node-opcua-pki 6.12.1 → 6.12.2

package/dist/bin/pki.mjs

@@ -384,9 +384,10 @@ function short(stringToShorten) {
   return stringToShorten.substring(0, 10);
 }
 function buildIdealCertificateName(certificate) {
-  const fingerprint2 = makeFingerprint(certificate);
+  const chain = coerceCertificateChain(certificate);
+  const fingerprint2 = makeFingerprint(chain);
   try {
-    const commonName = exploreCertificate(certificate).tbsCertificate.subject.commonName || "";
+    const commonName = exploreCertificate(chain[0]).tbsCertificate.subject.commonName || "";
     const sanitizedCommonName = commonName.replace(forbiddenChars, "_");
     return `${sanitizedCommonName}[${fingerprint2}]`;
   } catch (_err) {
@@ -615,18 +616,18 @@ var init_certificate_manager = __esm({
       /**
        * Move a certificate to the rejected store.
        * If the certificate was previously trusted, it will be removed from the trusted folder.
-       * @param certificate - the DER-encoded certificate
+       * @param certificateOrChain - the DER-encoded certificate or certificate chain
        */
-      async rejectCertificate(certificate) {
-        await this.#moveCertificate(certificate, "rejected");
+      async rejectCertificate(certificateOrChain) {
+        await this.#moveCertificate(certificateOrChain, "rejected");
       }
       /**
        * Move a certificate to the trusted store.
        * If the certificate was previously rejected, it will be removed from the rejected folder.
-       * @param certificate - the DER-encoded certificate
+       * @param certificateOrChain - the DER-encoded certificate or certificate chain
        */
-      async trustCertificate(certificate) {
-        await this.#moveCertificate(certificate, "trusted");
+      async trustCertificate(certificateOrChain) {
+        await this.#moveCertificate(certificateOrChain, "trusted");
       }
       /**
        * Check whether the trusted certificate store is empty.
@@ -680,31 +681,40 @@ var init_certificate_manager = __esm({
        * @returns `"Good"` if trusted, `"BadCertificateUntrusted"` if rejected/unknown,
        *   or `"BadCertificateInvalid"` if the certificate cannot be parsed.
        */
-      async isCertificateTrusted(certificate) {
-        let fingerprint2;
+      async isCertificateTrusted(certificateOrCertificateChain) {
         try {
-          fingerprint2 = makeFingerprint(certificate);
-        } catch (_err) {
-          return "BadCertificateInvalid";
-        }
-        if (this.#thumbs.trusted.has(fingerprint2)) {
-          return "Good";
-        }
-        if (!this.#thumbs.rejected.has(fingerprint2)) {
-          if (!this.untrustUnknownCertificate) {
-            return "Good";
+          const chain = coerceCertificateChain(certificateOrCertificateChain);
+          const leafCertificate = chain[0];
+          if (chain.length < 1) {
+            return "BadCertificateInvalid";
           }
+          let fingerprint2;
           try {
-            exploreCertificateInfo(certificate);
+            fingerprint2 = makeFingerprint(chain[0]);
           } catch (_err) {
             return "BadCertificateInvalid";
           }
-          const filename = path2.join(this.rejectedFolder, `${buildIdealCertificateName(certificate)}.pem`);
-          debugLog("certificate has never been seen before and is now rejected (untrusted) ", filename);
-          await fsWriteFile(filename, toPem(certificate, "CERTIFICATE"));
-          this.#thumbs.rejected.set(fingerprint2, { certificate, filename });
+          if (this.#thumbs.trusted.has(fingerprint2)) {
+            return "Good";
+          }
+          if (!this.#thumbs.rejected.has(fingerprint2)) {
+            if (!this.untrustUnknownCertificate) {
+              return "Good";
+            }
+            try {
+              exploreCertificateInfo(chain[0]);
+            } catch (_err) {
+              return "BadCertificateInvalid";
+            }
+            const filename = path2.join(this.rejectedFolder, `${buildIdealCertificateName(leafCertificate)}.pem`);
+            debugLog("certificate has never been seen before and is now rejected (untrusted) ", filename);
+            await fsWriteFile(filename, toPem(chain, "CERTIFICATE"));
+            this.#thumbs.rejected.set(fingerprint2, { certificate: leafCertificate, filename });
+          }
+          return "BadCertificateUntrusted";
+        } catch (_err) {
+          return "BadCertificateInvalid";
         }
-        return "BadCertificateUntrusted";
       }
       async #innerVerifyCertificateAsync(certificateOrChain, _isIssuer, level, options) {
         if (level >= 5) {
@@ -1374,7 +1384,7 @@ var init_certificate_manager = __esm({
             return "BadCertificateInvalid" /* BadCertificateInvalid */;
           }
         }
-        await this.trustCertificate(leafCertificate);
+        await this.trustCertificate(certificates);
         return "Good" /* Good */;
       }
       /**
@@ -1466,12 +1476,14 @@ var init_certificate_manager = __esm({
         }
         return "unknown";
       }
-      async #moveCertificate(certificate, newStatus) {
+      async #moveCertificate(certificateOrChain, newStatus) {
         await this.withLock2(async () => {
+          const chain = coerceCertificateChain(certificateOrChain);
+          const certificate = chain[0];
           const fingerprint2 = makeFingerprint(certificate);
           let status = await this.#checkRejectedOrTrusted(certificate);
           if (status === "unknown") {
-            const pem = toPem(certificate, "CERTIFICATE");
+            const pem = toPem(chain, "CERTIFICATE");
             const filename = path2.join(this.rejectedFolder, `${buildIdealCertificateName(certificate)}.pem`);
             await fs4.promises.writeFile(filename, pem);
             this.#thumbs.rejected.set(fingerprint2, { certificate, filename });
@@ -1658,7 +1670,25 @@ var init_certificate_manager = __esm({
           try {
             const stat = await fs4.promises.stat(filename);
             if (!stat.isFile()) continue;
-            const certificate = (await readCertificateChainAsync(filename))[0];
+            const certs = await readCertificateChainAsync(filename);
+            if (certs.length === 0) continue;
+            const certificate = certs[0];
+            if (certs.length > 1) {
+              try {
+                await fs4.promises.writeFile(filename, toPem(certs, "CERTIFICATE"), "ascii");
+              } catch (writeErr) {
+                debugLog(`scanCertFolder: could not rewrite legacy PEM ${filename} (read-only fs?)`, writeErr);
+              }
+              for (let i = 1; i < certs.length; i++) {
+                if (isIssuer(certs[i])) {
+                  try {
+                    await this.addIssuer(certs[i]);
+                  } catch (issuerErr) {
+                    debugLog(`scanCertFolder: could not auto-register issuer from ${filename}`, issuerErr);
+                  }
+                }
+              }
+            }
             const info = exploreCertificate(certificate);
             const fingerprint2 = makeFingerprint(certificate);
             index.set(fingerprint2, { certificate, filename, info });