node-opcua-pki 6.19.1 → 6.21.0

package/dist/bin/pki.mjs

@@ -91,6 +91,45 @@ var init_hostname = __esm({
   }
 });
 
+// packages/node-opcua-pki/lib/toolbox/common.ts
+import assert2 from "assert";
+async function resolvePrivateKeyPassphrase(passphrase) {
+  if (passphrase === void 0) {
+    return void 0;
+  }
+  return typeof passphrase === "function" ? await passphrase() : passphrase;
+}
+function adjustDate(params) {
+  assert2(params instanceof Object);
+  params.startDate = params.startDate || /* @__PURE__ */ new Date();
+  assert2(params.startDate instanceof Date);
+  if (params.validityMs !== void 0) {
+    if (params.validityMs <= 0) {
+      throw new RangeError(`validityMs must be > 0 (got ${params.validityMs})`);
+    }
+    params.endDate = new Date(params.startDate.getTime() + params.validityMs);
+    params.validity = Math.ceil(params.validityMs / 864e5);
+  } else {
+    params.validity = params.validity || 365;
+    params.endDate = new Date(params.startDate.getTime());
+    params.endDate.setDate(params.startDate.getDate() + params.validity);
+  }
+  assert2(params.endDate instanceof Date);
+  assert2(params.startDate instanceof Date);
+}
+function adjustApplicationUri(params) {
+  const applicationUri = params.applicationUri || "";
+  if (applicationUri.length > 200) {
+    throw new Error(`Openssl doesn't support urn with length greater than 200${applicationUri}`);
+  }
+}
+var init_common = __esm({
+  "packages/node-opcua-pki/lib/toolbox/common.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
 // packages/node-opcua-pki/lib/toolbox/config.ts
 var g_config;
 var init_config = __esm({
@@ -126,7 +165,7 @@ var init_debug = __esm({
 });
 
 // packages/node-opcua-pki/lib/toolbox/common2.ts
-import assert2 from "assert";
+import assert3 from "assert";
 import fs from "fs";
 import path from "path";
 import chalk from "chalk";
@@ -145,12 +184,31 @@ function mkdirRecursiveSync(folder) {
     fs.mkdirSync(folder, { recursive: true });
   }
 }
+function restrictPrivateFilePermissions(target, mode) {
+  if (process.platform === "win32") {
+    return;
+  }
+  try {
+    fs.chmodSync(target, mode);
+  } catch (err) {
+    warningLog(chalk.yellow("        could not restrict permissions on "), target, err.message);
+  }
+}
+function ensurePrivateDirectory(dir) {
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  }
+  restrictPrivateFilePermissions(dir, 448);
+}
+function isEncryptedPrivateKeyFile(filename) {
+  return fs.readFileSync(filename, "utf-8").includes("-----BEGIN ENCRYPTED PRIVATE KEY-----");
+}
 function makePath(folderName, filename) {
   let s;
   if (filename) {
     s = path.join(path.normalize(folderName), filename);
   } else {
-    assert2(folderName);
+    assert3(folderName);
     s = folderName;
   }
   s = s.replace(/\\/g, "/");
@@ -203,21 +261,22 @@ var init_display = __esm({
 });
 
 // packages/node-opcua-pki/lib/toolbox/without_openssl/create_certificate_signing_request.ts
-import assert3 from "assert";
+import assert4 from "assert";
 import fs2 from "fs";
-import { createCertificateSigningRequest, pemToPrivateKey, Subject } from "node-opcua-crypto";
+import { coercePrivateKeyPem, createCertificateSigningRequest, pemToPrivateKey, Subject } from "node-opcua-crypto";
 async function createCertificateSigningRequestAsync(certificateSigningRequestFilename, params) {
-  assert3(params);
-  assert3(params.rootDir);
-  assert3(params.configFile);
-  assert3(params.privateKey);
-  assert3(typeof params.privateKey === "string");
-  assert3(fs2.existsSync(params.privateKey), `Private key must exist${params.privateKey}`);
-  assert3(fs2.existsSync(params.rootDir), "RootDir key must exist");
-  assert3(typeof certificateSigningRequestFilename === "string");
+  assert4(params);
+  assert4(params.rootDir);
+  assert4(params.configFile);
+  assert4(params.privateKey);
+  if (typeof params.privateKey === "string") {
+    assert4(fs2.existsSync(params.privateKey), `Private key must exist${params.privateKey}`);
+  }
+  assert4(fs2.existsSync(params.rootDir), "RootDir key must exist");
+  assert4(typeof certificateSigningRequestFilename === "string");
   const subject = params.subject ? new Subject(params.subject).toString() : void 0;
   displaySubtitle("- Creating a Certificate Signing Request with subtile");
-  const privateKeyPem = await fs2.promises.readFile(params.privateKey, "utf-8");
+  const privateKeyPem = typeof params.privateKey === "string" ? await fs2.promises.readFile(params.privateKey, "utf-8") : coercePrivateKeyPem(params.privateKey);
   const privateKey = await pemToPrivateKey(privateKeyPem);
   const { csr } = await createCertificateSigningRequest({
     privateKey,
@@ -228,7 +287,7 @@ async function createCertificateSigningRequestAsync(certificateSigningRequestFil
     purpose: params.purpose
   });
   await fs2.promises.writeFile(certificateSigningRequestFilename, csr, "utf-8");
-  display(`- privateKey ${params.privateKey}`);
+  display(`- privateKey ${typeof params.privateKey === "string" ? params.privateKey : "<in-memory>"}`);
   display(`- certificateSigningRequestFilename ${certificateSigningRequestFilename}`);
 }
 var init_create_certificate_signing_request = __esm({
@@ -239,47 +298,12 @@ var init_create_certificate_signing_request = __esm({
   }
 });
 
-// packages/node-opcua-pki/lib/toolbox/common.ts
-import assert4 from "assert";
-function quote(str) {
-  return `"${str || ""}"`;
-}
-function adjustDate(params) {
-  assert4(params instanceof Object);
-  params.startDate = params.startDate || /* @__PURE__ */ new Date();
-  assert4(params.startDate instanceof Date);
-  if (params.validityMs !== void 0) {
-    if (params.validityMs <= 0) {
-      throw new RangeError(`validityMs must be > 0 (got ${params.validityMs})`);
-    }
-    params.endDate = new Date(params.startDate.getTime() + params.validityMs);
-    params.validity = Math.ceil(params.validityMs / 864e5);
-  } else {
-    params.validity = params.validity || 365;
-    params.endDate = new Date(params.startDate.getTime());
-    params.endDate.setDate(params.startDate.getDate() + params.validity);
-  }
-  assert4(params.endDate instanceof Date);
-  assert4(params.startDate instanceof Date);
-}
-function adjustApplicationUri(params) {
-  const applicationUri = params.applicationUri || "";
-  if (applicationUri.length > 200) {
-    throw new Error(`Openssl doesn't support urn with length greater than 200${applicationUri}`);
-  }
-}
-var init_common = __esm({
-  "packages/node-opcua-pki/lib/toolbox/common.ts"() {
-    "use strict";
-    init_esm_shims();
-  }
-});
-
 // packages/node-opcua-pki/lib/toolbox/without_openssl/create_self_signed_certificate.ts
 import assert5 from "assert";
 import fs3 from "fs";
 import {
   CertificatePurpose,
+  coercePrivateKeyPem as coercePrivateKeyPem2,
   createSelfSignedCertificate as createSelfSignedCertificate1,
   pemToPrivateKey as pemToPrivateKey2,
   Subject as Subject2
@@ -289,7 +313,9 @@ async function createSelfSignedCertificateAsync(certificate, params) {
   assert5(params.purpose, "Please provide a Certificate Purpose");
   assert5(fs3.existsSync(params.configFile));
   assert5(fs3.existsSync(params.rootDir));
-  assert5(fs3.existsSync(params.privateKey));
+  if (typeof params.privateKey === "string") {
+    assert5(fs3.existsSync(params.privateKey));
+  }
   if (!params.subject) {
     throw Error("Missing subject");
   }
@@ -301,7 +327,7 @@ async function createSelfSignedCertificateAsync(certificate, params) {
   subject = subject.toString();
   const purpose = params.purpose;
   displayTitle("Generate a certificate request");
-  const privateKeyPem = await fs3.promises.readFile(params.privateKey, "utf-8");
+  const privateKeyPem = typeof params.privateKey === "string" ? await fs3.promises.readFile(params.privateKey, "utf-8") : coercePrivateKeyPem2(params.privateKey);
   const privateKey = await pemToPrivateKey2(privateKeyPem);
   const { cert } = await createSelfSignedCertificate1({
     privateKey,
@@ -365,9 +391,11 @@ import {
   readCertificateChain,
   readCertificateChainAsync,
   readCertificateRevocationList,
+  readPrivateKey,
   split_der,
   toPem,
-  verifyCertificateSignature
+  verifyCertificateSignature,
+  writePrivateKeyFile
 } from "node-opcua-crypto";
 function getOrComputeInfo(entry) {
   if (!entry.info) {
@@ -468,6 +496,7 @@ var init_certificate_manager = __esm({
   "packages/node-opcua-pki/lib/pki/certificate_manager.ts"() {
     "use strict";
     init_esm_shims();
+    init_common();
     init_common2();
     init_debug();
     init_without_openssl();
@@ -490,7 +519,31 @@ var init_certificate_manager = __esm({
       // even if the consumer forgets to call dispose().
       static #activeInstances = /* @__PURE__ */ new Set();
       static #cleanupInstalled = false;
-      static #installProcessCleanup() {
+      static #exitHandler;
+      /**
+       * Install a best-effort `exit` hook that closes any watcher
+       * still open when the process terminates.
+       *
+       * **This library never terminates the host process.** No
+       * SIGINT/SIGTERM handler is installed: deciding how (and
+       * whether) to shut down on a signal is the application's
+       * responsibility, and a listener registered here would both
+       * pre-empt the application's own graceful shutdown and
+       * silently suppress Node's default signal behaviour.
+       *
+       * Nothing here is load-bearing for process exit. The native
+       * `fs.watch` handles are `unref()`'d when the watchers are
+       * created (see `#readCertificates`), so an undisposed
+       * CertificateManager never keeps the event loop alive. This
+       * hook is only tidiness on the way out.
+       *
+       * `exit` rather than `beforeExit`: `beforeExit` fires when
+       * the loop merely drains and the loop can subsequently be
+       * resurrected, which would leave a still-in-use instance
+       * marked Disposed. `exit` is terminal, synchronous-only and
+       * cannot alter the exit code.
+       */
+      static #installExitCleanup() {
         if (_CertificateManager.#cleanupInstalled) return;
         _CertificateManager.#cleanupInstalled = true;
         const closeDanglingWatchers = () => {
@@ -506,13 +559,22 @@ var init_certificate_manager = __esm({
           }
           _CertificateManager.#activeInstances.clear();
         };
-        process.on("beforeExit", closeDanglingWatchers);
-        for (const signal of ["SIGINT", "SIGTERM"]) {
-          process.once(signal, () => {
-            closeDanglingWatchers();
-            process.exit();
-          });
+        _CertificateManager.#exitHandler = closeDanglingWatchers;
+        process.on("exit", closeDanglingWatchers);
+      }
+      /**
+       * Remove the `exit` hook once the last instance is disposed,
+       * so a library that is initialized and disposed repeatedly
+       * does not accumulate process listeners. A later
+       * `initialize()` re-arms it.
+       */
+      static #uninstallExitCleanupIfIdle() {
+        if (_CertificateManager.#activeInstances.size > 0) return;
+        if (_CertificateManager.#exitHandler) {
+          process.removeListener("exit", _CertificateManager.#exitHandler);
+          _CertificateManager.#exitHandler = void 0;
         }
+        _CertificateManager.#cleanupInstalled = false;
       }
       /**
        * Dispose **all** active CertificateManager instances,
@@ -576,6 +638,15 @@ var init_certificate_manager = __esm({
       #initializingPromise;
       #addCertValidation;
       #disableFileWatchers;
+      #privateKeyPassphrase;
+      #privateKeyProvider;
+      /**
+       * The on-disk key, decrypted once and kept for the instance's lifetime,
+       * so the passphrase (or its resolver function) is consulted at most
+       * once. Cleared by `dispose()`. Not used when a provider is configured:
+       * the provider is the authority on the current key.
+       */
+      #cachedPrivateKey;
       #thumbs = {
         rejected: /* @__PURE__ */ new Map(),
         trusted: /* @__PURE__ */ new Map(),
@@ -610,6 +681,8 @@ var init_certificate_manager = __esm({
           maxChainLength: v.maxChainLength ?? 5
         };
         this.#disableFileWatchers = options.disableFileWatchers ?? process.env.OPCUA_PKI_DISABLE_FILE_WATCHERS === "true";
+        this.#privateKeyPassphrase = options.privateKeyPassphrase;
+        this.#privateKeyProvider = options.privateKeyProvider;
         mkdirRecursiveSync(options.location);
         if (!fs4.existsSync(this.#location)) {
           throw new Error(`CertificateManager cannot access location ${this.#location}`);
@@ -623,10 +696,108 @@ var init_certificate_manager = __esm({
       get rootDir() {
         return this.#location;
       }
-      /** Path to the private key file (`own/private/private_key.pem`). */
+      /**
+       * Path to the private key file (`own/private/private_key.pem`).
+       *
+       * Kept for backward compatibility with code that reads the key
+       * directly from disk. When a passphrase or a `privateKeyProvider` is
+       * configured, prefer {@link getPrivateKey} instead — this getter still
+       * returns the on-disk path even if a provider is configured (there may
+       * be no meaningful file in that case).
+       */
       get privateKey() {
         return path2.join(this.rootDir, "own/private/private_key.pem");
       }
+      /**
+       * Resolve the private key: from `privateKeyProvider` if configured,
+       * otherwise from disk (decrypting with `privateKeyPassphrase` if the
+       * key is encrypted). Fails closed — throws
+       * `PrivateKeyPassphraseRequiredError` — if the on-disk key is encrypted
+       * and no passphrase is configured, or if the wrong passphrase is
+       * configured.
+       *
+       * The on-disk key is read and decrypted once and then cached for the
+       * lifetime of this instance, so a `privateKeyPassphrase` function is
+       * called at most once (concurrent first calls share the same read). A
+       * failed read is not cached, so a caller can fix the passphrase and
+       * retry. A `privateKeyProvider` is consulted on every call: it is the
+       * authority on what the current key is.
+       */
+      async getPrivateKey() {
+        if (this.#privateKeyProvider) {
+          return await this.#privateKeyProvider.getPrivateKey();
+        }
+        if (this.#cachedPrivateKey) {
+          return this.#cachedPrivateKey;
+        }
+        if (!this.#privateKeyPromise) {
+          this.#privateKeyPromise = (async () => {
+            const passphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
+            return readPrivateKey(this.privateKey, passphrase);
+          })().then(
+            (key) => {
+              this.#cachedPrivateKey = key;
+              return key;
+            },
+            (err) => {
+              this.#privateKeyPromise = void 0;
+              throw err;
+            }
+          );
+        }
+        return await this.#privateKeyPromise;
+      }
+      /** In-flight first read of the on-disk key, so concurrent callers share one passphrase resolution. */
+      #privateKeyPromise;
+      /**
+       * Enable, disable, or rotate the passphrase protecting the on-disk
+       * private key: decrypt with `oldPassphrase` (omit if the key is
+       * currently unencrypted), then write back encrypted with
+       * `newPassphrase` (omit to leave it unencrypted). The write goes to a
+       * temporary file in the same directory and is atomically renamed into
+       * place, so a crash mid-rotation cannot leave a partially-written key;
+       * the temporary file is removed if anything fails, so a rotation *to*
+       * plaintext can never leave a stray cleartext copy behind. Runs under
+       * the same lock as `initialize()`.
+       *
+       * This only rewrites the on-disk file — it does not update this
+       * instance's own `privateKeyPassphrase` (set at construction), and it
+       * drops this instance's cached key so that disk stays the source of
+       * truth. Construct a new `CertificateManager` with the new passphrase to
+       * continue using it afterward.
+       *
+       * Not supported when a `privateKeyProvider` is configured (there is no
+       * disk file for this method to rewrite).
+       */
+      async reencryptPrivateKey(oldPassphrase, newPassphrase) {
+        if (this.#privateKeyProvider) {
+          throw new Error("reencryptPrivateKey: not supported when a privateKeyProvider is configured");
+        }
+        const oldPass = await resolvePrivateKeyPassphrase(oldPassphrase);
+        const newPass = await resolvePrivateKeyPassphrase(newPassphrase);
+        await this.withLock2(async () => {
+          const privateKey = readPrivateKey(this.privateKey, oldPass);
+          await this.#rewritePrivateKeyFile(privateKey, newPass);
+        });
+        this.#cachedPrivateKey = void 0;
+        this.#privateKeyPromise = void 0;
+      }
+      /**
+       * Atomically replace the on-disk private key with `privateKey`, written
+       * as PKCS#8 (encrypted with `passphrase` if given). Temp file next to the
+       * target, `0600`, renamed into place; the temp file is unlinked on any
+       * failure so no partial or cleartext copy can be left behind.
+       * Caller must hold the lock.
+       */
+      async #rewritePrivateKeyFile(privateKey, passphrase) {
+        const tmpFilename = `${this.privateKey}.${process.pid}-${Date.now()}.tmp`;
+        try {
+          await writePrivateKeyFile(tmpFilename, privateKey, { passphrase });
+          await fs4.promises.rename(tmpFilename, this.privateKey);
+        } finally {
+          await fs4.promises.rm(tmpFilename, { force: true });
+        }
+      }
       /** Path to the OpenSSL random seed file. */
       get randomFile() {
         return path2.join(this.rootDir, "./random.rnd");
@@ -828,23 +999,19 @@ var init_certificate_manager = __esm({
             return "BadCertificateUntrusted" /* BadCertificateUntrusted */;
           }
         }
-        const _c2 = chain[1] ? exploreCertificateInfo(chain[1]) : "non";
-        debugLog("chain[1] info=", _c2);
-        const certificateInfo = exploreCertificateInfo(chain[0]);
+        const { validity } = exploreCertificate(chain[0]).tbsCertificate;
         const now = /* @__PURE__ */ new Date();
         let isTimeInvalid = false;
-        if (certificateInfo.notBefore.getTime() > now.getTime()) {
+        if (validity.notBefore.getTime() > now.getTime()) {
           debugLog(
-            `${chalk3.red("certificate is invalid : certificate is not active yet !")} not before date =${certificateInfo.notBefore}`
+            `${chalk3.red("certificate is invalid : certificate is not active yet !")} not before date =${validity.notBefore}`
           );
           if (!options.acceptPendingCertificate) {
             isTimeInvalid = true;
           }
         }
-        if (certificateInfo.notAfter.getTime() <= now.getTime()) {
-          debugLog(
-            `${chalk3.red("certificate is invalid : certificate has expired !")} not after date =${certificateInfo.notAfter}`
-          );
+        if (validity.notAfter.getTime() <= now.getTime()) {
+          debugLog(`${chalk3.red("certificate is invalid : certificate has expired !")} not after date =${validity.notAfter}`);
           if (!options.acceptOutdatedCertificate) {
             isTimeInvalid = true;
           }
@@ -883,7 +1050,7 @@ var init_certificate_manager = __esm({
         const chain = coerceCertificateChain(certificate);
         for (const element of chain) {
           try {
-            exploreCertificateInfo(element);
+            exploreCertificate(element);
           } catch (_err) {
             return "BadCertificateInvalid" /* BadCertificateInvalid */;
           }
@@ -926,19 +1093,24 @@ var init_certificate_manager = __esm({
         }
         this.state = 1 /* Initializing */;
         this.#initializingPromise = this.#initialize();
-        await this.#initializingPromise;
+        try {
+          await this.#initializingPromise;
+        } catch (err) {
+          this.#initializingPromise = void 0;
+          this.state = 0 /* Uninitialized */;
+          throw err;
+        }
         this.#initializingPromise = void 0;
         this.state = 2 /* Initialized */;
         _CertificateManager.#activeInstances.add(this);
-        _CertificateManager.#installProcessCleanup();
+        _CertificateManager.#installExitCleanup();
       }
       async #initialize() {
-        this.state = 1 /* Initializing */;
         const pkiDir = this.#location;
         mkdirRecursiveSync(pkiDir);
         mkdirRecursiveSync(path2.join(pkiDir, "own"));
         mkdirRecursiveSync(path2.join(pkiDir, "own/certs"));
-        mkdirRecursiveSync(path2.join(pkiDir, "own/private"));
+        ensurePrivateDirectory(path2.join(pkiDir, "own/private"));
         mkdirRecursiveSync(path2.join(pkiDir, "rejected"));
         mkdirRecursiveSync(path2.join(pkiDir, "trusted"));
         mkdirRecursiveSync(path2.join(pkiDir, "trusted/certs"));
@@ -946,7 +1118,10 @@ var init_certificate_manager = __esm({
         mkdirRecursiveSync(path2.join(pkiDir, "issuers"));
         mkdirRecursiveSync(path2.join(pkiDir, "issuers/certs"));
         mkdirRecursiveSync(path2.join(pkiDir, "issuers/crl"));
-        if (!fs4.existsSync(this.configFile) || !fs4.existsSync(this.privateKey)) {
+        const ownsDiskKey = !this.#privateKeyProvider;
+        const needsKeyGeneration = ownsDiskKey && !fs4.existsSync(this.privateKey);
+        const needsKeyEncryption = ownsDiskKey && !needsKeyGeneration && this.#privateKeyPassphrase !== void 0 && !isEncryptedPrivateKeyFile(this.privateKey);
+        if (!fs4.existsSync(this.configFile) || needsKeyGeneration || needsKeyEncryption) {
           return await this.withLock2(async () => {
             if (this.state === 3 /* Disposing */ || this.state === 4 /* Disposed */) {
               return;
@@ -954,15 +1129,29 @@ var init_certificate_manager = __esm({
             if (!fs4.existsSync(this.configFile)) {
               fs4.writeFileSync(this.configFile, configurationFileSimpleTemplate);
             }
-            if (!fs4.existsSync(this.privateKey)) {
+            if (ownsDiskKey && !fs4.existsSync(this.privateKey)) {
               debugLog("generating private key ...");
-              await generatePrivateKeyFile(this.privateKey, this.keySize);
-              await this.#readCertificates();
-            } else {
-              await this.#readCertificates();
+              const passphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
+              await generatePrivateKeyFile(this.privateKey, this.keySize, { passphrase });
+              this.#cachedPrivateKey = readPrivateKey(this.privateKey, passphrase);
+            } else if (ownsDiskKey && this.#privateKeyPassphrase !== void 0 && !isEncryptedPrivateKeyFile(this.privateKey)) {
+              warningLog("initialize: private key is plaintext but a passphrase is configured; encrypting it in place");
+              const passphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
+              const plaintextKey = readPrivateKey(this.privateKey);
+              await this.#rewritePrivateKeyFile(plaintextKey, passphrase);
+              this.#cachedPrivateKey = plaintextKey;
             }
+            if (ownsDiskKey) {
+              restrictPrivateFilePermissions(this.privateKey, 384);
+            }
+            await this.getPrivateKey();
+            await this.#readCertificates();
           });
         } else {
+          if (ownsDiskKey) {
+            restrictPrivateFilePermissions(this.privateKey, 384);
+          }
+          await this.getPrivateKey();
           await this.#readCertificates();
         }
       }
@@ -998,7 +1187,10 @@ var init_certificate_manager = __esm({
           this.#watchers.splice(0);
         } finally {
           this.state = 4 /* Disposed */;
+          this.#cachedPrivateKey = void 0;
+          this.#privateKeyPromise = void 0;
           _CertificateManager.#activeInstances.delete(this);
+          _CertificateManager.#uninstallExitCleanupIfIdle();
         }
       }
       /**
@@ -1044,16 +1236,18 @@ var init_certificate_manager = __esm({
         if (typeof params.applicationUri !== "string") {
           throw new Error("createSelfSignedCertificate: expecting applicationUri to be a string");
         }
-        if (!fs4.existsSync(this.privateKey)) {
+        if (!this.#privateKeyProvider && !fs4.existsSync(this.privateKey)) {
           throw new Error(`Cannot find private key ${this.privateKey}`);
         }
         let certificateFilename = path2.join(this.rootDir, "own/certs/self_signed_certificate.pem");
         certificateFilename = params.outputFile || certificateFilename;
-        const _params = params;
-        _params.rootDir = this.rootDir;
-        _params.configFile = this.configFile;
-        _params.privateKey = this.privateKey;
-        _params.subject = params.subject || "CN=FIXME";
+        const _params = {
+          ...params,
+          rootDir: this.rootDir,
+          configFile: this.configFile,
+          privateKey: await this.getPrivateKey(),
+          subject: params.subject || "CN=FIXME"
+        };
         await this.withLock2(async () => {
           await createSelfSignedCertificate(certificateFilename, _params);
         });
@@ -1072,13 +1266,15 @@ var init_certificate_manager = __esm({
         if (!params) {
           throw new Error("params is required");
         }
-        const _params = params;
-        if (Object.prototype.hasOwnProperty.call(_params, "rootDir")) {
+        if (Object.prototype.hasOwnProperty.call(params, "rootDir")) {
           throw new Error("rootDir should not be specified ");
         }
-        _params.rootDir = path2.resolve(this.rootDir);
-        _params.configFile = path2.resolve(this.configFile);
-        _params.privateKey = path2.resolve(this.privateKey);
+        const _params = {
+          ...params,
+          rootDir: path2.resolve(this.rootDir),
+          configFile: path2.resolve(this.configFile),
+          privateKey: await this.getPrivateKey()
+        };
         return await this.withLock2(async () => {
           const now = /* @__PURE__ */ new Date();
           const today2 = `${now.toISOString().slice(0, 10)}_${now.getTime()}`;
@@ -1343,17 +1539,12 @@ var init_certificate_manager = __esm({
             return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
           }
           if (!opts.acceptExpiredCertificate) {
-            let certDetails;
-            try {
-              certDetails = exploreCertificateInfo(currentCert);
-            } catch (_err) {
-              return "BadCertificateInvalid" /* BadCertificateInvalid */;
-            }
+            const { validity } = currentInfo.tbsCertificate;
             const now = /* @__PURE__ */ new Date();
-            if (certDetails.notBefore.getTime() > now.getTime()) {
+            if (validity.notBefore.getTime() > now.getTime()) {
               return "BadCertificateTimeInvalid" /* BadCertificateTimeInvalid */;
             }
-            if (certDetails.notAfter.getTime() <= now.getTime()) {
+            if (validity.notAfter.getTime() <= now.getTime()) {
               return depth === 1 ? "BadCertificateTimeInvalid" /* BadCertificateTimeInvalid */ : "BadCertificateIssuerTimeInvalid" /* BadCertificateIssuerTimeInvalid */;
             }
           }
@@ -1703,6 +1894,7 @@ var init_certificate_manager = __esm({
         const chokidarOptions = {
           usePolling,
           ...usePolling ? { interval: pollingInterval } : {},
+          depth: 0,
           persistent: false
         };
         const allCapturedHandles = [];
@@ -1940,6 +2132,19 @@ var init_toolbox = __esm({
 });
 
 // packages/node-opcua-pki/lib/toolbox/with_openssl/_env.ts
+function buildChildEnv(extra) {
+  const env = {};
+  for (const key of Object.keys(process.env)) {
+    if (SAFE_ENV_PASSTHROUGH.has(key.toLowerCase())) {
+      env[key] = process.env[key];
+    }
+  }
+  return { ...env, ...extra };
+}
+function redactEnvForLog(options) {
+  const { env, ...rest } = options;
+  return env ? { ...rest, env: Object.keys(env) } : rest;
+}
 function setEnv(varName, value) {
   if (!g_config.silent) {
     warningLog(`          set ${varName}=${value}`);
@@ -1966,29 +2171,56 @@ function getEnvironmentVarNames() {
     return { key: varName, pattern: `\\$ENV\\:\\:${varName}` };
   });
 }
+function buildSubjectAltNameString(params) {
+  return [
+    `URI:${params.applicationUri}`,
+    ...(params.dns ?? []).map((d) => `DNS:${d}`),
+    ...(params.ip ?? []).map((d) => `IP:${d}`)
+  ].join(", ");
+}
 function processAltNames(params) {
   params.dns = params.dns || [];
   params.ip = params.ip || [];
-  let subjectAltName = [];
-  subjectAltName.push(`URI:${params.applicationUri}`);
-  subjectAltName = [].concat(
-    subjectAltName,
-    params.dns.map((d) => `DNS:${d}`)
-  );
-  subjectAltName = [].concat(
-    subjectAltName,
-    params.ip.map((d) => `IP:${d}`)
-  );
-  const subjectAltNameString = subjectAltName.join(", ");
-  setEnv("ALTNAME", subjectAltNameString);
+  setEnv("ALTNAME", buildSubjectAltNameString(params));
 }
-var exportedEnvVars;
+var SAFE_ENV_PASSTHROUGH, exportedEnvVars;
 var init_env = __esm({
   "packages/node-opcua-pki/lib/toolbox/with_openssl/_env.ts"() {
     "use strict";
     init_esm_shims();
     init_config();
     init_debug();
+    SAFE_ENV_PASSTHROUGH = /* @__PURE__ */ new Set([
+      // POSIX/Windows shell and process essentials
+      "path",
+      "home",
+      "userprofile",
+      "temp",
+      "tmp",
+      "tmpdir",
+      "systemroot",
+      "windir",
+      "comspec",
+      "pathext",
+      "appdata",
+      "localappdata",
+      // dynamic loader: a custom-built or relocated openssl (e.g. under /opt,
+      // or Homebrew on macOS) may need these to find its own libcrypto/libssl
+      "ld_library_path",
+      "dyld_library_path",
+      "dyld_fallback_library_path",
+      // locale, so openssl's textual output stays parseable
+      "lang",
+      "lc_all",
+      "lc_ctype",
+      // openssl configuration this app, or the host OS/user, may rely on
+      "openssl_conf",
+      "randfile",
+      "openssl_modules",
+      "openssl_engines",
+      "ssl_cert_file",
+      "ssl_cert_dir"
+    ]);
     exportedEnvVars = {};
   }
 });
@@ -2011,24 +2243,17 @@ import { pipeline } from "stream/promises";
 import byline from "byline";
 import chalk4 from "chalk";
 import yauzl from "yauzl";
-async function execute(cmd, cwd) {
+async function execute(file, args, cwd) {
   let output = "";
-  const options = {
-    cwd,
-    windowsHide: true
-  };
   return await new Promise((resolve, reject) => {
-    const child = child_process.exec(
-      cmd,
-      options,
-      (err) => {
-        const exitCode = err === null ? 0 : typeof err.code === "number" ? err.code : 1;
-        if (err) reject(err);
-        else {
-          resolve({ exitCode, output });
-        }
-      }
-    );
+    const child = child_process.spawn(file, args, {
+      cwd,
+      windowsHide: true,
+      env: buildChildEnv(),
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    child.on("error", (err) => reject(err));
+    child.on("close", (code) => resolve({ exitCode: code ?? 1, output }));
     const stream1 = byline(child.stdout);
     stream1.on("data", (line) => {
       output += `${line}
@@ -2040,16 +2265,13 @@ async function execute(cmd, cwd) {
     });
   });
 }
-function quote2(str) {
-  return `"${str.replace(/\\/g, "/")}"`;
-}
 function is_expected_openssl_version(strVersion) {
   return !!strVersion.match(/OpenSSL \d/);
 }
 async function getopensslExecPath() {
   let result1;
   try {
-    result1 = await execute("which openssl");
+    result1 = await execute("which", ["openssl"]);
   } catch (err) {
     warningLog("warning: ", err.message);
     throw new Error("Cannot find openssl");
@@ -2066,11 +2288,10 @@ async function getopensslExecPath() {
 }
 async function check_system_openssl_version() {
   const opensslExecPath = await getopensslExecPath();
-  const q_opensslExecPath = quote2(opensslExecPath);
   if (doDebug2) {
     warningLog(`              OpenSSL found in : ${chalk4.yellow(opensslExecPath)}`);
   }
-  const result = await execute(`${q_opensslExecPath} version`);
+  const result = await execute(opensslExecPath, ["version"]);
   const exitCode = result?.exitCode;
   const output = result?.output;
   const version = output.trim();
@@ -2110,9 +2331,8 @@ async function install_and_check_win32_openssl_version() {
         version: `cannot find file ${opensslExecPath2}`
       };
     } else {
-      const q_openssl_exe_path = quote2(opensslExecPath2);
       const cwd = ".";
-      const { exitCode, output } = await execute(`${q_openssl_exe_path} version`, cwd);
+      const { exitCode, output } = await execute(opensslExecPath2, ["version"], cwd);
       const version = output.trim();
       if (doDebug2) {
         warningLog(" Version = ", version);
@@ -2125,7 +2345,7 @@ async function install_and_check_win32_openssl_version() {
   }
   async function find_system_openssl_win32() {
     try {
-      const result = await execute("where openssl");
+      const result = await execute("where", ["openssl"]);
       if (result.exitCode !== 0) {
         return void 0;
       }
@@ -2133,8 +2353,7 @@ async function install_and_check_win32_openssl_version() {
       if (!opensslPath2 || !fs5.existsSync(opensslPath2)) {
         return void 0;
       }
-      const q5 = quote2(opensslPath2);
-      const versionResult = await execute(`${q5} version`);
+      const versionResult = await execute(opensslPath2, ["version"]);
       const version = versionResult.output.trim();
       if (versionResult.exitCode === 0 && is_expected_openssl_version(version)) {
         warningLog(
@@ -2299,6 +2518,7 @@ var init_install_prerequisite = __esm({
     "use strict";
     init_esm_shims();
     init_debug();
+    init_env();
     doDebug2 = process.env.NODEOPCUAPKIDEBUG || false;
   }
 });
@@ -2310,36 +2530,50 @@ import fs6 from "fs";
 import os3 from "os";
 import byline2 from "byline";
 import chalk5 from "chalk";
-async function execute2(cmd, options) {
+function passinArg(passphrase = "") {
+  return { args: ["-passin", `env:${PASSIN_ENV_VAR}`], env: { [PASSIN_ENV_VAR]: passphrase } };
+}
+function renderForDisplay(file, args) {
+  return [file, ...args].map((a) => a === "" || /[\s"'`$\\]/.test(a) ? JSON.stringify(a) : a).join(" ");
+}
+async function execute2(file, args, options) {
   const from = new Error();
   options.cwd = options.cwd || process.cwd();
   if (!g_config.silent) {
     warningLog(chalk5.cyan("                  CWD         "), options.cwd);
   }
   const outputs = [];
+  const errorOutputs = [];
+  const display2 = renderForDisplay(file, args);
   return await new Promise((resolve, reject) => {
-    const child = child_process2.exec(
-      cmd,
-      {
-        cwd: options.cwd,
-        windowsHide: true
-      },
-      (err) => {
-        if (err) {
-          if (!options.hideErrorMessage) {
-            const fence = "###########################################";
-            console.error(chalk5.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
-            console.error(chalk5.bgWhiteBright.redBright(`CWD = ${options.cwd}`));
-            console.error(chalk5.bgWhiteBright.redBright(err.message));
-            console.error(chalk5.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
-            console.error(from.stack);
-          }
-          reject(new Error(err.message));
-          return;
-        }
+    const child = child_process2.spawn(file, [...args], {
+      cwd: options.cwd,
+      windowsHide: true,
+      env: buildChildEnv(options.env),
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const fail = (message) => {
+      if (!options.hideErrorMessage && !g_config.silent) {
+        const fence = "###########################################";
+        console.error(chalk5.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
+        console.error(chalk5.bgWhiteBright.redBright(`CWD = ${options.cwd}`));
+        console.error(chalk5.bgWhiteBright.redBright(message));
+        console.error(chalk5.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
+        console.error(from.stack);
+      }
+      reject(new Error(message));
+    };
+    child.on("error", (err) => fail(`Command failed: ${display2}
+${err.message}`));
+    child.on("close", (code, signal) => {
+      if (code === 0) {
         resolve(outputs.join(""));
+        return;
       }
-    );
+      const why = signal ? `signal ${signal}` : `exit code ${code}`;
+      fail(`Command failed: ${display2}
+${errorOutputs.join("")}(${why})`);
+    });
     if (child.stdout) {
       const stream2 = byline2(child.stdout);
       stream2.on("data", (line) => {
@@ -2356,17 +2590,17 @@ async function execute2(cmd, options) {
         });
       }
     }
-    if (!g_config.silent) {
-      if (child.stderr) {
-        const stream1 = byline2(child.stderr);
-        stream1.on("data", (line) => {
-          line = line.toString();
-          if (displayError) {
-            process.stdout.write(`${chalk5.white("        stderr ") + chalk5.red(line)}
+    if (child.stderr) {
+      const stream1 = byline2(child.stderr);
+      stream1.on("data", (line) => {
+        line = line.toString();
+        errorOutputs.push(`${line}
 `);
-          }
-        });
-      }
+        if (!g_config.silent && displayError) {
+          process.stdout.write(`${chalk5.white("        stderr ") + chalk5.red(line)}
+`);
+        }
+      });
     }
   });
 }
@@ -2376,18 +2610,18 @@ async function find_openssl() {
 async function ensure_openssl_installed() {
   if (!opensslPath) {
     opensslPath = await find_openssl();
-    const outputs = await execute_openssl("version", { cwd: "." });
+    const outputs = await execute_openssl(["version"], { cwd: "." });
     g_config.opensslVersion = outputs.trim();
     if (doDebug) {
       warningLog("OpenSSL version : ", g_config.opensslVersion);
     }
   }
 }
-async function execute_openssl_no_failure(cmd, options) {
+async function execute_openssl_no_failure(args, options) {
   options = options || {};
   options.hideErrorMessage = true;
   try {
-    return await execute_openssl(cmd, options);
+    return await execute_openssl(args, options);
   } catch (err) {
     debugLog(" (ignored error =  ERROR : )", err.message);
   }
@@ -2395,8 +2629,8 @@ async function execute_openssl_no_failure(cmd, options) {
 function getTempFolder() {
   return os3.tmpdir();
 }
-async function execute_openssl(cmd, options) {
-  debugLog("execute_openssl", cmd, options);
+async function execute_openssl(args, options) {
+  debugLog("execute_openssl", args, redactEnvForLog(options));
   const empty_config_file = n(getTempFolder(), "empty_config.cnf");
   if (!fs6.existsSync(empty_config_file)) {
     await fs6.promises.writeFile(empty_config_file, "# empty config file");
@@ -2408,23 +2642,23 @@ async function execute_openssl(cmd, options) {
   if (!g_config.silent) {
     warningLog(chalk5.cyan("                  OPENSSL_CONF"), process.env.OPENSSL_CONF);
     warningLog(chalk5.cyan("                  RANDFILE    "), process.env.RANDFILE);
-    warningLog(chalk5.cyan("                  CMD         openssl "), chalk5.cyanBright(cmd));
+    warningLog(chalk5.cyan("                  CMD         "), chalk5.cyanBright(renderForDisplay("openssl", args)));
   }
   await ensure_openssl_installed();
-  return await execute2(`${quote(opensslPath)} ${cmd}`, options);
+  return await execute2(opensslPath, args, options);
 }
-var opensslPath, n;
+var opensslPath, n, PASSIN_ENV_VAR;
 var init_execute_openssl = __esm({
   "packages/node-opcua-pki/lib/toolbox/with_openssl/execute_openssl.ts"() {
     "use strict";
     init_esm_shims();
-    init_common();
     init_common2();
     init_config();
     init_debug();
     init_env();
     init_install_prerequisite();
     n = makePath;
+    PASSIN_ENV_VAR = "NODE_OPCUA_PKI_OPENSSL_PASSIN";
   }
 });
 
@@ -2440,19 +2674,27 @@ function openssl_require2DigitYearInDate() {
   }
   return g_config.opensslVersion.match(/OpenSSL 0\.9/);
 }
-function stripConditionalBlocks(template) {
+function stripConditionalBlocks(template, envOverrides) {
   return template.replace(/\{\{#([A-Z_][A-Z0-9_]*)\}\}([\s\S]*?)\{\{\/\1\}\}\r?\n?/g, (_match, key, content) => {
-    const keep = hasEnv(key) && getEnv(key) !== "";
+    const keep = envOverrides && Object.prototype.hasOwnProperty.call(envOverrides, key) ? envOverrides[key] !== "" : hasEnv(key) && getEnv(key) !== "";
     return keep ? content : "";
   });
 }
-function generateStaticConfig(configPath, options) {
+function generateStaticConfig(configPath, options, envOverrides) {
   const prePath = options?.cwd || "";
   const originalFilename = !path4.isAbsolute(configPath) ? path4.join(prePath, configPath) : configPath;
   let staticConfig = fs7.readFileSync(originalFilename, { encoding: "utf8" });
-  staticConfig = stripConditionalBlocks(staticConfig);
+  staticConfig = stripConditionalBlocks(staticConfig, envOverrides);
   for (const envVar of getEnvironmentVarNames()) {
-    staticConfig = staticConfig.replace(new RegExp(envVar.pattern, "gi"), getEnv(envVar.key));
+    if (envOverrides && Object.prototype.hasOwnProperty.call(envOverrides, envVar.key)) {
+      continue;
+    }
+    staticConfig = staticConfig.replace(new RegExp(envVar.pattern, "gi"), () => getEnv(envVar.key));
+  }
+  if (envOverrides) {
+    for (const [key, value] of Object.entries(envOverrides)) {
+      staticConfig = staticConfig.replace(new RegExp(`\\$ENV\\:\\:${key}`, "gi"), () => value);
+    }
   }
   const staticConfigPath = `${configPath}.${process.pid}-${_counter++}.tmp`;
   const temporaryConfigPath = !path4.isAbsolute(configPath) ? path4.join(prePath, staticConfigPath) : staticConfigPath;
@@ -2463,9 +2705,15 @@ function generateStaticConfig(configPath, options) {
     return temporaryConfigPath;
   }
 }
-async function getPublicKeyFromPrivateKey(privateKeyFilename, publicKeyFilename) {
+async function cleanupStaticConfig(configFile, options) {
+  await fs7.promises.rm(path4.resolve(options?.cwd ?? "", configFile), { force: true });
+}
+async function getPublicKeyFromPrivateKey(privateKeyFilename, publicKeyFilename, passphrase) {
   assert7(fs7.existsSync(privateKeyFilename));
-  await execute_openssl(`rsa -pubout -in ${q(n2(privateKeyFilename))} -out ${q(n2(publicKeyFilename))}`, {});
+  const passin = passinArg(passphrase);
+  await execute_openssl(["rsa", "-pubout", "-in", n2(privateKeyFilename), "-out", n2(publicKeyFilename), ...passin.args], {
+    env: passin.env
+  });
 }
 function x509Date(date) {
   date = date || /* @__PURE__ */ new Date();
@@ -2486,30 +2734,28 @@ function x509Date(date) {
 }
 async function dumpCertificate(certificate) {
   assert7(fs7.existsSync(certificate));
-  return await execute_openssl(`x509  -in ${q(n2(certificate))} -text  -noout`, {});
+  return await execute_openssl(["x509", "-in", n2(certificate), "-text", "-noout"], {});
 }
 async function toDer(certificatePem) {
   assert7(fs7.existsSync(certificatePem));
   const certificateDer = certificatePem.replace(".pem", ".der");
-  return await execute_openssl(`x509   -outform der  -in ${certificatePem} -out ${certificateDer}`, {});
+  return await execute_openssl(["x509", "-outform", "der", "-in", certificatePem, "-out", certificateDer], {});
 }
 async function fingerprint(certificatePem) {
   assert7(fs7.existsSync(certificatePem));
-  return await execute_openssl(`x509   -fingerprint  -noout  -in ${certificatePem}`, {});
+  return await execute_openssl(["x509", "-fingerprint", "-noout", "-in", certificatePem], {});
 }
-var _counter, q, n2;
+var _counter, n2;
 var init_toolbox2 = __esm({
   "packages/node-opcua-pki/lib/toolbox/with_openssl/toolbox.ts"() {
     "use strict";
     init_esm_shims();
-    init_common();
     init_common2();
     init_config();
     init_env();
     init_execute_openssl();
     g_config.opensslVersion = "";
     _counter = 0;
-    q = quote;
     n2 = makePath;
   }
 });
@@ -2530,29 +2776,42 @@ async function createCertificateSigningRequestWithOpenSSL(certificateSigningRequ
   assert8(typeof certificateSigningRequestFilename === "string");
   processAltNames(params);
   const configFile = generateStaticConfig(params.configFile, { cwd: params.rootDir });
-  const options = { cwd: params.rootDir, openssl_conf: path5.relative(params.rootDir, configFile) };
-  const configOption = ` -config ${q2(n3(configFile))}`;
-  const subject = params.subject ? new Subject3(params.subject).toString() : void 0;
-  const subjectOptions = subject ? ` -subj "${subject}"` : "";
-  displaySubtitle("- Creating a Certificate Signing Request with openssl");
-  await execute_openssl(
-    "req -new  -sha256  -batch  -text " + configOption + " -key " + q2(n3(params.privateKey)) + subjectOptions + " -out " + q2(n3(certificateSigningRequestFilename)),
-    options
-  );
+  try {
+    const options = { cwd: params.rootDir, openssl_conf: path5.relative(params.rootDir, configFile) };
+    const subject = params.subject ? new Subject3(params.subject).toString() : void 0;
+    displaySubtitle("- Creating a Certificate Signing Request with openssl");
+    await execute_openssl(
+      [
+        "req",
+        "-new",
+        "-sha256",
+        "-batch",
+        "-text",
+        "-config",
+        n3(configFile),
+        "-key",
+        n3(params.privateKey),
+        ...subject ? ["-subj", subject] : [],
+        "-out",
+        n3(certificateSigningRequestFilename)
+      ],
+      options
+    );
+  } finally {
+    await cleanupStaticConfig(configFile, { cwd: params.rootDir });
+  }
 }
-var q2, n3;
+var n3;
 var init_create_certificate_signing_request2 = __esm({
   "packages/node-opcua-pki/lib/toolbox/with_openssl/create_certificate_signing_request.ts"() {
     "use strict";
     init_esm_shims();
     init_subject();
-    init_common();
     init_common2();
     init_display();
     init_env();
     init_execute_openssl();
     init_toolbox2();
-    q2 = quote;
     n3 = makePath;
   }
 });
@@ -2571,94 +2830,909 @@ var init_with_openssl = __esm({
   }
 });
 
-// packages/node-opcua-pki/lib/pki/toolbox_pfx.ts
-import assert9 from "assert";
+// packages/node-opcua-pki/lib/ca/core/ca_database.ts
 import fs9 from "fs";
-async function createPFX(options) {
-  const { certificateFile, privateKeyFile, outputFile, passphrase = "", caCertificateFiles } = options;
-  assert9(fs9.existsSync(certificateFile), `Certificate file does not exist: ${certificateFile}`);
-  assert9(fs9.existsSync(privateKeyFile), `Private key file does not exist: ${privateKeyFile}`);
-  let cmd = `pkcs12 -export`;
-  cmd += ` -in ${q3(n4(certificateFile))}`;
-  cmd += ` -inkey ${q3(n4(privateKeyFile))}`;
-  if (caCertificateFiles) {
-    for (const caFile of caCertificateFiles) {
-      assert9(fs9.existsSync(caFile), `CA certificate file does not exist: ${caFile}`);
-      cmd += ` -certfile ${q3(n4(caFile))}`;
-    }
-  }
-  cmd += ` -out ${q3(n4(outputFile))}`;
-  cmd += ` -passout pass:${passphrase}`;
-  await execute_openssl(cmd, {});
+import path6 from "path";
+import { convertPEMtoDER, readCertificatePEM } from "node-opcua-crypto";
+function parseOpenSSLDate(dateStr) {
+  const raw = dateStr?.split(",")[0] ?? "";
+  if (raw.length < 12) return "";
+  const yy = parseInt(raw.substring(0, 2), 10);
+  const year = yy >= 70 ? 1900 + yy : 2e3 + yy;
+  const month = raw.substring(2, 4);
+  const day = raw.substring(4, 6);
+  const hour = raw.substring(6, 8);
+  const min = raw.substring(8, 10);
+  const sec = raw.substring(10, 12);
+  return `${year}-${month}-${day}T${hour}:${min}:${sec}Z`;
 }
-var q3, n4;
-var init_toolbox_pfx = __esm({
-  "packages/node-opcua-pki/lib/pki/toolbox_pfx.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_common();
-    init_common2();
-    init_execute_openssl();
-    q3 = quote;
-    n4 = makePath;
+function formatOpenSSLDate(date) {
+  const yy = String(date.getUTCFullYear() % 100).padStart(2, "0");
+  const mm = String(date.getUTCMonth() + 1).padStart(2, "0");
+  const dd = String(date.getUTCDate()).padStart(2, "0");
+  const hh = String(date.getUTCHours()).padStart(2, "0");
+  const mi = String(date.getUTCMinutes()).padStart(2, "0");
+  const ss = String(date.getUTCSeconds()).padStart(2, "0");
+  return `${yy}${mm}${dd}${hh}${mi}${ss}Z`;
+}
+function parseRevocationReason(dateStr) {
+  const parts = dateStr?.split(",");
+  return parts && parts.length > 1 ? parts[1] : void 0;
+}
+function evenLengthHex(value) {
+  const hex = value.toString(16).toUpperCase();
+  return hex.length % 2 === 0 ? hex : `0${hex}`;
+}
+function escapeIndexField(value) {
+  return value.replace(/[\x00-\x1f\x7f\\]/g, (c) => `\\x${c.charCodeAt(0).toString(16).toUpperCase().padStart(2, "0")}`);
+}
+function assertHexSerial(serial) {
+  if (!/^[0-9A-Fa-f]+$/.test(serial)) {
+    throw new Error(`Invalid certificate serial number: ${JSON.stringify(serial)}`);
   }
-});
-
-// packages/node-opcua-pki/lib/ca/templates/ca_config_template.cnf.ts
-var config2, ca_config_template_cnf_default;
-var init_ca_config_template_cnf = __esm({
-  "packages/node-opcua-pki/lib/ca/templates/ca_config_template.cnf.ts"() {
+  return serial.toUpperCase();
+}
+var CaDatabase;
+var init_ca_database = __esm({
+  "packages/node-opcua-pki/lib/ca/core/ca_database.ts"() {
     "use strict";
     init_esm_shims();
-    config2 = `#.........DO NOT MODIFY BY HAND .........................
-[ ca ]
-default_ca               = CA_default
-[ CA_default ]
-dir                      = %%ROOT_FOLDER%%            # the main CA folder
-certs                    = $dir/certs                 # where to store certificates
-new_certs_dir            = $dir/certs                 #
-database                 = $dir/index.txt             # the certificate database
-serial                   = $dir/serial                # the serial number counter
-certificate              = $dir/public/cacert.pem     # The root CA certificate
-private_key              = $dir/private/cakey.pem     # the CA private key
-x509_extensions          = usr_cert                   #
-default_days             = 3650                       # default validity : 10 years
-
-# default_md               = sha1
-
-default_md                = sha256                      # The default digest algorithm
-
-preserve                 = no
-policy                   = policy_match
-# randfile                 = $dir/random.rnd
-# default_startdate        = YYMMDDHHMMSSZ
-# default_enddate          = YYMMDDHHMMSSZ
-crl_dir                  = $dir/crl
-crl_extensions           = crl_ext
-crl                      = $dir/revocation_list.crl # the Revocation list
-crlnumber                = $dir/crlnumber           # CRL number file
-default_crl_days         = 30
-default_crl_hours        = 24
-#msie_hack
-
-[ policy_match ]
-countryName              = optional
-stateOrProvinceName      = optional
-localityName             = optional
-organizationName         = optional
-organizationalUnitName   = optional
-commonName               = optional
-emailAddress             = optional
-
-[ req ]
-default_bits             = 4096                     # Size of keys
-default_keyfile          = key.pem                  # name of generated keys
-distinguished_name       = req_distinguished_name
-attributes               = req_attributes
-x509_extensions          = v3_ca
-#input_password
-#output_password
-string_mask              = nombstr                  # permitted characters
+    CaDatabase = class {
+      #rootDir;
+      constructor(rootDir) {
+        this.#rootDir = rootDir;
+      }
+      /** Path to the OpenSSL certificate database file (`index.txt`). */
+      get indexFile() {
+        return path6.join(this.#rootDir, "index.txt");
+      }
+      /**
+       * Parse the OpenSSL `index.txt` certificate database.
+       *
+       * Each line has tab-separated fields:
+       * ```
+       * status  expiry  [revocationDate]  serial  unknown  subject
+       * ```
+       *
+       * - status: `V` (valid), `R` (revoked), `E` (expired)
+       * - expiry: `YYMMDDHHmmssZ`
+       * - revocationDate: present only for revoked certs
+       * - serial: hex string
+       * - unknown: always `"unknown"`
+       * - subject: X.500 slash-delimited string
+       */
+      readIndex() {
+        const indexPath = this.indexFile;
+        if (!fs9.existsSync(indexPath)) {
+          return [];
+        }
+        const content = fs9.readFileSync(indexPath, "utf-8");
+        const lines = content.split("\n").filter((l) => l.trim().length > 0);
+        const records = [];
+        for (const line of lines) {
+          const fields = line.split("	");
+          if (fields.length < 4) continue;
+          const statusChar = fields[0];
+          const expiryStr = fields[1];
+          let serial;
+          let subject;
+          let revocationDate;
+          if (statusChar === "R") {
+            revocationDate = fields[2];
+            serial = fields[3];
+            subject = fields.length >= 6 ? fields[5] : "";
+          } else {
+            serial = fields[3];
+            subject = fields.length >= 6 ? fields[5] : "";
+          }
+          let status;
+          switch (statusChar) {
+            case "V":
+              status = "valid";
+              break;
+            case "R":
+              status = "revoked";
+              break;
+            case "E":
+              status = "expired";
+              break;
+            default:
+              continue;
+          }
+          records.push({
+            serial,
+            status,
+            subject,
+            expiryDate: parseOpenSSLDate(expiryStr),
+            revocationDate: revocationDate ? parseOpenSSLDate(revocationDate) : void 0,
+            reason: revocationDate ? parseRevocationReason(revocationDate) : void 0
+          });
+        }
+        return records;
+      }
+      /** Look up one record by serial number (case-insensitive). */
+      findBySerial(serial) {
+        const upper = serial.toUpperCase();
+        return this.readIndex().find((r) => r.serial.toUpperCase() === upper);
+      }
+      /**
+       * Read a specific issued certificate by serial number.
+       *
+       * OpenSSL stores signed certificates in the `certs/` directory using
+       * the naming convention `<SERIAL>.pem`.
+       *
+       * @param serial - hex-encoded serial number (e.g. `"1000"`)
+       * @returns the DER buffer, or `undefined` if not found
+       */
+      getCertificateBySerial(serial) {
+        const upper = serial.toUpperCase();
+        const certFile = path6.join(this.#rootDir, "certs", `${upper}.pem`);
+        if (!fs9.existsSync(certFile)) {
+          return void 0;
+        }
+        const pem = readCertificatePEM(certFile);
+        return convertPEMtoDER(pem);
+      }
+      /**
+       * Read-increment-write a hex counter file (`serial`/`crlnumber`),
+       * returning the value to hand out — matching `openssl ca`'s own
+       * behavior: the file holds the *next* value to assign, and is bumped
+       * to the following one immediately after being read. A `.old` backup
+       * of the pre-bump content is kept, as `openssl` itself does.
+       */
+      #nextHexCounter(fileName) {
+        const counterFile = path6.join(this.#rootDir, fileName);
+        const current = BigInt(`0x${fs9.readFileSync(counterFile, "utf-8").trim()}`);
+        fs9.copyFileSync(counterFile, `${counterFile}.old`);
+        fs9.writeFileSync(counterFile, evenLengthHex(current + 1n));
+        return evenLengthHex(current);
+      }
+      /** Hand out the next certificate serial number, bumping the `serial` file. */
+      nextSerial() {
+        return this.#nextHexCounter("serial");
+      }
+      /** Hand out the next CRL number, bumping the `crlnumber` file. */
+      nextCrlNumber() {
+        return this.#nextHexCounter("crlnumber");
+      }
+      /** Append a newly-issued certificate's `V` (valid) row to `index.txt`. */
+      appendIssued(record) {
+        const serial = assertHexSerial(record.serial);
+        const subject = escapeIndexField(record.subject);
+        const line = `V	${formatOpenSSLDate(record.expiryDate)}		${serial}	unknown	${subject}
+`;
+        fs9.appendFileSync(this.indexFile, line);
+      }
+      /**
+       * Rewrite a certificate's `index.txt` row from `V` to `R` (revoked).
+       * Throws if the serial is not found, or is already revoked — the same
+       * "already revoked" case `openssl ca -revoke` itself rejects.
+       */
+      markRevoked(serial, revocationDate, reason) {
+        const upper = assertHexSerial(serial);
+        if (!/^[A-Za-z]+$/.test(reason)) {
+          throw new Error(`Invalid CRL reason: ${JSON.stringify(reason)}`);
+        }
+        const lines = fs9.readFileSync(this.indexFile, "utf-8").split("\n").filter((l) => l.trim().length > 0);
+        let found = false;
+        const rewritten = lines.map((line) => {
+          const fields = line.split("	");
+          if (fields.length < 4 || fields[3]?.toUpperCase() !== upper) {
+            return line;
+          }
+          if (fields[0] === "R") {
+            throw new Error(`Certificate ${upper} is already revoked`);
+          }
+          found = true;
+          const subject = fields.length >= 6 ? fields[5] : "";
+          return `R	${fields[1]}	${formatOpenSSLDate(revocationDate)},${reason}	${upper}	unknown	${subject}`;
+        });
+        if (!found) {
+          throw new Error(`Certificate ${upper} not found in the certificate database`);
+        }
+        fs9.writeFileSync(this.indexFile, `${rewritten.join("\n")}
+`);
+      }
+      /** Store a signed certificate's PEM under `certs/<SERIAL>.pem`, as `openssl ca` does. */
+      storeCertificate(serial, pem) {
+        const certFile = path6.join(this.#rootDir, "certs", `${assertHexSerial(serial)}.pem`);
+        fs9.writeFileSync(certFile, pem);
+      }
+    };
+  }
+});
+
+// packages/node-opcua-pki/lib/ca/backends/native_ca_backend.ts
+import fs10 from "fs";
+import path7 from "path";
+import {
+  CertificatePurpose as CertificatePurpose2,
+  createCertificateFromCsr,
+  createCertificateSigningRequest as createCertificateSigningRequest2,
+  createCrl,
+  isCaSigner,
+  privateKeyToCryptoKey,
+  readPrivateKey as readPrivateKey2,
+  Subject as Subject4,
+  x509
+} from "node-opcua-crypto";
+function signingAlgorithmOf(key) {
+  return isCaSigner(key) ? key.algorithm : RSA_SHA256;
+}
+function daysFromNow(notBefore, days) {
+  return new Date(notBefore.getTime() + days * 24 * 60 * 60 * 1e3);
+}
+function caSanUri(ca) {
+  return `urn:${ca.subject.commonName || "NodeOPCUA-CA"}`;
+}
+function sanFromCsr(csrPem) {
+  const request = new x509.Pkcs10CertificateRequest(csrPem);
+  const extension = request.getExtension("2.5.29.17");
+  const dns2 = [];
+  const ip = [];
+  let applicationUri;
+  for (const name of extension?.names.toJSON() ?? []) {
+    if (name.type === "dns") {
+      dns2.push(name.value);
+    } else if (name.type === "ip") {
+      ip.push(name.value);
+    } else if (name.type === "url" && applicationUri === void 0) {
+      applicationUri = name.value;
+    }
+  }
+  return { dns: dns2, ip, applicationUri };
+}
+function toOpenSslSubjectString(subjectName) {
+  const parts = [];
+  for (const rdn of subjectName.toJSON()) {
+    for (const [type, values] of Object.entries(rdn)) {
+      for (const value of values) {
+        parts.push(`${type}=${value}`);
+      }
+    }
+  }
+  return `/${parts.join("/")}`;
+}
+var CA_CERT_VALIDITY_DAYS, RSA_SHA256, REASON_TO_X509_CRL_REASON, NativeCaBackend;
+var init_native_ca_backend = __esm({
+  "packages/node-opcua-pki/lib/ca/backends/native_ca_backend.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_toolbox();
+    init_ca_database();
+    CA_CERT_VALIDITY_DAYS = 3650;
+    RSA_SHA256 = { name: "RSASSA-PKCS1-v1_5", hash: { name: "SHA-256" } };
+    REASON_TO_X509_CRL_REASON = {
+      unspecified: x509.X509CrlReason.unspecified,
+      keyCompromise: x509.X509CrlReason.keyCompromise,
+      CACompromise: x509.X509CrlReason.cACompromise,
+      affiliationChanged: x509.X509CrlReason.affiliationChanged,
+      superseded: x509.X509CrlReason.superseded,
+      cessationOfOperation: x509.X509CrlReason.cessationOfOperation,
+      certificateHold: x509.X509CrlReason.certificateHold,
+      removeFromCRL: x509.X509CrlReason.removeFromCRL
+    };
+    NativeCaBackend = class {
+      /** Nothing to check: this backend spawns no process and needs no tool on PATH. */
+      /** Signing goes through `ca._getSigningKey()`, which may be an external signer. */
+      supportsExternalSigner = true;
+      async preflight() {
+      }
+      /**
+       * Write a CSR for the CA's own key, the `[v3_ca_req]` equivalent. The
+       * key comes from the CA rather than from `privateKeyFile`: on a
+       * signer-backed CA that file does not exist.
+       */
+      async generateCaCsr(ca, _caRootDir, _privateKeyFile, csrFile) {
+        displayTitle("Generate a certificate request for the CA key");
+        const signingKey = await ca._getSigningKey();
+        const { csr } = await createCertificateSigningRequest2({
+          privateKey: signingKey,
+          subject: ca.subject.toString(),
+          applicationUri: caSanUri(ca),
+          purpose: CertificatePurpose2.ForCertificateAuthority
+        });
+        await fs10.promises.writeFile(csrFile, csr);
+      }
+      async bootstrap(ca) {
+        const caRootDir = path7.resolve(ca.rootDir);
+        const csrFile = path7.join(caRootDir, "private/cakey.csr");
+        await this.generateCaCsr(ca, caRootDir, path7.join(caRootDir, "private/cakey.pem"), csrFile);
+        const issuerCA = ca._issuerCA;
+        if (issuerCA) {
+          displayTitle("Generate CA Certificate (signed by issuer CA)");
+          const signWithIssuer = () => this.signSubordinateCsr(issuerCA, csrFile, ca.caCertificate, CA_CERT_VALIDITY_DAYS);
+          if (path7.resolve(issuerCA.rootDir) === caRootDir) {
+            await signWithIssuer();
+          } else {
+            await issuerCA._withCaDirectoryLock(signWithIssuer);
+          }
+        } else {
+          displayTitle("Generate CA Certificate (self-signed)");
+          const csrPem = await fs10.promises.readFile(csrFile, "utf-8");
+          const signingKey = await ca._getSigningKey();
+          const request = new x509.Pkcs10CertificateRequest(csrPem);
+          const notBefore = /* @__PURE__ */ new Date();
+          const { cert } = await createCertificateFromCsr({
+            csr: csrPem,
+            // the CSR's own parsed subject, so issuer and subject are
+            // byte-identical on a self-signed root: re-encoding a string
+            // form could differ and break chain building
+            issuerName: request.subjectName,
+            issuerPublicKey: request.publicKey,
+            signingKey,
+            signingAlgorithm: signingAlgorithmOf(signingKey),
+            notBefore,
+            notAfter: daysFromNow(notBefore, CA_CERT_VALIDITY_DAYS),
+            purpose: CertificatePurpose2.ForCertificateAuthority,
+            applicationUri: caSanUri(ca),
+            revocation: {
+              crlDistributionUrl: ca.crlDistributionUrl,
+              ocspResponderUrl: ca.ocspResponderUrl,
+              caIssuersUrl: ca.caIssuersUrl
+            }
+          });
+          await fs10.promises.writeFile(ca.caCertificate, cert);
+        }
+        displaySubtitle("generate initial CRL (Certificate Revocation List)");
+        await this.#regenerateCrlLocked(ca, new CaDatabase(ca.rootDir));
+        displayTitle("Create Certificate Authority (CA) ---> DONE");
+      }
+      /** Sign a subordinate CA's request with this CA's key, the `[v3_ca]` equivalent. */
+      async signSubordinateCsr(ca, csrFile, certFile, validityDays) {
+        const { signingKey, signingAlgorithm, issuerPublicKey, issuerName } = await this.#issuerContext(ca);
+        const csrPem = await fs10.promises.readFile(csrFile, "utf-8");
+        const db = new CaDatabase(ca.rootDir);
+        const serialNumber = db.nextSerial();
+        const notBefore = /* @__PURE__ */ new Date();
+        const notAfter = daysFromNow(notBefore, validityDays);
+        const { cert } = await createCertificateFromCsr({
+          csr: csrPem,
+          issuerName,
+          issuerPublicKey,
+          signingKey,
+          signingAlgorithm,
+          serialNumber,
+          notBefore,
+          notAfter,
+          purpose: CertificatePurpose2.ForCertificateAuthority,
+          // the subordinate's own SAN, not the issuer's
+          ...sanFromCsr(csrPem),
+          revocation: {
+            crlDistributionUrl: ca.crlDistributionUrl,
+            ocspResponderUrl: ca.ocspResponderUrl,
+            caIssuersUrl: ca.caIssuersUrl
+          }
+        });
+        await fs10.promises.writeFile(certFile, cert);
+        this.#record(db, serialNumber, cert, notAfter);
+      }
+      /**
+       * Self-sign a certificate with a caller-supplied key file and record it
+       * in this CA's database: the native equivalent of `openssl req -new`
+       * followed by `openssl ca -selfsign`, which likewise applies the
+       * end-entity profile and updates `index.txt`.
+       */
+      async createSelfSignedCertificate(ca, certificateFile, privateKeyFile, params) {
+        displaySubtitle("- the certificate signing request");
+        const key = await privateKeyToCryptoKey(readPrivateKey2(privateKeyFile, await ca._privateKeyPassphrase()));
+        const { csr } = await createCertificateSigningRequest2({
+          privateKey: key,
+          subject: params.subject ? new Subject4(params.subject).toString() : ca.subject.toString(),
+          dns: params.dns,
+          ip: params.ip,
+          applicationUri: params.applicationUri,
+          purpose: CertificatePurpose2.ForApplication
+        });
+        displaySubtitle("- creating the self-signed certificate");
+        const request = new x509.Pkcs10CertificateRequest(csr);
+        const db = new CaDatabase(ca.rootDir);
+        const serialNumber = db.nextSerial();
+        const notBefore = params.startDate ?? /* @__PURE__ */ new Date();
+        const notAfter = params.endDate ?? daysFromNow(notBefore, params.validity ?? 365);
+        const { cert } = await createCertificateFromCsr({
+          csr,
+          issuerName: request.subjectName,
+          issuerPublicKey: request.publicKey,
+          signingKey: key,
+          signingAlgorithm: RSA_SHA256,
+          serialNumber,
+          notBefore,
+          notAfter,
+          purpose: CertificatePurpose2.ForApplication,
+          ...sanFromCsr(csr)
+        });
+        await fs10.promises.writeFile(certificateFile, cert);
+        this.#record(db, serialNumber, cert, notAfter);
+      }
+      /** `certs/<SERIAL>.pem` plus the `V` row, exactly as `openssl ca` writes them. */
+      #record(db, serialNumber, certPem, notAfter) {
+        db.storeCertificate(serialNumber, certPem);
+        db.appendIssued({
+          serial: serialNumber,
+          expiryDate: notAfter,
+          subject: toOpenSslSubjectString(new x509.X509Certificate(certPem).subjectName)
+        });
+      }
+      /**
+       * The CA's signing key and issuer identity, resolved fresh on every
+       * call and never cached across operations. The identity is read back
+       * from the CA certificate on disk so that the issuer field of anything
+       * this CA signs is byte-identical to that certificate's subject.
+       */
+      async #issuerContext(ca) {
+        const signingKey = await ca._getSigningKey();
+        const caCertPem = await fs10.promises.readFile(ca.caCertificate, "utf-8");
+        const caCert = new x509.X509Certificate(caCertPem);
+        return {
+          signingKey,
+          signingAlgorithm: signingAlgorithmOf(signingKey),
+          issuerPublicKey: caCert.publicKey,
+          issuerName: caCert.subjectName
+        };
+      }
+      async signEndEntityCsr(ca, certificate, csr, params, sanOverride) {
+        const { signingKey, signingAlgorithm, issuerPublicKey, issuerName } = await this.#issuerContext(ca);
+        const db = new CaDatabase(ca.rootDir);
+        const serialNumber = db.nextSerial();
+        const csrPem = await fs10.promises.readFile(csr, "utf-8");
+        const notBefore = params.startDate ?? /* @__PURE__ */ new Date();
+        const notAfter = params.endDate ?? new Date(notBefore.getTime() + (params.validity ?? 365) * 24 * 60 * 60 * 1e3);
+        const { cert } = await createCertificateFromCsr({
+          csr: csrPem,
+          issuerName,
+          issuerPublicKey,
+          signingKey,
+          signingAlgorithm,
+          serialNumber,
+          notBefore,
+          notAfter,
+          purpose: CertificatePurpose2.ForApplication,
+          dns: sanOverride.dns,
+          ip: sanOverride.ip,
+          applicationUri: sanOverride.applicationUri,
+          revocation: {
+            crlDistributionUrl: ca.crlDistributionUrl,
+            ocspResponderUrl: ca.ocspResponderUrl,
+            caIssuersUrl: ca.caIssuersUrl
+          }
+        });
+        await fs10.promises.writeFile(certificate, cert);
+        this.#record(db, serialNumber, cert, notAfter);
+      }
+      async #regenerateCrlLocked(ca, db) {
+        const { signingKey, signingAlgorithm, issuerPublicKey, issuerName } = await this.#issuerContext(ca);
+        const crlNumber = db.nextCrlNumber();
+        const entries = db.readIndex().filter((r) => r.status === "revoked").map((r) => ({
+          serialNumber: r.serial,
+          revocationDate: r.revocationDate ? new Date(r.revocationDate) : /* @__PURE__ */ new Date(),
+          reason: r.reason ? REASON_TO_X509_CRL_REASON[r.reason] : void 0
+        }));
+        const { crl } = await createCrl({
+          issuerName,
+          issuerPublicKey,
+          signingKey,
+          signingAlgorithm,
+          crlNumber: BigInt(`0x${crlNumber}`),
+          entries
+        });
+        await fs10.promises.writeFile(ca.revocationList, crl);
+        const der = new x509.X509Crl(crl).rawData;
+        await fs10.promises.writeFile(ca.revocationListDER, Buffer.from(der));
+      }
+      async regenerateCrl(ca) {
+        const db = new CaDatabase(ca.rootDir);
+        await this.#regenerateCrlLocked(ca, db);
+      }
+      async revoke(ca, certificate, reason) {
+        const certPem = await fs10.promises.readFile(certificate, "utf-8");
+        const cert = new x509.X509Certificate(certPem);
+        const db = new CaDatabase(ca.rootDir);
+        db.markRevoked(cert.serialNumber, /* @__PURE__ */ new Date(), reason);
+        await this.#regenerateCrlLocked(ca, db);
+      }
+    };
+  }
+});
+
+// packages/node-opcua-pki/lib/ca/backends/openssl_ca_backend.ts
+import fs11 from "fs";
+import path8 from "path";
+import { Subject as Subject5 } from "node-opcua-crypto";
+function caAltName(ca) {
+  return `URI:urn:${ca.subject.commonName || "NodeOPCUA-CA"}`;
+}
+function caConfigEnvOverrides(ca, altName = caAltName(ca)) {
+  const aiaLegs = [];
+  if (ca.ocspResponderUrl) {
+    aiaLegs.push(`OCSP;URI:${ca.ocspResponderUrl}`);
+  }
+  if (ca.caIssuersUrl) {
+    aiaLegs.push(`caIssuers;URI:${ca.caIssuersUrl}`);
+  }
+  return {
+    ALTNAME: altName,
+    CDP_URL: ca.crlDistributionUrl ?? "",
+    AIA_VALUE: aiaLegs.join(",")
+  };
+}
+var n4, OpenSslCaBackend;
+var init_openssl_ca_backend = __esm({
+  "packages/node-opcua-pki/lib/ca/backends/openssl_ca_backend.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_toolbox();
+    init_with_openssl();
+    n4 = makePath;
+    OpenSslCaBackend = class {
+      /** This backend is the `openssl` executable, so it has to be there. */
+      /**
+       * `-passin env:` argv and env for an openssl call that has to load this
+       * CA's key. Built here rather than on the CA: the passphrase is the
+       * CA's business, but expressing it as an openssl argument is this
+       * backend's, and the core has no reason to know the flag exists.
+       */
+      async #passin(ca) {
+        return passinArg(await ca._privateKeyPassphrase());
+      }
+      /** The openssl CLI loads its key from a file, so it cannot call out to an HSM. */
+      supportsExternalSigner = false;
+      async preflight() {
+        await ensure_openssl_installed();
+      }
+      /**
+       * Render `conf/caconfig.cnf` once with explicit overrides, run `fn`
+       * with the rendered path, and always remove the temp file. Structural
+       * guarantee that (a) every render carries the three required env
+       * values and (b) no rendered `<name>.<pid>-<n>.tmp` file is ever left
+       * behind — each was previously a per-method discipline.
+       */
+      async #withConfig(ca, altName, fn) {
+        const caRootDir = path8.resolve(ca.rootDir);
+        const options = { cwd: caRootDir };
+        const configFile = generateStaticConfig("conf/caconfig.cnf", options, caConfigEnvOverrides(ca, altName));
+        try {
+          return await fn(configFile, options);
+        } finally {
+          await cleanupStaticConfig(configFile, options);
+        }
+      }
+      async #generateCaCsrWith(ca, configFile, options, privateKeyFile, csrFile) {
+        const passin = await this.#passin(ca);
+        displayTitle("Generate a certificate request for the CA key");
+        await execute_openssl(
+          [
+            "req",
+            "-new",
+            "-sha256",
+            "-extensions",
+            "v3_ca_req",
+            "-config",
+            n4(configFile),
+            "-key",
+            n4(privateKeyFile),
+            "-out",
+            n4(csrFile),
+            "-subj",
+            ca.subject.toString(),
+            ...passin.args
+          ],
+          { ...options, env: passin.env }
+        );
+      }
+      /**
+       * `openssl ca -gencrl` signs the CRL with the CA key it finds through the
+       * config file (`private_key = $dir/private/cakey.pem`), so it needs the
+       * CA passphrase like every other `openssl ca` invocation.
+       */
+      async #regenerateCrlWith(ca, configFile, options) {
+        const passin = await this.#passin(ca);
+        displaySubtitle("regenerate CRL (Certificate Revocation List)");
+        await execute_openssl(["ca", "-gencrl", "-config", n4(configFile), "-out", "crl/revocation_list.crl", ...passin.args], {
+          ...options,
+          env: passin.env
+        });
+        await execute_openssl(
+          ["crl", "-in", "crl/revocation_list.crl", "-out", "crl/revocation_list.der", "-outform", "der"],
+          options
+        );
+        displaySubtitle("Display (Certificate Revocation List)");
+        await execute_openssl(["crl", "-in", n4(ca.revocationList), "-text", "-noout"], options);
+      }
+      async generateCaCsr(ca, _caRootDir, privateKeyFile, csrFile) {
+        await this.#withConfig(
+          ca,
+          caAltName(ca),
+          (configFile, options) => this.#generateCaCsrWith(ca, configFile, options, privateKeyFile, csrFile)
+        );
+      }
+      async bootstrap(ca) {
+        const caRootDir = path8.resolve(ca.rootDir);
+        const privateKeyFilename = path8.join(caRootDir, "private/cakey.pem");
+        const csrFilename = path8.join(caRootDir, "private/cakey.csr");
+        await this.#withConfig(ca, caAltName(ca), async (configFile, options) => {
+          await this.#generateCaCsrWith(ca, configFile, options, privateKeyFilename, csrFilename);
+          const issuerCA = ca._issuerCA;
+          if (issuerCA) {
+            displayTitle("Generate CA Certificate (signed by issuer CA)");
+            const issuerCert = path8.resolve(issuerCA.caCertificate);
+            const issuerKey = path8.resolve(issuerCA.rootDir, "private/cakey.pem");
+            const issuerSerial = path8.resolve(issuerCA.rootDir, "serial");
+            const issuerPassin = await this.#passin(issuerCA);
+            const signWithIssuer = async () => {
+              await execute_openssl(
+                [
+                  "x509",
+                  "-sha256",
+                  "-req",
+                  "-days",
+                  "3650",
+                  "-extensions",
+                  "v3_ca",
+                  "-extfile",
+                  n4(configFile),
+                  "-in",
+                  "private/cakey.csr",
+                  "-CA",
+                  n4(issuerCert),
+                  "-CAkey",
+                  n4(issuerKey),
+                  "-CAserial",
+                  n4(issuerSerial),
+                  "-out",
+                  "public/cacert.pem",
+                  ...issuerPassin.args
+                ],
+                { ...options, env: issuerPassin.env }
+              );
+            };
+            if (path8.resolve(issuerCA.rootDir) === caRootDir) {
+              await signWithIssuer();
+            } else {
+              await issuerCA._withCaDirectoryLock(signWithIssuer);
+            }
+          } else {
+            displayTitle("Generate CA Certificate (self-signed)");
+            const passin = await this.#passin(ca);
+            await execute_openssl(
+              [
+                "x509",
+                "-sha256",
+                "-req",
+                "-days",
+                "3650",
+                "-extensions",
+                "v3_ca",
+                "-extfile",
+                n4(configFile),
+                "-in",
+                "private/cakey.csr",
+                "-signkey",
+                n4(privateKeyFilename),
+                "-out",
+                "public/cacert.pem",
+                ...passin.args
+              ],
+              { ...options, env: passin.env }
+            );
+          }
+          displaySubtitle("generate initial CRL (Certificate Revocation List)");
+          await this.#regenerateCrlWith(ca, configFile, options);
+        });
+        displayTitle("Create Certificate Authority (CA) ---> DONE");
+      }
+      async regenerateCrl(ca) {
+        await this.#withConfig(ca, caAltName(ca), (configFile, options) => this.#regenerateCrlWith(ca, configFile, options));
+      }
+      async signSubordinateCsr(ca, csrFile, certFile, validityDays) {
+        await this.#withConfig(ca, caAltName(ca), async (configFile, options) => {
+          const caRootDir = options.cwd;
+          const passin = await this.#passin(ca);
+          await execute_openssl(
+            [
+              "x509",
+              "-sha256",
+              "-req",
+              "-days",
+              String(validityDays),
+              "-extensions",
+              "v3_ca",
+              "-extfile",
+              n4(configFile),
+              "-in",
+              n4(csrFile),
+              "-CA",
+              n4(ca.caCertificate),
+              "-CAkey",
+              n4(path8.join(caRootDir, "private/cakey.pem")),
+              "-CAserial",
+              n4(path8.join(caRootDir, "serial")),
+              "-out",
+              n4(certFile),
+              ...passin.args
+            ],
+            { ...options, env: passin.env }
+          );
+        });
+      }
+      async signEndEntityCsr(ca, certificate, csr, params1, sanOverride) {
+        await this.#withConfig(ca, buildSubjectAltNameString(sanOverride), async (configFile, options) => {
+          displaySubtitle("- then we ask the authority to sign the certificate signing request");
+          const passin = await this.#passin(ca);
+          await execute_openssl(
+            [
+              "ca",
+              "-config",
+              configFile,
+              "-startdate",
+              x509Date(params1.startDate),
+              "-enddate",
+              x509Date(params1.endDate),
+              "-batch",
+              "-out",
+              n4(certificate),
+              "-in",
+              n4(csr),
+              ...passin.args
+            ],
+            { ...options, env: passin.env }
+          );
+          displaySubtitle("- dump the certificate for a check");
+          await execute_openssl(["x509", "-in", n4(certificate), "-dates", "-fingerprint", "-purpose", "-noout"], options);
+        });
+      }
+      async revoke(ca, certificate, reason) {
+        setEnv("RANDFILE", path8.join(ca.rootDir, "random.rnd"));
+        await this.#withConfig(ca, caAltName(ca), async (configFile, options) => {
+          displaySubtitle("Revoke certificate");
+          const passin = await this.#passin(ca);
+          await execute_openssl_no_failure(
+            ["ca", "-verbose", "-config", n4(configFile), "-revoke", certificate, "-crl_reason", reason, ...passin.args],
+            { ...options, env: passin.env }
+          );
+          await this.#regenerateCrlWith(ca, configFile, options);
+          displaySubtitle("Verify that certificate is revoked");
+          await execute_openssl_no_failure(
+            [
+              "verify",
+              "-verbose",
+              "-CRLfile",
+              n4(ca.revocationList),
+              "-CAfile",
+              n4(ca.caCertificate),
+              "-crl_check",
+              n4(certificate)
+            ],
+            options
+          );
+          displaySubtitle("Produce CRL in DER form ");
+          await execute_openssl(
+            ["crl", "-in", n4(ca.revocationList), "-out", "crl/revocation_list.der", "-outform", "der"],
+            options
+          );
+          displaySubtitle("Produce CRL in PEM form ");
+          await execute_openssl(
+            ["crl", "-in", n4(ca.revocationList), "-out", "crl/revocation_list.pem", "-outform", "pem", "-text"],
+            options
+          );
+        });
+      }
+      async createSelfSignedCertificate(ca, certificateFile, privateKeyFile, params) {
+        const envOverrides = caConfigEnvOverrides(ca, buildSubjectAltNameString(params));
+        const configFile = generateStaticConfig(ca.configFile, { cwd: ca.rootDir }, envOverrides);
+        const options = {
+          cwd: ca.rootDir,
+          openssl_conf: makePath(configFile)
+        };
+        try {
+          const subject = params.subject ? new Subject5(params.subject).toString() : "";
+          const subjectOptions = subject && subject.length > 1 ? ["-subj", subject] : [];
+          const csrFile = `${certificateFile}_csr`;
+          const passin = await this.#passin(ca);
+          displaySubtitle("- the certificate signing request");
+          await execute_openssl(
+            [
+              "req",
+              "-new",
+              "-sha256",
+              ...subjectOptions,
+              "-batch",
+              "-key",
+              n4(privateKeyFile),
+              "-out",
+              n4(csrFile),
+              ...passin.args
+            ],
+            { ...options, env: passin.env }
+          );
+          displaySubtitle("- creating the self-signed certificate");
+          await execute_openssl(
+            [
+              "ca",
+              "-selfsign",
+              "-keyfile",
+              n4(privateKeyFile),
+              "-startdate",
+              x509Date(params.startDate),
+              "-enddate",
+              x509Date(params.endDate),
+              "-batch",
+              "-out",
+              n4(certificateFile),
+              "-in",
+              n4(csrFile),
+              ...passin.args
+            ],
+            { ...options, env: passin.env }
+          );
+          displaySubtitle("- dump the certificate for a check");
+          await execute_openssl(["x509", "-in", n4(certificateFile), "-dates", "-fingerprint", "-purpose", "-noout"], {});
+          displaySubtitle("- verify self-signed certificate");
+          await execute_openssl_no_failure(["verify", "-verbose", "-CAfile", n4(certificateFile), n4(certificateFile)], options);
+          await fs11.promises.unlink(csrFile);
+        } finally {
+          await cleanupStaticConfig(configFile, { cwd: ca.rootDir });
+        }
+      }
+    };
+  }
+});
+
+// packages/node-opcua-pki/lib/ca/templates/ca_config_template.cnf.ts
+var config2, ca_config_template_cnf_default;
+var init_ca_config_template_cnf = __esm({
+  "packages/node-opcua-pki/lib/ca/templates/ca_config_template.cnf.ts"() {
+    "use strict";
+    init_esm_shims();
+    config2 = `#.........DO NOT MODIFY BY HAND .........................
+[ ca ]
+default_ca               = CA_default
+[ CA_default ]
+dir                      = "%%ROOT_FOLDER%%"        # the main CA folder (quoted: see renderCaConfig)
+certs                    = $dir/certs                 # where to store certificates
+new_certs_dir            = $dir/certs                 #
+database                 = $dir/index.txt             # the certificate database
+serial                   = $dir/serial                # the serial number counter
+certificate              = $dir/public/cacert.pem     # The root CA certificate
+private_key              = $dir/private/cakey.pem     # the CA private key
+x509_extensions          = usr_cert                   #
+default_days             = 3650                       # default validity : 10 years
+
+# default_md               = sha1
+
+default_md                = sha256                      # The default digest algorithm
+
+preserve                 = no
+policy                   = policy_match
+# randfile                 = $dir/random.rnd
+# default_startdate        = YYMMDDHHMMSSZ
+# default_enddate          = YYMMDDHHMMSSZ
+crl_dir                  = $dir/crl
+crl_extensions           = crl_ext
+crl                      = $dir/crl/revocation_list.crl # the Revocation list
+crlnumber                = $dir/crlnumber           # CRL number file
+default_crl_days         = 30
+default_crl_hours        = 24
+#msie_hack
+
+[ policy_match ]
+countryName              = optional
+stateOrProvinceName      = optional
+localityName             = optional
+organizationName         = optional
+organizationalUnitName   = optional
+commonName               = optional
+emailAddress             = optional
+
+[ req ]
+default_bits             = 4096                     # Size of keys
+default_keyfile          = key.pem                  # name of generated keys
+distinguished_name       = req_distinguished_name
+attributes               = req_attributes
+x509_extensions          = v3_ca
+#input_password
+#output_password
+string_mask              = nombstr                  # permitted characters
 req_extensions           = v3_req
 
 [ req_distinguished_name ]
@@ -2745,136 +3819,40 @@ authorityKeyIdentifier    = keyid:always,issuer:always
   }
 });
 
-// packages/node-opcua-pki/lib/ca/certificate_authority.ts
-import assert10 from "assert";
-import fs10 from "fs";
+// packages/node-opcua-pki/lib/ca/core/certificate_authority_core.ts
+import assert9 from "assert";
+import fs12 from "fs";
 import os4 from "os";
-import path6 from "path";
+import path9 from "path";
+import { withLock as withLock2 } from "@ster5/global-mutex";
 import chalk6 from "chalk";
 import {
-  CertificatePurpose as CertificatePurpose2,
+  CertificatePurpose as CertificatePurpose3,
   certificateMatchesPrivateKey,
-  convertPEMtoDER,
+  convertPEMtoDER as convertPEMtoDER2,
+  createCertificateSigningRequest as createCertificateSigningRequest3,
+  createPfx,
   exploreCertificate as exploreCertificate2,
   exploreCertificateSigningRequest,
   generatePrivateKeyFile as generatePrivateKeyFile2,
-  readCertificatePEM,
+  privateKeyToCryptoKey as privateKeyToCryptoKey2,
+  readCertificatePEM as readCertificatePEM2,
   readCertificateSigningRequest,
-  readPrivateKey,
-  Subject as Subject4,
-  toPem as toPem2
+  readPrivateKey as readPrivateKey3,
+  Subject as Subject6,
+  toPem as toPem2,
+  verifyCertificateSignature as verifyCertificateSignature2,
+  writePrivateKeyFile as writePrivateKeyFile2,
+  x509 as x5092
 } from "node-opcua-crypto";
-function octetStringToIpAddress(a) {
-  return parseInt(a.substring(0, 2), 16).toString() + "." + parseInt(a.substring(2, 4), 16).toString() + "." + parseInt(a.substring(4, 6), 16).toString() + "." + parseInt(a.substring(6, 8), 16).toString();
-}
-async function construct_CertificateAuthority(certificateAuthority) {
-  const subject = certificateAuthority.subject;
-  const caRootDir = path6.resolve(certificateAuthority.rootDir);
-  async function make_folders() {
-    mkdirRecursiveSync(caRootDir);
-    mkdirRecursiveSync(path6.join(caRootDir, "private"));
-    mkdirRecursiveSync(path6.join(caRootDir, "public"));
-    mkdirRecursiveSync(path6.join(caRootDir, "certs"));
-    mkdirRecursiveSync(path6.join(caRootDir, "crl"));
-    mkdirRecursiveSync(path6.join(caRootDir, "conf"));
-  }
-  await make_folders();
-  async function construct_default_files() {
-    const serial = path6.join(caRootDir, "serial");
-    if (!fs10.existsSync(serial)) {
-      await fs10.promises.writeFile(serial, "1000");
-    }
-    const crlNumber = path6.join(caRootDir, "crlnumber");
-    if (!fs10.existsSync(crlNumber)) {
-      await fs10.promises.writeFile(crlNumber, "1000");
-    }
-    const indexFile = path6.join(caRootDir, "index.txt");
-    if (!fs10.existsSync(indexFile)) {
-      await fs10.promises.writeFile(indexFile, "");
-    }
-  }
-  await construct_default_files();
-  const caKeyExists = fs10.existsSync(path6.join(caRootDir, "private/cakey.pem"));
-  const caCertExists = fs10.existsSync(path6.join(caRootDir, "public/cacert.pem"));
-  if (caKeyExists && caCertExists && !config3.forceCA) {
-    debugLog("CA private key and certificate already exist ... skipping");
-    return;
-  }
-  if (caKeyExists && !caCertExists) {
-    debugLog("CA private key exists but cacert.pem is missing \u2014 rebuilding CA");
-    fs10.unlinkSync(path6.join(caRootDir, "private/cakey.pem"));
-    const staleCsr = path6.join(caRootDir, "private/cakey.csr");
-    if (fs10.existsSync(staleCsr)) {
-      fs10.unlinkSync(staleCsr);
-    }
-  }
-  displayTitle("Create Certificate Authority (CA)");
-  const indexFileAttr = path6.join(caRootDir, "index.txt.attr");
-  if (!fs10.existsSync(indexFileAttr)) {
-    await fs10.promises.writeFile(indexFileAttr, "unique_subject = no");
-  }
-  const caConfigFile = certificateAuthority.configFile;
-  if (1) {
-    let data = configurationFileTemplate;
-    data = makePath(data.replace(/%%ROOT_FOLDER%%/, caRootDir));
-    await fs10.promises.writeFile(caConfigFile, data);
-  }
-  const subjectOpt = ` -subj "${subject.toString()}" `;
-  const caCommonName = subject.commonName || "NodeOPCUA-CA";
-  setEnv("ALTNAME", `URI:urn:${caCommonName}`);
-  certificateAuthority._wireRevocationEnvVars();
-  const options = { cwd: caRootDir };
-  const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-  const configOption = ` -config ${q4(n5(configFile))}`;
-  const keySize = certificateAuthority.keySize;
-  const privateKeyFilename = path6.join(caRootDir, "private/cakey.pem");
-  const csrFilename = path6.join(caRootDir, "private/cakey.csr");
-  displayTitle(`Generate the CA private Key - ${keySize}`);
-  await generatePrivateKeyFile2(privateKeyFilename, keySize);
-  displayTitle("Generate a certificate request for the CA key");
-  await execute_openssl(
-    "req -new -sha256  -text  -extensions v3_ca_req" + configOption + " -key " + q4(n5(privateKeyFilename)) + " -out " + q4(n5(csrFilename)) + " " + subjectOpt,
-    options
-  );
-  const issuerCA = certificateAuthority._issuerCA;
-  if (issuerCA) {
-    displayTitle("Generate CA Certificate (signed by issuer CA)");
-    const issuerCert = path6.resolve(issuerCA.caCertificate);
-    const issuerKey = path6.resolve(issuerCA.rootDir, "private/cakey.pem");
-    const issuerSerial = path6.resolve(issuerCA.rootDir, "serial");
-    await execute_openssl(
-      " x509 -sha256 -req -days 3650  -text  -extensions v3_ca -extfile " + q4(n5(configFile)) + " -in private/cakey.csr  -CA " + q4(n5(issuerCert)) + " -CAkey " + q4(n5(issuerKey)) + " -CAserial " + q4(n5(issuerSerial)) + " -out public/cacert.pem",
-      options
-    );
-  } else {
-    displayTitle("Generate CA Certificate (self-signed)");
-    await execute_openssl(
-      " x509 -sha256 -req -days 3650  -text  -extensions v3_ca -extfile " + q4(n5(configFile)) + " -in private/cakey.csr  -signkey " + q4(n5(privateKeyFilename)) + " -out public/cacert.pem",
-      options
-    );
-  }
-  displaySubtitle("generate initial CRL (Certificate Revocation List)");
-  await regenerateCrl(certificateAuthority.revocationList, configOption, options);
-  displayTitle("Create Certificate Authority (CA) ---> DONE");
+function escapeOpensslConfDoubleQuoted(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
 }
-async function regenerateCrl(revocationList, configOption, options) {
-  displaySubtitle("regenerate CRL (Certificate Revocation List)");
-  await execute_openssl(`ca -gencrl ${configOption} -out crl/revocation_list.crl`, options);
-  await execute_openssl("crl  -in  crl/revocation_list.crl -out  crl/revocation_list.der  -outform der", options);
-  displaySubtitle("Display (Certificate Revocation List)");
-  await execute_openssl(`crl  -in ${q4(n5(revocationList))} -text  -noout`, options);
+function renderCaConfig(caRootDir) {
+  return configurationFileTemplate.replace(/%%ROOT_FOLDER%%/, escapeOpensslConfDoubleQuoted(makePath(caRootDir)));
 }
-function parseOpenSSLDate(dateStr) {
-  const raw = dateStr?.split(",")[0] ?? "";
-  if (raw.length < 12) return "";
-  const yy = parseInt(raw.substring(0, 2), 10);
-  const year = yy >= 70 ? 1900 + yy : 2e3 + yy;
-  const month = raw.substring(2, 4);
-  const day = raw.substring(4, 6);
-  const hour = raw.substring(6, 8);
-  const min = raw.substring(8, 10);
-  const sec = raw.substring(10, 12);
-  return `${year}-${month}-${day}T${hour}:${min}:${sec}Z`;
+function octetStringToIpAddress(a) {
+  return parseInt(a.substring(0, 2), 16).toString() + "." + parseInt(a.substring(2, 4), 16).toString() + "." + parseInt(a.substring(4, 6), 16).toString() + "." + parseInt(a.substring(6, 8), 16).toString();
 }
 function validateRevocationUrl(url, fieldName) {
   if (url === void 0) {
@@ -2903,28 +3881,25 @@ function validateRevocationUrl(url, fieldName) {
   }
   return url;
 }
-var defaultSubject, configurationFileTemplate, configurationFileSimpleTemplate2, config3, n5, q4, CertificateAuthority;
-var init_certificate_authority = __esm({
-  "packages/node-opcua-pki/lib/ca/certificate_authority.ts"() {
+var defaultSubject, configurationFileTemplate, config3, CA_LOCK_MAX_WAIT_MS, CA_LOCK_RETRY, CertificateAuthorityCore;
+var init_certificate_authority_core = __esm({
+  "packages/node-opcua-pki/lib/ca/core/certificate_authority_core.ts"() {
     "use strict";
     init_esm_shims();
-    init_toolbox_pfx();
     init_toolbox();
-    init_with_openssl();
-    init_simple_config_template_cnf();
+    init_ca_database();
     init_ca_config_template_cnf();
     defaultSubject = "/C=FR/ST=IDF/L=Paris/O=Local NODE-OPCUA Certificate Authority/CN=NodeOPCUA-CA";
     configurationFileTemplate = ca_config_template_cnf_default;
-    configurationFileSimpleTemplate2 = simple_config_template_cnf_default;
     config3 = {
       certificateDir: "INVALID",
       forceCA: false,
       pkiDir: "INVALID"
     };
-    n5 = makePath;
-    q4 = quote;
-    assert10(octetStringToIpAddress("c07b9179") === "192.123.145.121");
-    CertificateAuthority = class {
+    CA_LOCK_MAX_WAIT_MS = 5 * 6e4;
+    CA_LOCK_RETRY = { minTimeout: 20, maxTimeout: 250 };
+    assert9(octetStringToIpAddress("c07b9179") === "192.123.145.121");
+    CertificateAuthorityCore = class {
       /** RSA key size used when generating the CA private key. */
       keySize;
       /** Root filesystem path of the CA directory structure. */
@@ -2937,13 +3912,45 @@ var init_certificate_authority = __esm({
       _crlDistributionUrl;
       _ocspResponderUrl;
       _caIssuersUrl;
+      #privateKeyPassphrase;
+      /** resolved once (see `privateKeyPassphrase`); `#passphraseResolved` distinguishes "none" from "not yet" */
+      #resolvedPassphrase;
+      #passphraseResolved = false;
+      /** Signing backend: `openssl` shells out to the CLI, `native` signs in-process. */
+      #backend;
+      /** External signing key (HSM/KMS), when one was supplied instead of a key file. */
+      #signer;
+      /** Read access to `index.txt` / `certs/<SERIAL>.pem`. */
+      #db;
       constructor(options) {
-        assert10(Object.prototype.hasOwnProperty.call(options, "location"));
-        assert10(Object.prototype.hasOwnProperty.call(options, "keySize"));
+        assert9(Object.prototype.hasOwnProperty.call(options, "location"));
+        assert9(Object.prototype.hasOwnProperty.call(options, "keySize"));
         this.location = options.location;
         this.keySize = options.keySize || 2048;
-        this.subject = new Subject4(options.subject || defaultSubject);
+        this.subject = new Subject6(options.subject || defaultSubject);
         this._issuerCA = options.issuerCA;
+        this.#privateKeyPassphrase = options.privateKeyPassphrase;
+        this.#signer = options.signer;
+        if (options.signer) {
+          const algorithm = options.signer.algorithm;
+          if (algorithm.name !== "RSASSA-PKCS1-v1_5" && algorithm.name !== "ECDSA") {
+            throw new Error(
+              `CertificateAuthority: signer algorithm ${algorithm.name} is not supported - use RSASSA-PKCS1-v1_5 or ECDSA.`
+            );
+          }
+          if (algorithm.name === "ECDSA" && !algorithm.namedCurve) {
+            throw new Error(
+              "CertificateAuthority: an ECDSA signer must declare its namedCurve (P-256, P-384 or P-521) - importing the signer's public key needs the curve, and an SPKI import cannot infer it."
+            );
+          }
+        }
+        if (options.signer && !options.backend.supportsExternalSigner) {
+          throw new Error(
+            "CertificateAuthority: this backend cannot sign with an external signer - it loads its key from a file. Use a backend that supports one, such as NativeCaBackend."
+          );
+        }
+        this.#backend = options.backend;
+        this.#db = new CaDatabase(this.location);
         if (options.crlDistributionUrl !== void 0) {
           this.setCrlDistributionUrl(options.crlDistributionUrl);
         }
@@ -3007,38 +4014,159 @@ var init_certificate_authority = __esm({
       setCaIssuersUrl(url) {
         this._caIssuersUrl = validateRevocationUrl(url, "caIssuersUrl");
       }
+      /** Absolute path to the CA root directory (alias for {@link location}). */
+      get rootDir() {
+        return this.location;
+      }
+      /** Path to the OpenSSL configuration file (`conf/caconfig.cnf`). */
+      get configFile() {
+        return path9.normalize(path9.join(this.rootDir, "./conf/caconfig.cnf"));
+      }
+      /** Path to the CA private key (`private/cakey.pem`); may be passphrase-encrypted, see {@link getPrivateKey}. */
+      get privateKey() {
+        return path9.join(path9.resolve(this.rootDir), "private/cakey.pem");
+      }
       /**
-       * @internal
-       * Populate the OpenSSL config substitution env vars (`CDP_URL` and
-       * `AIA_VALUE`) from the configured URLs, or unset them so the
-       * matching `{{#KEY}}...{{/KEY}}` blocks in the templates are
-       * stripped. MUST be called before every `generateStaticConfig`
-       * invocation that signs a certificate.
+       * The CA private key, decrypted with the configured `privateKeyPassphrase`
+       * if it is encrypted. Fails closed (`PrivateKeyPassphraseRequiredError`)
+       * on an encrypted key with no or the wrong passphrase.
        */
-      _wireRevocationEnvVars() {
-        unsetEnv("CDP_URL");
-        unsetEnv("AIA_VALUE");
-        if (this._crlDistributionUrl) {
-          setEnv("CDP_URL", this._crlDistributionUrl);
+      async getPrivateKey() {
+        this.#assertKeyIsOnDisk("getPrivateKey");
+        return readPrivateKey3(this.privateKey, await this._privateKeyPassphrase());
+      }
+      /**
+       * True when this CA signs with an external {@link CaSigner} (HSM/KMS)
+       * rather than with `private/cakey.pem`. There is then no private key
+       * file on disk, and never was one.
+       */
+      get hasExternalSigner() {
+        return this.#signer !== void 0;
+      }
+      /**
+       * Does `cert` certify the key this CA signs with? With the key on disk
+       * that is a private-key match; with a signer there is no private key to
+       * match, so compare the certified public key against the signer's own -
+       * the same question, asked the only way an HSM allows.
+       */
+      async #certificateMatchesOurKey(certPem, certDer) {
+        if (this.#signer) {
+          const ours = Buffer.from(await this.#signer.getPublicKey());
+          const certified = Buffer.from(new x5092.X509Certificate(certPem).publicKey.rawData);
+          return ours.equals(certified);
+        }
+        return certificateMatchesPrivateKey(certDer, await this.getPrivateKey());
+      }
+      /** Reject the key-file-only operations up front, rather than failing on a missing file later. */
+      #assertKeyIsOnDisk(what) {
+        if (this.#signer) {
+          throw new Error(
+            `CertificateAuthority.${what} is not available on a signer-backed CA: the private key lives in the signer (HSM/KMS) and is never written to disk.`
+          );
         }
-        const aiaLegs = [];
-        if (this._ocspResponderUrl) {
-          aiaLegs.push(`OCSP;URI:${this._ocspResponderUrl}`);
+      }
+      /**
+       * @internal The key every signing operation goes through. An injected
+       * {@link CaSigner} is returned as-is; otherwise the on-disk key is read
+       * (and decrypted) and handed over as a plain `CryptoKey`. Both are
+       * accepted by the `node-opcua-crypto` signing primitives, so callers
+       * never branch on which one they got.
+       */
+      async _getSigningKey() {
+        if (this.#signer) {
+          return this.#signer;
         }
-        if (this._caIssuersUrl) {
-          aiaLegs.push(`caIssuers;URI:${this._caIssuersUrl}`);
+        return privateKeyToCryptoKey2(await this.getPrivateKey());
+      }
+      /**
+       * Enable, disable, or rotate the passphrase protecting `private/cakey.pem`
+       * (temp file + atomic rename, temp file removed on failure). Only
+       * rewrites the file: construct a new `CertificateAuthority` with the new
+       * passphrase to continue using it.
+       */
+      async reencryptPrivateKey(oldPassphrase, newPassphrase) {
+        this.#assertKeyIsOnDisk("reencryptPrivateKey");
+        const oldPass = await resolvePrivateKeyPassphrase(oldPassphrase);
+        const newPass = await resolvePrivateKeyPassphrase(newPassphrase);
+        const key = readPrivateKey3(this.privateKey, oldPass);
+        await this.#rewritePrivateKeyFile(key, newPass);
+      }
+      async #rewritePrivateKeyFile(privateKey, passphrase) {
+        const tmpFilename = `${this.privateKey}.${process.pid}-${Date.now()}.tmp`;
+        try {
+          await writePrivateKeyFile2(tmpFilename, privateKey, { passphrase });
+          await fs12.promises.rename(tmpFilename, this.privateKey);
+        } finally {
+          await fs12.promises.rm(tmpFilename, { force: true });
         }
-        if (aiaLegs.length > 0) {
-          setEnv("AIA_VALUE", aiaLegs.join(","));
+      }
+      /** @internal resolve the configured passphrase, at most once per instance */
+      async _privateKeyPassphrase() {
+        if (!this.#passphraseResolved) {
+          this.#resolvedPassphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
+          this.#passphraseResolved = true;
         }
+        return this.#resolvedPassphrase;
       }
-      /** Absolute path to the CA root directory (alias for {@link location}). */
-      get rootDir() {
-        return this.location;
+      /**
+       * @internal On an existing key: encrypt it in place if a passphrase is
+       * configured and it is still plaintext (secure by default: the option
+       * means "protect this key", not "ignore me"), then read it back so a
+       * wrong or missing passphrase fails initialize() closed rather than the
+       * first signing operation.
+       */
+      async _ensurePrivateKeyProtection() {
+        if (this.#signer || !fs12.existsSync(this.privateKey)) {
+          return;
+        }
+        if (this.#privateKeyPassphrase !== void 0 && !isEncryptedPrivateKeyFile(this.privateKey)) {
+          warningLog("CertificateAuthority: private key is plaintext but a passphrase is configured; encrypting it in place");
+          const plaintextKey = readPrivateKey3(this.privateKey);
+          await this.#rewritePrivateKeyFile(plaintextKey, await this._privateKeyPassphrase());
+        }
+        await this.getPrivateKey();
       }
-      /** Path to the OpenSSL configuration file (`conf/caconfig.cnf`). */
-      get configFile() {
-        return path6.normalize(path6.join(this.rootDir, "./conf/caconfig.cnf"));
+      /**
+       * Acquire a file-based lock on this CA's directory for the duration of
+       * `action` — serializes every operation that mutates the certificate
+       * database (`index.txt`, `serial`, `crlnumber`, `certs/`,
+       * `crl/revocation_list.*`) or the CA's own key/certificate, so
+       * concurrent calls on one `CertificateAuthority` (or two instances
+       * pointed at the same directory, in this or another process) cannot
+       * interleave. Mirrors `CertificateManager.withLock2`.
+       *
+       * Only ever call this from a top-level public operation — nested calls
+       * on the same instance would deadlock, since the underlying file lock
+       * is not reentrant.
+       *
+       * The wait is bounded: a waiter gives up (throws) after
+       * `CA_LOCK_MAX_WAIT_MS`. Without a bound, a holder whose openssl child
+       * hangs would block every CA operation in every process forever and
+       * silently — the lock library's keepalive keeps refreshing the lock
+       * file's mtime as long as the holder process is alive, so stale-lock
+       * recovery never fires for a live-but-stuck holder. A dead holder's
+       * lock goes stale (default 2 minutes) and is taken over well within
+       * this bound.
+       */
+      async #withCaLock(action) {
+        const lockFileName = path9.join(this.rootDir, ".ca.lock");
+        return withLock2(
+          {
+            fileToLock: lockFileName,
+            retries: { forever: true, maxRetryTime: CA_LOCK_MAX_WAIT_MS, ...CA_LOCK_RETRY }
+          },
+          action
+        );
+      }
+      /**
+       * @internal Run `action` under this CA's directory lock. For the one
+       * legitimate cross-instance use: a subordinate CA's bootstrap signs its
+       * certificate with `openssl x509 -CAserial`, which read-increment-writes
+       * THIS issuer's `serial` file, and must therefore hold this issuer's
+       * lock (ordering is always subordinate -> issuer, so no cycle).
+       */
+      async _withCaDirectoryLock(action) {
+        return this.#withCaLock(action);
       }
       /** Path to the CA certificate in PEM format (`public/cacert.pem`). */
       get caCertificate() {
@@ -3087,8 +4215,8 @@ var init_certificate_authority = __esm({
        *   (call {@link initialize} first).
        */
       getCACertificateDER() {
-        const pem = readCertificatePEM(this.caCertificate);
-        return convertPEMtoDER(pem);
+        const pem = readCertificatePEM2(this.caCertificate);
+        return convertPEMtoDER2(pem);
       }
       /**
        * Return the CA certificate as a PEM-encoded string.
@@ -3097,7 +4225,7 @@ var init_certificate_authority = __esm({
        *   (call {@link initialize} first).
        */
       getCACertificatePEM() {
-        const raw = readCertificatePEM(this.caCertificate);
+        const raw = readCertificatePEM2(this.caCertificate);
         const beginMarker = "-----BEGIN CERTIFICATE-----";
         const idx = raw.indexOf(beginMarker);
         if (idx > 0) {
@@ -3113,10 +4241,10 @@ var init_certificate_authority = __esm({
        */
       getCRLDER() {
         const crlPath = this.revocationListDER;
-        if (!fs10.existsSync(crlPath)) {
+        if (!fs12.existsSync(crlPath)) {
           return Buffer.alloc(0);
         }
-        return fs10.readFileSync(crlPath);
+        return fs12.readFileSync(crlPath);
       }
       /**
        * Return the current Certificate Revocation List as a
@@ -3126,10 +4254,10 @@ var init_certificate_authority = __esm({
        */
       getCRLPEM() {
         const crlPath = this.revocationList;
-        if (!fs10.existsSync(crlPath)) {
+        if (!fs12.existsSync(crlPath)) {
           return "";
         }
-        const raw = fs10.readFileSync(crlPath, "utf-8");
+        const raw = fs12.readFileSync(crlPath, "utf-8");
         const beginMarker = "-----BEGIN X509 CRL-----";
         const idx = raw.indexOf(beginMarker);
         if (idx > 0) {
@@ -3148,14 +4276,14 @@ var init_certificate_authority = __esm({
        * expiry date, and (for revoked certs) the revocation date.
        */
       getIssuedCertificates() {
-        return this._parseIndexTxt();
+        return this.#db.readIndex();
       }
       /**
        * Return the total number of certificates recorded in
        * `index.txt`.
        */
       getIssuedCertificateCount() {
-        return this._parseIndexTxt().length;
+        return this.#db.readIndex().length;
       }
       /**
        * Return the status of a certificate by its serial number.
@@ -3165,9 +4293,7 @@ var init_certificate_authority = __esm({
        *   `undefined` if not found
        */
       getCertificateStatus(serial) {
-        const upper = serial.toUpperCase();
-        const record = this._parseIndexTxt().find((r) => r.serial.toUpperCase() === upper);
-        return record?.status;
+        return this.#db.findBySerial(serial)?.status;
       }
       /**
        * Read a specific issued certificate by serial number and
@@ -3180,82 +4306,13 @@ var init_certificate_authority = __esm({
        * @returns the DER buffer, or `undefined` if not found
        */
       getCertificateBySerial(serial) {
-        const upper = serial.toUpperCase();
-        const certFile = path6.join(this.rootDir, "certs", `${upper}.pem`);
-        if (!fs10.existsSync(certFile)) {
-          return void 0;
-        }
-        const pem = readCertificatePEM(certFile);
-        return convertPEMtoDER(pem);
+        return this.#db.getCertificateBySerial(serial);
       }
       /**
        * Path to the OpenSSL certificate database file.
        */
       get indexFile() {
-        return path6.join(this.rootDir, "index.txt");
-      }
-      /**
-       * Parse the OpenSSL `index.txt` certificate database.
-       *
-       * Each line has tab-separated fields:
-       * ```
-       * status  expiry  [revocationDate]  serial  unknown  subject
-       * ```
-       *
-       * - status: `V` (valid), `R` (revoked), `E` (expired)
-       * - expiry: `YYMMDDHHmmssZ`
-       * - revocationDate: present only for revoked certs
-       * - serial: hex string
-       * - unknown: always `"unknown"`
-       * - subject: X.500 slash-delimited string
-       */
-      _parseIndexTxt() {
-        const indexPath = this.indexFile;
-        if (!fs10.existsSync(indexPath)) {
-          return [];
-        }
-        const content = fs10.readFileSync(indexPath, "utf-8");
-        const lines = content.split("\n").filter((l) => l.trim().length > 0);
-        const records = [];
-        for (const line of lines) {
-          const fields = line.split("	");
-          if (fields.length < 4) continue;
-          const statusChar = fields[0];
-          const expiryStr = fields[1];
-          let serial;
-          let subject;
-          let revocationDate;
-          if (statusChar === "R") {
-            revocationDate = fields[2];
-            serial = fields[3];
-            subject = fields.length >= 6 ? fields[5] : "";
-          } else {
-            serial = fields[3];
-            subject = fields.length >= 6 ? fields[5] : "";
-          }
-          let status;
-          switch (statusChar) {
-            case "V":
-              status = "valid";
-              break;
-            case "R":
-              status = "revoked";
-              break;
-            case "E":
-              status = "expired";
-              break;
-            default:
-              continue;
-          }
-          records.push({
-            serial,
-            status,
-            subject,
-            expiryDate: parseOpenSSLDate(expiryStr),
-            revocationDate: revocationDate ? parseOpenSSLDate(revocationDate) : void 0
-          });
-        }
-        return records;
+        return this.#db.indexFile;
       }
       // ---------------------------------------------------------------
       // Buffer-based CA operations (US-058)
@@ -3277,12 +4334,12 @@ var init_certificate_authority = __esm({
        * @returns the signed certificate as a DER-encoded buffer
        */
       async signCertificateRequestFromDER(csrDer, options) {
-        const tmpDir = await fs10.promises.mkdtemp(path6.join(os4.tmpdir(), "pki-sign-"));
+        const tmpDir = await fs12.promises.mkdtemp(path9.join(os4.tmpdir(), "pki-sign-"));
         try {
-          const csrFile = path6.join(tmpDir, "request.csr");
-          const certFile = path6.join(tmpDir, "certificate.pem");
+          const csrFile = path9.join(tmpDir, "request.csr");
+          const certFile = path9.join(tmpDir, "certificate.pem");
           const csrPem = toPem2(csrDer, "CERTIFICATE REQUEST");
-          await fs10.promises.writeFile(csrFile, csrPem, "utf-8");
+          await fs12.promises.writeFile(csrFile, csrPem, "utf-8");
           const signingParams = {};
           if (options?.validityMs !== void 0) signingParams.validityMs = options.validityMs;
           else signingParams.validity = options?.validity ?? 365;
@@ -3292,10 +4349,10 @@ var init_certificate_authority = __esm({
           if (options?.applicationUri) signingParams.applicationUri = options.applicationUri;
           if (options?.subject) signingParams.subject = options.subject;
           await this.signCertificateRequest(certFile, csrFile, signingParams);
-          const certPem = readCertificatePEM(certFile);
-          return convertPEMtoDER(certPem);
+          const certPem = readCertificatePEM2(certFile);
+          return convertPEMtoDER2(certPem);
         } finally {
-          await fs10.promises.rm(tmpDir, {
+          await fs12.promises.rm(tmpDir, {
             recursive: true,
             force: true
           });
@@ -3345,27 +4402,35 @@ var init_certificate_authority = __esm({
        * @returns `{ certificateDer, privateKey }` — certificate as DER,
        *   private key as a branded `PrivateKey` buffer
        */
+      /**
+       * An ephemeral key and a CSR for it, written into `tmpDir`. Both
+       * `generateKeyPairAndSign*` methods need exactly this, and neither
+       * needs a subprocess for it: the key comes from node's crypto and the
+       * request is built and self-signed in process, so no `openssl.cnf` has
+       * to be rendered either.
+       */
+      async #createEphemeralKeyAndCsr(tmpDir, keySize, options) {
+        const privateKeyFile = path9.join(tmpDir, "private_key.pem");
+        await generatePrivateKeyFile2(privateKeyFile, keySize);
+        const { csr } = await createCertificateSigningRequest3({
+          privateKey: await privateKeyToCryptoKey2(readPrivateKey3(privateKeyFile)),
+          subject: options.subject ? new Subject6(options.subject).toString() : void 0,
+          applicationUri: options.applicationUri,
+          dns: options.dns ?? [],
+          ip: options.ip ?? [],
+          purpose: CertificatePurpose3.ForApplication
+        });
+        const csrFile = path9.join(tmpDir, "request.csr");
+        await fs12.promises.writeFile(csrFile, csr);
+        return { privateKeyFile, csrFile };
+      }
       async generateKeyPairAndSignDER(options) {
         const keySize = options.keySize ?? 2048;
         const startDate = options.startDate ?? /* @__PURE__ */ new Date();
-        const tmpDir = await fs10.promises.mkdtemp(path6.join(os4.tmpdir(), "pki-keygen-"));
+        const tmpDir = await fs12.promises.mkdtemp(path9.join(os4.tmpdir(), "pki-keygen-"));
         try {
-          const privateKeyFile = path6.join(tmpDir, "private_key.pem");
-          await generatePrivateKeyFile2(privateKeyFile, keySize);
-          const configFile = path6.join(tmpDir, "openssl.cnf");
-          await fs10.promises.writeFile(configFile, configurationFileSimpleTemplate2, "utf-8");
-          const csrFile = path6.join(tmpDir, "request.csr");
-          await createCertificateSigningRequestWithOpenSSL(csrFile, {
-            rootDir: tmpDir,
-            configFile,
-            privateKey: privateKeyFile,
-            applicationUri: options.applicationUri,
-            subject: options.subject,
-            dns: options.dns ?? [],
-            ip: options.ip ?? [],
-            purpose: CertificatePurpose2.ForApplication
-          });
-          const certFile = path6.join(tmpDir, "certificate.pem");
+          const { privateKeyFile, csrFile } = await this.#createEphemeralKeyAndCsr(tmpDir, keySize, options);
+          const certFile = path9.join(tmpDir, "certificate.pem");
           const signingParams = {
             applicationUri: options.applicationUri,
             dns: options.dns,
@@ -3375,12 +4440,12 @@ var init_certificate_authority = __esm({
           if (options.validityMs !== void 0) signingParams.validityMs = options.validityMs;
           else signingParams.validity = options.validity ?? 365;
           await this.signCertificateRequest(certFile, csrFile, signingParams);
-          const certPem = readCertificatePEM(certFile);
-          const certificateDer = convertPEMtoDER(certPem);
-          const privateKey = readPrivateKey(privateKeyFile);
+          const certPem = readCertificatePEM2(certFile);
+          const certificateDer = convertPEMtoDER2(certPem);
+          const privateKey = readPrivateKey3(privateKeyFile);
           return { certificateDer, privateKey };
         } finally {
-          await fs10.promises.rm(tmpDir, {
+          await fs12.promises.rm(tmpDir, {
             recursive: true,
             force: true
           });
@@ -3401,24 +4466,10 @@ var init_certificate_authority = __esm({
         const keySize = options.keySize ?? 2048;
         const startDate = options.startDate ?? /* @__PURE__ */ new Date();
         const passphrase = options.passphrase ?? "";
-        const tmpDir = await fs10.promises.mkdtemp(path6.join(os4.tmpdir(), "pki-keygen-pfx-"));
+        const tmpDir = await fs12.promises.mkdtemp(path9.join(os4.tmpdir(), "pki-keygen-pfx-"));
         try {
-          const privateKeyFile = path6.join(tmpDir, "private_key.pem");
-          await generatePrivateKeyFile2(privateKeyFile, keySize);
-          const configFile = path6.join(tmpDir, "openssl.cnf");
-          await fs10.promises.writeFile(configFile, configurationFileSimpleTemplate2, "utf-8");
-          const csrFile = path6.join(tmpDir, "request.csr");
-          await createCertificateSigningRequestWithOpenSSL(csrFile, {
-            rootDir: tmpDir,
-            configFile,
-            privateKey: privateKeyFile,
-            applicationUri: options.applicationUri,
-            subject: options.subject,
-            dns: options.dns ?? [],
-            ip: options.ip ?? [],
-            purpose: CertificatePurpose2.ForApplication
-          });
-          const certFile = path6.join(tmpDir, "certificate.pem");
+          const { privateKeyFile, csrFile } = await this.#createEphemeralKeyAndCsr(tmpDir, keySize, options);
+          const certFile = path9.join(tmpDir, "certificate.pem");
           const signingParams = {
             applicationUri: options.applicationUri,
             dns: options.dns,
@@ -3428,17 +4479,20 @@ var init_certificate_authority = __esm({
           if (options.validityMs !== void 0) signingParams.validityMs = options.validityMs;
           else signingParams.validity = options.validity ?? 365;
           await this.signCertificateRequest(certFile, csrFile, signingParams);
-          const pfxFile = path6.join(tmpDir, "bundle.pfx");
-          await createPFX({
-            certificateFile: certFile,
-            privateKeyFile,
-            outputFile: pfxFile,
-            passphrase,
-            caCertificateFiles: [this.caCertificate]
+          const blocks = (await fs12.promises.readFile(certFile, "utf-8")).match(
+            /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g
+          );
+          if (!blocks || blocks.length === 0) {
+            throw new Error(`generateKeyPairAndSignPFX: no certificate was produced in ${certFile}`);
+          }
+          return await createPfx({
+            certificate: convertPEMtoDER2(blocks[0]),
+            certificateChain: blocks.slice(1).map(convertPEMtoDER2),
+            privateKey: readPrivateKey3(privateKeyFile),
+            password: passphrase
           });
-          return await fs10.promises.readFile(pfxFile);
         } finally {
-          await fs10.promises.rm(tmpDir, {
+          await fs12.promises.rm(tmpDir, {
             recursive: true,
             force: true
           });
@@ -3459,8 +4513,8 @@ var init_certificate_authority = __esm({
       async revokeCertificateDER(certDer, reason) {
         const info = exploreCertificate2(certDer);
         const serial = info.tbsCertificate.serialNumber.replace(/:/g, "").toUpperCase();
-        const storedCertFile = path6.join(this.rootDir, "certs", `${serial}.pem`);
-        if (!fs10.existsSync(storedCertFile)) {
+        const storedCertFile = path9.join(this.rootDir, "certs", `${serial}.pem`);
+        if (!fs12.existsSync(storedCertFile)) {
           throw new Error(`Cannot revoke: no stored certificate found for serial ${serial} at ${storedCertFile}`);
         }
         await this.revokeCertificate(storedCertFile, {
@@ -3473,7 +4527,69 @@ var init_certificate_authority = __esm({
        * already exist.
        */
       async initialize() {
-        await construct_CertificateAuthority(this);
+        mkdirRecursiveSync(path9.resolve(this.rootDir));
+        await this.#withCaLock(() => this.#bootstrap());
+      }
+      /**
+       * @internal Shared (backend-agnostic) part of `initialize()`: directory
+       * layout, default database files, the "already initialized" / "partial
+       * init" checks, and the openssl config file — then delegates CSR
+       * generation, CA-certificate signing, and the initial CRL to
+       * {@link CaBackend.bootstrap}. Must be called under {@link #withCaLock}.
+       */
+      async #bootstrap() {
+        const caRootDir = path9.resolve(this.rootDir);
+        mkdirRecursiveSync(caRootDir);
+        ensurePrivateDirectory(path9.join(caRootDir, "private"));
+        mkdirRecursiveSync(path9.join(caRootDir, "public"));
+        mkdirRecursiveSync(path9.join(caRootDir, "certs"));
+        mkdirRecursiveSync(path9.join(caRootDir, "crl"));
+        mkdirRecursiveSync(path9.join(caRootDir, "conf"));
+        const serial = path9.join(caRootDir, "serial");
+        if (!fs12.existsSync(serial)) {
+          await fs12.promises.writeFile(serial, "1000");
+        }
+        const crlNumber = path9.join(caRootDir, "crlnumber");
+        if (!fs12.existsSync(crlNumber)) {
+          await fs12.promises.writeFile(crlNumber, "1000");
+        }
+        const indexFile = path9.join(caRootDir, "index.txt");
+        if (!fs12.existsSync(indexFile)) {
+          await fs12.promises.writeFile(indexFile, "");
+        }
+        const signerBacked = this.hasExternalSigner;
+        const caKeyExists = signerBacked || fs12.existsSync(path9.join(caRootDir, "private/cakey.pem"));
+        const caCertExists = fs12.existsSync(path9.join(caRootDir, "public/cacert.pem"));
+        if (caKeyExists && caCertExists && !config3.forceCA) {
+          if (!signerBacked) {
+            restrictPrivateFilePermissions(path9.join(caRootDir, "private/cakey.pem"), 384);
+            await this._ensurePrivateKeyProtection();
+          }
+          debugLog("CA private key and certificate already exist ... skipping");
+          return;
+        }
+        if (!signerBacked && caKeyExists && !caCertExists) {
+          debugLog("CA private key exists but cacert.pem is missing \u2014 rebuilding CA");
+          fs12.unlinkSync(path9.join(caRootDir, "private/cakey.pem"));
+          const staleCsr = path9.join(caRootDir, "private/cakey.csr");
+          if (fs12.existsSync(staleCsr)) {
+            fs12.unlinkSync(staleCsr);
+          }
+        }
+        displayTitle("Create Certificate Authority (CA)");
+        const indexFileAttr = path9.join(caRootDir, "index.txt.attr");
+        if (!fs12.existsSync(indexFileAttr)) {
+          await fs12.promises.writeFile(indexFileAttr, "unique_subject = no");
+        }
+        const caConfigFile = this.configFile;
+        await fs12.promises.writeFile(caConfigFile, renderCaConfig(caRootDir));
+        if (!signerBacked) {
+          const privateKeyFilename = path9.join(caRootDir, "private/cakey.pem");
+          displayTitle(`Generate the CA private Key - ${this.keySize}`);
+          await generatePrivateKeyFile2(privateKeyFilename, this.keySize, { passphrase: await this._privateKeyPassphrase() });
+          restrictPrivateFilePermissions(privateKeyFilename, 384);
+        }
+        await this.#backend.bootstrap(this);
       }
       /**
        * Initialize the CA directory structure and generate the
@@ -3495,16 +4611,25 @@ var init_certificate_authority = __esm({
        * @returns an {@link InitializeCSRResult} describing the CA state
        */
       async initializeCSR() {
-        const caRootDir = path6.resolve(this.rootDir);
+        const caRootDir = path9.resolve(this.rootDir);
         mkdirRecursiveSync(caRootDir);
-        for (const dir of ["private", "public", "certs", "crl", "conf"]) {
-          mkdirRecursiveSync(path6.join(caRootDir, dir));
+        return this.#withCaLock(() => this.#initializeCSRLocked(caRootDir));
+      }
+      async #initializeCSRLocked(caRootDir) {
+        for (const dir of ["public", "certs", "crl", "conf"]) {
+          mkdirRecursiveSync(path9.join(caRootDir, dir));
         }
+        ensurePrivateDirectory(path9.join(caRootDir, "private"));
         const caCertFile = this.caCertificate;
-        const privateKeyFile = path6.join(caRootDir, "private/cakey.pem");
-        const csrFile = path6.join(caRootDir, "private/cakey.csr");
-        if (fs10.existsSync(caCertFile)) {
-          const certDer = convertPEMtoDER(readCertificatePEM(caCertFile));
+        const privateKeyFile = path9.join(caRootDir, "private/cakey.pem");
+        const csrFile = path9.join(caRootDir, "private/cakey.csr");
+        const keyAvailable = this.hasExternalSigner || fs12.existsSync(privateKeyFile);
+        if (!this.hasExternalSigner && fs12.existsSync(privateKeyFile)) {
+          restrictPrivateFilePermissions(privateKeyFile, 384);
+          await this._ensurePrivateKeyProtection();
+        }
+        if (fs12.existsSync(caCertFile)) {
+          const certDer = convertPEMtoDER2(readCertificatePEM2(caCertFile));
           const certInfo = exploreCertificate2(certDer);
           const notAfter = certInfo.tbsCertificate.validity.notAfter;
           if (notAfter.getTime() < Date.now()) {
@@ -3515,32 +4640,31 @@ var init_certificate_authority = __esm({
           debugLog("CA certificate already exists and is valid \u2014 ready");
           return { status: "ready" };
         }
-        if (fs10.existsSync(privateKeyFile) && fs10.existsSync(csrFile)) {
+        if (keyAvailable && fs12.existsSync(csrFile)) {
           debugLog("CA key + CSR already exist \u2014 pending external signing");
           return { status: "pending", csrPath: csrFile };
         }
-        const serial = path6.join(caRootDir, "serial");
-        if (!fs10.existsSync(serial)) {
-          await fs10.promises.writeFile(serial, "1000");
+        const serial = path9.join(caRootDir, "serial");
+        if (!fs12.existsSync(serial)) {
+          await fs12.promises.writeFile(serial, "1000");
         }
-        const crlNumber = path6.join(caRootDir, "crlnumber");
-        if (!fs10.existsSync(crlNumber)) {
-          await fs10.promises.writeFile(crlNumber, "1000");
+        const crlNumber = path9.join(caRootDir, "crlnumber");
+        if (!fs12.existsSync(crlNumber)) {
+          await fs12.promises.writeFile(crlNumber, "1000");
         }
-        const indexFile = path6.join(caRootDir, "index.txt");
-        if (!fs10.existsSync(indexFile)) {
-          await fs10.promises.writeFile(indexFile, "");
+        const indexFile = path9.join(caRootDir, "index.txt");
+        if (!fs12.existsSync(indexFile)) {
+          await fs12.promises.writeFile(indexFile, "");
         }
-        const indexFileAttr = path6.join(caRootDir, "index.txt.attr");
-        if (!fs10.existsSync(indexFileAttr)) {
-          await fs10.promises.writeFile(indexFileAttr, "unique_subject = no");
+        const indexFileAttr = path9.join(caRootDir, "index.txt.attr");
+        if (!fs12.existsSync(indexFileAttr)) {
+          await fs12.promises.writeFile(indexFileAttr, "unique_subject = no");
         }
         const caConfigFile = this.configFile;
-        let data = configurationFileTemplate;
-        data = makePath(data.replace(/%%ROOT_FOLDER%%/, caRootDir));
-        await fs10.promises.writeFile(caConfigFile, data);
-        if (!fs10.existsSync(privateKeyFile)) {
-          await generatePrivateKeyFile2(privateKeyFile, this.keySize);
+        await fs12.promises.writeFile(caConfigFile, renderCaConfig(caRootDir));
+        if (!keyAvailable) {
+          await generatePrivateKeyFile2(privateKeyFile, this.keySize, { passphrase: await this._privateKeyPassphrase() });
+          restrictPrivateFilePermissions(privateKeyFile, 384);
         }
         await this._generateCSR(caRootDir, privateKeyFile, csrFile);
         return { status: "created", csrPath: csrFile };
@@ -3559,38 +4683,34 @@ var init_certificate_authority = __esm({
        *   renewal is needed, `"ready"` if the cert is still valid
        */
       async renewCSR(thresholdDays = 30) {
-        const caRootDir = path6.resolve(this.rootDir);
+        const caRootDir = path9.resolve(this.rootDir);
         const caCertFile = this.caCertificate;
-        const privateKeyFile = path6.join(caRootDir, "private/cakey.pem");
-        const csrFile = path6.join(caRootDir, "private/cakey.csr");
-        if (!fs10.existsSync(caCertFile)) {
+        const privateKeyFile = path9.join(caRootDir, "private/cakey.pem");
+        const csrFile = path9.join(caRootDir, "private/cakey.csr");
+        if (!fs12.existsSync(caCertFile)) {
           return this.initializeCSR();
         }
-        const certDer = convertPEMtoDER(readCertificatePEM(caCertFile));
+        const certDer = convertPEMtoDER2(readCertificatePEM2(caCertFile));
         const certInfo = exploreCertificate2(certDer);
         const notAfter = certInfo.tbsCertificate.validity.notAfter;
         const thresholdMs = thresholdDays * 24 * 60 * 60 * 1e3;
         if (notAfter.getTime() - Date.now() < thresholdMs) {
           debugLog(`CA certificate expires within ${thresholdDays} days \u2014 generating renewal CSR`);
-          await this._generateCSR(caRootDir, privateKeyFile, csrFile);
+          await this.#withCaLock(() => this._generateCSR(caRootDir, privateKeyFile, csrFile));
           return { status: "expired", csrPath: csrFile, expiryDate: notAfter };
         }
         return { status: "ready" };
       }
       /**
        * Generate a CSR using the existing private key.
+       * Must be called under {@link #withCaLock} — the lock is taken by the
+       * public callers (`initializeCSR`, `renewCSR`), not here, so that
+       * `initializeCSR` can hold one lock across key generation AND CSR
+       * generation without the non-reentrant file lock deadlocking.
        * @internal
        */
       async _generateCSR(caRootDir, privateKeyFile, csrFile) {
-        const subjectOpt = ` -subj "${this.subject.toString()}" `;
-        processAltNames({});
-        const options = { cwd: caRootDir };
-        const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-        const configOption = ` -config ${q4(n5(configFile))}`;
-        await execute_openssl(
-          "req -new -sha256  -text  -extensions v3_ca_req" + configOption + " -key " + q4(n5(privateKeyFile)) + " -out " + q4(n5(csrFile)) + " " + subjectOpt,
-          options
-        );
+        await this.#backend.generateCaCsr(this, caRootDir, privateKeyFile, csrFile);
       }
       /**
        * Install an externally-signed CA certificate and generate
@@ -3609,45 +4729,41 @@ var init_certificate_authority = __esm({
        *   `status: "success"` or `status: "error"` and a `reason`
        */
       async installCACertificate(signedCertFile) {
-        const caRootDir = path6.resolve(this.rootDir);
-        const caCertFile = this.caCertificate;
-        const privateKeyFile = path6.join(caRootDir, "private/cakey.pem");
-        const fullPem = await fs10.promises.readFile(signedCertFile, "utf8");
-        const pemBlocks = fullPem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
-        if (!pemBlocks || pemBlocks.length === 0) {
-          return {
-            status: "error",
-            reason: "no_certificate_found",
-            message: "The provided file does not contain any PEM-encoded certificate."
-          };
-        }
-        const certDer = convertPEMtoDER(pemBlocks[0]);
-        const privateKey = readPrivateKey(privateKeyFile);
-        if (!certificateMatchesPrivateKey(certDer, privateKey)) {
-          return {
-            status: "error",
-            reason: "certificate_key_mismatch",
-            message: "The provided certificate does not match the CA private key. Ensure the certificate was signed from the CSR generated by initializeCSR()."
-          };
-        }
-        await fs10.promises.writeFile(caCertFile, `${pemBlocks[0]}
+        return this.#withCaLock(async () => {
+          const caCertFile = this.caCertificate;
+          const fullPem = await fs12.promises.readFile(signedCertFile, "utf8");
+          const pemBlocks = fullPem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
+          if (!pemBlocks || pemBlocks.length === 0) {
+            return {
+              status: "error",
+              reason: "no_certificate_found",
+              message: "The provided file does not contain any PEM-encoded certificate."
+            };
+          }
+          const certDer = convertPEMtoDER2(pemBlocks[0]);
+          if (!await this.#certificateMatchesOurKey(pemBlocks[0], certDer)) {
+            return {
+              status: "error",
+              reason: "certificate_key_mismatch",
+              message: "The provided certificate does not match the CA private key. Ensure the certificate was signed from the CSR generated by initializeCSR()."
+            };
+          }
+          await fs12.promises.writeFile(caCertFile, `${pemBlocks[0]}
 `);
-        const issuerChainFile = this.issuerCertificateChain;
-        if (pemBlocks.length > 1) {
-          const issuerPem = `${pemBlocks.slice(1).join("\n")}
+          const issuerChainFile = this.issuerCertificateChain;
+          if (pemBlocks.length > 1) {
+            const issuerPem = `${pemBlocks.slice(1).join("\n")}
 `;
-          await fs10.promises.writeFile(issuerChainFile, issuerPem);
-          debugLog(`Stored ${pemBlocks.length - 1} issuer certificate(s) in issuer_chain.pem`);
-        } else {
-          if (fs10.existsSync(issuerChainFile)) {
-            await fs10.promises.unlink(issuerChainFile);
+            await fs12.promises.writeFile(issuerChainFile, issuerPem);
+            debugLog(`Stored ${pemBlocks.length - 1} issuer certificate(s) in issuer_chain.pem`);
+          } else {
+            if (fs12.existsSync(issuerChainFile)) {
+              await fs12.promises.unlink(issuerChainFile);
+            }
           }
-        }
-        const options = { cwd: caRootDir };
-        const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-        const configOption = ` -config ${q4(n5(configFile))}`;
-        await regenerateCrl(this.revocationList, configOption, options);
-        return { status: "success" };
+          await this.#backend.regenerateCrl(this);
+          return { status: "success" };
+        });
       }
       /**
        * Sign a CSR with CA extensions (`v3_ca`), producing a
@@ -3663,16 +4779,11 @@ var init_certificate_authority = __esm({
        * @param params - signing parameters
        */
       async signCACertificateRequest(certFile, csrFile, params) {
-        const caRootDir = path6.resolve(this.rootDir);
-        const options = { cwd: caRootDir };
-        this._wireRevocationEnvVars();
-        const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-        const validity = params.validity ?? 3650;
-        await execute_openssl(
-          ` x509 -sha256 -req -days ${validity} -text  -extensions v3_ca -extfile ` + q4(n5(configFile)) + " -in " + q4(n5(csrFile)) + " -CA " + q4(n5(this.caCertificate)) + " -CAkey " + q4(n5(path6.join(caRootDir, "private/cakey.pem"))) + " -CAserial " + q4(n5(path6.join(caRootDir, "serial"))) + " -out " + q4(n5(certFile)),
-          options
-        );
-        await this.constructCertificateChain(certFile);
+        await this.#withCaLock(async () => {
+          const validity = params.validity ?? 3650;
+          await this.#backend.signSubordinateCsr(this, csrFile, certFile, validity);
+          await this.constructCertificateChain(certFile);
+        });
       }
       /**
        * Rebuild the combined CA certificate + CRL file.
@@ -3683,13 +4794,13 @@ var init_certificate_authority = __esm({
        */
       async constructCACertificateWithCRL() {
         const cacertWithCRL = this.caCertificateWithCrl;
-        if (fs10.existsSync(this.revocationList)) {
-          await fs10.promises.writeFile(
+        if (fs12.existsSync(this.revocationList)) {
+          await fs12.promises.writeFile(
             cacertWithCRL,
-            fs10.readFileSync(this.caCertificate, "utf8") + fs10.readFileSync(this.revocationList, "utf8")
+            fs12.readFileSync(this.caCertificate, "utf8") + fs12.readFileSync(this.revocationList, "utf8")
           );
         } else {
-          await fs10.promises.writeFile(cacertWithCRL, fs10.readFileSync(this.caCertificate));
+          await fs12.promises.writeFile(cacertWithCRL, fs12.readFileSync(this.caCertificate));
         }
       }
       /**
@@ -3699,15 +4810,15 @@ var init_certificate_authority = __esm({
        * @param certificate - path to the certificate file to extend
        */
       async constructCertificateChain(certificate) {
-        assert10(fs10.existsSync(certificate));
-        assert10(fs10.existsSync(this.caCertificate));
+        assert9(fs12.existsSync(certificate));
+        assert9(fs12.existsSync(this.caCertificate));
         debugLog(chalk6.yellow("        certificate file :"), chalk6.cyan(certificate));
-        let chain = await fs10.promises.readFile(certificate, "utf8");
-        chain += await fs10.promises.readFile(this.caCertificate, "utf8");
-        if (fs10.existsSync(this.issuerCertificateChain)) {
-          chain += await fs10.promises.readFile(this.issuerCertificateChain, "utf8");
+        let chain = await fs12.promises.readFile(certificate, "utf8");
+        chain += await fs12.promises.readFile(this.caCertificate, "utf8");
+        if (fs12.existsSync(this.issuerCertificateChain)) {
+          chain += await fs12.promises.readFile(this.issuerCertificateChain, "utf8");
         }
-        await fs10.promises.writeFile(certificate, chain);
+        await fs12.promises.writeFile(certificate, chain);
       }
       /**
        * Create a self-signed certificate using OpenSSL.
@@ -3717,39 +4828,30 @@ var init_certificate_authority = __esm({
        * @param params - certificate parameters (subject, validity, SANs)
        */
       async createSelfSignedCertificate(certificateFile, privateKey, params) {
-        assert10(typeof privateKey === "string");
-        assert10(fs10.existsSync(privateKey));
+        assert9(typeof privateKey === "string");
+        assert9(fs12.existsSync(privateKey));
         if (!certificateFileExist(certificateFile)) {
           return;
         }
         adjustDate(params);
         adjustApplicationUri(params);
-        processAltNames(params);
-        const csrFile = `${certificateFile}_csr`;
-        assert10(csrFile);
-        const configFile = generateStaticConfig(this.configFile, { cwd: this.rootDir });
-        const options = {
-          cwd: this.rootDir,
-          openssl_conf: makePath(configFile)
-        };
-        const configOption = "";
-        const subject = params.subject ? new Subject4(params.subject).toString() : "";
-        const subjectOptions = subject && subject.length > 1 ? ` -subj ${subject} ` : "";
-        displaySubtitle("- the certificate signing request");
-        await execute_openssl(
-          "req  -new -sha256 -text " + configOption + subjectOptions + " -batch -key " + q4(n5(privateKey)) + " -out " + q4(n5(csrFile)),
-          options
-        );
-        displaySubtitle("- creating the self-signed certificate");
-        await execute_openssl(
-          "ca  -selfsign  -keyfile " + q4(n5(privateKey)) + " -startdate " + x509Date(params.startDate) + " -enddate " + x509Date(params.endDate) + " -batch -out " + q4(n5(certificateFile)) + " -in " + q4(n5(csrFile)),
-          options
-        );
-        displaySubtitle("- dump the certificate for a check");
-        await execute_openssl(`x509 -in ${q4(n5(certificateFile))}  -dates -fingerprint -purpose -noout`, {});
-        displaySubtitle("- verify self-signed certificate");
-        await execute_openssl_no_failure(`verify -verbose -CAfile ${q4(n5(certificateFile))} ${q4(n5(certificateFile))}`, options);
-        await fs10.promises.unlink(csrFile);
+        params.dns = params.dns || [];
+        params.ip = params.ip || [];
+        await this.#withCaLock(async () => {
+          await this.#backend.createSelfSignedCertificate(this, certificateFile, privateKey, params);
+        });
+      }
+      /**
+       * Regenerate `crl/revocation_list.{crl,der}` from the current database
+       * state, without changing any certificate's status. Normally
+       * unnecessary — `revokeCertificate` already regenerates the CRL as
+       * part of revoking — but useful to force a refresh (e.g. after
+       * switching a CA's `backend` between `"openssl"` and `"native"`).
+       */
+      async regenerateCrl() {
+        await this.#withCaLock(async () => {
+          await this.#backend.regenerateCrl(this);
+        });
       }
       /**
        * Revoke a certificate and regenerate the CRL.
@@ -3770,30 +4872,12 @@ var init_certificate_authority = __esm({
           "certificateHold",
           "removeFromCRL"
         ];
-        const configFile = generateStaticConfig("conf/caconfig.cnf", { cwd: this.rootDir });
-        const options = {
-          cwd: this.rootDir,
-          openssl_conf: makePath(configFile)
-        };
-        setEnv("ALTNAME", "");
-        const randomFile = path6.join(this.rootDir, "random.rnd");
-        setEnv("RANDFILE", randomFile);
-        const configOption = ` -config ${q4(n5(configFile))}`;
         const reason = params.reason || "keyCompromise";
-        assert10(crlReasons.indexOf(reason) >= 0);
+        assert9(crlReasons.indexOf(reason) >= 0);
         displayTitle(`Revoking certificate  ${certificate}`);
-        displaySubtitle("Revoke certificate");
-        await execute_openssl_no_failure(`ca -verbose ${configOption} -revoke ${q4(certificate)} -crl_reason ${reason}`, options);
-        await regenerateCrl(this.revocationList, configOption, options);
-        displaySubtitle("Verify that certificate is revoked");
-        await execute_openssl_no_failure(
-          "verify -verbose -CRLfile " + q4(n5(this.revocationList)) + " -CAfile " + q4(n5(this.caCertificate)) + " -crl_check " + q4(n5(certificate)),
-          options
-        );
-        displaySubtitle("Produce CRL in DER form ");
-        await execute_openssl(`crl  -in ${q4(n5(this.revocationList))} -out crl/revocation_list.der  -outform der`, options);
-        displaySubtitle("Produce CRL in PEM form ");
-        await execute_openssl(`crl  -in ${q4(n5(this.revocationList))} -out crl/revocation_list.pem  -outform pem -text `, options);
+        await this.#withCaLock(async () => {
+          await this.#backend.revoke(this, certificate, reason);
+        });
       }
       /**
        * Sign a Certificate Signing Request (CSR) with this CA.
@@ -3808,15 +4892,13 @@ var init_certificate_authority = __esm({
        * @returns the path to the signed certificate
        */
       async signCertificateRequest(certificate, certificateSigningRequestFilename, params1) {
-        await ensure_openssl_installed();
-        assert10(fs10.existsSync(certificateSigningRequestFilename));
+        await this.#backend.preflight();
+        assert9(fs12.existsSync(certificateSigningRequestFilename));
         if (!certificateFileExist(certificate)) {
           return "";
         }
         adjustDate(params1);
         adjustApplicationUri(params1);
-        processAltNames(params1);
-        const options = { cwd: this.rootDir };
         const csr = await readCertificateSigningRequest(certificateSigningRequestFilename);
         const csrInfo = exploreCertificateSigningRequest(csr);
         const applicationUri = csrInfo.extensionRequest.subjectAltName.uniformResourceIdentifier ? csrInfo.extensionRequest.subjectAltName.uniformResourceIdentifier[0] : void 0;
@@ -3826,61 +4908,122 @@ var init_certificate_authority = __esm({
         const dns2 = csrInfo.extensionRequest.subjectAltName.dNSName || [];
         let ip = csrInfo.extensionRequest.subjectAltName.iPAddress || [];
         ip = ip.map(octetStringToIpAddress);
-        const params = {
-          applicationUri,
-          dns: dns2,
-          ip
-        };
-        processAltNames(params);
-        this._wireRevocationEnvVars();
-        const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-        displaySubtitle("- then we ask the authority to sign the certificate signing request");
-        const configOption = ` -config ${configFile}`;
-        await execute_openssl(
-          "ca " + configOption + " -startdate " + x509Date(params1.startDate) + " -enddate " + x509Date(params1.endDate) + " -batch -out " + q4(n5(certificate)) + " -in " + q4(n5(certificateSigningRequestFilename)),
-          options
-        );
-        displaySubtitle("- dump the certificate for a check");
-        await execute_openssl(`x509 -in ${q4(n5(certificate))}  -dates -fingerprint -purpose -noout`, options);
-        displaySubtitle("- construct CA certificate with CRL");
-        await this.constructCACertificateWithCRL();
-        displaySubtitle("- construct certificate chain");
-        await this.constructCertificateChain(certificate);
-        displaySubtitle("- verify certificate against the root CA");
-        await this.verifyCertificate(certificate);
-        return certificate;
+        const sanOverride = { applicationUri, dns: dns2, ip };
+        return this.#withCaLock(async () => {
+          await this.#backend.signEndEntityCsr(this, certificate, certificateSigningRequestFilename, params1, sanOverride);
+          displaySubtitle("- construct CA certificate with CRL");
+          await this.constructCACertificateWithCRL();
+          displaySubtitle("- construct certificate chain");
+          await this.constructCertificateChain(certificate);
+          displaySubtitle("- verify certificate against the root CA");
+          await this.verifyCertificate(certificate);
+          return certificate;
+        });
       }
       /**
-       * Verify a certificate against this CA.
+       * Check that `certificate` really was signed by this CA, and throw if it
+       * was not.
        *
-       * @param certificate - path to the certificate file to verify
+       * This used to do nothing: `openssl verify` crashes on Windows, so the
+       * check was left as a placeholder. It no longer needs a subprocess -
+       * `verifyCertificateSignature` does it in pure JS, the same way
+       * {@link CertificateManager} already validates a chain - so the check
+       * that `signCertificateRequest` always claimed to perform now actually
+       * happens on every issuance, whichever backend did the signing.
+       *
+       * Only the leading certificate is examined: the file may be a chain,
+       * and the rest of it is this CA's own certificate and its issuers.
+       *
+       * @param certificate - path to the certificate (or chain) to verify
        */
       async verifyCertificate(certificate) {
-        const isImplemented = false;
-        if (isImplemented) {
-          const options = { cwd: this.rootDir };
-          const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-          setEnv("OPENSSL_CONF", makePath(configFile));
-          const _configOption = ` -config ${configFile}`;
-          _configOption;
-          await execute_openssl_no_failure(
-            `verify -verbose  -CAfile ${q4(n5(this.caCertificateWithCrl))} ${q4(n5(certificate))}`,
-            options
+        const pem = await fs12.promises.readFile(certificate, "utf-8");
+        const blocks = pem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
+        if (!blocks || blocks.length === 0) {
+          throw new Error(`verifyCertificate: ${certificate} contains no PEM-encoded certificate`);
+        }
+        const caCertificateDer = convertPEMtoDER2(readCertificatePEM2(this.caCertificate));
+        if (!verifyCertificateSignature2(convertPEMtoDER2(blocks[0]), caCertificateDer)) {
+          throw new Error(
+            `verifyCertificate: ${certificate} was not signed by this certificate authority (${this.caCertificate})`
+          );
+        }
+      }
+    };
+  }
+});
+
+// packages/node-opcua-pki/lib/ca/certificate_authority.ts
+var CertificateAuthority;
+var init_certificate_authority = __esm({
+  "packages/node-opcua-pki/lib/ca/certificate_authority.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_with_openssl();
+    init_native_ca_backend();
+    init_openssl_ca_backend();
+    init_certificate_authority_core();
+    init_certificate_authority_core();
+    CertificateAuthority = class extends CertificateAuthorityCore {
+      constructor(options) {
+        if (options.signer && options.backend === "openssl") {
+          throw new Error(
+            "CertificateAuthority: backend 'openssl' cannot be combined with 'signer' - the openssl CLI loads its key from a file and cannot call an external signer. Drop the backend option (a signer implies 'native') or drop the signer."
           );
         }
+        const backend = options.signer || options.backend === "native" ? new NativeCaBackend() : new OpenSslCaBackend();
+        super({ ...options, backend });
+      }
+      /**
+       * @internal `-passin env:` argv + env for an openssl call that loads
+       * this CA's key (always emitted, empty when none).
+       *
+       * The openssl backend builds its own now; this remains so that external
+       * code calling it keeps working, and lives here rather than on the core
+       * because the flag means nothing to a backend that spawns nothing.
+       */
+      async _opensslPassin() {
+        return passinArg(await this._privateKeyPassphrase());
+      }
+      /**
+       * @internal
+       * Legacy shim: publish the `CDP_URL` / `AIA_VALUE` config substitution
+       * values to the shared env registry, or unset them so the matching
+       * `{{#KEY}}...{{/KEY}}` blocks are stripped. Nothing in this package
+       * reads the registry any more - every openssl config render receives
+       * these values explicitly, from the same {@link caConfigEnvOverrides}
+       * builder this delegates to, so the two cannot drift - kept only for
+       * external code that renders openssl config templates against the
+       * registry directly.
+       *
+       * It lives on this class rather than the core because it is meaningful
+       * only to the openssl backend.
+       */
+      _wireRevocationEnvVars() {
+        const overrides = caConfigEnvOverrides(this);
+        if (overrides.CDP_URL) {
+          setEnv("CDP_URL", overrides.CDP_URL);
+        } else {
+          unsetEnv("CDP_URL");
+        }
+        if (overrides.AIA_VALUE) {
+          setEnv("AIA_VALUE", overrides.AIA_VALUE);
+        } else {
+          unsetEnv("AIA_VALUE");
+        }
       }
     };
   }
 });
 
 // packages/node-opcua-pki/lib/ca/crypto_create_CA.ts
-import assert11 from "assert";
-import fs11 from "fs";
+import assert10 from "assert";
+import fs13 from "fs";
 import { createRequire } from "module";
 import os5 from "os";
-import path7 from "path";
+import path10 from "path";
 import chalk7 from "chalk";
-import { CertificatePurpose as CertificatePurpose3, generatePrivateKeyFile as generatePrivateKeyFile3, Subject as Subject5 } from "node-opcua-crypto";
+import { CertificatePurpose as CertificatePurpose4, generatePrivateKeyFile as generatePrivateKeyFile3, Subject as Subject7 } from "node-opcua-crypto";
 import commandLineArgs from "command-line-args";
 import commandLineUsage from "command-line-usage";
 function get_offset_date(date, nbDays) {
@@ -3888,9 +5031,9 @@ function get_offset_date(date, nbDays) {
   d.setDate(d.getDate() + nbDays);
   return d;
 }
-async function construct_CertificateAuthority2(subject) {
-  assert11(typeof gLocalConfig.CAFolder === "string", "expecting a CAFolder in config");
-  assert11(typeof gLocalConfig.keySize === "number", "expecting a keySize in config");
+async function construct_CertificateAuthority(subject) {
+  assert10(typeof gLocalConfig.CAFolder === "string", "expecting a CAFolder in config");
+  assert10(typeof gLocalConfig.keySize === "number", "expecting a keySize in config");
   if (!g_certificateAuthority) {
     g_certificateAuthority = new CertificateAuthority({
       keySize: gLocalConfig.keySize,
@@ -3901,7 +5044,7 @@ async function construct_CertificateAuthority2(subject) {
   }
 }
 async function construct_CertificateManager() {
-  assert11(typeof gLocalConfig.PKIFolder === "string", "expecting a PKIFolder in config");
+  assert10(typeof gLocalConfig.PKIFolder === "string", "expecting a PKIFolder in config");
   if (!certificateManager) {
     certificateManager = new CertificateManager({
       keySize: gLocalConfig.keySize,
@@ -3912,35 +5055,35 @@ async function construct_CertificateManager() {
 }
 function default_template_content() {
   if (process.pkg?.entrypoint) {
-    const a = fs11.readFileSync(path7.join(__dirname, "../../bin/pki_config.example.js"), "utf8");
+    const a = fs13.readFileSync(path10.join(__dirname, "../../bin/pki_config.example.js"), "utf8");
     return a;
   }
   function find_default_config_template() {
     const rootFolder = find_module_root_folder();
     const configName = "pki_config.example.js";
-    let default_config_template2 = path7.join(rootFolder, "bin", configName);
-    if (!fs11.existsSync(default_config_template2)) {
-      default_config_template2 = path7.join(__dirname, "..", configName);
-      if (!fs11.existsSync(default_config_template2)) {
-        default_config_template2 = path7.join(__dirname, `../bin/${configName}`);
+    let default_config_template2 = path10.join(rootFolder, "bin", configName);
+    if (!fs13.existsSync(default_config_template2)) {
+      default_config_template2 = path10.join(__dirname, "..", configName);
+      if (!fs13.existsSync(default_config_template2)) {
+        default_config_template2 = path10.join(__dirname, `../bin/${configName}`);
       }
     }
     return default_config_template2;
   }
   const default_config_template = find_default_config_template();
-  assert11(fs11.existsSync(default_config_template));
-  const default_config_template_content = fs11.readFileSync(default_config_template, "utf8");
+  assert10(fs13.existsSync(default_config_template));
+  const default_config_template_content = fs13.readFileSync(default_config_template, "utf8");
   return default_config_template_content;
 }
 function find_module_root_folder() {
-  let rootFolder = path7.join(__dirname);
+  let rootFolder = path10.join(__dirname);
   for (let i = 0; i < 4; i++) {
-    if (fs11.existsSync(path7.join(rootFolder, "package.json"))) {
+    if (fs13.existsSync(path10.join(rootFolder, "package.json"))) {
       return rootFolder;
     }
-    rootFolder = path7.join(rootFolder, "..");
+    rootFolder = path10.join(rootFolder, "..");
   }
-  assert11(fs11.existsSync(path7.join(rootFolder, "package.json")), "root folder must have a package.json file");
+  assert10(fs13.existsSync(path10.join(rootFolder, "package.json")), "root folder must have a package.json file");
   return rootFolder;
 }
 async function readConfiguration(argv) {
@@ -3965,41 +5108,41 @@ async function readConfiguration(argv) {
     return str;
   }
   function prepare(file) {
-    const tmp = path7.resolve(performSubstitution(file));
+    const tmp = path10.resolve(performSubstitution(file));
     return makePath(tmp);
   }
   certificateDir = argv.root;
-  assert11(typeof certificateDir === "string");
+  assert10(typeof certificateDir === "string");
   certificateDir = prepare(certificateDir);
   mkdirRecursiveSync(certificateDir);
-  assert11(fs11.existsSync(certificateDir));
-  const default_config = path7.join(certificateDir, "config.js");
-  if (!fs11.existsSync(default_config)) {
+  assert10(fs13.existsSync(certificateDir));
+  const default_config = path10.join(certificateDir, "config.js");
+  if (!fs13.existsSync(default_config)) {
     debugLog(chalk7.yellow(" Creating default g_config file "), chalk7.cyan(default_config));
     const default_config_template_content = default_template_content();
-    fs11.writeFileSync(default_config, default_config_template_content);
+    fs13.writeFileSync(default_config, default_config_template_content);
   } else {
     debugLog(chalk7.yellow(" using  g_config file "), chalk7.cyan(default_config));
   }
-  if (!fs11.existsSync(default_config)) {
+  if (!fs13.existsSync(default_config)) {
     debugLog(chalk7.redBright(" cannot find config file ", default_config));
   }
-  const defaultRandomFile = path7.join(path7.dirname(default_config), "random.rnd");
+  const defaultRandomFile = path10.join(path10.dirname(default_config), "random.rnd");
   setEnv("RANDFILE", defaultRandomFile);
   const _require = createRequire(__filename);
   gLocalConfig = _require(default_config);
-  gLocalConfig.subject = new Subject5(gLocalConfig.subject || "");
+  gLocalConfig.subject = new Subject7(gLocalConfig.subject || "");
   if (argv.subject) {
-    gLocalConfig.subject = new Subject5(argv.subject);
+    gLocalConfig.subject = new Subject7(argv.subject);
   }
   if (!gLocalConfig.subject.commonName) {
     throw new Error("subject must have a Common Name");
   }
   gLocalConfig.certificateDir = certificateDir;
-  let CAFolder = argv.CAFolder || path7.join(certificateDir, "CA");
+  let CAFolder = argv.CAFolder || path10.join(certificateDir, "CA");
   CAFolder = prepare(CAFolder);
   gLocalConfig.CAFolder = CAFolder;
-  gLocalConfig.PKIFolder = path7.join(gLocalConfig.certificateDir, "PKI");
+  gLocalConfig.PKIFolder = path10.join(gLocalConfig.certificateDir, "PKI");
   if (argv.PKIFolder) {
     gLocalConfig.PKIFolder = prepare(argv.PKIFolder);
   }
@@ -4037,7 +5180,7 @@ async function readConfiguration(argv) {
   }
 }
 async function createDefaultCertificate(base_name, prefix, key_length, applicationUri, dev) {
-  assert11(key_length === 1024 || key_length === 2048 || key_length === 3072 || key_length === 4096);
+  assert10(key_length === 1024 || key_length === 2048 || key_length === 3072 || key_length === 4096);
   const private_key_file = makePath(base_name, `${prefix}key_${key_length}.pem`);
   const public_key_file = makePath(base_name, `${prefix}public_key_${key_length}.pub`);
   const certificate_file = makePath(base_name, `${prefix}cert_${key_length}.pem`);
@@ -4057,7 +5200,7 @@ async function createDefaultCertificate(base_name, prefix, key_length, applicati
   }
   const ip = [];
   async function createCertificateIfNotExist(certificate, private_key, applicationUri2, startDate, validity) {
-    if (fs11.existsSync(certificate)) {
+    if (fs13.existsSync(certificate)) {
       warningLog(chalk7.yellow("         certificate"), chalk7.cyan(certificate), chalk7.yellow(" already exists => skipping"));
       return "";
     } else {
@@ -4076,7 +5219,7 @@ async function createDefaultCertificate(base_name, prefix, key_length, applicati
       configFile,
       dns: dns3,
       ip: ip2,
-      purpose: CertificatePurpose3.ForApplication
+      purpose: CertificatePurpose4.ForApplication
     };
     await createCertificateSigningRequestWithOpenSSL(certificateSigningRequestFile, params);
     return await g_certificateAuthority.signCertificateRequest(certificate, certificateSigningRequestFile, {
@@ -4100,7 +5243,7 @@ async function createDefaultCertificate(base_name, prefix, key_length, applicati
     await g_certificateAuthority.revokeCertificate(certificate, {});
   }
   async function createPrivateKeyIfNotExist(privateKey, keyLength) {
-    if (fs11.existsSync(privateKey)) {
+    if (fs13.existsSync(privateKey)) {
       warningLog(chalk7.yellow("         privateKey"), chalk7.cyan(privateKey), chalk7.yellow(" already exists => skipping"));
       return;
     } else {
@@ -4114,14 +5257,14 @@ async function createDefaultCertificate(base_name, prefix, key_length, applicati
   displaySubtitle(` create Certificate ${certificate_file}`);
   await createCertificateIfNotExist(certificate_file, private_key_file, applicationUri, yesterday, 365);
   displaySubtitle(` create self signed Certificate ${self_signed_certificate_file}`);
-  if (fs11.existsSync(self_signed_certificate_file)) {
+  if (fs13.existsSync(self_signed_certificate_file)) {
     return;
   }
   await createSelfSignedCertificate2(self_signed_certificate_file, private_key_file, applicationUri, yesterday, 365);
   if (dev) {
     await createCertificateIfNotExist(certificate_file_outofdate, private_key_file, applicationUri, two_years_ago, 365);
     await createCertificateIfNotExist(certificate_file_not_active_yet, private_key_file, applicationUri, next_year, 365);
-    if (!fs11.existsSync(certificate_revoked)) {
+    if (!fs13.existsSync(certificate_revoked)) {
       const certificate = await createCertificateIfNotExist(
         certificate_revoked,
         private_key_file,
@@ -4131,7 +5274,7 @@ async function createDefaultCertificate(base_name, prefix, key_length, applicati
         365
       );
       warningLog(" certificate to revoke => ", certificate);
-      revoke_certificate(certificate_revoked);
+      await revoke_certificate(certificate_revoked);
     }
   }
 }
@@ -4143,13 +5286,13 @@ async function wrap(func) {
   }
 }
 async function create_default_certificates(dev) {
-  assert11(gLocalConfig);
+  assert10(gLocalConfig);
   const base_name = gLocalConfig.certificateDir || "";
-  assert11(fs11.existsSync(base_name));
+  assert10(fs13.existsSync(base_name));
   let clientURN;
   let serverURN;
   let discoveryServerURN;
-  wrap(async () => {
+  await wrap(async () => {
     await extractFullyQualifiedDomainName();
     const hostname = os5.hostname();
     const fqdn2 = getFullyQualifiedDomainName();
@@ -4176,7 +5319,7 @@ async function create_default_certificates(dev) {
   });
 }
 async function createDefaultCertificates(dev) {
-  await construct_CertificateAuthority2("");
+  await construct_CertificateAuthority("");
   await construct_CertificateManager();
   await create_default_certificates(dev);
 }
@@ -4242,7 +5385,7 @@ ${epilog}`
   }
   if (command === "version") {
     const rootFolder = find_module_root_folder();
-    const pkg = JSON.parse(fs11.readFileSync(path7.join(rootFolder, "package.json"), "utf-8"));
+    const pkg = JSON.parse(fs13.readFileSync(path10.join(rootFolder, "package.json"), "utf-8"));
     console.log(pkg.version);
     return;
   }
@@ -4267,12 +5410,12 @@ ${epilog}`
       await readConfiguration(local_argv);
       if (local_argv.clean) {
         displayTitle("Cleaning old certificates");
-        assert11(gLocalConfig);
+        assert10(gLocalConfig);
         const certificateDir = gLocalConfig.certificateDir || "";
-        const files = await fs11.promises.readdir(certificateDir);
+        const files = await fs13.promises.readdir(certificateDir);
         for (const file of files) {
           if (file.includes(".pem") || file.includes(".pub")) {
-            await fs11.promises.unlink(path7.join(certificateDir, file));
+            await fs13.promises.unlink(path10.join(certificateDir, file));
           }
         }
         mkdirRecursiveSync(certificateDir);
@@ -4293,7 +5436,7 @@ ${epilog}`
     await wrap(async () => {
       await ensure_openssl_installed();
       await readConfiguration(local_argv);
-      await construct_CertificateAuthority2(local_argv.subject);
+      await construct_CertificateAuthority(local_argv.subject);
     });
     return;
   }
@@ -4362,7 +5505,7 @@ ${epilog}`
       await readConfiguration(local_argv2);
       await construct_CertificateManager();
       displaySubtitle(` create self signed Certificate ${gLocalConfig.outputFile}`);
-      let subject = local_argv2.subject && local_argv2.subject.length > 1 ? new Subject5(local_argv2.subject) : gLocalConfig.subject || "";
+      let subject = local_argv2.subject && local_argv2.subject.length > 1 ? new Subject7(local_argv2.subject) : gLocalConfig.subject || "";
       subject = JSON.parse(JSON.stringify(subject));
       const params = {
         applicationUri: gLocalConfig.applicationUri || "",
@@ -4378,8 +5521,8 @@ ${epilog}`
     async function command_full_certificate(local_argv2) {
       await readConfiguration(local_argv2);
       await construct_CertificateManager();
-      await construct_CertificateAuthority2("");
-      assert11(fs11.existsSync(gLocalConfig.CAFolder || ""), " CA folder must exist");
+      await construct_CertificateAuthority("");
+      assert10(fs13.existsSync(gLocalConfig.CAFolder || ""), " CA folder must exist");
       gLocalConfig.privateKey = void 0;
       gLocalConfig.subject = local_argv2.subject && local_argv2.subject.length > 1 ? local_argv2.subject : gLocalConfig.subject;
       const csr_file = await certificateManager.createCertificateRequest(
@@ -4390,7 +5533,7 @@ ${epilog}`
       }
       warningLog(" csr_file = ", csr_file);
       const certificate = csr_file.replace(".csr", ".pem");
-      if (fs11.existsSync(certificate)) {
+      if (fs13.existsSync(certificate)) {
         throw new Error(` File ${certificate} already exist`);
       }
       await g_certificateAuthority.signCertificateRequest(
@@ -4398,8 +5541,8 @@ ${epilog}`
         csr_file,
         gLocalConfig
       );
-      assert11(typeof gLocalConfig.outputFile === "string");
-      fs11.writeFileSync(gLocalConfig.outputFile || "", fs11.readFileSync(certificate, "ascii"));
+      assert10(typeof gLocalConfig.outputFile === "string");
+      fs13.writeFileSync(gLocalConfig.outputFile || "", fs13.readFileSync(certificate, "ascii"));
     }
     await wrap(async () => await command_certificate(local_argv));
     return;
@@ -4418,13 +5561,13 @@ ${epilog}`
       await g_certificateAuthority.revokeCertificate(certificate, {});
     }
     await wrap(async () => {
-      const certificate = path7.resolve(local_argv.certificateFile);
+      const certificate = path10.resolve(local_argv.certificateFile);
       warningLog(chalk7.yellow(" Certificate to revoke : "), chalk7.cyan(certificate));
-      if (!fs11.existsSync(certificate)) {
+      if (!fs13.existsSync(certificate)) {
         throw new Error(`cannot find certificate to revoke ${certificate}`);
       }
       await readConfiguration(local_argv);
-      await construct_CertificateAuthority2("");
+      await construct_CertificateAuthority("");
       await revoke_certificate(certificate);
       warningLog("done ... ");
       warningLog("  crl = ", g_certificateAuthority.revocationList);
@@ -4467,11 +5610,11 @@ ${epilog}`
     if (local_argv.help) return showHelp("csr", "create a certificate signing request", optionsDef);
     await wrap(async () => {
       await readConfiguration(local_argv);
-      if (!fs11.existsSync(gLocalConfig.PKIFolder || "")) {
+      if (!fs13.existsSync(gLocalConfig.PKIFolder || "")) {
         warningLog("PKI folder must exist");
       }
       await construct_CertificateManager();
-      if (!gLocalConfig.outputFile || fs11.existsSync(gLocalConfig.outputFile)) {
+      if (!gLocalConfig.outputFile || fs13.existsSync(gLocalConfig.outputFile)) {
         throw new Error(` File ${gLocalConfig.outputFile} already exist`);
       }
       gLocalConfig.privateKey = void 0;
@@ -4486,8 +5629,8 @@ ${epilog}`
         warningLog("please specify a output file");
         return;
       }
-      const csr = await fs11.promises.readFile(internal_csr_file, "utf-8");
-      fs11.writeFileSync(gLocalConfig.outputFile || "", csr, "utf-8");
+      const csr = await fs13.promises.readFile(internal_csr_file, "utf-8");
+      fs13.writeFileSync(gLocalConfig.outputFile || "", csr, "utf-8");
       warningLog("Subject        = ", gLocalConfig.subject);
       warningLog("applicationUri = ", gLocalConfig.applicationUri);
       warningLog("altNames       = ", gLocalConfig.altNames);
@@ -4515,16 +5658,16 @@ ${epilog}`
       return showHelp("sign", "validate a certificate signing request and generate a certificate", optionsDef);
     await wrap(async () => {
       await readConfiguration(local_argv);
-      if (!fs11.existsSync(gLocalConfig.CAFolder || "")) {
+      if (!fs13.existsSync(gLocalConfig.CAFolder || "")) {
         throw new Error(`CA folder must exist:${gLocalConfig.CAFolder}`);
       }
-      await construct_CertificateAuthority2("");
-      const csr_file = path7.resolve(local_argv.csr || "");
-      if (!fs11.existsSync(csr_file)) {
+      await construct_CertificateAuthority("");
+      const csr_file = path10.resolve(local_argv.csr || "");
+      if (!fs13.existsSync(csr_file)) {
         throw new Error(`Certificate signing request doesn't exist: ${csr_file}`);
       }
-      const certificate = path7.resolve(local_argv.output || csr_file.replace(".csr", ".pem"));
-      if (fs11.existsSync(certificate)) {
+      const certificate = path10.resolve(local_argv.output || csr_file.replace(".csr", ".pem"));
+      if (fs13.existsSync(certificate)) {
         throw new Error(` File ${certificate} already exist`);
       }
       await g_certificateAuthority.signCertificateRequest(
@@ -4532,8 +5675,8 @@ ${epilog}`
         csr_file,
         gLocalConfig
       );
-      assert11(typeof gLocalConfig.outputFile === "string");
-      fs11.writeFileSync(gLocalConfig.outputFile || "", fs11.readFileSync(certificate, "ascii"));
+      assert10(typeof gLocalConfig.outputFile === "string");
+      fs13.writeFileSync(gLocalConfig.outputFile || "", fs13.readFileSync(certificate, "ascii"));
     });
     return;
   }