node-opcua-pki 6.19.0 → 6.20.0

package/dist/index.mjs

@@ -1,3 +1,6 @@
+// packages/node-opcua-pki/lib/index.ts
+import { PrivateKeyPassphraseRequiredError } from "node-opcua-crypto";
+
 // packages/node-opcua-pki/lib/ca/certificate_authority.ts
 import assert7 from "assert";
 import fs7 from "fs";
@@ -15,45 +18,16 @@ import {
   readCertificateSigningRequest,
   readPrivateKey,
   Subject as Subject2,
-  toPem
+  toPem,
+  writePrivateKeyFile
 } from "node-opcua-crypto";
 
 // packages/node-opcua-pki/lib/pki/toolbox_pfx.ts
-import assert4 from "assert";
+import assert3 from "assert";
 import fs4 from "fs";
 
-// packages/node-opcua-pki/lib/toolbox/common.ts
-import assert from "assert";
-function quote(str) {
-  return `"${str || ""}"`;
-}
-function adjustDate(params) {
-  assert(params instanceof Object);
-  params.startDate = params.startDate || /* @__PURE__ */ new Date();
-  assert(params.startDate instanceof Date);
-  if (params.validityMs !== void 0) {
-    if (params.validityMs <= 0) {
-      throw new RangeError(`validityMs must be > 0 (got ${params.validityMs})`);
-    }
-    params.endDate = new Date(params.startDate.getTime() + params.validityMs);
-    params.validity = Math.ceil(params.validityMs / 864e5);
-  } else {
-    params.validity = params.validity || 365;
-    params.endDate = new Date(params.startDate.getTime());
-    params.endDate.setDate(params.startDate.getDate() + params.validity);
-  }
-  assert(params.endDate instanceof Date);
-  assert(params.startDate instanceof Date);
-}
-function adjustApplicationUri(params) {
-  const applicationUri = params.applicationUri || "";
-  if (applicationUri.length > 200) {
-    throw new Error(`Openssl doesn't support urn with length greater than 200${applicationUri}`);
-  }
-}
-
 // packages/node-opcua-pki/lib/toolbox/common2.ts
-import assert2 from "assert";
+import assert from "assert";
 import fs from "fs";
 import path from "path";
 import chalk from "chalk";
@@ -94,12 +68,31 @@ function mkdirRecursiveSync(folder) {
     fs.mkdirSync(folder, { recursive: true });
   }
 }
+function restrictPrivateFilePermissions(target, mode) {
+  if (process.platform === "win32") {
+    return;
+  }
+  try {
+    fs.chmodSync(target, mode);
+  } catch (err) {
+    warningLog(chalk.yellow("        could not restrict permissions on "), target, err.message);
+  }
+}
+function ensurePrivateDirectory(dir) {
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  }
+  restrictPrivateFilePermissions(dir, 448);
+}
+function isEncryptedPrivateKeyFile(filename) {
+  return fs.readFileSync(filename, "utf-8").includes("-----BEGIN ENCRYPTED PRIVATE KEY-----");
+}
 function makePath(folderName, filename) {
   let s;
   if (filename) {
     s = path.join(path.normalize(folderName), filename);
   } else {
-    assert2(folderName);
+    assert(folderName);
     s = folderName;
   }
   s = s.replace(/\\/g, "/");
@@ -107,7 +100,7 @@ function makePath(folderName, filename) {
 }
 
 // packages/node-opcua-pki/lib/toolbox/with_openssl/execute_openssl.ts
-import assert3 from "assert";
+import assert2 from "assert";
 import child_process2 from "child_process";
 import fs3 from "fs";
 import os2 from "os";
@@ -115,6 +108,50 @@ import byline2 from "byline";
 import chalk3 from "chalk";
 
 // packages/node-opcua-pki/lib/toolbox/with_openssl/_env.ts
+var SAFE_ENV_PASSTHROUGH = /* @__PURE__ */ new Set([
+  // POSIX/Windows shell and process essentials
+  "path",
+  "home",
+  "userprofile",
+  "temp",
+  "tmp",
+  "tmpdir",
+  "systemroot",
+  "windir",
+  "comspec",
+  "pathext",
+  "appdata",
+  "localappdata",
+  // dynamic loader: a custom-built or relocated openssl (e.g. under /opt,
+  // or Homebrew on macOS) may need these to find its own libcrypto/libssl
+  "ld_library_path",
+  "dyld_library_path",
+  "dyld_fallback_library_path",
+  // locale, so openssl's textual output stays parseable
+  "lang",
+  "lc_all",
+  "lc_ctype",
+  // openssl configuration this app, or the host OS/user, may rely on
+  "openssl_conf",
+  "randfile",
+  "openssl_modules",
+  "openssl_engines",
+  "ssl_cert_file",
+  "ssl_cert_dir"
+]);
+function buildChildEnv(extra) {
+  const env = {};
+  for (const key of Object.keys(process.env)) {
+    if (SAFE_ENV_PASSTHROUGH.has(key.toLowerCase())) {
+      env[key] = process.env[key];
+    }
+  }
+  return { ...env, ...extra };
+}
+function redactEnvForLog(options) {
+  const { env, ...rest } = options;
+  return env ? { ...rest, env: Object.keys(env) } : rest;
+}
 var exportedEnvVars = {};
 function setEnv(varName, value) {
   if (!g_config.silent) {
@@ -169,24 +206,17 @@ import byline from "byline";
 import chalk2 from "chalk";
 import yauzl from "yauzl";
 var doDebug2 = process.env.NODEOPCUAPKIDEBUG || false;
-async function execute(cmd, cwd) {
+async function execute(file, args, cwd) {
   let output = "";
-  const options = {
-    cwd,
-    windowsHide: true
-  };
   return await new Promise((resolve, reject) => {
-    const child = child_process.exec(
-      cmd,
-      options,
-      (err) => {
-        const exitCode = err === null ? 0 : typeof err.code === "number" ? err.code : 1;
-        if (err) reject(err);
-        else {
-          resolve({ exitCode, output });
-        }
-      }
-    );
+    const child = child_process.spawn(file, args, {
+      cwd,
+      windowsHide: true,
+      env: buildChildEnv(),
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    child.on("error", (err) => reject(err));
+    child.on("close", (code) => resolve({ exitCode: code ?? 1, output }));
     const stream1 = byline(child.stdout);
     stream1.on("data", (line) => {
       output += `${line}
@@ -198,16 +228,13 @@ async function execute(cmd, cwd) {
     });
   });
 }
-function quote2(str) {
-  return `"${str.replace(/\\/g, "/")}"`;
-}
 function is_expected_openssl_version(strVersion) {
   return !!strVersion.match(/OpenSSL \d/);
 }
 async function getopensslExecPath() {
   let result1;
   try {
-    result1 = await execute("which openssl");
+    result1 = await execute("which", ["openssl"]);
   } catch (err) {
     warningLog("warning: ", err.message);
     throw new Error("Cannot find openssl");
@@ -224,11 +251,10 @@ async function getopensslExecPath() {
 }
 async function check_system_openssl_version() {
   const opensslExecPath = await getopensslExecPath();
-  const q_opensslExecPath = quote2(opensslExecPath);
   if (doDebug2) {
     warningLog(`              OpenSSL found in : ${chalk2.yellow(opensslExecPath)}`);
   }
-  const result = await execute(`${q_opensslExecPath} version`);
+  const result = await execute(opensslExecPath, ["version"]);
   const exitCode = result?.exitCode;
   const output = result?.output;
   const version = output.trim();
@@ -268,9 +294,8 @@ async function install_and_check_win32_openssl_version() {
         version: `cannot find file ${opensslExecPath2}`
       };
     } else {
-      const q_openssl_exe_path = quote2(opensslExecPath2);
       const cwd = ".";
-      const { exitCode, output } = await execute(`${q_openssl_exe_path} version`, cwd);
+      const { exitCode, output } = await execute(opensslExecPath2, ["version"], cwd);
       const version = output.trim();
       if (doDebug2) {
         warningLog(" Version = ", version);
@@ -283,7 +308,7 @@ async function install_and_check_win32_openssl_version() {
   }
   async function find_system_openssl_win32() {
     try {
-      const result = await execute("where openssl");
+      const result = await execute("where", ["openssl"]);
       if (result.exitCode !== 0) {
         return void 0;
       }
@@ -291,8 +316,7 @@ async function install_and_check_win32_openssl_version() {
       if (!opensslPath2 || !fs2.existsSync(opensslPath2)) {
         return void 0;
       }
-      const q4 = quote2(opensslPath2);
-      const versionResult = await execute(`${q4} version`);
+      const versionResult = await execute(opensslPath2, ["version"]);
       const version = versionResult.output.trim();
       if (versionResult.exitCode === 0 && is_expected_openssl_version(version)) {
         warningLog(
@@ -455,36 +479,55 @@ async function get_openssl_exec_path() {
 // packages/node-opcua-pki/lib/toolbox/with_openssl/execute_openssl.ts
 var opensslPath;
 var n = makePath;
-async function execute2(cmd, options) {
+var PASSIN_ENV_VAR = "NODE_OPCUA_PKI_OPENSSL_PASSIN";
+var PASSOUT_ENV_VAR = "NODE_OPCUA_PKI_OPENSSL_PASSOUT";
+function passinArg(passphrase = "") {
+  return { args: ["-passin", `env:${PASSIN_ENV_VAR}`], env: { [PASSIN_ENV_VAR]: passphrase } };
+}
+function passoutArg(passphrase = "") {
+  return { args: ["-passout", `env:${PASSOUT_ENV_VAR}`], env: { [PASSOUT_ENV_VAR]: passphrase } };
+}
+function renderForDisplay(file, args) {
+  return [file, ...args].map((a) => a === "" || /[\s"'`$\\]/.test(a) ? JSON.stringify(a) : a).join(" ");
+}
+async function execute2(file, args, options) {
   const from = new Error();
   options.cwd = options.cwd || process.cwd();
   if (!g_config.silent) {
     warningLog(chalk3.cyan("                  CWD         "), options.cwd);
   }
   const outputs = [];
+  const errorOutputs = [];
+  const display2 = renderForDisplay(file, args);
   return await new Promise((resolve, reject) => {
-    const child = child_process2.exec(
-      cmd,
-      {
-        cwd: options.cwd,
-        windowsHide: true
-      },
-      (err) => {
-        if (err) {
-          if (!options.hideErrorMessage) {
-            const fence = "###########################################";
-            console.error(chalk3.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
-            console.error(chalk3.bgWhiteBright.redBright(`CWD = ${options.cwd}`));
-            console.error(chalk3.bgWhiteBright.redBright(err.message));
-            console.error(chalk3.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
-            console.error(from.stack);
-          }
-          reject(new Error(err.message));
-          return;
-        }
+    const child = child_process2.spawn(file, [...args], {
+      cwd: options.cwd,
+      windowsHide: true,
+      env: buildChildEnv(options.env),
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const fail = (message) => {
+      if (!options.hideErrorMessage) {
+        const fence = "###########################################";
+        console.error(chalk3.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
+        console.error(chalk3.bgWhiteBright.redBright(`CWD = ${options.cwd}`));
+        console.error(chalk3.bgWhiteBright.redBright(message));
+        console.error(chalk3.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
+        console.error(from.stack);
+      }
+      reject(new Error(message));
+    };
+    child.on("error", (err) => fail(`Command failed: ${display2}
+${err.message}`));
+    child.on("close", (code, signal) => {
+      if (code === 0) {
         resolve(outputs.join(""));
+        return;
       }
-    );
+      const why = signal ? `signal ${signal}` : `exit code ${code}`;
+      fail(`Command failed: ${display2}
+${errorOutputs.join("")}(${why})`);
+    });
     if (child.stdout) {
       const stream2 = byline2(child.stdout);
       stream2.on("data", (line) => {
@@ -501,17 +544,17 @@ async function execute2(cmd, options) {
         });
       }
     }
-    if (!g_config.silent) {
-      if (child.stderr) {
-        const stream1 = byline2(child.stderr);
-        stream1.on("data", (line) => {
-          line = line.toString();
-          if (displayError) {
-            process.stdout.write(`${chalk3.white("        stderr ") + chalk3.red(line)}
+    if (child.stderr) {
+      const stream1 = byline2(child.stderr);
+      stream1.on("data", (line) => {
+        line = line.toString();
+        errorOutputs.push(`${line}
 `);
-          }
-        });
-      }
+        if (!g_config.silent && displayError) {
+          process.stdout.write(`${chalk3.white("        stderr ") + chalk3.red(line)}
+`);
+        }
+      });
     }
   });
 }
@@ -521,18 +564,18 @@ async function find_openssl() {
 async function ensure_openssl_installed() {
   if (!opensslPath) {
     opensslPath = await find_openssl();
-    const outputs = await execute_openssl("version", { cwd: "." });
+    const outputs = await execute_openssl(["version"], { cwd: "." });
     g_config.opensslVersion = outputs.trim();
     if (doDebug) {
       warningLog("OpenSSL version : ", g_config.opensslVersion);
     }
   }
 }
-async function execute_openssl_no_failure(cmd, options) {
+async function execute_openssl_no_failure(args, options) {
   options = options || {};
   options.hideErrorMessage = true;
   try {
-    return await execute_openssl(cmd, options);
+    return await execute_openssl(args, options);
   } catch (err) {
     debugLog(" (ignored error =  ERROR : )", err.message);
   }
@@ -540,62 +583,64 @@ async function execute_openssl_no_failure(cmd, options) {
 function getTempFolder() {
   return os2.tmpdir();
 }
-async function execute_openssl(cmd, options) {
-  debugLog("execute_openssl", cmd, options);
+async function execute_openssl(args, options) {
+  debugLog("execute_openssl", args, redactEnvForLog(options));
   const empty_config_file = n(getTempFolder(), "empty_config.cnf");
   if (!fs3.existsSync(empty_config_file)) {
     await fs3.promises.writeFile(empty_config_file, "# empty config file");
   }
   options = options || {};
   options.openssl_conf = options.openssl_conf || empty_config_file;
-  assert3(options.openssl_conf);
+  assert2(options.openssl_conf);
   setEnv("OPENSSL_CONF", options.openssl_conf);
   if (!g_config.silent) {
     warningLog(chalk3.cyan("                  OPENSSL_CONF"), process.env.OPENSSL_CONF);
     warningLog(chalk3.cyan("                  RANDFILE    "), process.env.RANDFILE);
-    warningLog(chalk3.cyan("                  CMD         openssl "), chalk3.cyanBright(cmd));
+    warningLog(chalk3.cyan("                  CMD         "), chalk3.cyanBright(renderForDisplay("openssl", args)));
   }
   await ensure_openssl_installed();
-  return await execute2(`${quote(opensslPath)} ${cmd}`, options);
+  return await execute2(opensslPath, args, options);
 }
 
 // packages/node-opcua-pki/lib/pki/toolbox_pfx.ts
-var q = quote;
 var n2 = makePath;
 async function createPFX(options) {
-  const { certificateFile, privateKeyFile, outputFile, passphrase = "", caCertificateFiles } = options;
-  assert4(fs4.existsSync(certificateFile), `Certificate file does not exist: ${certificateFile}`);
-  assert4(fs4.existsSync(privateKeyFile), `Private key file does not exist: ${privateKeyFile}`);
-  let cmd = `pkcs12 -export`;
-  cmd += ` -in ${q(n2(certificateFile))}`;
-  cmd += ` -inkey ${q(n2(privateKeyFile))}`;
+  const { certificateFile, privateKeyFile, privateKeyPassphrase, outputFile, passphrase = "", caCertificateFiles } = options;
+  assert3(fs4.existsSync(certificateFile), `Certificate file does not exist: ${certificateFile}`);
+  assert3(fs4.existsSync(privateKeyFile), `Private key file does not exist: ${privateKeyFile}`);
+  const args = ["pkcs12", "-export", "-in", n2(certificateFile), "-inkey", n2(privateKeyFile)];
   if (caCertificateFiles) {
     for (const caFile of caCertificateFiles) {
-      assert4(fs4.existsSync(caFile), `CA certificate file does not exist: ${caFile}`);
-      cmd += ` -certfile ${q(n2(caFile))}`;
+      assert3(fs4.existsSync(caFile), `CA certificate file does not exist: ${caFile}`);
+      args.push("-certfile", n2(caFile));
     }
   }
-  cmd += ` -out ${q(n2(outputFile))}`;
-  cmd += ` -passout pass:${passphrase}`;
-  await execute_openssl(cmd, {});
+  const passin = passinArg(privateKeyPassphrase);
+  const passout = passoutArg(passphrase);
+  args.push("-out", n2(outputFile), ...passin.args, ...passout.args);
+  await execute_openssl(args, { env: { ...passin.env, ...passout.env } });
 }
 async function extractCertificateFromPFX(options) {
   const { pfxFile, passphrase = "" } = options;
-  assert4(fs4.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  const cmd = `pkcs12 -in ${q(n2(pfxFile))} -clcerts -nokeys -nodes -passin pass:${passphrase}`;
-  return await execute_openssl(cmd, {});
+  assert3(fs4.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
+  const passin = passinArg(passphrase);
+  return await execute_openssl(["pkcs12", "-in", n2(pfxFile), "-clcerts", "-nokeys", "-nodes", ...passin.args], {
+    env: passin.env
+  });
 }
 async function extractPrivateKeyFromPFX(options) {
   const { pfxFile, passphrase = "" } = options;
-  assert4(fs4.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  const cmd = `pkcs12 -in ${q(n2(pfxFile))} -nocerts -nodes -passin pass:${passphrase}`;
-  return await execute_openssl(cmd, {});
+  assert3(fs4.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
+  const passin = passinArg(passphrase);
+  return await execute_openssl(["pkcs12", "-in", n2(pfxFile), "-nocerts", "-nodes", ...passin.args], { env: passin.env });
 }
 async function extractCACertificatesFromPFX(options) {
   const { pfxFile, passphrase = "" } = options;
-  assert4(fs4.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  const cmd = `pkcs12 -in ${q(n2(pfxFile))} -cacerts -nokeys -nodes -passin pass:${passphrase}`;
-  return await execute_openssl(cmd, {});
+  assert3(fs4.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
+  const passin = passinArg(passphrase);
+  return await execute_openssl(["pkcs12", "-in", n2(pfxFile), "-cacerts", "-nokeys", "-nodes", ...passin.args], {
+    env: passin.env
+  });
 }
 async function extractAllFromPFX(options) {
   const [certificate, privateKey, caCertificates] = await Promise.all([
@@ -606,14 +651,50 @@ async function extractAllFromPFX(options) {
   return { certificate, privateKey, caCertificates };
 }
 async function convertPFXtoPEM(pfxFile, pemFile, passphrase = "") {
-  assert4(fs4.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  const cmd = `pkcs12 -in ${q(n2(pfxFile))} -out ${q(n2(pemFile))} -nodes -passin pass:${passphrase}`;
-  await execute_openssl(cmd, {});
+  assert3(fs4.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
+  const passin = passinArg(passphrase);
+  await execute_openssl(["pkcs12", "-in", n2(pfxFile), "-out", n2(pemFile), "-nodes", ...passin.args], { env: passin.env });
 }
 async function dumpPFX(pfxFile, passphrase = "") {
-  assert4(fs4.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  const cmd = `pkcs12 -in ${q(n2(pfxFile))} -info -nodes -passin pass:${passphrase}`;
-  return await execute_openssl(cmd, {});
+  assert3(fs4.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
+  const passin = passinArg(passphrase);
+  return await execute_openssl(["pkcs12", "-in", n2(pfxFile), "-info", "-nodes", ...passin.args], { env: passin.env });
+}
+
+// packages/node-opcua-pki/lib/toolbox/common.ts
+import assert4 from "assert";
+function quote(str) {
+  return `"${str || ""}"`;
+}
+async function resolvePrivateKeyPassphrase(passphrase) {
+  if (passphrase === void 0) {
+    return void 0;
+  }
+  return typeof passphrase === "function" ? await passphrase() : passphrase;
+}
+function adjustDate(params) {
+  assert4(params instanceof Object);
+  params.startDate = params.startDate || /* @__PURE__ */ new Date();
+  assert4(params.startDate instanceof Date);
+  if (params.validityMs !== void 0) {
+    if (params.validityMs <= 0) {
+      throw new RangeError(`validityMs must be > 0 (got ${params.validityMs})`);
+    }
+    params.endDate = new Date(params.startDate.getTime() + params.validityMs);
+    params.validity = Math.ceil(params.validityMs / 864e5);
+  } else {
+    params.validity = params.validity || 365;
+    params.endDate = new Date(params.startDate.getTime());
+    params.endDate.setDate(params.startDate.getDate() + params.validity);
+  }
+  assert4(params.endDate instanceof Date);
+  assert4(params.startDate instanceof Date);
+}
+function adjustApplicationUri(params) {
+  const applicationUri = params.applicationUri || "";
+  if (applicationUri.length > 200) {
+    throw new Error(`Openssl doesn't support urn with length greater than 200${applicationUri}`);
+  }
 }
 
 // packages/node-opcua-pki/lib/toolbox/display.ts
@@ -705,7 +786,6 @@ function x509Date(date) {
 }
 
 // packages/node-opcua-pki/lib/toolbox/with_openssl/create_certificate_signing_request.ts
-var q2 = quote;
 var n3 = makePath;
 async function createCertificateSigningRequestWithOpenSSL(certificateSigningRequestFilename, params) {
   assert6(params);
@@ -720,12 +800,23 @@ async function createCertificateSigningRequestWithOpenSSL(certificateSigningRequ
   processAltNames(params);
   const configFile = generateStaticConfig(params.configFile, { cwd: params.rootDir });
   const options = { cwd: params.rootDir, openssl_conf: path4.relative(params.rootDir, configFile) };
-  const configOption = ` -config ${q2(n3(configFile))}`;
   const subject = params.subject ? new Subject(params.subject).toString() : void 0;
-  const subjectOptions = subject ? ` -subj "${subject}"` : "";
   displaySubtitle("- Creating a Certificate Signing Request with openssl");
   await execute_openssl(
-    "req -new  -sha256  -batch  -text " + configOption + " -key " + q2(n3(params.privateKey)) + subjectOptions + " -out " + q2(n3(certificateSigningRequestFilename)),
+    [
+      "req",
+      "-new",
+      "-sha256",
+      "-batch",
+      "-text",
+      "-config",
+      n3(configFile),
+      "-key",
+      n3(params.privateKey),
+      ...subject ? ["-subj", subject] : [],
+      "-out",
+      n3(certificateSigningRequestFilename)
+    ],
     options
   );
 }
@@ -739,7 +830,7 @@ var config2 = `#.........DO NOT MODIFY BY HAND .........................
 [ ca ]
 default_ca               = CA_default
 [ CA_default ]
-dir                      = %%ROOT_FOLDER%%            # the main CA folder
+dir                      = "%%ROOT_FOLDER%%"        # the main CA folder (quoted: see renderCaConfig)
 certs                    = $dir/certs                 # where to store certificates
 new_certs_dir            = $dir/certs                 #
 database                 = $dir/index.txt             # the certificate database
@@ -872,13 +963,18 @@ var ca_config_template_cnf_default = config2;
 var defaultSubject = "/C=FR/ST=IDF/L=Paris/O=Local NODE-OPCUA Certificate Authority/CN=NodeOPCUA-CA";
 var configurationFileTemplate = ca_config_template_cnf_default;
 var configurationFileSimpleTemplate = simple_config_template_cnf_default;
+function escapeOpensslConfDoubleQuoted(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+function renderCaConfig(caRootDir) {
+  return configurationFileTemplate.replace(/%%ROOT_FOLDER%%/, escapeOpensslConfDoubleQuoted(makePath(caRootDir)));
+}
 var config3 = {
   certificateDir: "INVALID",
   forceCA: false,
   pkiDir: "INVALID"
 };
 var n4 = makePath;
-var q3 = quote;
 function octetStringToIpAddress(a) {
   return parseInt(a.substring(0, 2), 16).toString() + "." + parseInt(a.substring(2, 4), 16).toString() + "." + parseInt(a.substring(4, 6), 16).toString() + "." + parseInt(a.substring(6, 8), 16).toString();
 }
@@ -888,7 +984,7 @@ async function construct_CertificateAuthority(certificateAuthority) {
   const caRootDir = path5.resolve(certificateAuthority.rootDir);
   async function make_folders() {
     mkdirRecursiveSync(caRootDir);
-    mkdirRecursiveSync(path5.join(caRootDir, "private"));
+    ensurePrivateDirectory(path5.join(caRootDir, "private"));
     mkdirRecursiveSync(path5.join(caRootDir, "public"));
     mkdirRecursiveSync(path5.join(caRootDir, "certs"));
     mkdirRecursiveSync(path5.join(caRootDir, "crl"));
@@ -913,6 +1009,8 @@ async function construct_CertificateAuthority(certificateAuthority) {
   const caKeyExists = fs7.existsSync(path5.join(caRootDir, "private/cakey.pem"));
   const caCertExists = fs7.existsSync(path5.join(caRootDir, "public/cacert.pem"));
   if (caKeyExists && caCertExists && !config3.forceCA) {
+    restrictPrivateFilePermissions(path5.join(caRootDir, "private/cakey.pem"), 384);
+    await certificateAuthority._ensurePrivateKeyProtection();
     debugLog("CA private key and certificate already exist ... skipping");
     return;
   }
@@ -931,26 +1029,40 @@ async function construct_CertificateAuthority(certificateAuthority) {
   }
   const caConfigFile = certificateAuthority.configFile;
   if (1) {
-    let data = configurationFileTemplate;
-    data = makePath(data.replace(/%%ROOT_FOLDER%%/, caRootDir));
-    await fs7.promises.writeFile(caConfigFile, data);
+    await fs7.promises.writeFile(caConfigFile, renderCaConfig(caRootDir));
   }
-  const subjectOpt = ` -subj "${subject.toString()}" `;
+  const subjectOpt = ["-subj", subject.toString()];
   const caCommonName = subject.commonName || "NodeOPCUA-CA";
   setEnv("ALTNAME", `URI:urn:${caCommonName}`);
   certificateAuthority._wireRevocationEnvVars();
   const options = { cwd: caRootDir };
   const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-  const configOption = ` -config ${q3(n4(configFile))}`;
+  const configOption = ["-config", n4(configFile)];
   const keySize = certificateAuthority.keySize;
   const privateKeyFilename = path5.join(caRootDir, "private/cakey.pem");
   const csrFilename = path5.join(caRootDir, "private/cakey.csr");
   displayTitle(`Generate the CA private Key - ${keySize}`);
-  await generatePrivateKeyFile(privateKeyFilename, keySize);
+  const passin = await certificateAuthority._opensslPassin();
+  await generatePrivateKeyFile(privateKeyFilename, keySize, { passphrase: await certificateAuthority._privateKeyPassphrase() });
+  restrictPrivateFilePermissions(privateKeyFilename, 384);
   displayTitle("Generate a certificate request for the CA key");
   await execute_openssl(
-    "req -new -sha256  -text  -extensions v3_ca_req" + configOption + " -key " + q3(n4(privateKeyFilename)) + " -out " + q3(n4(csrFilename)) + " " + subjectOpt,
-    options
+    [
+      "req",
+      "-new",
+      "-sha256",
+      "-text",
+      "-extensions",
+      "v3_ca_req",
+      ...configOption,
+      "-key",
+      n4(privateKeyFilename),
+      "-out",
+      n4(csrFilename),
+      ...subjectOpt,
+      ...passin.args
+    ],
+    { ...options, env: passin.env }
   );
   const issuerCA = certificateAuthority._issuerCA;
   if (issuerCA) {
@@ -958,27 +1070,71 @@ async function construct_CertificateAuthority(certificateAuthority) {
     const issuerCert = path5.resolve(issuerCA.caCertificate);
     const issuerKey = path5.resolve(issuerCA.rootDir, "private/cakey.pem");
     const issuerSerial = path5.resolve(issuerCA.rootDir, "serial");
+    const issuerPassin = await issuerCA._opensslPassin();
     await execute_openssl(
-      " x509 -sha256 -req -days 3650  -text  -extensions v3_ca -extfile " + q3(n4(configFile)) + " -in private/cakey.csr  -CA " + q3(n4(issuerCert)) + " -CAkey " + q3(n4(issuerKey)) + " -CAserial " + q3(n4(issuerSerial)) + " -out public/cacert.pem",
-      options
+      [
+        "x509",
+        "-sha256",
+        "-req",
+        "-days",
+        "3650",
+        "-text",
+        "-extensions",
+        "v3_ca",
+        "-extfile",
+        n4(configFile),
+        "-in",
+        "private/cakey.csr",
+        "-CA",
+        n4(issuerCert),
+        "-CAkey",
+        n4(issuerKey),
+        "-CAserial",
+        n4(issuerSerial),
+        "-out",
+        "public/cacert.pem",
+        ...issuerPassin.args
+      ],
+      { ...options, env: issuerPassin.env }
     );
   } else {
     displayTitle("Generate CA Certificate (self-signed)");
     await execute_openssl(
-      " x509 -sha256 -req -days 3650  -text  -extensions v3_ca -extfile " + q3(n4(configFile)) + " -in private/cakey.csr  -signkey " + q3(n4(privateKeyFilename)) + " -out public/cacert.pem",
-      options
+      [
+        "x509",
+        "-sha256",
+        "-req",
+        "-days",
+        "3650",
+        "-text",
+        "-extensions",
+        "v3_ca",
+        "-extfile",
+        n4(configFile),
+        "-in",
+        "private/cakey.csr",
+        "-signkey",
+        n4(privateKeyFilename),
+        "-out",
+        "public/cacert.pem",
+        ...passin.args
+      ],
+      { ...options, env: passin.env }
     );
   }
   displaySubtitle("generate initial CRL (Certificate Revocation List)");
-  await regenerateCrl(certificateAuthority.revocationList, configOption, options);
+  await regenerateCrl(certificateAuthority.revocationList, configOption, options, passin);
   displayTitle("Create Certificate Authority (CA) ---> DONE");
 }
-async function regenerateCrl(revocationList, configOption, options) {
+async function regenerateCrl(revocationList, configOption, options, passin) {
   displaySubtitle("regenerate CRL (Certificate Revocation List)");
-  await execute_openssl(`ca -gencrl ${configOption} -out crl/revocation_list.crl`, options);
-  await execute_openssl("crl  -in  crl/revocation_list.crl -out  crl/revocation_list.der  -outform der", options);
+  await execute_openssl(["ca", "-gencrl", ...configOption, "-out", "crl/revocation_list.crl", ...passin.args], {
+    ...options,
+    env: passin.env
+  });
+  await execute_openssl(["crl", "-in", "crl/revocation_list.crl", "-out", "crl/revocation_list.der", "-outform", "der"], options);
   displaySubtitle("Display (Certificate Revocation List)");
-  await execute_openssl(`crl  -in ${q3(n4(revocationList))} -text  -noout`, options);
+  await execute_openssl(["crl", "-in", n4(revocationList), "-text", "-noout"], options);
 }
 function parseOpenSSLDate(dateStr) {
   const raw = dateStr?.split(",")[0] ?? "";
@@ -1032,6 +1188,10 @@ var CertificateAuthority = class {
   _crlDistributionUrl;
   _ocspResponderUrl;
   _caIssuersUrl;
+  #privateKeyPassphrase;
+  /** resolved once (see `privateKeyPassphrase`); `#passphraseResolved` distinguishes "none" from "not yet" */
+  #resolvedPassphrase;
+  #passphraseResolved = false;
   constructor(options) {
     assert7(Object.prototype.hasOwnProperty.call(options, "location"));
     assert7(Object.prototype.hasOwnProperty.call(options, "keySize"));
@@ -1039,6 +1199,7 @@ var CertificateAuthority = class {
     this.keySize = options.keySize || 2048;
     this.subject = new Subject2(options.subject || defaultSubject);
     this._issuerCA = options.issuerCA;
+    this.#privateKeyPassphrase = options.privateKeyPassphrase;
     if (options.crlDistributionUrl !== void 0) {
       this.setCrlDistributionUrl(options.crlDistributionUrl);
     }
@@ -1135,6 +1296,69 @@ var CertificateAuthority = class {
   get configFile() {
     return path5.normalize(path5.join(this.rootDir, "./conf/caconfig.cnf"));
   }
+  /** Path to the CA private key (`private/cakey.pem`); may be passphrase-encrypted, see {@link getPrivateKey}. */
+  get privateKey() {
+    return path5.join(path5.resolve(this.rootDir), "private/cakey.pem");
+  }
+  /**
+   * The CA private key, decrypted with the configured `privateKeyPassphrase`
+   * if it is encrypted. Fails closed (`PrivateKeyPassphraseRequiredError`)
+   * on an encrypted key with no or the wrong passphrase.
+   */
+  async getPrivateKey() {
+    return readPrivateKey(this.privateKey, await this._privateKeyPassphrase());
+  }
+  /**
+   * Enable, disable, or rotate the passphrase protecting `private/cakey.pem`
+   * (temp file + atomic rename, temp file removed on failure). Only
+   * rewrites the file: construct a new `CertificateAuthority` with the new
+   * passphrase to continue using it.
+   */
+  async reencryptPrivateKey(oldPassphrase, newPassphrase) {
+    const oldPass = await resolvePrivateKeyPassphrase(oldPassphrase);
+    const newPass = await resolvePrivateKeyPassphrase(newPassphrase);
+    const key = readPrivateKey(this.privateKey, oldPass);
+    await this.#rewritePrivateKeyFile(key, newPass);
+  }
+  async #rewritePrivateKeyFile(privateKey, passphrase) {
+    const tmpFilename = `${this.privateKey}.${process.pid}-${Date.now()}.tmp`;
+    try {
+      await writePrivateKeyFile(tmpFilename, privateKey, { passphrase });
+      await fs7.promises.rename(tmpFilename, this.privateKey);
+    } finally {
+      await fs7.promises.rm(tmpFilename, { force: true });
+    }
+  }
+  /** @internal resolve the configured passphrase, at most once per instance */
+  async _privateKeyPassphrase() {
+    if (!this.#passphraseResolved) {
+      this.#resolvedPassphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
+      this.#passphraseResolved = true;
+    }
+    return this.#resolvedPassphrase;
+  }
+  /** @internal `-passin env:` argv + env for every openssl call that loads this CA's key (always emitted, empty when none) */
+  async _opensslPassin() {
+    return passinArg(await this._privateKeyPassphrase());
+  }
+  /**
+   * @internal On an existing key: encrypt it in place if a passphrase is
+   * configured and it is still plaintext (secure by default: the option
+   * means "protect this key", not "ignore me"), then read it back so a
+   * wrong or missing passphrase fails initialize() closed rather than the
+   * first signing operation.
+   */
+  async _ensurePrivateKeyProtection() {
+    if (!fs7.existsSync(this.privateKey)) {
+      return;
+    }
+    if (this.#privateKeyPassphrase !== void 0 && !isEncryptedPrivateKeyFile(this.privateKey)) {
+      warningLog("CertificateAuthority: private key is plaintext but a passphrase is configured; encrypting it in place");
+      const plaintextKey = readPrivateKey(this.privateKey);
+      await this.#rewritePrivateKeyFile(plaintextKey, await this._privateKeyPassphrase());
+    }
+    await this.getPrivateKey();
+  }
   /** Path to the CA certificate in PEM format (`public/cacert.pem`). */
   get caCertificate() {
     return makePath(this.rootDir, "./public/cacert.pem");
@@ -1592,12 +1816,17 @@ var CertificateAuthority = class {
   async initializeCSR() {
     const caRootDir = path5.resolve(this.rootDir);
     mkdirRecursiveSync(caRootDir);
-    for (const dir of ["private", "public", "certs", "crl", "conf"]) {
+    for (const dir of ["public", "certs", "crl", "conf"]) {
       mkdirRecursiveSync(path5.join(caRootDir, dir));
     }
+    ensurePrivateDirectory(path5.join(caRootDir, "private"));
     const caCertFile = this.caCertificate;
     const privateKeyFile = path5.join(caRootDir, "private/cakey.pem");
     const csrFile = path5.join(caRootDir, "private/cakey.csr");
+    if (fs7.existsSync(privateKeyFile)) {
+      restrictPrivateFilePermissions(privateKeyFile, 384);
+      await this._ensurePrivateKeyProtection();
+    }
     if (fs7.existsSync(caCertFile)) {
       const certDer = convertPEMtoDER(readCertificatePEM(caCertFile));
       const certInfo = exploreCertificate(certDer);
@@ -1631,11 +1860,10 @@ var CertificateAuthority = class {
       await fs7.promises.writeFile(indexFileAttr, "unique_subject = no");
     }
     const caConfigFile = this.configFile;
-    let data = configurationFileTemplate;
-    data = makePath(data.replace(/%%ROOT_FOLDER%%/, caRootDir));
-    await fs7.promises.writeFile(caConfigFile, data);
+    await fs7.promises.writeFile(caConfigFile, renderCaConfig(caRootDir));
     if (!fs7.existsSync(privateKeyFile)) {
-      await generatePrivateKeyFile(privateKeyFile, this.keySize);
+      await generatePrivateKeyFile(privateKeyFile, this.keySize, { passphrase: await this._privateKeyPassphrase() });
+      restrictPrivateFilePermissions(privateKeyFile, 384);
     }
     await this._generateCSR(caRootDir, privateKeyFile, csrFile);
     return { status: "created", csrPath: csrFile };
@@ -1677,14 +1905,29 @@ var CertificateAuthority = class {
    * @internal
    */
   async _generateCSR(caRootDir, privateKeyFile, csrFile) {
-    const subjectOpt = ` -subj "${this.subject.toString()}" `;
     processAltNames({});
     const options = { cwd: caRootDir };
     const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-    const configOption = ` -config ${q3(n4(configFile))}`;
+    const passin = await this._opensslPassin();
     await execute_openssl(
-      "req -new -sha256  -text  -extensions v3_ca_req" + configOption + " -key " + q3(n4(privateKeyFile)) + " -out " + q3(n4(csrFile)) + " " + subjectOpt,
-      options
+      [
+        "req",
+        "-new",
+        "-sha256",
+        "-text",
+        "-extensions",
+        "v3_ca_req",
+        "-config",
+        n4(configFile),
+        "-key",
+        n4(privateKeyFile),
+        "-out",
+        n4(csrFile),
+        "-subj",
+        this.subject.toString(),
+        ...passin.args
+      ],
+      { ...options, env: passin.env }
     );
   }
   /**
@@ -1706,7 +1949,6 @@ var CertificateAuthority = class {
   async installCACertificate(signedCertFile) {
     const caRootDir = path5.resolve(this.rootDir);
     const caCertFile = this.caCertificate;
-    const privateKeyFile = path5.join(caRootDir, "private/cakey.pem");
     const fullPem = await fs7.promises.readFile(signedCertFile, "utf8");
     const pemBlocks = fullPem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
     if (!pemBlocks || pemBlocks.length === 0) {
@@ -1717,7 +1959,7 @@ var CertificateAuthority = class {
       };
     }
     const certDer = convertPEMtoDER(pemBlocks[0]);
-    const privateKey = readPrivateKey(privateKeyFile);
+    const privateKey = await this.getPrivateKey();
     if (!certificateMatchesPrivateKey(certDer, privateKey)) {
       return {
         status: "error",
@@ -1740,8 +1982,7 @@ var CertificateAuthority = class {
     }
     const options = { cwd: caRootDir };
     const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-    const configOption = ` -config ${q3(n4(configFile))}`;
-    await regenerateCrl(this.revocationList, configOption, options);
+    await regenerateCrl(this.revocationList, ["-config", n4(configFile)], options, await this._opensslPassin());
     return { status: "success" };
   }
   /**
@@ -1763,9 +2004,32 @@ var CertificateAuthority = class {
     this._wireRevocationEnvVars();
     const configFile = generateStaticConfig("conf/caconfig.cnf", options);
     const validity = params.validity ?? 3650;
+    const passin = await this._opensslPassin();
     await execute_openssl(
-      ` x509 -sha256 -req -days ${validity} -text  -extensions v3_ca -extfile ` + q3(n4(configFile)) + " -in " + q3(n4(csrFile)) + " -CA " + q3(n4(this.caCertificate)) + " -CAkey " + q3(n4(path5.join(caRootDir, "private/cakey.pem"))) + " -CAserial " + q3(n4(path5.join(caRootDir, "serial"))) + " -out " + q3(n4(certFile)),
-      options
+      [
+        "x509",
+        "-sha256",
+        "-req",
+        "-days",
+        String(validity),
+        "-text",
+        "-extensions",
+        "v3_ca",
+        "-extfile",
+        n4(configFile),
+        "-in",
+        n4(csrFile),
+        "-CA",
+        n4(this.caCertificate),
+        "-CAkey",
+        n4(path5.join(caRootDir, "private/cakey.pem")),
+        "-CAserial",
+        n4(path5.join(caRootDir, "serial")),
+        "-out",
+        n4(certFile),
+        ...passin.args
+      ],
+      { ...options, env: passin.env }
     );
     await this.constructCertificateChain(certFile);
   }
@@ -1827,23 +2091,36 @@ var CertificateAuthority = class {
       cwd: this.rootDir,
       openssl_conf: makePath(configFile)
     };
-    const configOption = "";
     const subject = params.subject ? new Subject2(params.subject).toString() : "";
-    const subjectOptions = subject && subject.length > 1 ? ` -subj ${subject} ` : "";
+    const subjectOptions = subject && subject.length > 1 ? ["-subj", subject] : [];
     displaySubtitle("- the certificate signing request");
     await execute_openssl(
-      "req  -new -sha256 -text " + configOption + subjectOptions + " -batch -key " + q3(n4(privateKey)) + " -out " + q3(n4(csrFile)),
+      ["req", "-new", "-sha256", "-text", ...subjectOptions, "-batch", "-key", n4(privateKey), "-out", n4(csrFile)],
       options
     );
     displaySubtitle("- creating the self-signed certificate");
     await execute_openssl(
-      "ca  -selfsign  -keyfile " + q3(n4(privateKey)) + " -startdate " + x509Date(params.startDate) + " -enddate " + x509Date(params.endDate) + " -batch -out " + q3(n4(certificateFile)) + " -in " + q3(n4(csrFile)),
+      [
+        "ca",
+        "-selfsign",
+        "-keyfile",
+        n4(privateKey),
+        "-startdate",
+        x509Date(params.startDate),
+        "-enddate",
+        x509Date(params.endDate),
+        "-batch",
+        "-out",
+        n4(certificateFile),
+        "-in",
+        n4(csrFile)
+      ],
       options
     );
     displaySubtitle("- dump the certificate for a check");
-    await execute_openssl(`x509 -in ${q3(n4(certificateFile))}  -dates -fingerprint -purpose -noout`, {});
+    await execute_openssl(["x509", "-in", n4(certificateFile), "-dates", "-fingerprint", "-purpose", "-noout"], {});
     displaySubtitle("- verify self-signed certificate");
-    await execute_openssl_no_failure(`verify -verbose -CAfile ${q3(n4(certificateFile))} ${q3(n4(certificateFile))}`, options);
+    await execute_openssl_no_failure(["verify", "-verbose", "-CAfile", n4(certificateFile), n4(certificateFile)], options);
     await fs7.promises.unlink(csrFile);
   }
   /**
@@ -1873,22 +2150,41 @@ var CertificateAuthority = class {
     setEnv("ALTNAME", "");
     const randomFile = path5.join(this.rootDir, "random.rnd");
     setEnv("RANDFILE", randomFile);
-    const configOption = ` -config ${q3(n4(configFile))}`;
+    const configOption = ["-config", n4(configFile)];
     const reason = params.reason || "keyCompromise";
     assert7(crlReasons.indexOf(reason) >= 0);
     displayTitle(`Revoking certificate  ${certificate}`);
     displaySubtitle("Revoke certificate");
-    await execute_openssl_no_failure(`ca -verbose ${configOption} -revoke ${q3(certificate)} -crl_reason ${reason}`, options);
-    await regenerateCrl(this.revocationList, configOption, options);
+    const passin = await this._opensslPassin();
+    await execute_openssl_no_failure(
+      ["ca", "-verbose", ...configOption, "-revoke", certificate, "-crl_reason", reason, ...passin.args],
+      { ...options, env: passin.env }
+    );
+    await regenerateCrl(this.revocationList, configOption, options, passin);
     displaySubtitle("Verify that certificate is revoked");
     await execute_openssl_no_failure(
-      "verify -verbose -CRLfile " + q3(n4(this.revocationList)) + " -CAfile " + q3(n4(this.caCertificate)) + " -crl_check " + q3(n4(certificate)),
+      [
+        "verify",
+        "-verbose",
+        "-CRLfile",
+        n4(this.revocationList),
+        "-CAfile",
+        n4(this.caCertificate),
+        "-crl_check",
+        n4(certificate)
+      ],
       options
     );
     displaySubtitle("Produce CRL in DER form ");
-    await execute_openssl(`crl  -in ${q3(n4(this.revocationList))} -out crl/revocation_list.der  -outform der`, options);
+    await execute_openssl(
+      ["crl", "-in", n4(this.revocationList), "-out", "crl/revocation_list.der", "-outform", "der"],
+      options
+    );
     displaySubtitle("Produce CRL in PEM form ");
-    await execute_openssl(`crl  -in ${q3(n4(this.revocationList))} -out crl/revocation_list.pem  -outform pem -text `, options);
+    await execute_openssl(
+      ["crl", "-in", n4(this.revocationList), "-out", "crl/revocation_list.pem", "-outform", "pem", "-text"],
+      options
+    );
   }
   /**
    * Sign a Certificate Signing Request (CSR) with this CA.
@@ -1930,13 +2226,27 @@ var CertificateAuthority = class {
     this._wireRevocationEnvVars();
     const configFile = generateStaticConfig("conf/caconfig.cnf", options);
     displaySubtitle("- then we ask the authority to sign the certificate signing request");
-    const configOption = ` -config ${configFile}`;
+    const passin = await this._opensslPassin();
     await execute_openssl(
-      "ca " + configOption + " -startdate " + x509Date(params1.startDate) + " -enddate " + x509Date(params1.endDate) + " -batch -out " + q3(n4(certificate)) + " -in " + q3(n4(certificateSigningRequestFilename)),
-      options
+      [
+        "ca",
+        "-config",
+        configFile,
+        "-startdate",
+        x509Date(params1.startDate),
+        "-enddate",
+        x509Date(params1.endDate),
+        "-batch",
+        "-out",
+        n4(certificate),
+        "-in",
+        n4(certificateSigningRequestFilename),
+        ...passin.args
+      ],
+      { ...options, env: passin.env }
     );
     displaySubtitle("- dump the certificate for a check");
-    await execute_openssl(`x509 -in ${q3(n4(certificate))}  -dates -fingerprint -purpose -noout`, options);
+    await execute_openssl(["x509", "-in", n4(certificate), "-dates", "-fingerprint", "-purpose", "-noout"], options);
     displaySubtitle("- construct CA certificate with CRL");
     await this.constructCACertificateWithCRL();
     displaySubtitle("- construct certificate chain");
@@ -1956,10 +2266,8 @@ var CertificateAuthority = class {
       const options = { cwd: this.rootDir };
       const configFile = generateStaticConfig("conf/caconfig.cnf", options);
       setEnv("OPENSSL_CONF", makePath(configFile));
-      const _configOption = ` -config ${configFile}`;
-      _configOption;
       await execute_openssl_no_failure(
-        `verify -verbose  -CAfile ${q3(n4(this.caCertificateWithCrl))} ${q3(n4(certificate))}`,
+        ["verify", "-verbose", "-CAfile", n4(this.caCertificateWithCrl), n4(certificate)],
         options
       );
     }
@@ -1982,27 +2290,30 @@ import {
   readCertificateChain,
   readCertificateChainAsync,
   readCertificateRevocationList,
+  readPrivateKey as readPrivateKey2,
   split_der,
   toPem as toPem2,
-  verifyCertificateSignature
+  verifyCertificateSignature,
+  writePrivateKeyFile as writePrivateKeyFile2
 } from "node-opcua-crypto";
 
 // packages/node-opcua-pki/lib/toolbox/without_openssl/create_certificate_signing_request.ts
 import assert8 from "assert";
 import fs8 from "fs";
-import { createCertificateSigningRequest, pemToPrivateKey, Subject as Subject3 } from "node-opcua-crypto";
+import { coercePrivateKeyPem, createCertificateSigningRequest, pemToPrivateKey, Subject as Subject3 } from "node-opcua-crypto";
 async function createCertificateSigningRequestAsync(certificateSigningRequestFilename, params) {
   assert8(params);
   assert8(params.rootDir);
   assert8(params.configFile);
   assert8(params.privateKey);
-  assert8(typeof params.privateKey === "string");
-  assert8(fs8.existsSync(params.privateKey), `Private key must exist${params.privateKey}`);
+  if (typeof params.privateKey === "string") {
+    assert8(fs8.existsSync(params.privateKey), `Private key must exist${params.privateKey}`);
+  }
   assert8(fs8.existsSync(params.rootDir), "RootDir key must exist");
   assert8(typeof certificateSigningRequestFilename === "string");
   const subject = params.subject ? new Subject3(params.subject).toString() : void 0;
   displaySubtitle("- Creating a Certificate Signing Request with subtile");
-  const privateKeyPem = await fs8.promises.readFile(params.privateKey, "utf-8");
+  const privateKeyPem = typeof params.privateKey === "string" ? await fs8.promises.readFile(params.privateKey, "utf-8") : coercePrivateKeyPem(params.privateKey);
   const privateKey = await pemToPrivateKey(privateKeyPem);
   const { csr } = await createCertificateSigningRequest({
     privateKey,
@@ -2013,7 +2324,7 @@ async function createCertificateSigningRequestAsync(certificateSigningRequestFil
     purpose: params.purpose
   });
   await fs8.promises.writeFile(certificateSigningRequestFilename, csr, "utf-8");
-  display(`- privateKey ${params.privateKey}`);
+  display(`- privateKey ${typeof params.privateKey === "string" ? params.privateKey : "<in-memory>"}`);
   display(`- certificateSigningRequestFilename ${certificateSigningRequestFilename}`);
 }
 
@@ -2022,6 +2333,7 @@ import assert9 from "assert";
 import fs9 from "fs";
 import {
   CertificatePurpose as CertificatePurpose2,
+  coercePrivateKeyPem as coercePrivateKeyPem2,
   createSelfSignedCertificate as createSelfSignedCertificate1,
   pemToPrivateKey as pemToPrivateKey2,
   Subject as Subject4
@@ -2031,7 +2343,9 @@ async function createSelfSignedCertificateAsync(certificate, params) {
   assert9(params.purpose, "Please provide a Certificate Purpose");
   assert9(fs9.existsSync(params.configFile));
   assert9(fs9.existsSync(params.rootDir));
-  assert9(fs9.existsSync(params.privateKey));
+  if (typeof params.privateKey === "string") {
+    assert9(fs9.existsSync(params.privateKey));
+  }
   if (!params.subject) {
     throw Error("Missing subject");
   }
@@ -2043,7 +2357,7 @@ async function createSelfSignedCertificateAsync(certificate, params) {
   subject = subject.toString();
   const purpose = params.purpose;
   displayTitle("Generate a certificate request");
-  const privateKeyPem = await fs9.promises.readFile(params.privateKey, "utf-8");
+  const privateKeyPem = typeof params.privateKey === "string" ? await fs9.promises.readFile(params.privateKey, "utf-8") : coercePrivateKeyPem2(params.privateKey);
   const privateKey = await pemToPrivateKey2(privateKeyPem);
   const { cert } = await createSelfSignedCertificate1({
     privateKey,
@@ -2310,6 +2624,15 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
   #initializingPromise;
   #addCertValidation;
   #disableFileWatchers;
+  #privateKeyPassphrase;
+  #privateKeyProvider;
+  /**
+   * The on-disk key, decrypted once and kept for the instance's lifetime,
+   * so the passphrase (or its resolver function) is consulted at most
+   * once. Cleared by `dispose()`. Not used when a provider is configured:
+   * the provider is the authority on the current key.
+   */
+  #cachedPrivateKey;
   #thumbs = {
     rejected: /* @__PURE__ */ new Map(),
     trusted: /* @__PURE__ */ new Map(),
@@ -2344,6 +2667,8 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
       maxChainLength: v.maxChainLength ?? 5
     };
     this.#disableFileWatchers = options.disableFileWatchers ?? process.env.OPCUA_PKI_DISABLE_FILE_WATCHERS === "true";
+    this.#privateKeyPassphrase = options.privateKeyPassphrase;
+    this.#privateKeyProvider = options.privateKeyProvider;
     mkdirRecursiveSync(options.location);
     if (!fs10.existsSync(this.#location)) {
       throw new Error(`CertificateManager cannot access location ${this.#location}`);
@@ -2357,10 +2682,108 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
   get rootDir() {
     return this.#location;
   }
-  /** Path to the private key file (`own/private/private_key.pem`). */
+  /**
+   * Path to the private key file (`own/private/private_key.pem`).
+   *
+   * Kept for backward compatibility with code that reads the key
+   * directly from disk. When a passphrase or a `privateKeyProvider` is
+   * configured, prefer {@link getPrivateKey} instead — this getter still
+   * returns the on-disk path even if a provider is configured (there may
+   * be no meaningful file in that case).
+   */
   get privateKey() {
     return path6.join(this.rootDir, "own/private/private_key.pem");
   }
+  /**
+   * Resolve the private key: from `privateKeyProvider` if configured,
+   * otherwise from disk (decrypting with `privateKeyPassphrase` if the
+   * key is encrypted). Fails closed — throws
+   * `PrivateKeyPassphraseRequiredError` — if the on-disk key is encrypted
+   * and no passphrase is configured, or if the wrong passphrase is
+   * configured.
+   *
+   * The on-disk key is read and decrypted once and then cached for the
+   * lifetime of this instance, so a `privateKeyPassphrase` function is
+   * called at most once (concurrent first calls share the same read). A
+   * failed read is not cached, so a caller can fix the passphrase and
+   * retry. A `privateKeyProvider` is consulted on every call: it is the
+   * authority on what the current key is.
+   */
+  async getPrivateKey() {
+    if (this.#privateKeyProvider) {
+      return await this.#privateKeyProvider.getPrivateKey();
+    }
+    if (this.#cachedPrivateKey) {
+      return this.#cachedPrivateKey;
+    }
+    if (!this.#privateKeyPromise) {
+      this.#privateKeyPromise = (async () => {
+        const passphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
+        return readPrivateKey2(this.privateKey, passphrase);
+      })().then(
+        (key) => {
+          this.#cachedPrivateKey = key;
+          return key;
+        },
+        (err) => {
+          this.#privateKeyPromise = void 0;
+          throw err;
+        }
+      );
+    }
+    return await this.#privateKeyPromise;
+  }
+  /** In-flight first read of the on-disk key, so concurrent callers share one passphrase resolution. */
+  #privateKeyPromise;
+  /**
+   * Enable, disable, or rotate the passphrase protecting the on-disk
+   * private key: decrypt with `oldPassphrase` (omit if the key is
+   * currently unencrypted), then write back encrypted with
+   * `newPassphrase` (omit to leave it unencrypted). The write goes to a
+   * temporary file in the same directory and is atomically renamed into
+   * place, so a crash mid-rotation cannot leave a partially-written key;
+   * the temporary file is removed if anything fails, so a rotation *to*
+   * plaintext can never leave a stray cleartext copy behind. Runs under
+   * the same lock as `initialize()`.
+   *
+   * This only rewrites the on-disk file — it does not update this
+   * instance's own `privateKeyPassphrase` (set at construction), and it
+   * drops this instance's cached key so that disk stays the source of
+   * truth. Construct a new `CertificateManager` with the new passphrase to
+   * continue using it afterward.
+   *
+   * Not supported when a `privateKeyProvider` is configured (there is no
+   * disk file for this method to rewrite).
+   */
+  async reencryptPrivateKey(oldPassphrase, newPassphrase) {
+    if (this.#privateKeyProvider) {
+      throw new Error("reencryptPrivateKey: not supported when a privateKeyProvider is configured");
+    }
+    const oldPass = await resolvePrivateKeyPassphrase(oldPassphrase);
+    const newPass = await resolvePrivateKeyPassphrase(newPassphrase);
+    await this.withLock2(async () => {
+      const privateKey = readPrivateKey2(this.privateKey, oldPass);
+      await this.#rewritePrivateKeyFile(privateKey, newPass);
+    });
+    this.#cachedPrivateKey = void 0;
+    this.#privateKeyPromise = void 0;
+  }
+  /**
+   * Atomically replace the on-disk private key with `privateKey`, written
+   * as PKCS#8 (encrypted with `passphrase` if given). Temp file next to the
+   * target, `0600`, renamed into place; the temp file is unlinked on any
+   * failure so no partial or cleartext copy can be left behind.
+   * Caller must hold the lock.
+   */
+  async #rewritePrivateKeyFile(privateKey, passphrase) {
+    const tmpFilename = `${this.privateKey}.${process.pid}-${Date.now()}.tmp`;
+    try {
+      await writePrivateKeyFile2(tmpFilename, privateKey, { passphrase });
+      await fs10.promises.rename(tmpFilename, this.privateKey);
+    } finally {
+      await fs10.promises.rm(tmpFilename, { force: true });
+    }
+  }
   /** Path to the OpenSSL random seed file. */
   get randomFile() {
     return path6.join(this.rootDir, "./random.rnd");
@@ -2660,19 +3083,24 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     }
     this.state = 1 /* Initializing */;
     this.#initializingPromise = this.#initialize();
-    await this.#initializingPromise;
+    try {
+      await this.#initializingPromise;
+    } catch (err) {
+      this.#initializingPromise = void 0;
+      this.state = 0 /* Uninitialized */;
+      throw err;
+    }
     this.#initializingPromise = void 0;
     this.state = 2 /* Initialized */;
     _CertificateManager.#activeInstances.add(this);
     _CertificateManager.#installProcessCleanup();
   }
   async #initialize() {
-    this.state = 1 /* Initializing */;
     const pkiDir = this.#location;
     mkdirRecursiveSync(pkiDir);
     mkdirRecursiveSync(path6.join(pkiDir, "own"));
     mkdirRecursiveSync(path6.join(pkiDir, "own/certs"));
-    mkdirRecursiveSync(path6.join(pkiDir, "own/private"));
+    ensurePrivateDirectory(path6.join(pkiDir, "own/private"));
     mkdirRecursiveSync(path6.join(pkiDir, "rejected"));
     mkdirRecursiveSync(path6.join(pkiDir, "trusted"));
     mkdirRecursiveSync(path6.join(pkiDir, "trusted/certs"));
@@ -2680,7 +3108,10 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     mkdirRecursiveSync(path6.join(pkiDir, "issuers"));
     mkdirRecursiveSync(path6.join(pkiDir, "issuers/certs"));
     mkdirRecursiveSync(path6.join(pkiDir, "issuers/crl"));
-    if (!fs10.existsSync(this.configFile) || !fs10.existsSync(this.privateKey)) {
+    const ownsDiskKey = !this.#privateKeyProvider;
+    const needsKeyGeneration = ownsDiskKey && !fs10.existsSync(this.privateKey);
+    const needsKeyEncryption = ownsDiskKey && !needsKeyGeneration && this.#privateKeyPassphrase !== void 0 && !isEncryptedPrivateKeyFile(this.privateKey);
+    if (!fs10.existsSync(this.configFile) || needsKeyGeneration || needsKeyEncryption) {
       return await this.withLock2(async () => {
         if (this.state === 3 /* Disposing */ || this.state === 4 /* Disposed */) {
           return;
@@ -2688,15 +3119,29 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
         if (!fs10.existsSync(this.configFile)) {
           fs10.writeFileSync(this.configFile, configurationFileSimpleTemplate2);
         }
-        if (!fs10.existsSync(this.privateKey)) {
+        if (ownsDiskKey && !fs10.existsSync(this.privateKey)) {
           debugLog("generating private key ...");
-          await generatePrivateKeyFile2(this.privateKey, this.keySize);
-          await this.#readCertificates();
-        } else {
-          await this.#readCertificates();
+          const passphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
+          await generatePrivateKeyFile2(this.privateKey, this.keySize, { passphrase });
+          this.#cachedPrivateKey = readPrivateKey2(this.privateKey, passphrase);
+        } else if (ownsDiskKey && this.#privateKeyPassphrase !== void 0 && !isEncryptedPrivateKeyFile(this.privateKey)) {
+          warningLog("initialize: private key is plaintext but a passphrase is configured; encrypting it in place");
+          const passphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
+          const plaintextKey = readPrivateKey2(this.privateKey);
+          await this.#rewritePrivateKeyFile(plaintextKey, passphrase);
+          this.#cachedPrivateKey = plaintextKey;
+        }
+        if (ownsDiskKey) {
+          restrictPrivateFilePermissions(this.privateKey, 384);
         }
+        await this.getPrivateKey();
+        await this.#readCertificates();
       });
     } else {
+      if (ownsDiskKey) {
+        restrictPrivateFilePermissions(this.privateKey, 384);
+      }
+      await this.getPrivateKey();
       await this.#readCertificates();
     }
   }
@@ -2732,6 +3177,8 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
       this.#watchers.splice(0);
     } finally {
       this.state = 4 /* Disposed */;
+      this.#cachedPrivateKey = void 0;
+      this.#privateKeyPromise = void 0;
       _CertificateManager.#activeInstances.delete(this);
     }
   }
@@ -2778,16 +3225,18 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     if (typeof params.applicationUri !== "string") {
       throw new Error("createSelfSignedCertificate: expecting applicationUri to be a string");
     }
-    if (!fs10.existsSync(this.privateKey)) {
+    if (!this.#privateKeyProvider && !fs10.existsSync(this.privateKey)) {
       throw new Error(`Cannot find private key ${this.privateKey}`);
     }
     let certificateFilename = path6.join(this.rootDir, "own/certs/self_signed_certificate.pem");
     certificateFilename = params.outputFile || certificateFilename;
-    const _params = params;
-    _params.rootDir = this.rootDir;
-    _params.configFile = this.configFile;
-    _params.privateKey = this.privateKey;
-    _params.subject = params.subject || "CN=FIXME";
+    const _params = {
+      ...params,
+      rootDir: this.rootDir,
+      configFile: this.configFile,
+      privateKey: await this.getPrivateKey(),
+      subject: params.subject || "CN=FIXME"
+    };
     await this.withLock2(async () => {
       await createSelfSignedCertificate(certificateFilename, _params);
     });
@@ -2806,13 +3255,15 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     if (!params) {
       throw new Error("params is required");
     }
-    const _params = params;
-    if (Object.prototype.hasOwnProperty.call(_params, "rootDir")) {
+    if (Object.prototype.hasOwnProperty.call(params, "rootDir")) {
       throw new Error("rootDir should not be specified ");
     }
-    _params.rootDir = path6.resolve(this.rootDir);
-    _params.configFile = path6.resolve(this.configFile);
-    _params.privateKey = path6.resolve(this.privateKey);
+    const _params = {
+      ...params,
+      rootDir: path6.resolve(this.rootDir),
+      configFile: path6.resolve(this.configFile),
+      privateKey: await this.getPrivateKey()
+    };
     return await this.withLock2(async () => {
       const now = /* @__PURE__ */ new Date();
       const today = `${now.toISOString().slice(0, 10)}_${now.getTime()}`;
@@ -3662,6 +4113,7 @@ export {
   CertificateManager,
   CertificateManagerState,
   ChainCompletionStatus,
+  PrivateKeyPassphraseRequiredError,
   Subject,
   VerificationStatus,
   adjustApplicationUri,
@@ -3680,6 +4132,7 @@ export {
   isIssuer,
   isRootIssuer,
   makeFingerprint,
-  quote
+  quote,
+  resolvePrivateKeyPassphrase
 };
 //# sourceMappingURL=index.mjs.map