node-opcua-pki 6.19.0 → 6.20.0

package/dist/bin/pki.mjs

@@ -91,6 +91,45 @@ var init_hostname = __esm({
   }
 });
 
+// packages/node-opcua-pki/lib/toolbox/common.ts
+import assert2 from "assert";
+async function resolvePrivateKeyPassphrase(passphrase) {
+  if (passphrase === void 0) {
+    return void 0;
+  }
+  return typeof passphrase === "function" ? await passphrase() : passphrase;
+}
+function adjustDate(params) {
+  assert2(params instanceof Object);
+  params.startDate = params.startDate || /* @__PURE__ */ new Date();
+  assert2(params.startDate instanceof Date);
+  if (params.validityMs !== void 0) {
+    if (params.validityMs <= 0) {
+      throw new RangeError(`validityMs must be > 0 (got ${params.validityMs})`);
+    }
+    params.endDate = new Date(params.startDate.getTime() + params.validityMs);
+    params.validity = Math.ceil(params.validityMs / 864e5);
+  } else {
+    params.validity = params.validity || 365;
+    params.endDate = new Date(params.startDate.getTime());
+    params.endDate.setDate(params.startDate.getDate() + params.validity);
+  }
+  assert2(params.endDate instanceof Date);
+  assert2(params.startDate instanceof Date);
+}
+function adjustApplicationUri(params) {
+  const applicationUri = params.applicationUri || "";
+  if (applicationUri.length > 200) {
+    throw new Error(`Openssl doesn't support urn with length greater than 200${applicationUri}`);
+  }
+}
+var init_common = __esm({
+  "packages/node-opcua-pki/lib/toolbox/common.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
 // packages/node-opcua-pki/lib/toolbox/config.ts
 var g_config;
 var init_config = __esm({
@@ -126,7 +165,7 @@ var init_debug = __esm({
 });
 
 // packages/node-opcua-pki/lib/toolbox/common2.ts
-import assert2 from "assert";
+import assert3 from "assert";
 import fs from "fs";
 import path from "path";
 import chalk from "chalk";
@@ -145,12 +184,31 @@ function mkdirRecursiveSync(folder) {
     fs.mkdirSync(folder, { recursive: true });
   }
 }
+function restrictPrivateFilePermissions(target, mode) {
+  if (process.platform === "win32") {
+    return;
+  }
+  try {
+    fs.chmodSync(target, mode);
+  } catch (err) {
+    warningLog(chalk.yellow("        could not restrict permissions on "), target, err.message);
+  }
+}
+function ensurePrivateDirectory(dir) {
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  }
+  restrictPrivateFilePermissions(dir, 448);
+}
+function isEncryptedPrivateKeyFile(filename) {
+  return fs.readFileSync(filename, "utf-8").includes("-----BEGIN ENCRYPTED PRIVATE KEY-----");
+}
 function makePath(folderName, filename) {
   let s;
   if (filename) {
     s = path.join(path.normalize(folderName), filename);
   } else {
-    assert2(folderName);
+    assert3(folderName);
     s = folderName;
   }
   s = s.replace(/\\/g, "/");
@@ -203,21 +261,22 @@ var init_display = __esm({
 });
 
 // packages/node-opcua-pki/lib/toolbox/without_openssl/create_certificate_signing_request.ts
-import assert3 from "assert";
+import assert4 from "assert";
 import fs2 from "fs";
-import { createCertificateSigningRequest, pemToPrivateKey, Subject } from "node-opcua-crypto";
+import { coercePrivateKeyPem, createCertificateSigningRequest, pemToPrivateKey, Subject } from "node-opcua-crypto";
 async function createCertificateSigningRequestAsync(certificateSigningRequestFilename, params) {
-  assert3(params);
-  assert3(params.rootDir);
-  assert3(params.configFile);
-  assert3(params.privateKey);
-  assert3(typeof params.privateKey === "string");
-  assert3(fs2.existsSync(params.privateKey), `Private key must exist${params.privateKey}`);
-  assert3(fs2.existsSync(params.rootDir), "RootDir key must exist");
-  assert3(typeof certificateSigningRequestFilename === "string");
+  assert4(params);
+  assert4(params.rootDir);
+  assert4(params.configFile);
+  assert4(params.privateKey);
+  if (typeof params.privateKey === "string") {
+    assert4(fs2.existsSync(params.privateKey), `Private key must exist${params.privateKey}`);
+  }
+  assert4(fs2.existsSync(params.rootDir), "RootDir key must exist");
+  assert4(typeof certificateSigningRequestFilename === "string");
   const subject = params.subject ? new Subject(params.subject).toString() : void 0;
   displaySubtitle("- Creating a Certificate Signing Request with subtile");
-  const privateKeyPem = await fs2.promises.readFile(params.privateKey, "utf-8");
+  const privateKeyPem = typeof params.privateKey === "string" ? await fs2.promises.readFile(params.privateKey, "utf-8") : coercePrivateKeyPem(params.privateKey);
   const privateKey = await pemToPrivateKey(privateKeyPem);
   const { csr } = await createCertificateSigningRequest({
     privateKey,
@@ -228,7 +287,7 @@ async function createCertificateSigningRequestAsync(certificateSigningRequestFil
     purpose: params.purpose
   });
   await fs2.promises.writeFile(certificateSigningRequestFilename, csr, "utf-8");
-  display(`- privateKey ${params.privateKey}`);
+  display(`- privateKey ${typeof params.privateKey === "string" ? params.privateKey : "<in-memory>"}`);
   display(`- certificateSigningRequestFilename ${certificateSigningRequestFilename}`);
 }
 var init_create_certificate_signing_request = __esm({
@@ -239,47 +298,12 @@ var init_create_certificate_signing_request = __esm({
   }
 });
 
-// packages/node-opcua-pki/lib/toolbox/common.ts
-import assert4 from "assert";
-function quote(str) {
-  return `"${str || ""}"`;
-}
-function adjustDate(params) {
-  assert4(params instanceof Object);
-  params.startDate = params.startDate || /* @__PURE__ */ new Date();
-  assert4(params.startDate instanceof Date);
-  if (params.validityMs !== void 0) {
-    if (params.validityMs <= 0) {
-      throw new RangeError(`validityMs must be > 0 (got ${params.validityMs})`);
-    }
-    params.endDate = new Date(params.startDate.getTime() + params.validityMs);
-    params.validity = Math.ceil(params.validityMs / 864e5);
-  } else {
-    params.validity = params.validity || 365;
-    params.endDate = new Date(params.startDate.getTime());
-    params.endDate.setDate(params.startDate.getDate() + params.validity);
-  }
-  assert4(params.endDate instanceof Date);
-  assert4(params.startDate instanceof Date);
-}
-function adjustApplicationUri(params) {
-  const applicationUri = params.applicationUri || "";
-  if (applicationUri.length > 200) {
-    throw new Error(`Openssl doesn't support urn with length greater than 200${applicationUri}`);
-  }
-}
-var init_common = __esm({
-  "packages/node-opcua-pki/lib/toolbox/common.ts"() {
-    "use strict";
-    init_esm_shims();
-  }
-});
-
 // packages/node-opcua-pki/lib/toolbox/without_openssl/create_self_signed_certificate.ts
 import assert5 from "assert";
 import fs3 from "fs";
 import {
   CertificatePurpose,
+  coercePrivateKeyPem as coercePrivateKeyPem2,
   createSelfSignedCertificate as createSelfSignedCertificate1,
   pemToPrivateKey as pemToPrivateKey2,
   Subject as Subject2
@@ -289,7 +313,9 @@ async function createSelfSignedCertificateAsync(certificate, params) {
   assert5(params.purpose, "Please provide a Certificate Purpose");
   assert5(fs3.existsSync(params.configFile));
   assert5(fs3.existsSync(params.rootDir));
-  assert5(fs3.existsSync(params.privateKey));
+  if (typeof params.privateKey === "string") {
+    assert5(fs3.existsSync(params.privateKey));
+  }
   if (!params.subject) {
     throw Error("Missing subject");
   }
@@ -301,7 +327,7 @@ async function createSelfSignedCertificateAsync(certificate, params) {
   subject = subject.toString();
   const purpose = params.purpose;
   displayTitle("Generate a certificate request");
-  const privateKeyPem = await fs3.promises.readFile(params.privateKey, "utf-8");
+  const privateKeyPem = typeof params.privateKey === "string" ? await fs3.promises.readFile(params.privateKey, "utf-8") : coercePrivateKeyPem2(params.privateKey);
   const privateKey = await pemToPrivateKey2(privateKeyPem);
   const { cert } = await createSelfSignedCertificate1({
     privateKey,
@@ -365,9 +391,11 @@ import {
   readCertificateChain,
   readCertificateChainAsync,
   readCertificateRevocationList,
+  readPrivateKey,
   split_der,
   toPem,
-  verifyCertificateSignature
+  verifyCertificateSignature,
+  writePrivateKeyFile
 } from "node-opcua-crypto";
 function getOrComputeInfo(entry) {
   if (!entry.info) {
@@ -468,6 +496,7 @@ var init_certificate_manager = __esm({
   "packages/node-opcua-pki/lib/pki/certificate_manager.ts"() {
     "use strict";
     init_esm_shims();
+    init_common();
     init_common2();
     init_debug();
     init_without_openssl();
@@ -576,6 +605,15 @@ var init_certificate_manager = __esm({
       #initializingPromise;
       #addCertValidation;
       #disableFileWatchers;
+      #privateKeyPassphrase;
+      #privateKeyProvider;
+      /**
+       * The on-disk key, decrypted once and kept for the instance's lifetime,
+       * so the passphrase (or its resolver function) is consulted at most
+       * once. Cleared by `dispose()`. Not used when a provider is configured:
+       * the provider is the authority on the current key.
+       */
+      #cachedPrivateKey;
       #thumbs = {
         rejected: /* @__PURE__ */ new Map(),
         trusted: /* @__PURE__ */ new Map(),
@@ -610,6 +648,8 @@ var init_certificate_manager = __esm({
           maxChainLength: v.maxChainLength ?? 5
         };
         this.#disableFileWatchers = options.disableFileWatchers ?? process.env.OPCUA_PKI_DISABLE_FILE_WATCHERS === "true";
+        this.#privateKeyPassphrase = options.privateKeyPassphrase;
+        this.#privateKeyProvider = options.privateKeyProvider;
         mkdirRecursiveSync(options.location);
         if (!fs4.existsSync(this.#location)) {
           throw new Error(`CertificateManager cannot access location ${this.#location}`);
@@ -623,10 +663,108 @@ var init_certificate_manager = __esm({
       get rootDir() {
         return this.#location;
       }
-      /** Path to the private key file (`own/private/private_key.pem`). */
+      /**
+       * Path to the private key file (`own/private/private_key.pem`).
+       *
+       * Kept for backward compatibility with code that reads the key
+       * directly from disk. When a passphrase or a `privateKeyProvider` is
+       * configured, prefer {@link getPrivateKey} instead — this getter still
+       * returns the on-disk path even if a provider is configured (there may
+       * be no meaningful file in that case).
+       */
       get privateKey() {
         return path2.join(this.rootDir, "own/private/private_key.pem");
       }
+      /**
+       * Resolve the private key: from `privateKeyProvider` if configured,
+       * otherwise from disk (decrypting with `privateKeyPassphrase` if the
+       * key is encrypted). Fails closed — throws
+       * `PrivateKeyPassphraseRequiredError` — if the on-disk key is encrypted
+       * and no passphrase is configured, or if the wrong passphrase is
+       * configured.
+       *
+       * The on-disk key is read and decrypted once and then cached for the
+       * lifetime of this instance, so a `privateKeyPassphrase` function is
+       * called at most once (concurrent first calls share the same read). A
+       * failed read is not cached, so a caller can fix the passphrase and
+       * retry. A `privateKeyProvider` is consulted on every call: it is the
+       * authority on what the current key is.
+       */
+      async getPrivateKey() {
+        if (this.#privateKeyProvider) {
+          return await this.#privateKeyProvider.getPrivateKey();
+        }
+        if (this.#cachedPrivateKey) {
+          return this.#cachedPrivateKey;
+        }
+        if (!this.#privateKeyPromise) {
+          this.#privateKeyPromise = (async () => {
+            const passphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
+            return readPrivateKey(this.privateKey, passphrase);
+          })().then(
+            (key) => {
+              this.#cachedPrivateKey = key;
+              return key;
+            },
+            (err) => {
+              this.#privateKeyPromise = void 0;
+              throw err;
+            }
+          );
+        }
+        return await this.#privateKeyPromise;
+      }
+      /** In-flight first read of the on-disk key, so concurrent callers share one passphrase resolution. */
+      #privateKeyPromise;
+      /**
+       * Enable, disable, or rotate the passphrase protecting the on-disk
+       * private key: decrypt with `oldPassphrase` (omit if the key is
+       * currently unencrypted), then write back encrypted with
+       * `newPassphrase` (omit to leave it unencrypted). The write goes to a
+       * temporary file in the same directory and is atomically renamed into
+       * place, so a crash mid-rotation cannot leave a partially-written key;
+       * the temporary file is removed if anything fails, so a rotation *to*
+       * plaintext can never leave a stray cleartext copy behind. Runs under
+       * the same lock as `initialize()`.
+       *
+       * This only rewrites the on-disk file — it does not update this
+       * instance's own `privateKeyPassphrase` (set at construction), and it
+       * drops this instance's cached key so that disk stays the source of
+       * truth. Construct a new `CertificateManager` with the new passphrase to
+       * continue using it afterward.
+       *
+       * Not supported when a `privateKeyProvider` is configured (there is no
+       * disk file for this method to rewrite).
+       */
+      async reencryptPrivateKey(oldPassphrase, newPassphrase) {
+        if (this.#privateKeyProvider) {
+          throw new Error("reencryptPrivateKey: not supported when a privateKeyProvider is configured");
+        }
+        const oldPass = await resolvePrivateKeyPassphrase(oldPassphrase);
+        const newPass = await resolvePrivateKeyPassphrase(newPassphrase);
+        await this.withLock2(async () => {
+          const privateKey = readPrivateKey(this.privateKey, oldPass);
+          await this.#rewritePrivateKeyFile(privateKey, newPass);
+        });
+        this.#cachedPrivateKey = void 0;
+        this.#privateKeyPromise = void 0;
+      }
+      /**
+       * Atomically replace the on-disk private key with `privateKey`, written
+       * as PKCS#8 (encrypted with `passphrase` if given). Temp file next to the
+       * target, `0600`, renamed into place; the temp file is unlinked on any
+       * failure so no partial or cleartext copy can be left behind.
+       * Caller must hold the lock.
+       */
+      async #rewritePrivateKeyFile(privateKey, passphrase) {
+        const tmpFilename = `${this.privateKey}.${process.pid}-${Date.now()}.tmp`;
+        try {
+          await writePrivateKeyFile(tmpFilename, privateKey, { passphrase });
+          await fs4.promises.rename(tmpFilename, this.privateKey);
+        } finally {
+          await fs4.promises.rm(tmpFilename, { force: true });
+        }
+      }
       /** Path to the OpenSSL random seed file. */
       get randomFile() {
         return path2.join(this.rootDir, "./random.rnd");
@@ -926,19 +1064,24 @@ var init_certificate_manager = __esm({
         }
         this.state = 1 /* Initializing */;
         this.#initializingPromise = this.#initialize();
-        await this.#initializingPromise;
+        try {
+          await this.#initializingPromise;
+        } catch (err) {
+          this.#initializingPromise = void 0;
+          this.state = 0 /* Uninitialized */;
+          throw err;
+        }
         this.#initializingPromise = void 0;
         this.state = 2 /* Initialized */;
         _CertificateManager.#activeInstances.add(this);
         _CertificateManager.#installProcessCleanup();
       }
       async #initialize() {
-        this.state = 1 /* Initializing */;
         const pkiDir = this.#location;
         mkdirRecursiveSync(pkiDir);
         mkdirRecursiveSync(path2.join(pkiDir, "own"));
         mkdirRecursiveSync(path2.join(pkiDir, "own/certs"));
-        mkdirRecursiveSync(path2.join(pkiDir, "own/private"));
+        ensurePrivateDirectory(path2.join(pkiDir, "own/private"));
         mkdirRecursiveSync(path2.join(pkiDir, "rejected"));
         mkdirRecursiveSync(path2.join(pkiDir, "trusted"));
         mkdirRecursiveSync(path2.join(pkiDir, "trusted/certs"));
@@ -946,7 +1089,10 @@ var init_certificate_manager = __esm({
         mkdirRecursiveSync(path2.join(pkiDir, "issuers"));
         mkdirRecursiveSync(path2.join(pkiDir, "issuers/certs"));
         mkdirRecursiveSync(path2.join(pkiDir, "issuers/crl"));
-        if (!fs4.existsSync(this.configFile) || !fs4.existsSync(this.privateKey)) {
+        const ownsDiskKey = !this.#privateKeyProvider;
+        const needsKeyGeneration = ownsDiskKey && !fs4.existsSync(this.privateKey);
+        const needsKeyEncryption = ownsDiskKey && !needsKeyGeneration && this.#privateKeyPassphrase !== void 0 && !isEncryptedPrivateKeyFile(this.privateKey);
+        if (!fs4.existsSync(this.configFile) || needsKeyGeneration || needsKeyEncryption) {
           return await this.withLock2(async () => {
             if (this.state === 3 /* Disposing */ || this.state === 4 /* Disposed */) {
               return;
@@ -954,15 +1100,29 @@ var init_certificate_manager = __esm({
             if (!fs4.existsSync(this.configFile)) {
               fs4.writeFileSync(this.configFile, configurationFileSimpleTemplate);
             }
-            if (!fs4.existsSync(this.privateKey)) {
+            if (ownsDiskKey && !fs4.existsSync(this.privateKey)) {
               debugLog("generating private key ...");
-              await generatePrivateKeyFile(this.privateKey, this.keySize);
-              await this.#readCertificates();
-            } else {
-              await this.#readCertificates();
+              const passphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
+              await generatePrivateKeyFile(this.privateKey, this.keySize, { passphrase });
+              this.#cachedPrivateKey = readPrivateKey(this.privateKey, passphrase);
+            } else if (ownsDiskKey && this.#privateKeyPassphrase !== void 0 && !isEncryptedPrivateKeyFile(this.privateKey)) {
+              warningLog("initialize: private key is plaintext but a passphrase is configured; encrypting it in place");
+              const passphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
+              const plaintextKey = readPrivateKey(this.privateKey);
+              await this.#rewritePrivateKeyFile(plaintextKey, passphrase);
+              this.#cachedPrivateKey = plaintextKey;
+            }
+            if (ownsDiskKey) {
+              restrictPrivateFilePermissions(this.privateKey, 384);
             }
+            await this.getPrivateKey();
+            await this.#readCertificates();
           });
         } else {
+          if (ownsDiskKey) {
+            restrictPrivateFilePermissions(this.privateKey, 384);
+          }
+          await this.getPrivateKey();
           await this.#readCertificates();
         }
       }
@@ -998,6 +1158,8 @@ var init_certificate_manager = __esm({
           this.#watchers.splice(0);
         } finally {
           this.state = 4 /* Disposed */;
+          this.#cachedPrivateKey = void 0;
+          this.#privateKeyPromise = void 0;
           _CertificateManager.#activeInstances.delete(this);
         }
       }
@@ -1044,16 +1206,18 @@ var init_certificate_manager = __esm({
         if (typeof params.applicationUri !== "string") {
           throw new Error("createSelfSignedCertificate: expecting applicationUri to be a string");
         }
-        if (!fs4.existsSync(this.privateKey)) {
+        if (!this.#privateKeyProvider && !fs4.existsSync(this.privateKey)) {
           throw new Error(`Cannot find private key ${this.privateKey}`);
         }
         let certificateFilename = path2.join(this.rootDir, "own/certs/self_signed_certificate.pem");
         certificateFilename = params.outputFile || certificateFilename;
-        const _params = params;
-        _params.rootDir = this.rootDir;
-        _params.configFile = this.configFile;
-        _params.privateKey = this.privateKey;
-        _params.subject = params.subject || "CN=FIXME";
+        const _params = {
+          ...params,
+          rootDir: this.rootDir,
+          configFile: this.configFile,
+          privateKey: await this.getPrivateKey(),
+          subject: params.subject || "CN=FIXME"
+        };
         await this.withLock2(async () => {
           await createSelfSignedCertificate(certificateFilename, _params);
         });
@@ -1072,13 +1236,15 @@ var init_certificate_manager = __esm({
         if (!params) {
           throw new Error("params is required");
         }
-        const _params = params;
-        if (Object.prototype.hasOwnProperty.call(_params, "rootDir")) {
+        if (Object.prototype.hasOwnProperty.call(params, "rootDir")) {
           throw new Error("rootDir should not be specified ");
         }
-        _params.rootDir = path2.resolve(this.rootDir);
-        _params.configFile = path2.resolve(this.configFile);
-        _params.privateKey = path2.resolve(this.privateKey);
+        const _params = {
+          ...params,
+          rootDir: path2.resolve(this.rootDir),
+          configFile: path2.resolve(this.configFile),
+          privateKey: await this.getPrivateKey()
+        };
         return await this.withLock2(async () => {
           const now = /* @__PURE__ */ new Date();
           const today2 = `${now.toISOString().slice(0, 10)}_${now.getTime()}`;
@@ -1940,6 +2106,19 @@ var init_toolbox = __esm({
 });
 
 // packages/node-opcua-pki/lib/toolbox/with_openssl/_env.ts
+function buildChildEnv(extra) {
+  const env = {};
+  for (const key of Object.keys(process.env)) {
+    if (SAFE_ENV_PASSTHROUGH.has(key.toLowerCase())) {
+      env[key] = process.env[key];
+    }
+  }
+  return { ...env, ...extra };
+}
+function redactEnvForLog(options) {
+  const { env, ...rest } = options;
+  return env ? { ...rest, env: Object.keys(env) } : rest;
+}
 function setEnv(varName, value) {
   if (!g_config.silent) {
     warningLog(`          set ${varName}=${value}`);
@@ -1982,13 +2161,44 @@ function processAltNames(params) {
   const subjectAltNameString = subjectAltName.join(", ");
   setEnv("ALTNAME", subjectAltNameString);
 }
-var exportedEnvVars;
+var SAFE_ENV_PASSTHROUGH, exportedEnvVars;
 var init_env = __esm({
   "packages/node-opcua-pki/lib/toolbox/with_openssl/_env.ts"() {
     "use strict";
     init_esm_shims();
     init_config();
     init_debug();
+    SAFE_ENV_PASSTHROUGH = /* @__PURE__ */ new Set([
+      // POSIX/Windows shell and process essentials
+      "path",
+      "home",
+      "userprofile",
+      "temp",
+      "tmp",
+      "tmpdir",
+      "systemroot",
+      "windir",
+      "comspec",
+      "pathext",
+      "appdata",
+      "localappdata",
+      // dynamic loader: a custom-built or relocated openssl (e.g. under /opt,
+      // or Homebrew on macOS) may need these to find its own libcrypto/libssl
+      "ld_library_path",
+      "dyld_library_path",
+      "dyld_fallback_library_path",
+      // locale, so openssl's textual output stays parseable
+      "lang",
+      "lc_all",
+      "lc_ctype",
+      // openssl configuration this app, or the host OS/user, may rely on
+      "openssl_conf",
+      "randfile",
+      "openssl_modules",
+      "openssl_engines",
+      "ssl_cert_file",
+      "ssl_cert_dir"
+    ]);
     exportedEnvVars = {};
   }
 });
@@ -2011,24 +2221,17 @@ import { pipeline } from "stream/promises";
 import byline from "byline";
 import chalk4 from "chalk";
 import yauzl from "yauzl";
-async function execute(cmd, cwd) {
+async function execute(file, args, cwd) {
   let output = "";
-  const options = {
-    cwd,
-    windowsHide: true
-  };
   return await new Promise((resolve, reject) => {
-    const child = child_process.exec(
-      cmd,
-      options,
-      (err) => {
-        const exitCode = err === null ? 0 : typeof err.code === "number" ? err.code : 1;
-        if (err) reject(err);
-        else {
-          resolve({ exitCode, output });
-        }
-      }
-    );
+    const child = child_process.spawn(file, args, {
+      cwd,
+      windowsHide: true,
+      env: buildChildEnv(),
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    child.on("error", (err) => reject(err));
+    child.on("close", (code) => resolve({ exitCode: code ?? 1, output }));
     const stream1 = byline(child.stdout);
     stream1.on("data", (line) => {
       output += `${line}
@@ -2040,16 +2243,13 @@ async function execute(cmd, cwd) {
     });
   });
 }
-function quote2(str) {
-  return `"${str.replace(/\\/g, "/")}"`;
-}
 function is_expected_openssl_version(strVersion) {
   return !!strVersion.match(/OpenSSL \d/);
 }
 async function getopensslExecPath() {
   let result1;
   try {
-    result1 = await execute("which openssl");
+    result1 = await execute("which", ["openssl"]);
   } catch (err) {
     warningLog("warning: ", err.message);
     throw new Error("Cannot find openssl");
@@ -2066,11 +2266,10 @@ async function getopensslExecPath() {
 }
 async function check_system_openssl_version() {
   const opensslExecPath = await getopensslExecPath();
-  const q_opensslExecPath = quote2(opensslExecPath);
   if (doDebug2) {
     warningLog(`              OpenSSL found in : ${chalk4.yellow(opensslExecPath)}`);
   }
-  const result = await execute(`${q_opensslExecPath} version`);
+  const result = await execute(opensslExecPath, ["version"]);
   const exitCode = result?.exitCode;
   const output = result?.output;
   const version = output.trim();
@@ -2110,9 +2309,8 @@ async function install_and_check_win32_openssl_version() {
         version: `cannot find file ${opensslExecPath2}`
       };
     } else {
-      const q_openssl_exe_path = quote2(opensslExecPath2);
       const cwd = ".";
-      const { exitCode, output } = await execute(`${q_openssl_exe_path} version`, cwd);
+      const { exitCode, output } = await execute(opensslExecPath2, ["version"], cwd);
       const version = output.trim();
       if (doDebug2) {
         warningLog(" Version = ", version);
@@ -2125,7 +2323,7 @@ async function install_and_check_win32_openssl_version() {
   }
   async function find_system_openssl_win32() {
     try {
-      const result = await execute("where openssl");
+      const result = await execute("where", ["openssl"]);
       if (result.exitCode !== 0) {
         return void 0;
       }
@@ -2133,8 +2331,7 @@ async function install_and_check_win32_openssl_version() {
       if (!opensslPath2 || !fs5.existsSync(opensslPath2)) {
         return void 0;
       }
-      const q5 = quote2(opensslPath2);
-      const versionResult = await execute(`${q5} version`);
+      const versionResult = await execute(opensslPath2, ["version"]);
       const version = versionResult.output.trim();
       if (versionResult.exitCode === 0 && is_expected_openssl_version(version)) {
         warningLog(
@@ -2299,6 +2496,7 @@ var init_install_prerequisite = __esm({
     "use strict";
     init_esm_shims();
     init_debug();
+    init_env();
     doDebug2 = process.env.NODEOPCUAPKIDEBUG || false;
   }
 });
@@ -2310,36 +2508,53 @@ import fs6 from "fs";
 import os3 from "os";
 import byline2 from "byline";
 import chalk5 from "chalk";
-async function execute2(cmd, options) {
+function passinArg(passphrase = "") {
+  return { args: ["-passin", `env:${PASSIN_ENV_VAR}`], env: { [PASSIN_ENV_VAR]: passphrase } };
+}
+function passoutArg(passphrase = "") {
+  return { args: ["-passout", `env:${PASSOUT_ENV_VAR}`], env: { [PASSOUT_ENV_VAR]: passphrase } };
+}
+function renderForDisplay(file, args) {
+  return [file, ...args].map((a) => a === "" || /[\s"'`$\\]/.test(a) ? JSON.stringify(a) : a).join(" ");
+}
+async function execute2(file, args, options) {
   const from = new Error();
   options.cwd = options.cwd || process.cwd();
   if (!g_config.silent) {
     warningLog(chalk5.cyan("                  CWD         "), options.cwd);
   }
   const outputs = [];
+  const errorOutputs = [];
+  const display2 = renderForDisplay(file, args);
   return await new Promise((resolve, reject) => {
-    const child = child_process2.exec(
-      cmd,
-      {
-        cwd: options.cwd,
-        windowsHide: true
-      },
-      (err) => {
-        if (err) {
-          if (!options.hideErrorMessage) {
-            const fence = "###########################################";
-            console.error(chalk5.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
-            console.error(chalk5.bgWhiteBright.redBright(`CWD = ${options.cwd}`));
-            console.error(chalk5.bgWhiteBright.redBright(err.message));
-            console.error(chalk5.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
-            console.error(from.stack);
-          }
-          reject(new Error(err.message));
-          return;
-        }
+    const child = child_process2.spawn(file, [...args], {
+      cwd: options.cwd,
+      windowsHide: true,
+      env: buildChildEnv(options.env),
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const fail = (message) => {
+      if (!options.hideErrorMessage) {
+        const fence = "###########################################";
+        console.error(chalk5.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
+        console.error(chalk5.bgWhiteBright.redBright(`CWD = ${options.cwd}`));
+        console.error(chalk5.bgWhiteBright.redBright(message));
+        console.error(chalk5.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
+        console.error(from.stack);
+      }
+      reject(new Error(message));
+    };
+    child.on("error", (err) => fail(`Command failed: ${display2}
+${err.message}`));
+    child.on("close", (code, signal) => {
+      if (code === 0) {
         resolve(outputs.join(""));
+        return;
       }
-    );
+      const why = signal ? `signal ${signal}` : `exit code ${code}`;
+      fail(`Command failed: ${display2}
+${errorOutputs.join("")}(${why})`);
+    });
     if (child.stdout) {
       const stream2 = byline2(child.stdout);
       stream2.on("data", (line) => {
@@ -2356,17 +2571,17 @@ async function execute2(cmd, options) {
         });
       }
     }
-    if (!g_config.silent) {
-      if (child.stderr) {
-        const stream1 = byline2(child.stderr);
-        stream1.on("data", (line) => {
-          line = line.toString();
-          if (displayError) {
-            process.stdout.write(`${chalk5.white("        stderr ") + chalk5.red(line)}
+    if (child.stderr) {
+      const stream1 = byline2(child.stderr);
+      stream1.on("data", (line) => {
+        line = line.toString();
+        errorOutputs.push(`${line}
 `);
-          }
-        });
-      }
+        if (!g_config.silent && displayError) {
+          process.stdout.write(`${chalk5.white("        stderr ") + chalk5.red(line)}
+`);
+        }
+      });
     }
   });
 }
@@ -2376,18 +2591,18 @@ async function find_openssl() {
 async function ensure_openssl_installed() {
   if (!opensslPath) {
     opensslPath = await find_openssl();
-    const outputs = await execute_openssl("version", { cwd: "." });
+    const outputs = await execute_openssl(["version"], { cwd: "." });
     g_config.opensslVersion = outputs.trim();
     if (doDebug) {
       warningLog("OpenSSL version : ", g_config.opensslVersion);
     }
   }
 }
-async function execute_openssl_no_failure(cmd, options) {
+async function execute_openssl_no_failure(args, options) {
   options = options || {};
   options.hideErrorMessage = true;
   try {
-    return await execute_openssl(cmd, options);
+    return await execute_openssl(args, options);
   } catch (err) {
     debugLog(" (ignored error =  ERROR : )", err.message);
   }
@@ -2395,8 +2610,8 @@ async function execute_openssl_no_failure(cmd, options) {
 function getTempFolder() {
   return os3.tmpdir();
 }
-async function execute_openssl(cmd, options) {
-  debugLog("execute_openssl", cmd, options);
+async function execute_openssl(args, options) {
+  debugLog("execute_openssl", args, redactEnvForLog(options));
   const empty_config_file = n(getTempFolder(), "empty_config.cnf");
   if (!fs6.existsSync(empty_config_file)) {
     await fs6.promises.writeFile(empty_config_file, "# empty config file");
@@ -2408,23 +2623,24 @@ async function execute_openssl(cmd, options) {
   if (!g_config.silent) {
     warningLog(chalk5.cyan("                  OPENSSL_CONF"), process.env.OPENSSL_CONF);
     warningLog(chalk5.cyan("                  RANDFILE    "), process.env.RANDFILE);
-    warningLog(chalk5.cyan("                  CMD         openssl "), chalk5.cyanBright(cmd));
+    warningLog(chalk5.cyan("                  CMD         "), chalk5.cyanBright(renderForDisplay("openssl", args)));
   }
   await ensure_openssl_installed();
-  return await execute2(`${quote(opensslPath)} ${cmd}`, options);
+  return await execute2(opensslPath, args, options);
 }
-var opensslPath, n;
+var opensslPath, n, PASSIN_ENV_VAR, PASSOUT_ENV_VAR;
 var init_execute_openssl = __esm({
   "packages/node-opcua-pki/lib/toolbox/with_openssl/execute_openssl.ts"() {
     "use strict";
     init_esm_shims();
-    init_common();
     init_common2();
     init_config();
     init_debug();
     init_env();
     init_install_prerequisite();
     n = makePath;
+    PASSIN_ENV_VAR = "NODE_OPCUA_PKI_OPENSSL_PASSIN";
+    PASSOUT_ENV_VAR = "NODE_OPCUA_PKI_OPENSSL_PASSOUT";
   }
 });
 
@@ -2463,9 +2679,12 @@ function generateStaticConfig(configPath, options) {
     return temporaryConfigPath;
   }
 }
-async function getPublicKeyFromPrivateKey(privateKeyFilename, publicKeyFilename) {
+async function getPublicKeyFromPrivateKey(privateKeyFilename, publicKeyFilename, passphrase) {
   assert7(fs7.existsSync(privateKeyFilename));
-  await execute_openssl(`rsa -pubout -in ${q(n2(privateKeyFilename))} -out ${q(n2(publicKeyFilename))}`, {});
+  const passin = passinArg(passphrase);
+  await execute_openssl(["rsa", "-pubout", "-in", n2(privateKeyFilename), "-out", n2(publicKeyFilename), ...passin.args], {
+    env: passin.env
+  });
 }
 function x509Date(date) {
   date = date || /* @__PURE__ */ new Date();
@@ -2486,30 +2705,28 @@ function x509Date(date) {
 }
 async function dumpCertificate(certificate) {
   assert7(fs7.existsSync(certificate));
-  return await execute_openssl(`x509  -in ${q(n2(certificate))} -text  -noout`, {});
+  return await execute_openssl(["x509", "-in", n2(certificate), "-text", "-noout"], {});
 }
 async function toDer(certificatePem) {
   assert7(fs7.existsSync(certificatePem));
   const certificateDer = certificatePem.replace(".pem", ".der");
-  return await execute_openssl(`x509   -outform der  -in ${certificatePem} -out ${certificateDer}`, {});
+  return await execute_openssl(["x509", "-outform", "der", "-in", certificatePem, "-out", certificateDer], {});
 }
 async function fingerprint(certificatePem) {
   assert7(fs7.existsSync(certificatePem));
-  return await execute_openssl(`x509   -fingerprint  -noout  -in ${certificatePem}`, {});
+  return await execute_openssl(["x509", "-fingerprint", "-noout", "-in", certificatePem], {});
 }
-var _counter, q, n2;
+var _counter, n2;
 var init_toolbox2 = __esm({
   "packages/node-opcua-pki/lib/toolbox/with_openssl/toolbox.ts"() {
     "use strict";
     init_esm_shims();
-    init_common();
     init_common2();
     init_config();
     init_env();
     init_execute_openssl();
     g_config.opensslVersion = "";
     _counter = 0;
-    q = quote;
     n2 = makePath;
   }
 });
@@ -2531,28 +2748,37 @@ async function createCertificateSigningRequestWithOpenSSL(certificateSigningRequ
   processAltNames(params);
   const configFile = generateStaticConfig(params.configFile, { cwd: params.rootDir });
   const options = { cwd: params.rootDir, openssl_conf: path5.relative(params.rootDir, configFile) };
-  const configOption = ` -config ${q2(n3(configFile))}`;
   const subject = params.subject ? new Subject3(params.subject).toString() : void 0;
-  const subjectOptions = subject ? ` -subj "${subject}"` : "";
   displaySubtitle("- Creating a Certificate Signing Request with openssl");
   await execute_openssl(
-    "req -new  -sha256  -batch  -text " + configOption + " -key " + q2(n3(params.privateKey)) + subjectOptions + " -out " + q2(n3(certificateSigningRequestFilename)),
+    [
+      "req",
+      "-new",
+      "-sha256",
+      "-batch",
+      "-text",
+      "-config",
+      n3(configFile),
+      "-key",
+      n3(params.privateKey),
+      ...subject ? ["-subj", subject] : [],
+      "-out",
+      n3(certificateSigningRequestFilename)
+    ],
     options
   );
 }
-var q2, n3;
+var n3;
 var init_create_certificate_signing_request2 = __esm({
   "packages/node-opcua-pki/lib/toolbox/with_openssl/create_certificate_signing_request.ts"() {
     "use strict";
     init_esm_shims();
     init_subject();
-    init_common();
     init_common2();
     init_display();
     init_env();
     init_execute_openssl();
     init_toolbox2();
-    q2 = quote;
     n3 = makePath;
   }
 });
@@ -2575,31 +2801,28 @@ var init_with_openssl = __esm({
 import assert9 from "assert";
 import fs9 from "fs";
 async function createPFX(options) {
-  const { certificateFile, privateKeyFile, outputFile, passphrase = "", caCertificateFiles } = options;
+  const { certificateFile, privateKeyFile, privateKeyPassphrase, outputFile, passphrase = "", caCertificateFiles } = options;
   assert9(fs9.existsSync(certificateFile), `Certificate file does not exist: ${certificateFile}`);
   assert9(fs9.existsSync(privateKeyFile), `Private key file does not exist: ${privateKeyFile}`);
-  let cmd = `pkcs12 -export`;
-  cmd += ` -in ${q3(n4(certificateFile))}`;
-  cmd += ` -inkey ${q3(n4(privateKeyFile))}`;
+  const args = ["pkcs12", "-export", "-in", n4(certificateFile), "-inkey", n4(privateKeyFile)];
   if (caCertificateFiles) {
     for (const caFile of caCertificateFiles) {
       assert9(fs9.existsSync(caFile), `CA certificate file does not exist: ${caFile}`);
-      cmd += ` -certfile ${q3(n4(caFile))}`;
+      args.push("-certfile", n4(caFile));
     }
   }
-  cmd += ` -out ${q3(n4(outputFile))}`;
-  cmd += ` -passout pass:${passphrase}`;
-  await execute_openssl(cmd, {});
+  const passin = passinArg(privateKeyPassphrase);
+  const passout = passoutArg(passphrase);
+  args.push("-out", n4(outputFile), ...passin.args, ...passout.args);
+  await execute_openssl(args, { env: { ...passin.env, ...passout.env } });
 }
-var q3, n4;
+var n4;
 var init_toolbox_pfx = __esm({
   "packages/node-opcua-pki/lib/pki/toolbox_pfx.ts"() {
     "use strict";
     init_esm_shims();
-    init_common();
     init_common2();
     init_execute_openssl();
-    q3 = quote;
     n4 = makePath;
   }
 });
@@ -2614,7 +2837,7 @@ var init_ca_config_template_cnf = __esm({
 [ ca ]
 default_ca               = CA_default
 [ CA_default ]
-dir                      = %%ROOT_FOLDER%%            # the main CA folder
+dir                      = "%%ROOT_FOLDER%%"        # the main CA folder (quoted: see renderCaConfig)
 certs                    = $dir/certs                 # where to store certificates
 new_certs_dir            = $dir/certs                 #
 database                 = $dir/index.txt             # the certificate database
@@ -2760,10 +2983,17 @@ import {
   generatePrivateKeyFile as generatePrivateKeyFile2,
   readCertificatePEM,
   readCertificateSigningRequest,
-  readPrivateKey,
+  readPrivateKey as readPrivateKey2,
   Subject as Subject4,
-  toPem as toPem2
+  toPem as toPem2,
+  writePrivateKeyFile as writePrivateKeyFile2
 } from "node-opcua-crypto";
+function escapeOpensslConfDoubleQuoted(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+function renderCaConfig(caRootDir) {
+  return configurationFileTemplate.replace(/%%ROOT_FOLDER%%/, escapeOpensslConfDoubleQuoted(makePath(caRootDir)));
+}
 function octetStringToIpAddress(a) {
   return parseInt(a.substring(0, 2), 16).toString() + "." + parseInt(a.substring(2, 4), 16).toString() + "." + parseInt(a.substring(4, 6), 16).toString() + "." + parseInt(a.substring(6, 8), 16).toString();
 }
@@ -2772,7 +3002,7 @@ async function construct_CertificateAuthority(certificateAuthority) {
   const caRootDir = path6.resolve(certificateAuthority.rootDir);
   async function make_folders() {
     mkdirRecursiveSync(caRootDir);
-    mkdirRecursiveSync(path6.join(caRootDir, "private"));
+    ensurePrivateDirectory(path6.join(caRootDir, "private"));
     mkdirRecursiveSync(path6.join(caRootDir, "public"));
     mkdirRecursiveSync(path6.join(caRootDir, "certs"));
     mkdirRecursiveSync(path6.join(caRootDir, "crl"));
@@ -2797,6 +3027,8 @@ async function construct_CertificateAuthority(certificateAuthority) {
   const caKeyExists = fs10.existsSync(path6.join(caRootDir, "private/cakey.pem"));
   const caCertExists = fs10.existsSync(path6.join(caRootDir, "public/cacert.pem"));
   if (caKeyExists && caCertExists && !config3.forceCA) {
+    restrictPrivateFilePermissions(path6.join(caRootDir, "private/cakey.pem"), 384);
+    await certificateAuthority._ensurePrivateKeyProtection();
     debugLog("CA private key and certificate already exist ... skipping");
     return;
   }
@@ -2815,26 +3047,40 @@ async function construct_CertificateAuthority(certificateAuthority) {
   }
   const caConfigFile = certificateAuthority.configFile;
   if (1) {
-    let data = configurationFileTemplate;
-    data = makePath(data.replace(/%%ROOT_FOLDER%%/, caRootDir));
-    await fs10.promises.writeFile(caConfigFile, data);
+    await fs10.promises.writeFile(caConfigFile, renderCaConfig(caRootDir));
   }
-  const subjectOpt = ` -subj "${subject.toString()}" `;
+  const subjectOpt = ["-subj", subject.toString()];
   const caCommonName = subject.commonName || "NodeOPCUA-CA";
   setEnv("ALTNAME", `URI:urn:${caCommonName}`);
   certificateAuthority._wireRevocationEnvVars();
   const options = { cwd: caRootDir };
   const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-  const configOption = ` -config ${q4(n5(configFile))}`;
+  const configOption = ["-config", n5(configFile)];
   const keySize = certificateAuthority.keySize;
   const privateKeyFilename = path6.join(caRootDir, "private/cakey.pem");
   const csrFilename = path6.join(caRootDir, "private/cakey.csr");
   displayTitle(`Generate the CA private Key - ${keySize}`);
-  await generatePrivateKeyFile2(privateKeyFilename, keySize);
+  const passin = await certificateAuthority._opensslPassin();
+  await generatePrivateKeyFile2(privateKeyFilename, keySize, { passphrase: await certificateAuthority._privateKeyPassphrase() });
+  restrictPrivateFilePermissions(privateKeyFilename, 384);
   displayTitle("Generate a certificate request for the CA key");
   await execute_openssl(
-    "req -new -sha256  -text  -extensions v3_ca_req" + configOption + " -key " + q4(n5(privateKeyFilename)) + " -out " + q4(n5(csrFilename)) + " " + subjectOpt,
-    options
+    [
+      "req",
+      "-new",
+      "-sha256",
+      "-text",
+      "-extensions",
+      "v3_ca_req",
+      ...configOption,
+      "-key",
+      n5(privateKeyFilename),
+      "-out",
+      n5(csrFilename),
+      ...subjectOpt,
+      ...passin.args
+    ],
+    { ...options, env: passin.env }
   );
   const issuerCA = certificateAuthority._issuerCA;
   if (issuerCA) {
@@ -2842,27 +3088,71 @@ async function construct_CertificateAuthority(certificateAuthority) {
     const issuerCert = path6.resolve(issuerCA.caCertificate);
     const issuerKey = path6.resolve(issuerCA.rootDir, "private/cakey.pem");
     const issuerSerial = path6.resolve(issuerCA.rootDir, "serial");
+    const issuerPassin = await issuerCA._opensslPassin();
     await execute_openssl(
-      " x509 -sha256 -req -days 3650  -text  -extensions v3_ca -extfile " + q4(n5(configFile)) + " -in private/cakey.csr  -CA " + q4(n5(issuerCert)) + " -CAkey " + q4(n5(issuerKey)) + " -CAserial " + q4(n5(issuerSerial)) + " -out public/cacert.pem",
-      options
+      [
+        "x509",
+        "-sha256",
+        "-req",
+        "-days",
+        "3650",
+        "-text",
+        "-extensions",
+        "v3_ca",
+        "-extfile",
+        n5(configFile),
+        "-in",
+        "private/cakey.csr",
+        "-CA",
+        n5(issuerCert),
+        "-CAkey",
+        n5(issuerKey),
+        "-CAserial",
+        n5(issuerSerial),
+        "-out",
+        "public/cacert.pem",
+        ...issuerPassin.args
+      ],
+      { ...options, env: issuerPassin.env }
     );
   } else {
     displayTitle("Generate CA Certificate (self-signed)");
     await execute_openssl(
-      " x509 -sha256 -req -days 3650  -text  -extensions v3_ca -extfile " + q4(n5(configFile)) + " -in private/cakey.csr  -signkey " + q4(n5(privateKeyFilename)) + " -out public/cacert.pem",
-      options
+      [
+        "x509",
+        "-sha256",
+        "-req",
+        "-days",
+        "3650",
+        "-text",
+        "-extensions",
+        "v3_ca",
+        "-extfile",
+        n5(configFile),
+        "-in",
+        "private/cakey.csr",
+        "-signkey",
+        n5(privateKeyFilename),
+        "-out",
+        "public/cacert.pem",
+        ...passin.args
+      ],
+      { ...options, env: passin.env }
     );
   }
   displaySubtitle("generate initial CRL (Certificate Revocation List)");
-  await regenerateCrl(certificateAuthority.revocationList, configOption, options);
+  await regenerateCrl(certificateAuthority.revocationList, configOption, options, passin);
   displayTitle("Create Certificate Authority (CA) ---> DONE");
 }
-async function regenerateCrl(revocationList, configOption, options) {
+async function regenerateCrl(revocationList, configOption, options, passin) {
   displaySubtitle("regenerate CRL (Certificate Revocation List)");
-  await execute_openssl(`ca -gencrl ${configOption} -out crl/revocation_list.crl`, options);
-  await execute_openssl("crl  -in  crl/revocation_list.crl -out  crl/revocation_list.der  -outform der", options);
+  await execute_openssl(["ca", "-gencrl", ...configOption, "-out", "crl/revocation_list.crl", ...passin.args], {
+    ...options,
+    env: passin.env
+  });
+  await execute_openssl(["crl", "-in", "crl/revocation_list.crl", "-out", "crl/revocation_list.der", "-outform", "der"], options);
   displaySubtitle("Display (Certificate Revocation List)");
-  await execute_openssl(`crl  -in ${q4(n5(revocationList))} -text  -noout`, options);
+  await execute_openssl(["crl", "-in", n5(revocationList), "-text", "-noout"], options);
 }
 function parseOpenSSLDate(dateStr) {
   const raw = dateStr?.split(",")[0] ?? "";
@@ -2903,7 +3193,7 @@ function validateRevocationUrl(url, fieldName) {
   }
   return url;
 }
-var defaultSubject, configurationFileTemplate, configurationFileSimpleTemplate2, config3, n5, q4, CertificateAuthority;
+var defaultSubject, configurationFileTemplate, configurationFileSimpleTemplate2, config3, n5, CertificateAuthority;
 var init_certificate_authority = __esm({
   "packages/node-opcua-pki/lib/ca/certificate_authority.ts"() {
     "use strict";
@@ -2922,7 +3212,6 @@ var init_certificate_authority = __esm({
       pkiDir: "INVALID"
     };
     n5 = makePath;
-    q4 = quote;
     assert10(octetStringToIpAddress("c07b9179") === "192.123.145.121");
     CertificateAuthority = class {
       /** RSA key size used when generating the CA private key. */
@@ -2937,6 +3226,10 @@ var init_certificate_authority = __esm({
       _crlDistributionUrl;
       _ocspResponderUrl;
       _caIssuersUrl;
+      #privateKeyPassphrase;
+      /** resolved once (see `privateKeyPassphrase`); `#passphraseResolved` distinguishes "none" from "not yet" */
+      #resolvedPassphrase;
+      #passphraseResolved = false;
       constructor(options) {
         assert10(Object.prototype.hasOwnProperty.call(options, "location"));
         assert10(Object.prototype.hasOwnProperty.call(options, "keySize"));
@@ -2944,6 +3237,7 @@ var init_certificate_authority = __esm({
         this.keySize = options.keySize || 2048;
         this.subject = new Subject4(options.subject || defaultSubject);
         this._issuerCA = options.issuerCA;
+        this.#privateKeyPassphrase = options.privateKeyPassphrase;
         if (options.crlDistributionUrl !== void 0) {
           this.setCrlDistributionUrl(options.crlDistributionUrl);
         }
@@ -3040,6 +3334,69 @@ var init_certificate_authority = __esm({
       get configFile() {
         return path6.normalize(path6.join(this.rootDir, "./conf/caconfig.cnf"));
       }
+      /** Path to the CA private key (`private/cakey.pem`); may be passphrase-encrypted, see {@link getPrivateKey}. */
+      get privateKey() {
+        return path6.join(path6.resolve(this.rootDir), "private/cakey.pem");
+      }
+      /**
+       * The CA private key, decrypted with the configured `privateKeyPassphrase`
+       * if it is encrypted. Fails closed (`PrivateKeyPassphraseRequiredError`)
+       * on an encrypted key with no or the wrong passphrase.
+       */
+      async getPrivateKey() {
+        return readPrivateKey2(this.privateKey, await this._privateKeyPassphrase());
+      }
+      /**
+       * Enable, disable, or rotate the passphrase protecting `private/cakey.pem`
+       * (temp file + atomic rename, temp file removed on failure). Only
+       * rewrites the file: construct a new `CertificateAuthority` with the new
+       * passphrase to continue using it.
+       */
+      async reencryptPrivateKey(oldPassphrase, newPassphrase) {
+        const oldPass = await resolvePrivateKeyPassphrase(oldPassphrase);
+        const newPass = await resolvePrivateKeyPassphrase(newPassphrase);
+        const key = readPrivateKey2(this.privateKey, oldPass);
+        await this.#rewritePrivateKeyFile(key, newPass);
+      }
+      async #rewritePrivateKeyFile(privateKey, passphrase) {
+        const tmpFilename = `${this.privateKey}.${process.pid}-${Date.now()}.tmp`;
+        try {
+          await writePrivateKeyFile2(tmpFilename, privateKey, { passphrase });
+          await fs10.promises.rename(tmpFilename, this.privateKey);
+        } finally {
+          await fs10.promises.rm(tmpFilename, { force: true });
+        }
+      }
+      /** @internal resolve the configured passphrase, at most once per instance */
+      async _privateKeyPassphrase() {
+        if (!this.#passphraseResolved) {
+          this.#resolvedPassphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
+          this.#passphraseResolved = true;
+        }
+        return this.#resolvedPassphrase;
+      }
+      /** @internal `-passin env:` argv + env for every openssl call that loads this CA's key (always emitted, empty when none) */
+      async _opensslPassin() {
+        return passinArg(await this._privateKeyPassphrase());
+      }
+      /**
+       * @internal On an existing key: encrypt it in place if a passphrase is
+       * configured and it is still plaintext (secure by default: the option
+       * means "protect this key", not "ignore me"), then read it back so a
+       * wrong or missing passphrase fails initialize() closed rather than the
+       * first signing operation.
+       */
+      async _ensurePrivateKeyProtection() {
+        if (!fs10.existsSync(this.privateKey)) {
+          return;
+        }
+        if (this.#privateKeyPassphrase !== void 0 && !isEncryptedPrivateKeyFile(this.privateKey)) {
+          warningLog("CertificateAuthority: private key is plaintext but a passphrase is configured; encrypting it in place");
+          const plaintextKey = readPrivateKey2(this.privateKey);
+          await this.#rewritePrivateKeyFile(plaintextKey, await this._privateKeyPassphrase());
+        }
+        await this.getPrivateKey();
+      }
       /** Path to the CA certificate in PEM format (`public/cacert.pem`). */
       get caCertificate() {
         return makePath(this.rootDir, "./public/cacert.pem");
@@ -3377,7 +3734,7 @@ var init_certificate_authority = __esm({
           await this.signCertificateRequest(certFile, csrFile, signingParams);
           const certPem = readCertificatePEM(certFile);
           const certificateDer = convertPEMtoDER(certPem);
-          const privateKey = readPrivateKey(privateKeyFile);
+          const privateKey = readPrivateKey2(privateKeyFile);
           return { certificateDer, privateKey };
         } finally {
           await fs10.promises.rm(tmpDir, {
@@ -3497,12 +3854,17 @@ var init_certificate_authority = __esm({
       async initializeCSR() {
         const caRootDir = path6.resolve(this.rootDir);
         mkdirRecursiveSync(caRootDir);
-        for (const dir of ["private", "public", "certs", "crl", "conf"]) {
+        for (const dir of ["public", "certs", "crl", "conf"]) {
           mkdirRecursiveSync(path6.join(caRootDir, dir));
         }
+        ensurePrivateDirectory(path6.join(caRootDir, "private"));
         const caCertFile = this.caCertificate;
         const privateKeyFile = path6.join(caRootDir, "private/cakey.pem");
         const csrFile = path6.join(caRootDir, "private/cakey.csr");
+        if (fs10.existsSync(privateKeyFile)) {
+          restrictPrivateFilePermissions(privateKeyFile, 384);
+          await this._ensurePrivateKeyProtection();
+        }
         if (fs10.existsSync(caCertFile)) {
           const certDer = convertPEMtoDER(readCertificatePEM(caCertFile));
           const certInfo = exploreCertificate2(certDer);
@@ -3536,11 +3898,10 @@ var init_certificate_authority = __esm({
           await fs10.promises.writeFile(indexFileAttr, "unique_subject = no");
         }
         const caConfigFile = this.configFile;
-        let data = configurationFileTemplate;
-        data = makePath(data.replace(/%%ROOT_FOLDER%%/, caRootDir));
-        await fs10.promises.writeFile(caConfigFile, data);
+        await fs10.promises.writeFile(caConfigFile, renderCaConfig(caRootDir));
         if (!fs10.existsSync(privateKeyFile)) {
-          await generatePrivateKeyFile2(privateKeyFile, this.keySize);
+          await generatePrivateKeyFile2(privateKeyFile, this.keySize, { passphrase: await this._privateKeyPassphrase() });
+          restrictPrivateFilePermissions(privateKeyFile, 384);
         }
         await this._generateCSR(caRootDir, privateKeyFile, csrFile);
         return { status: "created", csrPath: csrFile };
@@ -3582,14 +3943,29 @@ var init_certificate_authority = __esm({
        * @internal
        */
       async _generateCSR(caRootDir, privateKeyFile, csrFile) {
-        const subjectOpt = ` -subj "${this.subject.toString()}" `;
         processAltNames({});
         const options = { cwd: caRootDir };
         const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-        const configOption = ` -config ${q4(n5(configFile))}`;
+        const passin = await this._opensslPassin();
         await execute_openssl(
-          "req -new -sha256  -text  -extensions v3_ca_req" + configOption + " -key " + q4(n5(privateKeyFile)) + " -out " + q4(n5(csrFile)) + " " + subjectOpt,
-          options
+          [
+            "req",
+            "-new",
+            "-sha256",
+            "-text",
+            "-extensions",
+            "v3_ca_req",
+            "-config",
+            n5(configFile),
+            "-key",
+            n5(privateKeyFile),
+            "-out",
+            n5(csrFile),
+            "-subj",
+            this.subject.toString(),
+            ...passin.args
+          ],
+          { ...options, env: passin.env }
         );
       }
       /**
@@ -3611,7 +3987,6 @@ var init_certificate_authority = __esm({
       async installCACertificate(signedCertFile) {
         const caRootDir = path6.resolve(this.rootDir);
         const caCertFile = this.caCertificate;
-        const privateKeyFile = path6.join(caRootDir, "private/cakey.pem");
         const fullPem = await fs10.promises.readFile(signedCertFile, "utf8");
         const pemBlocks = fullPem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
         if (!pemBlocks || pemBlocks.length === 0) {
@@ -3622,7 +3997,7 @@ var init_certificate_authority = __esm({
           };
         }
         const certDer = convertPEMtoDER(pemBlocks[0]);
-        const privateKey = readPrivateKey(privateKeyFile);
+        const privateKey = await this.getPrivateKey();
         if (!certificateMatchesPrivateKey(certDer, privateKey)) {
           return {
             status: "error",
@@ -3645,8 +4020,7 @@ var init_certificate_authority = __esm({
         }
         const options = { cwd: caRootDir };
         const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-        const configOption = ` -config ${q4(n5(configFile))}`;
-        await regenerateCrl(this.revocationList, configOption, options);
+        await regenerateCrl(this.revocationList, ["-config", n5(configFile)], options, await this._opensslPassin());
         return { status: "success" };
       }
       /**
@@ -3668,9 +4042,32 @@ var init_certificate_authority = __esm({
         this._wireRevocationEnvVars();
         const configFile = generateStaticConfig("conf/caconfig.cnf", options);
         const validity = params.validity ?? 3650;
+        const passin = await this._opensslPassin();
         await execute_openssl(
-          ` x509 -sha256 -req -days ${validity} -text  -extensions v3_ca -extfile ` + q4(n5(configFile)) + " -in " + q4(n5(csrFile)) + " -CA " + q4(n5(this.caCertificate)) + " -CAkey " + q4(n5(path6.join(caRootDir, "private/cakey.pem"))) + " -CAserial " + q4(n5(path6.join(caRootDir, "serial"))) + " -out " + q4(n5(certFile)),
-          options
+          [
+            "x509",
+            "-sha256",
+            "-req",
+            "-days",
+            String(validity),
+            "-text",
+            "-extensions",
+            "v3_ca",
+            "-extfile",
+            n5(configFile),
+            "-in",
+            n5(csrFile),
+            "-CA",
+            n5(this.caCertificate),
+            "-CAkey",
+            n5(path6.join(caRootDir, "private/cakey.pem")),
+            "-CAserial",
+            n5(path6.join(caRootDir, "serial")),
+            "-out",
+            n5(certFile),
+            ...passin.args
+          ],
+          { ...options, env: passin.env }
         );
         await this.constructCertificateChain(certFile);
       }
@@ -3732,23 +4129,36 @@ var init_certificate_authority = __esm({
           cwd: this.rootDir,
           openssl_conf: makePath(configFile)
         };
-        const configOption = "";
         const subject = params.subject ? new Subject4(params.subject).toString() : "";
-        const subjectOptions = subject && subject.length > 1 ? ` -subj ${subject} ` : "";
+        const subjectOptions = subject && subject.length > 1 ? ["-subj", subject] : [];
         displaySubtitle("- the certificate signing request");
         await execute_openssl(
-          "req  -new -sha256 -text " + configOption + subjectOptions + " -batch -key " + q4(n5(privateKey)) + " -out " + q4(n5(csrFile)),
+          ["req", "-new", "-sha256", "-text", ...subjectOptions, "-batch", "-key", n5(privateKey), "-out", n5(csrFile)],
           options
         );
         displaySubtitle("- creating the self-signed certificate");
         await execute_openssl(
-          "ca  -selfsign  -keyfile " + q4(n5(privateKey)) + " -startdate " + x509Date(params.startDate) + " -enddate " + x509Date(params.endDate) + " -batch -out " + q4(n5(certificateFile)) + " -in " + q4(n5(csrFile)),
+          [
+            "ca",
+            "-selfsign",
+            "-keyfile",
+            n5(privateKey),
+            "-startdate",
+            x509Date(params.startDate),
+            "-enddate",
+            x509Date(params.endDate),
+            "-batch",
+            "-out",
+            n5(certificateFile),
+            "-in",
+            n5(csrFile)
+          ],
           options
         );
         displaySubtitle("- dump the certificate for a check");
-        await execute_openssl(`x509 -in ${q4(n5(certificateFile))}  -dates -fingerprint -purpose -noout`, {});
+        await execute_openssl(["x509", "-in", n5(certificateFile), "-dates", "-fingerprint", "-purpose", "-noout"], {});
         displaySubtitle("- verify self-signed certificate");
-        await execute_openssl_no_failure(`verify -verbose -CAfile ${q4(n5(certificateFile))} ${q4(n5(certificateFile))}`, options);
+        await execute_openssl_no_failure(["verify", "-verbose", "-CAfile", n5(certificateFile), n5(certificateFile)], options);
         await fs10.promises.unlink(csrFile);
       }
       /**
@@ -3778,22 +4188,41 @@ var init_certificate_authority = __esm({
         setEnv("ALTNAME", "");
         const randomFile = path6.join(this.rootDir, "random.rnd");
         setEnv("RANDFILE", randomFile);
-        const configOption = ` -config ${q4(n5(configFile))}`;
+        const configOption = ["-config", n5(configFile)];
         const reason = params.reason || "keyCompromise";
         assert10(crlReasons.indexOf(reason) >= 0);
         displayTitle(`Revoking certificate  ${certificate}`);
         displaySubtitle("Revoke certificate");
-        await execute_openssl_no_failure(`ca -verbose ${configOption} -revoke ${q4(certificate)} -crl_reason ${reason}`, options);
-        await regenerateCrl(this.revocationList, configOption, options);
+        const passin = await this._opensslPassin();
+        await execute_openssl_no_failure(
+          ["ca", "-verbose", ...configOption, "-revoke", certificate, "-crl_reason", reason, ...passin.args],
+          { ...options, env: passin.env }
+        );
+        await regenerateCrl(this.revocationList, configOption, options, passin);
         displaySubtitle("Verify that certificate is revoked");
         await execute_openssl_no_failure(
-          "verify -verbose -CRLfile " + q4(n5(this.revocationList)) + " -CAfile " + q4(n5(this.caCertificate)) + " -crl_check " + q4(n5(certificate)),
+          [
+            "verify",
+            "-verbose",
+            "-CRLfile",
+            n5(this.revocationList),
+            "-CAfile",
+            n5(this.caCertificate),
+            "-crl_check",
+            n5(certificate)
+          ],
           options
         );
         displaySubtitle("Produce CRL in DER form ");
-        await execute_openssl(`crl  -in ${q4(n5(this.revocationList))} -out crl/revocation_list.der  -outform der`, options);
+        await execute_openssl(
+          ["crl", "-in", n5(this.revocationList), "-out", "crl/revocation_list.der", "-outform", "der"],
+          options
+        );
         displaySubtitle("Produce CRL in PEM form ");
-        await execute_openssl(`crl  -in ${q4(n5(this.revocationList))} -out crl/revocation_list.pem  -outform pem -text `, options);
+        await execute_openssl(
+          ["crl", "-in", n5(this.revocationList), "-out", "crl/revocation_list.pem", "-outform", "pem", "-text"],
+          options
+        );
       }
       /**
        * Sign a Certificate Signing Request (CSR) with this CA.
@@ -3835,13 +4264,27 @@ var init_certificate_authority = __esm({
         this._wireRevocationEnvVars();
         const configFile = generateStaticConfig("conf/caconfig.cnf", options);
         displaySubtitle("- then we ask the authority to sign the certificate signing request");
-        const configOption = ` -config ${configFile}`;
+        const passin = await this._opensslPassin();
         await execute_openssl(
-          "ca " + configOption + " -startdate " + x509Date(params1.startDate) + " -enddate " + x509Date(params1.endDate) + " -batch -out " + q4(n5(certificate)) + " -in " + q4(n5(certificateSigningRequestFilename)),
-          options
+          [
+            "ca",
+            "-config",
+            configFile,
+            "-startdate",
+            x509Date(params1.startDate),
+            "-enddate",
+            x509Date(params1.endDate),
+            "-batch",
+            "-out",
+            n5(certificate),
+            "-in",
+            n5(certificateSigningRequestFilename),
+            ...passin.args
+          ],
+          { ...options, env: passin.env }
         );
         displaySubtitle("- dump the certificate for a check");
-        await execute_openssl(`x509 -in ${q4(n5(certificate))}  -dates -fingerprint -purpose -noout`, options);
+        await execute_openssl(["x509", "-in", n5(certificate), "-dates", "-fingerprint", "-purpose", "-noout"], options);
         displaySubtitle("- construct CA certificate with CRL");
         await this.constructCACertificateWithCRL();
         displaySubtitle("- construct certificate chain");
@@ -3861,10 +4304,8 @@ var init_certificate_authority = __esm({
           const options = { cwd: this.rootDir };
           const configFile = generateStaticConfig("conf/caconfig.cnf", options);
           setEnv("OPENSSL_CONF", makePath(configFile));
-          const _configOption = ` -config ${configFile}`;
-          _configOption;
           await execute_openssl_no_failure(
-            `verify -verbose  -CAfile ${q4(n5(this.caCertificateWithCrl))} ${q4(n5(certificate))}`,
+            ["verify", "-verbose", "-CAfile", n5(this.caCertificateWithCrl), n5(certificate)],
             options
           );
         }
@@ -4131,7 +4572,7 @@ async function createDefaultCertificate(base_name, prefix, key_length, applicati
         365
       );
       warningLog(" certificate to revoke => ", certificate);
-      revoke_certificate(certificate_revoked);
+      await revoke_certificate(certificate_revoked);
     }
   }
 }
@@ -4149,7 +4590,7 @@ async function create_default_certificates(dev) {
   let clientURN;
   let serverURN;
   let discoveryServerURN;
-  wrap(async () => {
+  await wrap(async () => {
     await extractFullyQualifiedDomainName();
     const hostname = os5.hostname();
     const fqdn2 = getFullyQualifiedDomainName();