node-opcua-pki 6.11.1 → 6.12.1

package/dist/bin/pki.mjs

@@ -336,7 +336,7 @@ var init_simple_config_template_cnf = __esm({
   "packages/node-opcua-pki/lib/pki/templates/simple_config_template.cnf.ts"() {
     "use strict";
     init_esm_shims();
-    config = '##################################################################################################\n## SIMPLE OPENSSL CONFIG FILE FOR SELF-SIGNED CERTIFICATE GENERATION\n################################################################################################################\n\ndistinguished_name       = req_distinguished_name\ndefault_md               = sha1\n\ndefault_md                = sha256                      # The default digest algorithm\n\n[ v3_ca ]\nsubjectKeyIdentifier        = hash\nauthorityKeyIdentifier      = keyid:always,issuer:always\n\n# authorityKeyIdentifier    = keyid\nbasicConstraints            = CA:TRUE\nkeyUsage                    = critical, cRLSign, keyCertSign\nnsComment                   = "Self-signed Certificate for CA generated by Node-OPCUA Certificate utility"\n#nsCertType                 = sslCA, emailCA\n#subjectAltName             = email:copy\n#issuerAltName              = issuer:copy\n#obj                        = DER:02:03\n# crlDistributionPoints       = @crl_info\n# [ crl_info ]\n# URI.0                     = http://localhost:8900/crl.pem\nsubjectAltName              = $ENV::ALTNAME\n\n[ req ]\ndays                      = 390\nreq_extensions            = v3_req\nx509_extensions           = v3_ca\n\n[v3_req]\nbasicConstraints       = CA:false\nkeyUsage               = critical, cRLSign, keyCertSign\nsubjectAltName         = $ENV::ALTNAME\n\n[ v3_ca_signed]\nsubjectKeyIdentifier      = hash\nauthorityKeyIdentifier    = keyid,issuer\nbasicConstraints          = critical, CA:FALSE\nkeyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign\nextendedKeyUsage          = clientAuth,serverAuth \nnsComment                 = "certificate generated by Node-OPCUA Certificate utility and signed by a CA"\nsubjectAltName            = $ENV::ALTNAME\n[ v3_selfsigned]\nsubjectKeyIdentifier      = hash\nauthorityKeyIdentifier    = keyid,issuer\nbasicConstraints          = critical, CA:FALSE\nkeyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign\nextendedKeyUsage          = clientAuth,serverAuth \nnsComment                 = "Self-signed certificate generated by Node-OPCUA Certificate utility"\nsubjectAltName            = $ENV::ALTNAME\n[ req_distinguished_name ]\ncountryName             = Country Name (2 letter code)\ncountryName_default     = FR\ncountryName_min         = 2\ncountryName_max         = 2\n# stateOrProvinceName     = State or Province Name (full name)\n# stateOrProvinceName_default = Ile de France\n# localityName            = Locality Name (city, district)\n# localityName_default    = Paris\norganizationName          = Organization Name (company)\norganizationName_default  = NodeOPCUA\n# organizationalUnitName  = Organizational Unit Name (department, division)\n# organizationalUnitName_default = R&D\ncommonName                = Common Name (hostname, FQDN, IP, or your name)\ncommonName_max            = 256\ncommonName_default        = NodeOPCUA\n# emailAddress            = Email Address\n# emailAddress_max        = 40\n# emailAddress_default    = node-opcua (at) node-opcua (dot) com\nsubjectAltName            = $ENV::ALTNAME';
+    config = '##################################################################################################\n## SIMPLE OPENSSL CONFIG FILE FOR SELF-SIGNED CERTIFICATE GENERATION\n################################################################################################################\n\ndistinguished_name       = req_distinguished_name\ndefault_md               = sha1\n\ndefault_md                = sha256                      # The default digest algorithm\n\n[ v3_ca ]\nsubjectKeyIdentifier        = hash\nauthorityKeyIdentifier      = keyid:always,issuer:always\n\n# authorityKeyIdentifier    = keyid\nbasicConstraints            = CA:TRUE\nkeyUsage                    = critical, cRLSign, keyCertSign\nnsComment                   = "Self-signed Certificate for CA generated by Node-OPCUA Certificate utility"\n#nsCertType                 = sslCA, emailCA\n#subjectAltName             = email:copy\n#issuerAltName              = issuer:copy\n#obj                        = DER:02:03\n# crlDistributionPoints       = @crl_info\n# [ crl_info ]\n# URI.0                     = http://localhost:8900/crl.pem\nsubjectAltName              = $ENV::ALTNAME\n\n[ req ]\ndays                      = 390\nreq_extensions            = v3_req\nx509_extensions           = v3_ca\n\n[v3_req]\nbasicConstraints       = CA:false\nkeyUsage               = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment\nsubjectAltName         = $ENV::ALTNAME\n\n[ v3_ca_signed]\nsubjectKeyIdentifier      = hash\nauthorityKeyIdentifier    = keyid,issuer\nbasicConstraints          = critical, CA:FALSE\nkeyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment\nextendedKeyUsage          = clientAuth,serverAuth \nnsComment                 = "certificate generated by Node-OPCUA Certificate utility and signed by a CA"\nsubjectAltName            = $ENV::ALTNAME\n[ v3_selfsigned]\nsubjectKeyIdentifier      = hash\nauthorityKeyIdentifier    = keyid,issuer\nbasicConstraints          = critical, CA:FALSE\nkeyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment\nextendedKeyUsage          = clientAuth,serverAuth \nnsComment                 = "Self-signed certificate generated by Node-OPCUA Certificate utility"\nsubjectAltName            = $ENV::ALTNAME\n[ req_distinguished_name ]\ncountryName             = Country Name (2 letter code)\ncountryName_default     = FR\ncountryName_min         = 2\ncountryName_max         = 2\n# stateOrProvinceName     = State or Province Name (full name)\n# stateOrProvinceName_default = Ile de France\n# localityName            = Locality Name (city, district)\n# localityName_default    = Paris\norganizationName          = Organization Name (company)\norganizationName_default  = NodeOPCUA\n# organizationalUnitName  = Organizational Unit Name (department, division)\n# organizationalUnitName_default = R&D\ncommonName                = Common Name (hostname, FQDN, IP, or your name)\ncommonName_max            = 256\ncommonName_default        = NodeOPCUA\n# emailAddress            = Email Address\n# emailAddress_max        = 40\n# emailAddress_default    = node-opcua (at) node-opcua (dot) com\nsubjectAltName            = $ENV::ALTNAME';
     simple_config_template_cnf_default = config;
   }
 });
@@ -354,38 +354,30 @@ import {
   exploreCertificateRevocationList,
   generatePrivateKeyFile,
   makeSHA1Thumbprint,
-  readCertificate,
-  readCertificateAsync,
+  readCertificateChain,
+  readCertificateChainAsync,
   readCertificateRevocationList,
   split_der,
   toPem,
-  verifyCertificateChain,
   verifyCertificateSignature
 } from "node-opcua-crypto";
 function getOrComputeInfo(entry) {
   if (!entry.info) {
-    entry.info = exploreCertificateCached(entry.certificate);
+    entry.info = exploreCertificate(entry.certificate);
   }
   return entry.info;
 }
-function exploreCertificateCached(certificate) {
-  const key = makeSHA1Thumbprint(certificate).toString("hex");
-  const cached = _exploreCache.get(key);
-  if (cached) {
-    _exploreCache.delete(key);
-    _exploreCache.set(key, cached);
-    return cached;
+function coerceCertificateChain(certificate) {
+  if (Array.isArray(certificate)) {
+    if (certificate.length === 0) return [];
+    return certificate.reduce((acc, cert) => {
+      return acc.concat(split_der(cert));
+    }, []);
   }
-  const info = exploreCertificate(certificate);
-  _exploreCache.set(key, info);
-  if (_exploreCache.size > EXPLORE_CACHE_MAX) {
-    const oldest = _exploreCache.keys().next().value;
-    if (oldest) _exploreCache.delete(oldest);
-  }
-  return info;
+  return split_der(certificate);
 }
 function makeFingerprint(certificate) {
-  const chain = split_der(certificate);
+  const chain = coerceCertificateChain(certificate);
   return makeSHA1Thumbprint(chain[0]).toString("hex");
 }
 function short(stringToShorten) {
@@ -394,7 +386,7 @@ function short(stringToShorten) {
 function buildIdealCertificateName(certificate) {
   const fingerprint2 = makeFingerprint(certificate);
   try {
-    const commonName = exploreCertificateCached(certificate).tbsCertificate.subject.commonName || "";
+    const commonName = exploreCertificate(certificate).tbsCertificate.subject.commonName || "";
     const sanitizedCommonName = commonName.replace(forbiddenChars, "_");
     return `${sanitizedCommonName}[${fingerprint2}]`;
   } catch (_err) {
@@ -411,24 +403,46 @@ function isSelfSigned2(info) {
   return info.tbsCertificate.extensions?.subjectKeyIdentifier === info.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier;
 }
 function isSelfSigned3(certificate) {
-  const info = exploreCertificateCached(certificate);
+  const info = exploreCertificate(certificate);
   return isSelfSigned2(info);
 }
+function _isIssuerInfo(info) {
+  const basicConstraints = info.tbsCertificate.extensions?.basicConstraints;
+  if (basicConstraints?.cA) {
+    return true;
+  }
+  const keyUsage = info.tbsCertificate.extensions?.keyUsage;
+  if (keyUsage?.keyCertSign) {
+    return true;
+  }
+  return false;
+}
+function isIssuer(certificate) {
+  try {
+    const info = exploreCertificate(certificate);
+    return _isIssuerInfo(info);
+  } catch (_err) {
+    return false;
+  }
+}
 function findIssuerCertificateInChain(certificate, chain) {
-  if (!certificate) {
+  const coercedCertificate = coerceCertificateChain(certificate);
+  const firstCertificate = coercedCertificate[0];
+  if (!firstCertificate) {
     return null;
   }
-  const certInfo = exploreCertificateCached(certificate);
+  const certInfo = exploreCertificate(firstCertificate);
   if (isSelfSigned2(certInfo)) {
-    return certificate;
+    return firstCertificate;
   }
   const wantedIssuerKey = certInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier;
   if (!wantedIssuerKey) {
     debugLog("Certificate has no extension 3");
     return null;
   }
-  const potentialIssuers = chain.filter((c) => {
-    const info = exploreCertificateCached(c);
+  const coercedChain = coerceCertificateChain(chain);
+  const potentialIssuers = coercedChain.filter((c) => {
+    const info = exploreCertificate(c);
     return info.tbsCertificate.extensions && info.tbsCertificate.extensions.subjectKeyIdentifier === wantedIssuerKey;
   });
   if (potentialIssuers.length === 1) {
@@ -440,7 +454,7 @@ function findIssuerCertificateInChain(certificate, chain) {
   }
   return null;
 }
-var configurationFileSimpleTemplate, fsWriteFile, EXPLORE_CACHE_MAX, _exploreCache, forbiddenChars, CertificateManager;
+var configurationFileSimpleTemplate, fsWriteFile, forbiddenChars, CertificateManager;
 var init_certificate_manager = __esm({
   "packages/node-opcua-pki/lib/pki/certificate_manager.ts"() {
     "use strict";
@@ -451,8 +465,6 @@ var init_certificate_manager = __esm({
     init_simple_config_template_cnf();
     configurationFileSimpleTemplate = simple_config_template_cnf_default;
     fsWriteFile = fs4.promises.writeFile;
-    EXPLORE_CACHE_MAX = 8;
-    _exploreCache = /* @__PURE__ */ new Map();
     forbiddenChars = /[\x00-\x1F<>:"/\\|?*]/g;
     CertificateManager = class _CertificateManager extends EventEmitter {
       // ── Global instance registry ─────────────────────────────────
@@ -545,6 +557,7 @@ var init_certificate_manager = __esm({
       #readCertificatesCalled = false;
       #filenameToHash = /* @__PURE__ */ new Map();
       #initializingPromise;
+      #addCertValidation;
       #thumbs = {
         rejected: /* @__PURE__ */ new Map(),
         trusted: /* @__PURE__ */ new Map(),
@@ -571,6 +584,13 @@ var init_certificate_manager = __esm({
         }
         this.#location = makePath(options.location, "");
         this.keySize = options.keySize;
+        const v = options.addCertificateValidationOptions ?? {};
+        this.#addCertValidation = {
+          acceptExpiredCertificate: v.acceptExpiredCertificate ?? false,
+          acceptRevokedCertificate: v.acceptRevokedCertificate ?? false,
+          ignoreMissingRevocationList: v.ignoreMissingRevocationList ?? false,
+          maxChainLength: v.maxChainLength ?? 5
+        };
         mkdirRecursiveSync(options.location);
         if (!fs4.existsSync(this.#location)) {
           throw new Error(`CertificateManager cannot access location ${this.#location}`);
@@ -661,7 +681,12 @@ var init_certificate_manager = __esm({
        *   or `"BadCertificateInvalid"` if the certificate cannot be parsed.
        */
       async isCertificateTrusted(certificate) {
-        const fingerprint2 = makeFingerprint(certificate);
+        let fingerprint2;
+        try {
+          fingerprint2 = makeFingerprint(certificate);
+        } catch (_err) {
+          return "BadCertificateInvalid";
+        }
         if (this.#thumbs.trusted.has(fingerprint2)) {
           return "Good";
         }
@@ -681,13 +706,13 @@ var init_certificate_manager = __esm({
         }
         return "BadCertificateUntrusted";
       }
-      async #innerVerifyCertificateAsync(certificate, _isIssuer, level, options) {
+      async #innerVerifyCertificateAsync(certificateOrChain, _isIssuer, level, options) {
         if (level >= 5) {
           return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
         }
-        const chain = split_der(certificate);
+        const chain = coerceCertificateChain(certificateOrChain);
         debugLog("NB CERTIFICATE IN CHAIN = ", chain.length);
-        const info = exploreCertificateCached(chain[0]);
+        const info = exploreCertificate(chain[0]);
         let hasValidIssuer = false;
         let hasTrustedIssuer = false;
         const hasIssuerKey = info.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier;
@@ -724,7 +749,7 @@ var init_certificate_manager = __esm({
               return "BadCertificateIssuerRevocationUnknown" /* BadCertificateIssuerRevocationUnknown */;
             }
             if (issuerStatus === "BadCertificateTimeInvalid" /* BadCertificateTimeInvalid */) {
-              if (!options || !options.acceptOutDatedIssuerCertificate) {
+              if (!options?.acceptOutDatedIssuerCertificate) {
                 return "BadCertificateIssuerTimeInvalid" /* BadCertificateIssuerTimeInvalid */;
               }
             }
@@ -734,13 +759,13 @@ var init_certificate_manager = __esm({
             if (issuerStatus !== "Good" /* Good */ && issuerStatus !== "BadCertificateUntrusted" /* BadCertificateUntrusted */) {
               return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
             }
-            const isCertificateSignatureOK = verifyCertificateSignature(certificate, issuerCertificate);
+            const isCertificateSignatureOK = verifyCertificateSignature(chain[0], issuerCertificate);
             if (!isCertificateSignatureOK) {
               debugLog(" the certificate was not signed by the issuer as it claim to be ! Danger");
               return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
             }
             hasValidIssuer = true;
-            let revokedStatus = await this.isCertificateRevoked(certificate);
+            let revokedStatus = await this.isCertificateRevoked(chain, issuerCertificate);
             if (revokedStatus === "BadCertificateRevocationUnknown" /* BadCertificateRevocationUnknown */) {
               if (options?.ignoreMissingRevocationList) {
                 revokedStatus = "Good" /* Good */;
@@ -760,16 +785,16 @@ var init_certificate_manager = __esm({
               return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
             }
           } else {
-            const isCertificateSignatureOK = verifyCertificateSignature(certificate, certificate);
+            const isCertificateSignatureOK = verifyCertificateSignature(chain[0], chain[0]);
             if (!isCertificateSignatureOK) {
               debugLog("Self-signed Certificate signature is not valid");
               return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
             }
-            const revokedStatus = await this.isCertificateRevoked(certificate);
+            const revokedStatus = await this.isCertificateRevoked(chain);
             debugLog("revokedStatus of self signed certificate:", revokedStatus);
           }
         }
-        const status = await this.#checkRejectedOrTrusted(certificate);
+        const status = await this.#checkRejectedOrTrusted(chain[0]);
         if (status === "rejected") {
           if (!(options.acceptCertificateWithValidIssuerChain && hasValidIssuer && hasTrustedIssuer)) {
             return "BadCertificateUntrusted" /* BadCertificateUntrusted */;
@@ -777,7 +802,7 @@ var init_certificate_manager = __esm({
         }
         const _c2 = chain[1] ? exploreCertificateInfo(chain[1]) : "non";
         debugLog("chain[1] info=", _c2);
-        const certificateInfo = exploreCertificateInfo(certificate);
+        const certificateInfo = exploreCertificateInfo(chain[0]);
         const now = /* @__PURE__ */ new Date();
         let isTimeInvalid = false;
         if (certificateInfo.notBefore.getTime() > now.getTime()) {
@@ -827,7 +852,15 @@ var init_certificate_manager = __esm({
        * @returns the verification status code
        */
       async verifyCertificateAsync(certificate, options) {
-        const status1 = await this.#innerVerifyCertificateAsync(certificate, false, 0, options);
+        const chain = coerceCertificateChain(certificate);
+        for (const element of chain) {
+          try {
+            exploreCertificateInfo(element);
+          } catch (_err) {
+            return "BadCertificateInvalid" /* BadCertificateInvalid */;
+          }
+        }
+        const status1 = await this.#innerVerifyCertificateAsync(chain, false, 0, options);
         return status1;
       }
       /**
@@ -1054,6 +1087,23 @@ var init_certificate_manager = __esm({
         }
         return "Good" /* Good */;
       }
+      /**
+       * Add multiple CA (issuer) certificates to the issuers store.
+       * @param certificates - the DER-encoded CA certificates
+       * @param validate - if `true`, verify each certificate before adding
+       * @param addInTrustList - if `true`, also add each certificate to the trusted store
+       * @returns `VerificationStatus.Good` on success
+       */
+      async addIssuers(certificates, validate = false, addInTrustList = false) {
+        for (const certificate of certificates) {
+          if (!isIssuer(certificate)) {
+            warningLog(`Certificate ${makeFingerprint(certificate)} is not a issuer certificate`);
+            continue;
+          }
+          await this.addIssuer(certificate, validate, addInTrustList);
+        }
+        return "Good" /* Good */;
+      }
       /**
        * Add a CRL to the certificate manager.
        * @param crl - the CRL to add
@@ -1177,7 +1227,7 @@ var init_certificate_manager = __esm({
        * @param target - "issuers", "trusted", or "all" (default "all")
        */
       async removeRevocationListsForIssuer(issuerCertificate, target = "all") {
-        const issuerInfo = exploreCertificateCached(issuerCertificate);
+        const issuerInfo = exploreCertificate(issuerCertificate);
         const issuerFingerprint = issuerInfo.tbsCertificate.subjectFingerPrint;
         const processIndex = async (index) => {
           const crlData = index.get(issuerFingerprint);
@@ -1204,41 +1254,125 @@ var init_certificate_manager = __esm({
        * Validate a certificate (optionally with its chain) and add
        * the leaf certificate to the trusted store.
        *
-       * The certificate buffer may contain a single certificate or a
-       * full chain (leaf + issuer certificates concatenated in DER).
-       * Only the leaf certificate is added to the trusted store.
+       * Performs OPC UA Part 4, Table 100 validation:
        *
-       * When the chain contains issuer certificates, this method
-       * verifies that each issuer is already registered via
-       * {@link addIssuer} before trusting the leaf.
+       * 1. **Certificate Structure** — parse the DER encoding.
+       * 2. **Build Certificate Chain** — walk from the leaf to a
+       *    self-signed root CA, using the provided chain and the
+       *    issuers store.
+       * 3. **Signature** — verify each certificate's signature
+       *    against its issuer.
+       * 4. **Issuer Presence** — every issuer in the chain must
+       *    already be registered in the issuers store (per GDS
+       *    7.8.2.6).
+       * 5. **Validity Period** — each certificate must be within
+       *    its validity window (overridable via
+       *    {@link AddCertificateValidationOptions.acceptExpiredCertificate}).
+       * 6. **Revocation Check** — each certificate is checked
+       *    against its issuer's CRL (overridable via
+       *    {@link AddCertificateValidationOptions.acceptRevokedCertificate}
+       *    and {@link AddCertificateValidationOptions.ignoreMissingRevocationList}).
        *
-       * If one of the certificates in the chain is not registered in the issuers store,
-       * the leaf certificate will be rejected.
+       * Only the leaf certificate is added to the trusted store.
        *
        * @param certificateChain - DER-encoded certificate or chain
        * @returns `VerificationStatus.Good` on success, or an error
        *  status indicating why the certificate was rejected.
        */
       async addTrustedCertificateFromChain(certificateChain) {
-        const certificates = split_der(certificateChain);
-        const leafCertificate = certificates[0];
         try {
-          exploreCertificateCached(leafCertificate);
+          return await this.#addTrustedCertificateFromChainImpl(certificateChain);
         } catch (_err) {
+          warningLog("addTrustedCertificateFromChain: unexpected error", _err);
           return "BadCertificateInvalid" /* BadCertificateInvalid */;
         }
-        const result = await verifyCertificateChain([leafCertificate]);
-        if (result.status !== "Good") {
+      }
+      async #addTrustedCertificateFromChainImpl(certificateChain) {
+        let certificates;
+        try {
+          certificates = coerceCertificateChain(certificateChain);
+        } catch (_err) {
           return "BadCertificateInvalid" /* BadCertificateInvalid */;
         }
-        if (certificates.length > 1) {
-          await this.#scanCertFolder(this.issuersCertFolder, this.#thumbs.issuers.certs);
-          for (const issuerCert of certificates.slice(1)) {
-            const thumbprint = makeFingerprint(issuerCert);
-            if (!await this.hasIssuer(thumbprint)) {
+        if (certificates.length === 0) {
+          return "BadCertificateInvalid" /* BadCertificateInvalid */;
+        }
+        const leafCertificate = certificates[0];
+        const opts = this.#addCertValidation;
+        let leafInfo;
+        try {
+          leafInfo = exploreCertificate(leafCertificate);
+        } catch (_err) {
+          return "BadCertificateInvalid" /* BadCertificateInvalid */;
+        }
+        await this.#scanCertFolder(this.issuersCertFolder, this.#thumbs.issuers.certs);
+        let currentCert = leafCertificate;
+        let currentInfo = leafInfo;
+        let depth = 0;
+        while (true) {
+          depth++;
+          if (depth > opts.maxChainLength) {
+            return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
+          }
+          if (!opts.acceptExpiredCertificate) {
+            let certDetails;
+            try {
+              certDetails = exploreCertificateInfo(currentCert);
+            } catch (_err) {
+              return "BadCertificateInvalid" /* BadCertificateInvalid */;
+            }
+            const now = /* @__PURE__ */ new Date();
+            if (certDetails.notBefore.getTime() > now.getTime()) {
+              return "BadCertificateTimeInvalid" /* BadCertificateTimeInvalid */;
+            }
+            if (certDetails.notAfter.getTime() <= now.getTime()) {
+              return depth === 1 ? "BadCertificateTimeInvalid" /* BadCertificateTimeInvalid */ : "BadCertificateIssuerTimeInvalid" /* BadCertificateIssuerTimeInvalid */;
+            }
+          }
+          if (isSelfSigned2(currentInfo)) {
+            try {
+              if (!verifyCertificateSignature(currentCert, currentCert)) {
+                return "BadCertificateInvalid" /* BadCertificateInvalid */;
+              }
+            } catch (_err) {
+              return "BadCertificateInvalid" /* BadCertificateInvalid */;
+            }
+            break;
+          }
+          let issuerCert = await this.findIssuerCertificate(currentCert);
+          if (!issuerCert) {
+            issuerCert = findIssuerCertificateInChain(currentCert, certificates);
+            if (!issuerCert || issuerCert === currentCert) {
               return "BadCertificateChainIncomplete" /* BadCertificateChainIncomplete */;
             }
           }
+          try {
+            if (!verifyCertificateSignature(currentCert, issuerCert)) {
+              return "BadCertificateInvalid" /* BadCertificateInvalid */;
+            }
+          } catch (_err) {
+            return "BadCertificateInvalid" /* BadCertificateInvalid */;
+          }
+          const issuerThumbprint = makeFingerprint(issuerCert);
+          if (!await this.hasIssuer(issuerThumbprint)) {
+            return "BadCertificateChainIncomplete" /* BadCertificateChainIncomplete */;
+          }
+          const revokedStatus = await this.isCertificateRevoked(currentCert, issuerCert);
+          if (revokedStatus === "BadCertificateRevoked" /* BadCertificateRevoked */) {
+            if (!opts.acceptRevokedCertificate) {
+              return "BadCertificateRevoked" /* BadCertificateRevoked */;
+            }
+          } else if (revokedStatus === "BadCertificateRevocationUnknown" /* BadCertificateRevocationUnknown */) {
+            if (!opts.ignoreMissingRevocationList) {
+              return "BadCertificateRevocationUnknown" /* BadCertificateRevocationUnknown */;
+            }
+          }
+          currentCert = issuerCert;
+          try {
+            currentInfo = exploreCertificate(currentCert);
+          } catch (_err) {
+            return "BadCertificateInvalid" /* BadCertificateInvalid */;
+          }
         }
         await this.trustCertificate(leafCertificate);
         return "Good" /* Good */;
@@ -1283,9 +1417,10 @@ var init_certificate_manager = __esm({
        *
        */
       async findIssuerCertificate(certificate) {
-        const certInfo = exploreCertificateCached(certificate);
+        const firstCertificate = coerceCertificateChain(certificate)[0];
+        const certInfo = exploreCertificate(firstCertificate);
         if (isSelfSigned2(certInfo)) {
-          return certificate;
+          return firstCertificate;
         }
         const wantedIssuerKey = certInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier;
         if (!wantedIssuerKey) {
@@ -1319,7 +1454,8 @@ var init_certificate_manager = __esm({
        * @private
        */
       async #checkRejectedOrTrusted(certificate) {
-        const fingerprint2 = makeFingerprint(certificate);
+        const firstCertificate = coerceCertificateChain(certificate)[0];
+        const fingerprint2 = makeFingerprint(firstCertificate);
         debugLog("#checkRejectedOrTrusted fingerprint ", short(fingerprint2));
         await this.#readCertificates();
         if (this.#thumbs.rejected.has(fingerprint2)) {
@@ -1364,7 +1500,7 @@ var init_certificate_manager = __esm({
         });
       }
       #findAssociatedCRLs(issuerCertificate) {
-        const issuerCertificateInfo = exploreCertificateCached(issuerCertificate);
+        const issuerCertificateInfo = exploreCertificate(issuerCertificate);
         const key = issuerCertificateInfo.tbsCertificate.subjectFingerPrint;
         return this.#thumbs.issuersCrl.get(key) ?? this.#thumbs.crl.get(key) ?? null;
       }
@@ -1385,11 +1521,16 @@ var init_certificate_manager = __esm({
        *   found.
        */
       async isCertificateRevoked(certificate, issuerCertificate) {
-        if (isSelfSigned3(certificate)) {
+        const chain = coerceCertificateChain(certificate);
+        const firstCertificate = chain[0];
+        if (isSelfSigned3(firstCertificate)) {
           return "Good" /* Good */;
         }
         if (!issuerCertificate) {
-          issuerCertificate = await this.findIssuerCertificate(certificate);
+          issuerCertificate = await this.findIssuerCertificate(firstCertificate);
+        }
+        if (!issuerCertificate) {
+          issuerCertificate = findIssuerCertificateInChain(firstCertificate, chain);
         }
         if (!issuerCertificate) {
           return "BadCertificateChainIncomplete" /* BadCertificateChainIncomplete */;
@@ -1398,7 +1539,7 @@ var init_certificate_manager = __esm({
         if (!crls) {
           return "BadCertificateRevocationUnknown" /* BadCertificateRevocationUnknown */;
         }
-        const certInfo = exploreCertificateCached(certificate);
+        const certInfo = exploreCertificate(firstCertificate);
         const serialNumber = certInfo.tbsCertificate.serialNumber || certInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.serial || "";
         const key = certInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.authorityCertIssuerFingerPrint || "<unknown>";
         const crl2 = this.#thumbs.crl.get(key) ?? null;
@@ -1517,8 +1658,8 @@ var init_certificate_manager = __esm({
           try {
             const stat = await fs4.promises.stat(filename);
             if (!stat.isFile()) continue;
-            const certificate = await readCertificateAsync(filename);
-            const info = exploreCertificateCached(certificate);
+            const certificate = (await readCertificateChainAsync(filename))[0];
+            const info = exploreCertificate(certificate);
             const fingerprint2 = makeFingerprint(certificate);
             index.set(fingerprint2, { certificate, filename, info });
             this.#filenameToHash.set(filename, fingerprint2);
@@ -1604,8 +1745,8 @@ var init_certificate_manager = __esm({
         w.on("add", (filename) => {
           debugLog(chalk3.cyan(`add in folder ${folder}`), filename);
           try {
-            const certificate = readCertificate(filename);
-            const info = exploreCertificateCached(certificate);
+            const certificate = readCertificateChain(filename)[0];
+            const info = exploreCertificate(certificate);
             const fingerprint2 = makeFingerprint(certificate);
             const isNew = !index.has(fingerprint2);
             index.set(fingerprint2, { certificate, filename, info });
@@ -1627,13 +1768,13 @@ var init_certificate_manager = __esm({
         w.on("change", (changedPath) => {
           debugLog(chalk3.cyan(`change in folder ${folder}`), changedPath);
           try {
-            const certificate = readCertificate(changedPath);
+            const certificate = readCertificateChain(changedPath)[0];
             const newFingerprint = makeFingerprint(certificate);
             const oldHash = this.#filenameToHash.get(changedPath);
             if (oldHash && oldHash !== newFingerprint) {
               index.delete(oldHash);
             }
-            index.set(newFingerprint, { certificate, filename: changedPath, info: exploreCertificateCached(certificate) });
+            index.set(newFingerprint, { certificate, filename: changedPath, info: exploreCertificate(certificate) });
             this.#filenameToHash.set(changedPath, newFingerprint);
             this.emit("certificateChange", { store, certificate, fingerprint: newFingerprint, filename: changedPath });
           } catch (err) {
@@ -2416,7 +2557,7 @@ nsComment                 = ''OpenSSL Generated Certificate''
 #nsRenewalUrl             =
 #nsCaPolicyUrl            =
 #nsSslServerName          =
-keyUsage                  = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign
+keyUsage                  = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement
 extendedKeyUsage          = critical,serverAuth ,clientAuth
 
 [ v3_req ]