node-opcua-pki 6.12.1 → 6.12.2

package/dist/index.mjs

@@ -1921,9 +1921,10 @@ function short(stringToShorten) {
 }
 var forbiddenChars = /[\x00-\x1F<>:"/\\|?*]/g;
 function buildIdealCertificateName(certificate) {
-  const fingerprint = makeFingerprint(certificate);
+  const chain = coerceCertificateChain(certificate);
+  const fingerprint = makeFingerprint(chain);
   try {
-    const commonName = exploreCertificate2(certificate).tbsCertificate.subject.commonName || "";
+    const commonName = exploreCertificate2(chain[0]).tbsCertificate.subject.commonName || "";
     const sanitizedCommonName = commonName.replace(forbiddenChars, "_");
     return `${sanitizedCommonName}[${fingerprint}]`;
   } catch (_err) {
@@ -2170,18 +2171,18 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
   /**
    * Move a certificate to the rejected store.
    * If the certificate was previously trusted, it will be removed from the trusted folder.
-   * @param certificate - the DER-encoded certificate
+   * @param certificateOrChain - the DER-encoded certificate or certificate chain
    */
-  async rejectCertificate(certificate) {
-    await this.#moveCertificate(certificate, "rejected");
+  async rejectCertificate(certificateOrChain) {
+    await this.#moveCertificate(certificateOrChain, "rejected");
   }
   /**
    * Move a certificate to the trusted store.
    * If the certificate was previously rejected, it will be removed from the rejected folder.
-   * @param certificate - the DER-encoded certificate
+   * @param certificateOrChain - the DER-encoded certificate or certificate chain
    */
-  async trustCertificate(certificate) {
-    await this.#moveCertificate(certificate, "trusted");
+  async trustCertificate(certificateOrChain) {
+    await this.#moveCertificate(certificateOrChain, "trusted");
   }
   /**
    * Check whether the trusted certificate store is empty.
@@ -2235,31 +2236,40 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
    * @returns `"Good"` if trusted, `"BadCertificateUntrusted"` if rejected/unknown,
    *   or `"BadCertificateInvalid"` if the certificate cannot be parsed.
    */
-  async isCertificateTrusted(certificate) {
-    let fingerprint;
+  async isCertificateTrusted(certificateOrCertificateChain) {
     try {
-      fingerprint = makeFingerprint(certificate);
-    } catch (_err) {
-      return "BadCertificateInvalid";
-    }
-    if (this.#thumbs.trusted.has(fingerprint)) {
-      return "Good";
-    }
-    if (!this.#thumbs.rejected.has(fingerprint)) {
-      if (!this.untrustUnknownCertificate) {
-        return "Good";
+      const chain = coerceCertificateChain(certificateOrCertificateChain);
+      const leafCertificate = chain[0];
+      if (chain.length < 1) {
+        return "BadCertificateInvalid";
       }
+      let fingerprint;
       try {
-        exploreCertificateInfo(certificate);
+        fingerprint = makeFingerprint(chain[0]);
       } catch (_err) {
         return "BadCertificateInvalid";
       }
-      const filename = path6.join(this.rejectedFolder, `${buildIdealCertificateName(certificate)}.pem`);
-      debugLog("certificate has never been seen before and is now rejected (untrusted) ", filename);
-      await fsWriteFile(filename, toPem2(certificate, "CERTIFICATE"));
-      this.#thumbs.rejected.set(fingerprint, { certificate, filename });
+      if (this.#thumbs.trusted.has(fingerprint)) {
+        return "Good";
+      }
+      if (!this.#thumbs.rejected.has(fingerprint)) {
+        if (!this.untrustUnknownCertificate) {
+          return "Good";
+        }
+        try {
+          exploreCertificateInfo(chain[0]);
+        } catch (_err) {
+          return "BadCertificateInvalid";
+        }
+        const filename = path6.join(this.rejectedFolder, `${buildIdealCertificateName(leafCertificate)}.pem`);
+        debugLog("certificate has never been seen before and is now rejected (untrusted) ", filename);
+        await fsWriteFile(filename, toPem2(chain, "CERTIFICATE"));
+        this.#thumbs.rejected.set(fingerprint, { certificate: leafCertificate, filename });
+      }
+      return "BadCertificateUntrusted";
+    } catch (_err) {
+      return "BadCertificateInvalid";
     }
-    return "BadCertificateUntrusted";
   }
   async #innerVerifyCertificateAsync(certificateOrChain, _isIssuer, level, options) {
     if (level >= 5) {
@@ -2929,7 +2939,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
         return "BadCertificateInvalid" /* BadCertificateInvalid */;
       }
     }
-    await this.trustCertificate(leafCertificate);
+    await this.trustCertificate(certificates);
     return "Good" /* Good */;
   }
   /**
@@ -3021,12 +3031,14 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     }
     return "unknown";
   }
-  async #moveCertificate(certificate, newStatus) {
+  async #moveCertificate(certificateOrChain, newStatus) {
     await this.withLock2(async () => {
+      const chain = coerceCertificateChain(certificateOrChain);
+      const certificate = chain[0];
       const fingerprint = makeFingerprint(certificate);
       let status = await this.#checkRejectedOrTrusted(certificate);
       if (status === "unknown") {
-        const pem = toPem2(certificate, "CERTIFICATE");
+        const pem = toPem2(chain, "CERTIFICATE");
         const filename = path6.join(this.rejectedFolder, `${buildIdealCertificateName(certificate)}.pem`);
         await fs10.promises.writeFile(filename, pem);
         this.#thumbs.rejected.set(fingerprint, { certificate, filename });
@@ -3213,7 +3225,25 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
       try {
         const stat = await fs10.promises.stat(filename);
         if (!stat.isFile()) continue;
-        const certificate = (await readCertificateChainAsync(filename))[0];
+        const certs = await readCertificateChainAsync(filename);
+        if (certs.length === 0) continue;
+        const certificate = certs[0];
+        if (certs.length > 1) {
+          try {
+            await fs10.promises.writeFile(filename, toPem2(certs, "CERTIFICATE"), "ascii");
+          } catch (writeErr) {
+            debugLog(`scanCertFolder: could not rewrite legacy PEM ${filename} (read-only fs?)`, writeErr);
+          }
+          for (let i = 1; i < certs.length; i++) {
+            if (isIssuer(certs[i])) {
+              try {
+                await this.addIssuer(certs[i]);
+              } catch (issuerErr) {
+                debugLog(`scanCertFolder: could not auto-register issuer from ${filename}`, issuerErr);
+              }
+            }
+          }
+        }
         const info = exploreCertificate2(certificate);
         const fingerprint = makeFingerprint(certificate);
         index.set(fingerprint, { certificate, filename, info });