node-opcua-pki 6.12.1 → 6.12.2

package/dist/index.d.mts

@@ -919,15 +919,15 @@ declare class CertificateManager extends EventEmitter {
     /**
      * Move a certificate to the rejected store.
      * If the certificate was previously trusted, it will be removed from the trusted folder.
-     * @param certificate - the DER-encoded certificate
+     * @param certificateOrChain - the DER-encoded certificate or certificate chain
      */
-    rejectCertificate(certificate: Certificate): Promise<void>;
+    rejectCertificate(certificateOrChain: Certificate | Certificate[]): Promise<void>;
     /**
      * Move a certificate to the trusted store.
      * If the certificate was previously rejected, it will be removed from the rejected folder.
-     * @param certificate - the DER-encoded certificate
+     * @param certificateOrChain - the DER-encoded certificate or certificate chain
      */
-    trustCertificate(certificate: Certificate): Promise<void>;
+    trustCertificate(certificateOrChain: Certificate | Certificate[]): Promise<void>;
     /**
      * Check whether the trusted certificate store is empty.
      *
@@ -962,7 +962,7 @@ declare class CertificateManager extends EventEmitter {
      * @returns `"Good"` if trusted, `"BadCertificateUntrusted"` if rejected/unknown,
      *   or `"BadCertificateInvalid"` if the certificate cannot be parsed.
      */
-    isCertificateTrusted(certificate: Certificate): Promise<"Good" | "BadCertificateUntrusted" | "BadCertificateInvalid">;
+    isCertificateTrusted(certificateOrCertificateChain: Certificate | Certificate[]): Promise<"Good" | "BadCertificateUntrusted" | "BadCertificateInvalid">;
     /**
      * Internal verification hook called by {@link verifyCertificate}.
      *

package/dist/index.d.ts

@@ -919,15 +919,15 @@ declare class CertificateManager extends EventEmitter {
     /**
      * Move a certificate to the rejected store.
      * If the certificate was previously trusted, it will be removed from the trusted folder.
-     * @param certificate - the DER-encoded certificate
+     * @param certificateOrChain - the DER-encoded certificate or certificate chain
      */
-    rejectCertificate(certificate: Certificate): Promise<void>;
+    rejectCertificate(certificateOrChain: Certificate | Certificate[]): Promise<void>;
     /**
      * Move a certificate to the trusted store.
      * If the certificate was previously rejected, it will be removed from the rejected folder.
-     * @param certificate - the DER-encoded certificate
+     * @param certificateOrChain - the DER-encoded certificate or certificate chain
      */
-    trustCertificate(certificate: Certificate): Promise<void>;
+    trustCertificate(certificateOrChain: Certificate | Certificate[]): Promise<void>;
     /**
      * Check whether the trusted certificate store is empty.
      *
@@ -962,7 +962,7 @@ declare class CertificateManager extends EventEmitter {
      * @returns `"Good"` if trusted, `"BadCertificateUntrusted"` if rejected/unknown,
      *   or `"BadCertificateInvalid"` if the certificate cannot be parsed.
      */
-    isCertificateTrusted(certificate: Certificate): Promise<"Good" | "BadCertificateUntrusted" | "BadCertificateInvalid">;
+    isCertificateTrusted(certificateOrCertificateChain: Certificate | Certificate[]): Promise<"Good" | "BadCertificateUntrusted" | "BadCertificateInvalid">;
     /**
      * Internal verification hook called by {@link verifyCertificate}.
      *

package/dist/index.js

@@ -1949,9 +1949,10 @@ function short(stringToShorten) {
 }
 var forbiddenChars = /[\x00-\x1F<>:"/\\|?*]/g;
 function buildIdealCertificateName(certificate) {
-  const fingerprint = makeFingerprint(certificate);
+  const chain = coerceCertificateChain(certificate);
+  const fingerprint = makeFingerprint(chain);
   try {
-    const commonName = (0, import_node_opcua_crypto5.exploreCertificate)(certificate).tbsCertificate.subject.commonName || "";
+    const commonName = (0, import_node_opcua_crypto5.exploreCertificate)(chain[0]).tbsCertificate.subject.commonName || "";
     const sanitizedCommonName = commonName.replace(forbiddenChars, "_");
     return `${sanitizedCommonName}[${fingerprint}]`;
   } catch (_err) {
@@ -2198,18 +2199,18 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
   /**
    * Move a certificate to the rejected store.
    * If the certificate was previously trusted, it will be removed from the trusted folder.
-   * @param certificate - the DER-encoded certificate
+   * @param certificateOrChain - the DER-encoded certificate or certificate chain
    */
-  async rejectCertificate(certificate) {
-    await this.#moveCertificate(certificate, "rejected");
+  async rejectCertificate(certificateOrChain) {
+    await this.#moveCertificate(certificateOrChain, "rejected");
   }
   /**
    * Move a certificate to the trusted store.
    * If the certificate was previously rejected, it will be removed from the rejected folder.
-   * @param certificate - the DER-encoded certificate
+   * @param certificateOrChain - the DER-encoded certificate or certificate chain
    */
-  async trustCertificate(certificate) {
-    await this.#moveCertificate(certificate, "trusted");
+  async trustCertificate(certificateOrChain) {
+    await this.#moveCertificate(certificateOrChain, "trusted");
   }
   /**
    * Check whether the trusted certificate store is empty.
@@ -2263,31 +2264,40 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
    * @returns `"Good"` if trusted, `"BadCertificateUntrusted"` if rejected/unknown,
    *   or `"BadCertificateInvalid"` if the certificate cannot be parsed.
    */
-  async isCertificateTrusted(certificate) {
-    let fingerprint;
+  async isCertificateTrusted(certificateOrCertificateChain) {
     try {
-      fingerprint = makeFingerprint(certificate);
-    } catch (_err) {
-      return "BadCertificateInvalid";
-    }
-    if (this.#thumbs.trusted.has(fingerprint)) {
-      return "Good";
-    }
-    if (!this.#thumbs.rejected.has(fingerprint)) {
-      if (!this.untrustUnknownCertificate) {
-        return "Good";
+      const chain = coerceCertificateChain(certificateOrCertificateChain);
+      const leafCertificate = chain[0];
+      if (chain.length < 1) {
+        return "BadCertificateInvalid";
       }
+      let fingerprint;
       try {
-        (0, import_node_opcua_crypto5.exploreCertificateInfo)(certificate);
+        fingerprint = makeFingerprint(chain[0]);
       } catch (_err) {
         return "BadCertificateInvalid";
       }
-      const filename = import_node_path6.default.join(this.rejectedFolder, `${buildIdealCertificateName(certificate)}.pem`);
-      debugLog("certificate has never been seen before and is now rejected (untrusted) ", filename);
-      await fsWriteFile(filename, (0, import_node_opcua_crypto5.toPem)(certificate, "CERTIFICATE"));
-      this.#thumbs.rejected.set(fingerprint, { certificate, filename });
+      if (this.#thumbs.trusted.has(fingerprint)) {
+        return "Good";
+      }
+      if (!this.#thumbs.rejected.has(fingerprint)) {
+        if (!this.untrustUnknownCertificate) {
+          return "Good";
+        }
+        try {
+          (0, import_node_opcua_crypto5.exploreCertificateInfo)(chain[0]);
+        } catch (_err) {
+          return "BadCertificateInvalid";
+        }
+        const filename = import_node_path6.default.join(this.rejectedFolder, `${buildIdealCertificateName(leafCertificate)}.pem`);
+        debugLog("certificate has never been seen before and is now rejected (untrusted) ", filename);
+        await fsWriteFile(filename, (0, import_node_opcua_crypto5.toPem)(chain, "CERTIFICATE"));
+        this.#thumbs.rejected.set(fingerprint, { certificate: leafCertificate, filename });
+      }
+      return "BadCertificateUntrusted";
+    } catch (_err) {
+      return "BadCertificateInvalid";
     }
-    return "BadCertificateUntrusted";
   }
   async #innerVerifyCertificateAsync(certificateOrChain, _isIssuer, level, options) {
     if (level >= 5) {
@@ -2957,7 +2967,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
         return "BadCertificateInvalid" /* BadCertificateInvalid */;
       }
     }
-    await this.trustCertificate(leafCertificate);
+    await this.trustCertificate(certificates);
     return "Good" /* Good */;
   }
   /**
@@ -3049,12 +3059,14 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     }
     return "unknown";
   }
-  async #moveCertificate(certificate, newStatus) {
+  async #moveCertificate(certificateOrChain, newStatus) {
     await this.withLock2(async () => {
+      const chain = coerceCertificateChain(certificateOrChain);
+      const certificate = chain[0];
       const fingerprint = makeFingerprint(certificate);
       let status = await this.#checkRejectedOrTrusted(certificate);
       if (status === "unknown") {
-        const pem = (0, import_node_opcua_crypto5.toPem)(certificate, "CERTIFICATE");
+        const pem = (0, import_node_opcua_crypto5.toPem)(chain, "CERTIFICATE");
         const filename = import_node_path6.default.join(this.rejectedFolder, `${buildIdealCertificateName(certificate)}.pem`);
         await import_node_fs10.default.promises.writeFile(filename, pem);
         this.#thumbs.rejected.set(fingerprint, { certificate, filename });
@@ -3241,7 +3253,25 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
       try {
         const stat = await import_node_fs10.default.promises.stat(filename);
         if (!stat.isFile()) continue;
-        const certificate = (await (0, import_node_opcua_crypto5.readCertificateChainAsync)(filename))[0];
+        const certs = await (0, import_node_opcua_crypto5.readCertificateChainAsync)(filename);
+        if (certs.length === 0) continue;
+        const certificate = certs[0];
+        if (certs.length > 1) {
+          try {
+            await import_node_fs10.default.promises.writeFile(filename, (0, import_node_opcua_crypto5.toPem)(certs, "CERTIFICATE"), "ascii");
+          } catch (writeErr) {
+            debugLog(`scanCertFolder: could not rewrite legacy PEM ${filename} (read-only fs?)`, writeErr);
+          }
+          for (let i = 1; i < certs.length; i++) {
+            if (isIssuer(certs[i])) {
+              try {
+                await this.addIssuer(certs[i]);
+              } catch (issuerErr) {
+                debugLog(`scanCertFolder: could not auto-register issuer from ${filename}`, issuerErr);
+              }
+            }
+          }
+        }
         const info = (0, import_node_opcua_crypto5.exploreCertificate)(certificate);
         const fingerprint = makeFingerprint(certificate);
         index.set(fingerprint, { certificate, filename, info });