
+      if (options?.subject) signingParams.subject = options.subject;
+      await this.signCertificateRequest(certFile, csrFile, signingParams);
       const certPem = (0, import_node_opcua_crypto2.readCertificatePEM)(certFile);
       return (0, import_node_opcua_crypto2.convertPEMtoDER)(certPem);
     } finally {
-      await import_node_fs6.default.promises.rm(tmpDir, {
+      await import_node_fs7.default.promises.rm(tmpDir, {
+        recursive: true,
+        force: true
+      });
+    }
+  }
+  /**
+   * Generate a new RSA key pair, create an internal CSR, sign it
+   * with this CA, and return both the certificate and private key
+   * as DER-encoded buffers.
+   *
+   * The private key is **never stored** by the CA — it exists only
+   * in a temporary directory that is cleaned up after the operation.
+   *
+   * This is used by `StartNewKeyPairRequest` (OPC UA Part 12) for
+   * constrained devices that cannot generate their own keys.
+   *
+   * @param options - key generation and certificate parameters
+   * @returns `{ certificateDer, privateKey }` — certificate as DER,
+   *   private key as a branded `PrivateKey` buffer
+   */
+  async generateKeyPairAndSignDER(options) {
+    const keySize = options.keySize ?? 2048;
+    const validity = options.validity ?? 365;
+    const startDate = options.startDate ?? /* @__PURE__ */ new Date();
+    const tmpDir = await import_node_fs7.default.promises.mkdtemp(import_node_path5.default.join(import_node_os3.default.tmpdir(), "pki-keygen-"));
+    try {
+      const privateKeyFile = import_node_path5.default.join(tmpDir, "private_key.pem");
+      await (0, import_node_opcua_crypto2.generatePrivateKeyFile)(privateKeyFile, keySize);
+      const configFile = import_node_path5.default.join(tmpDir, "openssl.cnf");
+      await import_node_fs7.default.promises.writeFile(configFile, configurationFileSimpleTemplate, "utf-8");
+      const csrFile = import_node_path5.default.join(tmpDir, "request.csr");
+      await createCertificateSigningRequestWithOpenSSL(csrFile, {
+        rootDir: tmpDir,
+        configFile,
+        privateKey: privateKeyFile,
+        applicationUri: options.applicationUri,
+        subject: options.subject,
+        dns: options.dns ?? [],
+        ip: options.ip ?? [],
+        purpose: import_node_opcua_crypto2.CertificatePurpose.ForApplication
+      });
+      const certFile = import_node_path5.default.join(tmpDir, "certificate.pem");
+      await this.signCertificateRequest(certFile, csrFile, {
+        applicationUri: options.applicationUri,
+        dns: options.dns,
+        ip: options.ip,
+        startDate,
+        validity
+      });
+      const certPem = (0, import_node_opcua_crypto2.readCertificatePEM)(certFile);
+      const certificateDer = (0, import_node_opcua_crypto2.convertPEMtoDER)(certPem);
+      const privateKey = (0, import_node_opcua_crypto2.readPrivateKey)(privateKeyFile);
+      return { certificateDer, privateKey };
+    } finally {
+      await import_node_fs7.default.promises.rm(tmpDir, {
+        recursive: true,
+        force: true
+      });
+    }
+  }
+  /**
+   * Generate a new RSA key pair, create an internal CSR, sign it
+   * with this CA, and return the result as a PKCS#12 (PFX)
+   * buffer bundling the certificate, private key, and CA chain.
+   *
+   * The private key is **never stored** by the CA — it exists only
+   * in a temporary directory that is cleaned up after the operation.
+   *
+   * @param options - key generation, certificate, and PFX options
+   * @returns the PFX as a `Buffer`
+   */
+  async generateKeyPairAndSignPFX(options) {
+    const keySize = options.keySize ?? 2048;
+    const validity = options.validity ?? 365;
+    const startDate = options.startDate ?? /* @__PURE__ */ new Date();
+    const passphrase = options.passphrase ?? "";
+    const tmpDir = await import_node_fs7.default.promises.mkdtemp(import_node_path5.default.join(import_node_os3.default.tmpdir(), "pki-keygen-pfx-"));
+    try {
+      const privateKeyFile = import_node_path5.default.join(tmpDir, "private_key.pem");
+      await (0, import_node_opcua_crypto2.generatePrivateKeyFile)(privateKeyFile, keySize);
+      const configFile = import_node_path5.default.join(tmpDir, "openssl.cnf");
+      await import_node_fs7.default.promises.writeFile(configFile, configurationFileSimpleTemplate, "utf-8");
+      const csrFile = import_node_path5.default.join(tmpDir, "request.csr");
+      await createCertificateSigningRequestWithOpenSSL(csrFile, {
+        rootDir: tmpDir,
+        configFile,
+        privateKey: privateKeyFile,
+        applicationUri: options.applicationUri,
+        subject: options.subject,
+        dns: options.dns ?? [],
+        ip: options.ip ?? [],
+        purpose: import_node_opcua_crypto2.CertificatePurpose.ForApplication
+      });
+      const certFile = import_node_path5.default.join(tmpDir, "certificate.pem");
+      await this.signCertificateRequest(certFile, csrFile, {
+        applicationUri: options.applicationUri,
+        dns: options.dns,
+        ip: options.ip,
+        startDate,
+        validity
+      });
+      const pfxFile = import_node_path5.default.join(tmpDir, "bundle.pfx");
+      await createPFX({
+        certificateFile: certFile,
+        privateKeyFile,
+        outputFile: pfxFile,
+        passphrase,
+        caCertificateFiles: [this.caCertificate]
+      });
+      return await import_node_fs7.default.promises.readFile(pfxFile);
+    } finally {
+      await import_node_fs7.default.promises.rm(tmpDir, {
         recursive: true,
         force: true
       });
@@ -1171,7 +1410,7 @@ var CertificateAuthority = class {
     const info = (0, import_node_opcua_crypto2.exploreCertificate)(certDer);
     const serial = info.tbsCertificate.serialNumber.replace(/:/g, "").toUpperCase();
     const storedCertFile = import_node_path5.default.join(this.rootDir, "certs", `${serial}.pem`);
-    if (!import_node_fs6.default.existsSync(storedCertFile)) {
+    if (!import_node_fs7.default.existsSync(storedCertFile)) {
       throw new Error(`Cannot revoke: no stored certificate found for serial ${serial} at ${storedCertFile}`);
     }
     await this.revokeCertificate(storedCertFile, {
@@ -1186,6 +1425,204 @@ var CertificateAuthority = class {
   async initialize() {
     await construct_CertificateAuthority(this);
   }
+  /**
+   * Initialize the CA directory structure and generate the
+   * private key + CSR **without signing**.
+   *
+   * Use this when the CA certificate will be signed by an
+   * external (third-party) root CA.  After receiving the signed
+   * certificate, call {@link installCACertificate} to complete
+   * the setup.
+   *
+   * **Idempotent / restart-safe:**
+   * - If the CA certificate exists and is valid → `{ status: "ready" }`
+   * - If the CA certificate has expired → `{ status: "expired", csrPath, expiryDate }`
+   *   (a new CSR is generated, preserving the existing private key)
+   * - If key + CSR exist but no cert (restart before install) →
+   *   `{ status: "pending", csrPath }` without regenerating
+   * - Otherwise → generates key + CSR → `{ status: "created", csrPath }`
+   *
+   * @returns an {@link InitializeCSRResult} describing the CA state
+   */
+  async initializeCSR() {
+    const caRootDir = import_node_path5.default.resolve(this.rootDir);
+    mkdirRecursiveSync(caRootDir);
+    for (const dir of ["private", "public", "certs", "crl", "conf"]) {
+      mkdirRecursiveSync(import_node_path5.default.join(caRootDir, dir));
+    }
+    const caCertFile = this.caCertificate;
+    const privateKeyFile = import_node_path5.default.join(caRootDir, "private/cakey.pem");
+    const csrFile = import_node_path5.default.join(caRootDir, "private/cakey.csr");
+    if (import_node_fs7.default.existsSync(caCertFile)) {
+      const certDer = (0, import_node_opcua_crypto2.convertPEMtoDER)((0, import_node_opcua_crypto2.readCertificatePEM)(caCertFile));
+      const certInfo = (0, import_node_opcua_crypto2.exploreCertificate)(certDer);
+      const notAfter = certInfo.tbsCertificate.validity.notAfter;
+      if (notAfter.getTime() < Date.now()) {
+        debugLog("CA certificate has expired \u2014 generating renewal CSR");
+        await this._generateCSR(caRootDir, privateKeyFile, csrFile);
+        return { status: "expired", csrPath: csrFile, expiryDate: notAfter };
+      }
+      debugLog("CA certificate already exists and is valid \u2014 ready");
+      return { status: "ready" };
+    }
+    if (import_node_fs7.default.existsSync(privateKeyFile) && import_node_fs7.default.existsSync(csrFile)) {
+      debugLog("CA key + CSR already exist \u2014 pending external signing");
+      return { status: "pending", csrPath: csrFile };
+    }
+    const serial = import_node_path5.default.join(caRootDir, "serial");
+    if (!import_node_fs7.default.existsSync(serial)) {
+      await import_node_fs7.default.promises.writeFile(serial, "1000");
+    }
+    const crlNumber = import_node_path5.default.join(caRootDir, "crlnumber");
+    if (!import_node_fs7.default.existsSync(crlNumber)) {
+      await import_node_fs7.default.promises.writeFile(crlNumber, "1000");
+    }
+    const indexFile = import_node_path5.default.join(caRootDir, "index.txt");
+    if (!import_node_fs7.default.existsSync(indexFile)) {
+      await import_node_fs7.default.promises.writeFile(indexFile, "");
+    }
+    const indexFileAttr = import_node_path5.default.join(caRootDir, "index.txt.attr");
+    if (!import_node_fs7.default.existsSync(indexFileAttr)) {
+      await import_node_fs7.default.promises.writeFile(indexFileAttr, "unique_subject = no");
+    }
+    const caConfigFile = this.configFile;
+    let data = configurationFileTemplate;
+    data = makePath(data.replace(/%%ROOT_FOLDER%%/, caRootDir));
+    await import_node_fs7.default.promises.writeFile(caConfigFile, data);
+    if (!import_node_fs7.default.existsSync(privateKeyFile)) {
+      await (0, import_node_opcua_crypto2.generatePrivateKeyFile)(privateKeyFile, this.keySize);
+    }
+    await this._generateCSR(caRootDir, privateKeyFile, csrFile);
+    return { status: "created", csrPath: csrFile };
+  }
+  /**
+   * Check whether the CA certificate needs renewal and, if so,
+   * generate a new CSR for re-signing by the external root CA.
+   *
+   * Use this while the CA is running to detect upcoming expiry
+   * **before** it actually expires. The existing private key is
+   * preserved so previously issued certs remain valid.
+   *
+   * @param thresholdDays - number of days before expiry at which
+   *   to trigger renewal (default: 30)
+   * @returns an {@link InitializeCSRResult} — `"expired"` if
+   *   renewal is needed, `"ready"` if the cert is still valid
+   */
+  async renewCSR(thresholdDays = 30) {
+    const caRootDir = import_node_path5.default.resolve(this.rootDir);
+    const caCertFile = this.caCertificate;
+    const privateKeyFile = import_node_path5.default.join(caRootDir, "private/cakey.pem");
+    const csrFile = import_node_path5.default.join(caRootDir, "private/cakey.csr");
+    if (!import_node_fs7.default.existsSync(caCertFile)) {
+      return this.initializeCSR();
+    }
+    const certDer = (0, import_node_opcua_crypto2.convertPEMtoDER)((0, import_node_opcua_crypto2.readCertificatePEM)(caCertFile));
+    const certInfo = (0, import_node_opcua_crypto2.exploreCertificate)(certDer);
+    const notAfter = certInfo.tbsCertificate.validity.notAfter;
+    const thresholdMs = thresholdDays * 24 * 60 * 60 * 1e3;
+    if (notAfter.getTime() - Date.now() < thresholdMs) {
+      debugLog(`CA certificate expires within ${thresholdDays} days \u2014 generating renewal CSR`);
+      await this._generateCSR(caRootDir, privateKeyFile, csrFile);
+      return { status: "expired", csrPath: csrFile, expiryDate: notAfter };
+    }
+    return { status: "ready" };
+  }
+  /**
+   * Generate a CSR using the existing private key.
+   * @internal
+   */
+  async _generateCSR(caRootDir, privateKeyFile, csrFile) {
+    const subjectOpt = ` -subj "${this.subject.toString()}" `;
+    processAltNames({});
+    const options = { cwd: caRootDir };
+    const configFile = generateStaticConfig("conf/caconfig.cnf", options);
+    const configOption = ` -config ${q3(n4(configFile))}`;
+    await execute_openssl(
+      "req -new -sha256  -text  -extensions v3_ca_req" + configOption + " -key " + q3(n4(privateKeyFile)) + " -out " + q3(n4(csrFile)) + " " + subjectOpt,
+      options
+    );
+  }
+  /**
+   * Install an externally-signed CA certificate and generate
+   * the initial CRL.
+   *
+   * Call this after {@link initializeCSR} once the external
+   * root CA has signed the CSR.
+   *
+   * **Safety checks:**
+   * - Verifies that the certificate's public key matches the
+   *   CA private key before installing.
+   *
+   * @param signedCertFile - path to the PEM-encoded signed
+   *   CA certificate (issued by the external root CA)
+   * @returns an {@link InstallCACertificateResult} with
+   *   `status: "success"` or `status: "error"` and a `reason`
+   */
+  async installCACertificate(signedCertFile) {
+    const caRootDir = import_node_path5.default.resolve(this.rootDir);
+    const caCertFile = this.caCertificate;
+    const privateKeyFile = import_node_path5.default.join(caRootDir, "private/cakey.pem");
+    const fullPem = await import_node_fs7.default.promises.readFile(signedCertFile, "utf8");
+    const pemBlocks = fullPem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
+    if (!pemBlocks || pemBlocks.length === 0) {
+      return {
+        status: "error",
+        reason: "no_certificate_found",
+        message: "The provided file does not contain any PEM-encoded certificate."
+      };
+    }
+    const certDer = (0, import_node_opcua_crypto2.convertPEMtoDER)(pemBlocks[0]);
+    const privateKey = (0, import_node_opcua_crypto2.readPrivateKey)(privateKeyFile);
+    if (!(0, import_node_opcua_crypto2.certificateMatchesPrivateKey)(certDer, privateKey)) {
+      return {
+        status: "error",
+        reason: "certificate_key_mismatch",
+        message: "The provided certificate does not match the CA private key. Ensure the certificate was signed from the CSR generated by initializeCSR()."
+      };
+    }
+    await import_node_fs7.default.promises.writeFile(caCertFile, `${pemBlocks[0]}
+`);
+    const issuerChainFile = this.issuerCertificateChain;
+    if (pemBlocks.length > 1) {
+      const issuerPem = `${pemBlocks.slice(1).join("\n")}
+`;
+      await import_node_fs7.default.promises.writeFile(issuerChainFile, issuerPem);
+      debugLog(`Stored ${pemBlocks.length - 1} issuer certificate(s) in issuer_chain.pem`);
+    } else {
+      if (import_node_fs7.default.existsSync(issuerChainFile)) {
+        await import_node_fs7.default.promises.unlink(issuerChainFile);
+      }
+    }
+    const options = { cwd: caRootDir };
+    const configFile = generateStaticConfig("conf/caconfig.cnf", options);
+    const configOption = ` -config ${q3(n4(configFile))}`;
+    await regenerateCrl(this.revocationList, configOption, options);
+    return { status: "success" };
+  }
+  /**
+   * Sign a CSR with CA extensions (`v3_ca`), producing a
+   * subordinate CA certificate.
+   *
+   * Unlike {@link signCertificateRequest} which signs with
+   * end-entity extensions (SANs, etc.), this method signs
+   * with `basicConstraints = CA:TRUE` and `keyUsage =
+   * keyCertSign, cRLSign`.
+   *
+   * @param certFile - output path for the signed CA cert (PEM)
+   * @param csrFile - path to the subordinate CA's CSR
+   * @param params - signing parameters
+   */
+  async signCACertificateRequest(certFile, csrFile, params) {
+    const caRootDir = import_node_path5.default.resolve(this.rootDir);
+    const options = { cwd: caRootDir };
+    const configFile = generateStaticConfig("conf/caconfig.cnf", options);
+    const validity = params.validity ?? 3650;
+    await execute_openssl(
+      ` x509 -sha256 -req -days ${validity} -text  -extensions v3_ca -extfile ` + q3(n4(configFile)) + " -in " + q3(n4(csrFile)) + " -CA " + q3(n4(this.caCertificate)) + " -CAkey " + q3(n4(import_node_path5.default.join(caRootDir, "private/cakey.pem"))) + " -CAserial " + q3(n4(import_node_path5.default.join(caRootDir, "serial"))) + " -out " + q3(n4(certFile)),
+      options
+    );
+    await this.constructCertificateChain(certFile);
+  }
   /**
    * Rebuild the combined CA certificate + CRL file.
    *
@@ -1195,13 +1632,13 @@ var CertificateAuthority = class {
    */
   async constructCACertificateWithCRL() {
     const cacertWithCRL = this.caCertificateWithCrl;
-    if (import_node_fs6.default.existsSync(this.revocationList)) {
-      await import_node_fs6.default.promises.writeFile(
+    if (import_node_fs7.default.existsSync(this.revocationList)) {
+      await import_node_fs7.default.promises.writeFile(
         cacertWithCRL,
-        import_node_fs6.default.readFileSync(this.caCertificate, "utf8") + import_node_fs6.default.readFileSync(this.revocationList, "utf8")
+        import_node_fs7.default.readFileSync(this.caCertificate, "utf8") + import_node_fs7.default.readFileSync(this.revocationList, "utf8")
       );
     } else {
-      await import_node_fs6.default.promises.writeFile(cacertWithCRL, import_node_fs6.default.readFileSync(this.caCertificate));
+      await import_node_fs7.default.promises.writeFile(cacertWithCRL, import_node_fs7.default.readFileSync(this.caCertificate));
     }
   }
   /**
@@ -1211,14 +1648,15 @@ var CertificateAuthority = class {
    * @param certificate - path to the certificate file to extend
    */
   async constructCertificateChain(certificate) {
-    (0, import_node_assert6.default)(import_node_fs6.default.existsSync(certificate));
-    (0, import_node_assert6.default)(import_node_fs6.default.existsSync(this.caCertificate));
+    (0, import_node_assert7.default)(import_node_fs7.default.existsSync(certificate));
+    (0, import_node_assert7.default)(import_node_fs7.default.existsSync(this.caCertificate));
     debugLog(import_chalk5.default.yellow("        certificate file :"), import_chalk5.default.cyan(certificate));
-    await import_node_fs6.default.promises.writeFile(
-      certificate,
-      await import_node_fs6.default.promises.readFile(certificate, "utf8") + await import_node_fs6.default.promises.readFile(this.caCertificate, "utf8")
-      //   + fs.readFileSync(this.revocationList)
-    );
+    let chain = await import_node_fs7.default.promises.readFile(certificate, "utf8");
+    chain += await import_node_fs7.default.promises.readFile(this.caCertificate, "utf8");
+    if (import_node_fs7.default.existsSync(this.issuerCertificateChain)) {
+      chain += await import_node_fs7.default.promises.readFile(this.issuerCertificateChain, "utf8");
+    }
+    await import_node_fs7.default.promises.writeFile(certificate, chain);
   }
   /**
    * Create a self-signed certificate using OpenSSL.
@@ -1228,8 +1666,8 @@ var CertificateAuthority = class {
    * @param params - certificate parameters (subject, validity, SANs)
    */
   async createSelfSignedCertificate(certificateFile, privateKey, params) {
-    (0, import_node_assert6.default)(typeof privateKey === "string");
-    (0, import_node_assert6.default)(import_node_fs6.default.existsSync(privateKey));
+    (0, import_node_assert7.default)(typeof privateKey === "string");
+    (0, import_node_assert7.default)(import_node_fs7.default.existsSync(privateKey));
     if (!certificateFileExist(certificateFile)) {
       return;
     }
@@ -1237,7 +1675,7 @@ var CertificateAuthority = class {
     adjustApplicationUri(params);
     processAltNames(params);
     const csrFile = `${certificateFile}_csr`;
-    (0, import_node_assert6.default)(csrFile);
+    (0, import_node_assert7.default)(csrFile);
     const configFile = generateStaticConfig(this.configFile, { cwd: this.rootDir });
     const options = {
       cwd: this.rootDir,
@@ -1248,19 +1686,19 @@ var CertificateAuthority = class {
     const subjectOptions = subject && subject.length > 1 ? ` -subj ${subject} ` : "";
     displaySubtitle("- the certificate signing request");
     await execute_openssl(
-      "req  -new -sha256 -text " + configOption + subjectOptions + " -batch -key " + q(n2(privateKey)) + " -out " + q(n2(csrFile)),
+      "req  -new -sha256 -text " + configOption + subjectOptions + " -batch -key " + q3(n4(privateKey)) + " -out " + q3(n4(csrFile)),
       options
     );
     displaySubtitle("- creating the self-signed certificate");
     await execute_openssl(
-      "ca  -selfsign  -keyfile " + q(n2(privateKey)) + " -startdate " + x509Date(params.startDate) + " -enddate " + x509Date(params.endDate) + " -batch -out " + q(n2(certificateFile)) + " -in " + q(n2(csrFile)),
+      "ca  -selfsign  -keyfile " + q3(n4(privateKey)) + " -startdate " + x509Date(params.startDate) + " -enddate " + x509Date(params.endDate) + " -batch -out " + q3(n4(certificateFile)) + " -in " + q3(n4(csrFile)),
       options
     );
     displaySubtitle("- dump the certificate for a check");
-    await execute_openssl(`x509 -in ${q(n2(certificateFile))}  -dates -fingerprint -purpose -noout`, {});
+    await execute_openssl(`x509 -in ${q3(n4(certificateFile))}  -dates -fingerprint -purpose -noout`, {});
     displaySubtitle("- verify self-signed certificate");
-    await execute_openssl_no_failure(`verify -verbose -CAfile ${q(n2(certificateFile))} ${q(n2(certificateFile))}`, options);
-    await import_node_fs6.default.promises.unlink(csrFile);
+    await execute_openssl_no_failure(`verify -verbose -CAfile ${q3(n4(certificateFile))} ${q3(n4(certificateFile))}`, options);
+    await import_node_fs7.default.promises.unlink(csrFile);
   }
   /**
    * Revoke a certificate and regenerate the CRL.
@@ -1289,22 +1727,22 @@ var CertificateAuthority = class {
     setEnv("ALTNAME", "");
     const randomFile = import_node_path5.default.join(this.rootDir, "random.rnd");
     setEnv("RANDFILE", randomFile);
-    const configOption = ` -config ${q(n2(configFile))}`;
+    const configOption = ` -config ${q3(n4(configFile))}`;
     const reason = params.reason || "keyCompromise";
-    (0, import_node_assert6.default)(crlReasons.indexOf(reason) >= 0);
+    (0, import_node_assert7.default)(crlReasons.indexOf(reason) >= 0);
     displayTitle(`Revoking certificate  ${certificate}`);
     displaySubtitle("Revoke certificate");
-    await execute_openssl_no_failure(`ca -verbose ${configOption} -revoke ${q(certificate)} -crl_reason ${reason}`, options);
+    await execute_openssl_no_failure(`ca -verbose ${configOption} -revoke ${q3(certificate)} -crl_reason ${reason}`, options);
     await regenerateCrl(this.revocationList, configOption, options);
     displaySubtitle("Verify that certificate is revoked");
     await execute_openssl_no_failure(
-      "verify -verbose -CRLfile " + q(n2(this.revocationList)) + " -CAfile " + q(n2(this.caCertificate)) + " -crl_check " + q(n2(certificate)),
+      "verify -verbose -CRLfile " + q3(n4(this.revocationList)) + " -CAfile " + q3(n4(this.caCertificate)) + " -crl_check " + q3(n4(certificate)),
       options
     );
     displaySubtitle("Produce CRL in DER form ");
-    await execute_openssl(`crl  -in ${q(n2(this.revocationList))} -out crl/revocation_list.der  -outform der`, options);
+    await execute_openssl(`crl  -in ${q3(n4(this.revocationList))} -out crl/revocation_list.der  -outform der`, options);
     displaySubtitle("Produce CRL in PEM form ");
-    await execute_openssl(`crl  -in ${q(n2(this.revocationList))} -out crl/revocation_list.pem  -outform pem -text `, options);
+    await execute_openssl(`crl  -in ${q3(n4(this.revocationList))} -out crl/revocation_list.pem  -outform pem -text `, options);
   }
   /**
    * Sign a Certificate Signing Request (CSR) with this CA.
@@ -1320,7 +1758,7 @@ var CertificateAuthority = class {
    */
   async signCertificateRequest(certificate, certificateSigningRequestFilename, params1) {
     await ensure_openssl_installed();
-    (0, import_node_assert6.default)(import_node_fs6.default.existsSync(certificateSigningRequestFilename));
+    (0, import_node_assert7.default)(import_node_fs7.default.existsSync(certificateSigningRequestFilename));
     if (!certificateFileExist(certificate)) {
       return "";
     }
@@ -1347,11 +1785,11 @@ var CertificateAuthority = class {
     displaySubtitle("- then we ask the authority to sign the certificate signing request");
     const configOption = ` -config ${configFile}`;
     await execute_openssl(
-      "ca " + configOption + " -startdate " + x509Date(params1.startDate) + " -enddate " + x509Date(params1.endDate) + " -batch -out " + q(n2(certificate)) + " -in " + q(n2(certificateSigningRequestFilename)),
+      "ca " + configOption + " -startdate " + x509Date(params1.startDate) + " -enddate " + x509Date(params1.endDate) + " -batch -out " + q3(n4(certificate)) + " -in " + q3(n4(certificateSigningRequestFilename)),
       options
     );
     displaySubtitle("- dump the certificate for a check");
-    await execute_openssl(`x509 -in ${q(n2(certificate))}  -dates -fingerprint -purpose -noout`, options);
+    await execute_openssl(`x509 -in ${q3(n4(certificate))}  -dates -fingerprint -purpose -noout`, options);
     displaySubtitle("- construct CA certificate with CRL");
     await this.constructCACertificateWithCRL();
     displaySubtitle("- construct certificate chain");
@@ -1374,7 +1812,7 @@ var CertificateAuthority = class {
       const _configOption = ` -config ${configFile}`;
       _configOption;
       await execute_openssl_no_failure(
-        `verify -verbose  -CAfile ${q(n2(this.caCertificateWithCrl))} ${q(n2(certificate))}`,
+        `verify -verbose  -CAfile ${q3(n4(this.caCertificateWithCrl))} ${q3(n4(certificate))}`,
         options
       );
     }
@@ -1383,7 +1821,7 @@ var CertificateAuthority = class {
 
 // packages/node-opcua-pki/lib/pki/certificate_manager.ts
 var import_node_events = require("events");
-var import_node_fs9 = __toESM(require("fs"));
+var import_node_fs10 = __toESM(require("fs"));
 var import_node_path6 = __toESM(require("path"));
 var import_global_mutex = require("@ster5/global-mutex");
 var import_chalk6 = __toESM(require("chalk"));
@@ -1391,21 +1829,21 @@ var import_chokidar = __toESM(require("chokidar"));
 var import_node_opcua_crypto5 = require("node-opcua-crypto");
 
 // packages/node-opcua-pki/lib/toolbox/without_openssl/create_certificate_signing_request.ts
-var import_node_assert7 = __toESM(require("assert"));
-var import_node_fs7 = __toESM(require("fs"));
+var import_node_assert8 = __toESM(require("assert"));
+var import_node_fs8 = __toESM(require("fs"));
 var import_node_opcua_crypto3 = require("node-opcua-crypto");
 async function createCertificateSigningRequestAsync(certificateSigningRequestFilename, params) {
-  (0, import_node_assert7.default)(params);
-  (0, import_node_assert7.default)(params.rootDir);
-  (0, import_node_assert7.default)(params.configFile);
-  (0, import_node_assert7.default)(params.privateKey);
-  (0, import_node_assert7.default)(typeof params.privateKey === "string");
-  (0, import_node_assert7.default)(import_node_fs7.default.existsSync(params.privateKey), `Private key must exist${params.privateKey}`);
-  (0, import_node_assert7.default)(import_node_fs7.default.existsSync(params.rootDir), "RootDir key must exist");
-  (0, import_node_assert7.default)(typeof certificateSigningRequestFilename === "string");
+  (0, import_node_assert8.default)(params);
+  (0, import_node_assert8.default)(params.rootDir);
+  (0, import_node_assert8.default)(params.configFile);
+  (0, import_node_assert8.default)(params.privateKey);
+  (0, import_node_assert8.default)(typeof params.privateKey === "string");
+  (0, import_node_assert8.default)(import_node_fs8.default.existsSync(params.privateKey), `Private key must exist${params.privateKey}`);
+  (0, import_node_assert8.default)(import_node_fs8.default.existsSync(params.rootDir), "RootDir key must exist");
+  (0, import_node_assert8.default)(typeof certificateSigningRequestFilename === "string");
   const subject = params.subject ? new import_node_opcua_crypto3.Subject(params.subject).toString() : void 0;
   displaySubtitle("- Creating a Certificate Signing Request with subtile");
-  const privateKeyPem = await import_node_fs7.default.promises.readFile(params.privateKey, "utf-8");
+  const privateKeyPem = await import_node_fs8.default.promises.readFile(params.privateKey, "utf-8");
   const privateKey = await (0, import_node_opcua_crypto3.pemToPrivateKey)(privateKeyPem);
   const { csr } = await (0, import_node_opcua_crypto3.createCertificateSigningRequest)({
     privateKey,
@@ -1415,33 +1853,33 @@ async function createCertificateSigningRequestAsync(certificateSigningRequestFil
     applicationUri: params.applicationUri,
     purpose: params.purpose
   });
-  await import_node_fs7.default.promises.writeFile(certificateSigningRequestFilename, csr, "utf-8");
+  await import_node_fs8.default.promises.writeFile(certificateSigningRequestFilename, csr, "utf-8");
   display(`- privateKey ${params.privateKey}`);
   display(`- certificateSigningRequestFilename ${certificateSigningRequestFilename}`);
 }
 
 // packages/node-opcua-pki/lib/toolbox/without_openssl/create_self_signed_certificate.ts
-var import_node_assert8 = __toESM(require("assert"));
-var import_node_fs8 = __toESM(require("fs"));
+var import_node_assert9 = __toESM(require("assert"));
+var import_node_fs9 = __toESM(require("fs"));
 var import_node_opcua_crypto4 = require("node-opcua-crypto");
 async function createSelfSignedCertificateAsync(certificate, params) {
   params.purpose = params.purpose || import_node_opcua_crypto4.CertificatePurpose.ForApplication;
-  (0, import_node_assert8.default)(params.purpose, "Please provide a Certificate Purpose");
-  (0, import_node_assert8.default)(import_node_fs8.default.existsSync(params.configFile));
-  (0, import_node_assert8.default)(import_node_fs8.default.existsSync(params.rootDir));
-  (0, import_node_assert8.default)(import_node_fs8.default.existsSync(params.privateKey));
+  (0, import_node_assert9.default)(params.purpose, "Please provide a Certificate Purpose");
+  (0, import_node_assert9.default)(import_node_fs9.default.existsSync(params.configFile));
+  (0, import_node_assert9.default)(import_node_fs9.default.existsSync(params.rootDir));
+  (0, import_node_assert9.default)(import_node_fs9.default.existsSync(params.privateKey));
   if (!params.subject) {
     throw Error("Missing subject");
   }
-  (0, import_node_assert8.default)(typeof params.applicationUri === "string");
-  (0, import_node_assert8.default)(Array.isArray(params.dns));
+  (0, import_node_assert9.default)(typeof params.applicationUri === "string");
+  (0, import_node_assert9.default)(Array.isArray(params.dns));
   adjustDate(params);
-  (0, import_node_assert8.default)(Object.prototype.hasOwnProperty.call(params, "validity"));
+  (0, import_node_assert9.default)(Object.prototype.hasOwnProperty.call(params, "validity"));
   let subject = new import_node_opcua_crypto4.Subject(params.subject);
   subject = subject.toString();
   const purpose = params.purpose;
   displayTitle("Generate a certificate request");
-  const privateKeyPem = await import_node_fs8.default.promises.readFile(params.privateKey, "utf-8");
+  const privateKeyPem = await import_node_fs9.default.promises.readFile(params.privateKey, "utf-8");
   const privateKey = await (0, import_node_opcua_crypto4.pemToPrivateKey)(privateKeyPem);
   const { cert } = await (0, import_node_opcua_crypto4.createSelfSignedCertificate)({
     privateKey,
@@ -1454,19 +1892,15 @@ async function createSelfSignedCertificateAsync(certificate, params) {
     applicationUri: params.applicationUri,
     purpose
   });
-  await import_node_fs8.default.promises.writeFile(certificate, cert, "utf-8");
+  await import_node_fs9.default.promises.writeFile(certificate, cert, "utf-8");
 }
 async function createSelfSignedCertificate(certificate, params) {
   await createSelfSignedCertificateAsync(certificate, params);
 }
 
-// packages/node-opcua-pki/lib/pki/templates/simple_config_template.cnf.ts
-var config3 = '##################################################################################################\n## SIMPLE OPENSSL CONFIG FILE FOR SELF-SIGNED CERTIFICATE GENERATION\n################################################################################################################\n\ndistinguished_name       = req_distinguished_name\ndefault_md               = sha1\n\ndefault_md                = sha256                      # The default digest algorithm\n\n[ v3_ca ]\nsubjectKeyIdentifier        = hash\nauthorityKeyIdentifier      = keyid:always,issuer:always\n\n# authorityKeyIdentifier    = keyid\nbasicConstraints            = CA:TRUE\nkeyUsage                    = critical, cRLSign, keyCertSign\nnsComment                   = "Self-signed Certificate for CA generated by Node-OPCUA Certificate utility"\n#nsCertType                 = sslCA, emailCA\n#subjectAltName             = email:copy\n#issuerAltName              = issuer:copy\n#obj                        = DER:02:03\n# crlDistributionPoints       = @crl_info\n# [ crl_info ]\n# URI.0                     = http://localhost:8900/crl.pem\nsubjectAltName              = $ENV::ALTNAME\n\n[ req ]\ndays                      = 390\nreq_extensions            = v3_req\nx509_extensions           = v3_ca\n\n[v3_req]\nbasicConstraints       = CA:false\nkeyUsage               = critical, cRLSign, keyCertSign\nsubjectAltName         = $ENV::ALTNAME\n\n[ v3_ca_signed]\nsubjectKeyIdentifier      = hash\nauthorityKeyIdentifier    = keyid,issuer\nbasicConstraints          = critical, CA:FALSE\nkeyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign\nextendedKeyUsage          = clientAuth,serverAuth \nnsComment                 = "certificate generated by Node-OPCUA Certificate utility and signed by a CA"\nsubjectAltName            = $ENV::ALTNAME\n[ v3_selfsigned]\nsubjectKeyIdentifier      = hash\nauthorityKeyIdentifier    = keyid,issuer\nbasicConstraints          = critical, CA:FALSE\nkeyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign\nextendedKeyUsage          = clientAuth,serverAuth \nnsComment                 = "Self-signed certificate generated by Node-OPCUA Certificate utility"\nsubjectAltName            = $ENV::ALTNAME\n[ req_distinguished_name ]\ncountryName             = Country Name (2 letter code)\ncountryName_default     = FR\ncountryName_min         = 2\ncountryName_max         = 2\n# stateOrProvinceName     = State or Province Name (full name)\n# stateOrProvinceName_default = Ile de France\n# localityName            = Locality Name (city, district)\n# localityName_default    = Paris\norganizationName          = Organization Name (company)\norganizationName_default  = NodeOPCUA\n# organizationalUnitName  = Organizational Unit Name (department, division)\n# organizationalUnitName_default = R&D\ncommonName                = Common Name (hostname, FQDN, IP, or your name)\ncommonName_max            = 256\ncommonName_default        = NodeOPCUA\n# emailAddress            = Email Address\n# emailAddress_max        = 40\n# emailAddress_default    = node-opcua (at) node-opcua (dot) com\nsubjectAltName            = $ENV::ALTNAME';
-var simple_config_template_cnf_default = config3;
-
 // packages/node-opcua-pki/lib/pki/certificate_manager.ts
-var configurationFileSimpleTemplate = simple_config_template_cnf_default;
-var fsWriteFile = import_node_fs9.default.promises.writeFile;
+var configurationFileSimpleTemplate2 = simple_config_template_cnf_default;
+var fsWriteFile = import_node_fs10.default.promises.writeFile;
 function getOrComputeInfo(entry) {
   if (!entry.info) {
     entry.info = exploreCertificateCached(entry.certificate);
@@ -1693,7 +2127,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     this.#location = makePath(options.location, "");
     this.keySize = options.keySize;
     mkdirRecursiveSync(options.location);
-    if (!import_node_fs9.default.existsSync(this.#location)) {
+    if (!import_node_fs10.default.existsSync(this.#location)) {
       throw new Error(`CertificateManager cannot access location ${this.#location}`);
     }
   }
@@ -2006,15 +2440,15 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     mkdirRecursiveSync(import_node_path6.default.join(pkiDir, "issuers"));
     mkdirRecursiveSync(import_node_path6.default.join(pkiDir, "issuers/certs"));
     mkdirRecursiveSync(import_node_path6.default.join(pkiDir, "issuers/crl"));
-    if (!import_node_fs9.default.existsSync(this.configFile) || !import_node_fs9.default.existsSync(this.privateKey)) {
+    if (!import_node_fs10.default.existsSync(this.configFile) || !import_node_fs10.default.existsSync(this.privateKey)) {
       return await this.withLock2(async () => {
         if (this.state === 3 /* Disposing */ || this.state === 4 /* Disposed */) {
           return;
         }
-        if (!import_node_fs9.default.existsSync(this.configFile)) {
-          import_node_fs9.default.writeFileSync(this.configFile, configurationFileSimpleTemplate);
+        if (!import_node_fs10.default.existsSync(this.configFile)) {
+          import_node_fs10.default.writeFileSync(this.configFile, configurationFileSimpleTemplate2);
         }
-        if (!import_node_fs9.default.existsSync(this.privateKey)) {
+        if (!import_node_fs10.default.existsSync(this.privateKey)) {
           debugLog("generating private key ...");
           await (0, import_node_opcua_crypto5.generatePrivateKeyFile)(this.privateKey, this.keySize);
           await this.#readCertificates();
@@ -2104,7 +2538,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     if (typeof params.applicationUri !== "string") {
       throw new Error("createSelfSignedCertificate: expecting applicationUri to be a string");
     }
-    if (!import_node_fs9.default.existsSync(this.privateKey)) {
+    if (!import_node_fs10.default.existsSync(this.privateKey)) {
       throw new Error(`Cannot find private key ${this.privateKey}`);
     }
     let certificateFilename = import_node_path6.default.join(this.rootDir, "own/certs/self_signed_certificate.pem");
@@ -2168,7 +2602,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
       return "Good" /* Good */;
     }
     const filename = import_node_path6.default.join(this.issuersCertFolder, `issuer_${buildIdealCertificateName(certificate)}.pem`);
-    await import_node_fs9.default.promises.writeFile(filename, pemCertificate, "ascii");
+    await import_node_fs10.default.promises.writeFile(filename, pemCertificate, "ascii");
     this.#thumbs.issuers.certs.set(fingerprint, { certificate, filename });
     if (addInTrustList) {
       await this.trustCertificate(certificate);
@@ -2191,8 +2625,9 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
           index.set(key, { crls: [], serialNumbers: {} });
         }
         const pemCertificate = (0, import_node_opcua_crypto5.toPem)(crl, "X509 CRL");
-        const filename = import_node_path6.default.join(folder, `crl_${buildIdealCertificateName(crl)}.pem`);
-        await import_node_fs9.default.promises.writeFile(filename, pemCertificate, "ascii");
+        const sanitizedKey = key.replace(/:/g, "");
+        const filename = import_node_path6.default.join(folder, `crl_[${sanitizedKey}].pem`);
+        await import_node_fs10.default.promises.writeFile(filename, pemCertificate, "ascii");
         await this.#onCrlFileAdded(index, filename);
         await this.#waitAndCheckCRLProcessingStatus();
         return "Good" /* Good */;
@@ -2211,11 +2646,11 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
   async clearRevocationLists(target) {
     const clearFolder = async (folder, index) => {
       try {
-        const files = await import_node_fs9.default.promises.readdir(folder);
+        const files = await import_node_fs10.default.promises.readdir(folder);
         for (const file of files) {
           const ext = import_node_path6.default.extname(file).toLowerCase();
           if (ext === ".crl" || ext === ".pem" || ext === ".der") {
-            await import_node_fs9.default.promises.unlink(import_node_path6.default.join(folder, file));
+            await import_node_fs10.default.promises.unlink(import_node_path6.default.join(folder, file));
           }
         }
       } catch (err) {
@@ -2257,7 +2692,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
       return null;
     }
     try {
-      await import_node_fs9.default.promises.unlink(entry.filename);
+      await import_node_fs10.default.promises.unlink(entry.filename);
     } catch (err) {
       if (err.code !== "ENOENT") {
         throw err;
@@ -2281,7 +2716,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
       return null;
     }
     try {
-      await import_node_fs9.default.promises.unlink(entry.filename);
+      await import_node_fs10.default.promises.unlink(entry.filename);
     } catch (err) {
       if (err.code !== "ENOENT") {
         throw err;
@@ -2304,7 +2739,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
       if (!crlData) return;
       for (const crlEntry of crlData.crls) {
         try {
-          await import_node_fs9.default.promises.unlink(crlEntry.filename);
+          await import_node_fs10.default.promises.unlink(crlEntry.filename);
         } catch (err) {
           if (err.code !== "ENOENT") {
             throw err;
@@ -2457,7 +2892,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
       if (status === "unknown") {
         const pem = (0, import_node_opcua_crypto5.toPem)(certificate, "CERTIFICATE");
         const filename = import_node_path6.default.join(this.rejectedFolder, `${buildIdealCertificateName(certificate)}.pem`);
-        await import_node_fs9.default.promises.writeFile(filename, pem);
+        await import_node_fs10.default.promises.writeFile(filename, pem);
         this.#thumbs.rejected.set(fingerprint, { certificate, filename });
         status = "rejected";
       }
@@ -2476,7 +2911,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
         const certificateDest = import_node_path6.default.join(destFolder, import_node_path6.default.basename(srcEntry.filename));
         debugLog("#moveCertificate", fingerprint.substring(0, 10), "old name", srcEntry.filename);
         debugLog("#moveCertificate", fingerprint.substring(0, 10), "new name", certificateDest);
-        await import_node_fs9.default.promises.rename(srcEntry.filename, certificateDest);
+        await import_node_fs10.default.promises.rename(srcEntry.filename, certificateDest);
         indexSrc.delete(fingerprint);
         const indexDest = newStatus === "trusted" ? this.#thumbs.trusted : this.#thumbs.rejected;
         indexDest.set(fingerprint, { certificate, filename: certificateDest });
@@ -2586,11 +3021,11 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
       persistent: false
     };
     const allCapturedHandles = [];
-    const origWatch = import_node_fs9.default.watch;
+    const origWatch = import_node_fs10.default.watch;
     let watcherReadyCount = 0;
     const totalWatchers = 5;
-    import_node_fs9.default.watch = ((...args) => {
-      const handle = origWatch.apply(import_node_fs9.default, args);
+    import_node_fs10.default.watch = ((...args) => {
+      const handle = origWatch.apply(import_node_fs10.default, args);
       handle.setMaxListeners(handle.getMaxListeners() + 1);
       handle.on("error", () => {
       });
@@ -2606,7 +3041,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
         }
         watcherReadyCount++;
         if (watcherReadyCount >= totalWatchers) {
-          import_node_fs9.default.watch = origWatch;
+          import_node_fs10.default.watch = origWatch;
         }
       };
       return { w, capturedHandles: allCapturedHandles.slice(startIdx), unreffAll };
@@ -2630,12 +3065,12 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
    * file reads, preventing main-loop stalls with large folders.
    */
   async #scanCertFolder(folder, index) {
-    if (!import_node_fs9.default.existsSync(folder)) return;
-    const files = await import_node_fs9.default.promises.readdir(folder);
+    if (!import_node_fs10.default.existsSync(folder)) return;
+    const files = await import_node_fs10.default.promises.readdir(folder);
     for (const file of files) {
       const filename = import_node_path6.default.join(folder, file);
       try {
-        const stat = await import_node_fs9.default.promises.stat(filename);
+        const stat = await import_node_fs10.default.promises.stat(filename);
         if (!stat.isFile()) continue;
         const certificate = await (0, import_node_opcua_crypto5.readCertificateAsync)(filename);
         const info = exploreCertificateCached(certificate);
@@ -2651,12 +3086,12 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
    * Scan a CRL folder and populate the in-memory CRL index.
    */
   async #scanCrlFolder(folder, index) {
-    if (!import_node_fs9.default.existsSync(folder)) return;
-    const files = await import_node_fs9.default.promises.readdir(folder);
+    if (!import_node_fs10.default.existsSync(folder)) return;
+    const files = await import_node_fs10.default.promises.readdir(folder);
     for (const file of files) {
       const filename = import_node_path6.default.join(folder, file);
       try {
-        const stat = await import_node_fs9.default.promises.stat(filename);
+        const stat = await import_node_fs10.default.promises.stat(filename);
         if (!stat.isFile()) continue;
         this.#onCrlFileAdded(index, filename);
       } catch (err) {
@@ -2781,65 +3216,6 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     });
   }
 };
-
-// packages/node-opcua-pki/lib/pki/toolbox_pfx.ts
-var import_node_assert9 = __toESM(require("assert"));
-var import_node_fs10 = __toESM(require("fs"));
-var q2 = quote;
-var n3 = makePath;
-async function createPFX(options) {
-  const { certificateFile, privateKeyFile, outputFile, passphrase = "", caCertificateFiles } = options;
-  (0, import_node_assert9.default)(import_node_fs10.default.existsSync(certificateFile), `Certificate file does not exist: ${certificateFile}`);
-  (0, import_node_assert9.default)(import_node_fs10.default.existsSync(privateKeyFile), `Private key file does not exist: ${privateKeyFile}`);
-  let cmd = `pkcs12 -export`;
-  cmd += ` -in ${q2(n3(certificateFile))}`;
-  cmd += ` -inkey ${q2(n3(privateKeyFile))}`;
-  if (caCertificateFiles) {
-    for (const caFile of caCertificateFiles) {
-      (0, import_node_assert9.default)(import_node_fs10.default.existsSync(caFile), `CA certificate file does not exist: ${caFile}`);
-      cmd += ` -certfile ${q2(n3(caFile))}`;
-    }
-  }
-  cmd += ` -out ${q2(n3(outputFile))}`;
-  cmd += ` -passout pass:${passphrase}`;
-  await execute_openssl(cmd, {});
-}
-async function extractCertificateFromPFX(options) {
-  const { pfxFile, passphrase = "" } = options;
-  (0, import_node_assert9.default)(import_node_fs10.default.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  const cmd = `pkcs12 -in ${q2(n3(pfxFile))} -clcerts -nokeys -nodes -passin pass:${passphrase}`;
-  return await execute_openssl(cmd, {});
-}
-async function extractPrivateKeyFromPFX(options) {
-  const { pfxFile, passphrase = "" } = options;
-  (0, import_node_assert9.default)(import_node_fs10.default.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  const cmd = `pkcs12 -in ${q2(n3(pfxFile))} -nocerts -nodes -passin pass:${passphrase}`;
-  return await execute_openssl(cmd, {});
-}
-async function extractCACertificatesFromPFX(options) {
-  const { pfxFile, passphrase = "" } = options;
-  (0, import_node_assert9.default)(import_node_fs10.default.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  const cmd = `pkcs12 -in ${q2(n3(pfxFile))} -cacerts -nokeys -nodes -passin pass:${passphrase}`;
-  return await execute_openssl(cmd, {});
-}
-async function extractAllFromPFX(options) {
-  const [certificate, privateKey, caCertificates] = await Promise.all([
-    extractCertificateFromPFX(options),
-    extractPrivateKeyFromPFX(options),
-    extractCACertificatesFromPFX(options)
-  ]);
-  return { certificate, privateKey, caCertificates };
-}
-async function convertPFXtoPEM(pfxFile, pemFile, passphrase = "") {
-  (0, import_node_assert9.default)(import_node_fs10.default.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  const cmd = `pkcs12 -in ${q2(n3(pfxFile))} -out ${q2(n3(pemFile))} -nodes -passin pass:${passphrase}`;
-  await execute_openssl(cmd, {});
-}
-async function dumpPFX(pfxFile, passphrase = "") {
-  (0, import_node_assert9.default)(import_node_fs10.default.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  const cmd = `pkcs12 -in ${q2(n3(pfxFile))} -info -nodes -passin pass:${passphrase}`;
-  return await execute_openssl(cmd, {});
-}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   CertificateAuthority,