node-opcua-pki 6.20.0 → 6.22.0

package/dist/bin/pki.mjs

@@ -93,6 +93,9 @@ var init_hostname = __esm({
 
 // packages/node-opcua-pki/lib/toolbox/common.ts
 import assert2 from "assert";
+function isOpaqueSigner(privateKey) {
+  return typeof privateKey !== "string" && typeof privateKey.sign === "function";
+}
 async function resolvePrivateKeyPassphrase(passphrase) {
   if (passphrase === void 0) {
     return void 0;
@@ -276,8 +279,9 @@ async function createCertificateSigningRequestAsync(certificateSigningRequestFil
   assert4(typeof certificateSigningRequestFilename === "string");
   const subject = params.subject ? new Subject(params.subject).toString() : void 0;
   displaySubtitle("- Creating a Certificate Signing Request with subtile");
-  const privateKeyPem = typeof params.privateKey === "string" ? await fs2.promises.readFile(params.privateKey, "utf-8") : coercePrivateKeyPem(params.privateKey);
-  const privateKey = await pemToPrivateKey(privateKeyPem);
+  const privateKey = isOpaqueSigner(params.privateKey) ? params.privateKey : await pemToPrivateKey(
+    typeof params.privateKey === "string" ? await fs2.promises.readFile(params.privateKey, "utf-8") : coercePrivateKeyPem(params.privateKey)
+  );
   const { csr } = await createCertificateSigningRequest({
     privateKey,
     dns: params.dns,
@@ -287,13 +291,16 @@ async function createCertificateSigningRequestAsync(certificateSigningRequestFil
     purpose: params.purpose
   });
   await fs2.promises.writeFile(certificateSigningRequestFilename, csr, "utf-8");
-  display(`- privateKey ${typeof params.privateKey === "string" ? params.privateKey : "<in-memory>"}`);
+  display(
+    `- privateKey ${typeof params.privateKey === "string" ? params.privateKey : isOpaqueSigner(params.privateKey) ? "<opaque-signer>" : "<in-memory>"}`
+  );
   display(`- certificateSigningRequestFilename ${certificateSigningRequestFilename}`);
 }
 var init_create_certificate_signing_request = __esm({
   "packages/node-opcua-pki/lib/toolbox/without_openssl/create_certificate_signing_request.ts"() {
     "use strict";
     init_esm_shims();
+    init_common();
     init_display();
   }
 });
@@ -327,8 +334,9 @@ async function createSelfSignedCertificateAsync(certificate, params) {
   subject = subject.toString();
   const purpose = params.purpose;
   displayTitle("Generate a certificate request");
-  const privateKeyPem = typeof params.privateKey === "string" ? await fs3.promises.readFile(params.privateKey, "utf-8") : coercePrivateKeyPem2(params.privateKey);
-  const privateKey = await pemToPrivateKey2(privateKeyPem);
+  const privateKey = isOpaqueSigner(params.privateKey) ? params.privateKey : await pemToPrivateKey2(
+    typeof params.privateKey === "string" ? await fs3.promises.readFile(params.privateKey, "utf-8") : coercePrivateKeyPem2(params.privateKey)
+  );
   const { cert } = await createSelfSignedCertificate1({
     privateKey,
     notBefore: params.startDate,
@@ -383,11 +391,14 @@ import { drainPendingLocks, withLock } from "@ster5/global-mutex";
 import chalk3 from "chalk";
 import chokidar from "chokidar";
 import {
+  caSignerFromKeyOperations,
   exploreCertificate,
   exploreCertificateInfo,
   exploreCertificateRevocationList,
   generatePrivateKeyFile,
+  keyOperationsFromPrivateKey,
   makeSHA1Thumbprint,
+  PrivateKeyUnavailableError,
   readCertificateChain,
   readCertificateChainAsync,
   readCertificateRevocationList,
@@ -519,7 +530,31 @@ var init_certificate_manager = __esm({
       // even if the consumer forgets to call dispose().
       static #activeInstances = /* @__PURE__ */ new Set();
       static #cleanupInstalled = false;
-      static #installProcessCleanup() {
+      static #exitHandler;
+      /**
+       * Install a best-effort `exit` hook that closes any watcher
+       * still open when the process terminates.
+       *
+       * **This library never terminates the host process.** No
+       * SIGINT/SIGTERM handler is installed: deciding how (and
+       * whether) to shut down on a signal is the application's
+       * responsibility, and a listener registered here would both
+       * pre-empt the application's own graceful shutdown and
+       * silently suppress Node's default signal behaviour.
+       *
+       * Nothing here is load-bearing for process exit. The native
+       * `fs.watch` handles are `unref()`'d when the watchers are
+       * created (see `#readCertificates`), so an undisposed
+       * CertificateManager never keeps the event loop alive. This
+       * hook is only tidiness on the way out.
+       *
+       * `exit` rather than `beforeExit`: `beforeExit` fires when
+       * the loop merely drains and the loop can subsequently be
+       * resurrected, which would leave a still-in-use instance
+       * marked Disposed. `exit` is terminal, synchronous-only and
+       * cannot alter the exit code.
+       */
+      static #installExitCleanup() {
         if (_CertificateManager.#cleanupInstalled) return;
         _CertificateManager.#cleanupInstalled = true;
         const closeDanglingWatchers = () => {
@@ -535,13 +570,22 @@ var init_certificate_manager = __esm({
           }
           _CertificateManager.#activeInstances.clear();
         };
-        process.on("beforeExit", closeDanglingWatchers);
-        for (const signal of ["SIGINT", "SIGTERM"]) {
-          process.once(signal, () => {
-            closeDanglingWatchers();
-            process.exit();
-          });
+        _CertificateManager.#exitHandler = closeDanglingWatchers;
+        process.on("exit", closeDanglingWatchers);
+      }
+      /**
+       * Remove the `exit` hook once the last instance is disposed,
+       * so a library that is initialized and disposed repeatedly
+       * does not accumulate process listeners. A later
+       * `initialize()` re-arms it.
+       */
+      static #uninstallExitCleanupIfIdle() {
+        if (_CertificateManager.#activeInstances.size > 0) return;
+        if (_CertificateManager.#exitHandler) {
+          process.removeListener("exit", _CertificateManager.#exitHandler);
+          _CertificateManager.#exitHandler = void 0;
         }
+        _CertificateManager.#cleanupInstalled = false;
       }
       /**
        * Dispose **all** active CertificateManager instances,
@@ -607,6 +651,9 @@ var init_certificate_manager = __esm({
       #disableFileWatchers;
       #privateKeyPassphrase;
       #privateKeyProvider;
+      #keyOperations;
+      /** The stable lazy wrap handed out by {@link getKeyOperations} for non-opaque configurations. */
+      #lazyLocalKeyOperations;
       /**
        * The on-disk key, decrypted once and kept for the instance's lifetime,
        * so the passphrase (or its resolver function) is consulted at most
@@ -650,6 +697,17 @@ var init_certificate_manager = __esm({
         this.#disableFileWatchers = options.disableFileWatchers ?? process.env.OPCUA_PKI_DISABLE_FILE_WATCHERS === "true";
         this.#privateKeyPassphrase = options.privateKeyPassphrase;
         this.#privateKeyProvider = options.privateKeyProvider;
+        this.#keyOperations = options.keyOperations;
+        if (this.#keyOperations && this.#privateKeyProvider) {
+          throw new Error(
+            "CertificateManager: 'keyOperations' and 'privateKeyProvider' are mutually exclusive: one hides the key, the other sources its material"
+          );
+        }
+        if (this.#keyOperations && this.#privateKeyPassphrase) {
+          throw new Error(
+            "CertificateManager: 'privateKeyPassphrase' is meaningless with 'keyOperations': there is no key material for a passphrase to protect"
+          );
+        }
         mkdirRecursiveSync(options.location);
         if (!fs4.existsSync(this.#location)) {
           throw new Error(`CertificateManager cannot access location ${this.#location}`);
@@ -691,6 +749,11 @@ var init_certificate_manager = __esm({
        * authority on what the current key is.
        */
       async getPrivateKey() {
+        if (this.#keyOperations) {
+          throw new PrivateKeyUnavailableError(
+            "CertificateManager.getPrivateKey is not available when keyOperations is configured: the private key is held by the key-operations provider (HSM/KMS) and cannot be read \u2014 use getKeyOperations() instead"
+          );
+        }
         if (this.#privateKeyProvider) {
           return await this.#privateKeyProvider.getPrivateKey();
         }
@@ -716,6 +779,75 @@ var init_certificate_manager = __esm({
       }
       /** In-flight first read of the on-disk key, so concurrent callers share one passphrase resolution. */
       #privateKeyPromise;
+      /**
+       * True when this manager's key is opaque — configured through
+       * `keyOperations`, held by an HSM/KMS, never obtainable as material.
+       * When true, {@link getPrivateKey} throws `PrivateKeyUnavailableError`
+       * and {@link getKeyOperations} is the only way to use the key.
+       */
+      isPrivateKeyOpaque() {
+        return !!this.#keyOperations;
+      }
+      /**
+       * The key as an opaque {@link IKeyOperations} — the recommended way to
+       * *use* the private key regardless of where it lives.
+       *
+       * Returns the configured `keyOperations` object when the key is opaque.
+       * Otherwise returns a stable lazy wrap over {@link getPrivateKey}: its
+       * methods resolve the key on first use (disk read, passphrase,
+       * `privateKeyProvider` — all async), so the wrap offers no synchronous
+       * fast path; callers that need one resolve the key themselves and build
+       * a `LocalKeyOperations` over it. The wrap follows key rotation: a
+       * `privateKeyProvider` that starts returning a different key gets a
+       * fresh underlying `LocalKeyOperations`.
+       */
+      getKeyOperations() {
+        if (this.#keyOperations) {
+          return this.#keyOperations;
+        }
+        if (!this.#lazyLocalKeyOperations) {
+          let cached;
+          const resolve = async () => {
+            const key = await this.getPrivateKey();
+            if (!cached || cached.key !== key) {
+              cached = { key, ops: keyOperationsFromPrivateKey(key) };
+            }
+            return cached.ops;
+          };
+          this.#lazyLocalKeyOperations = {
+            sign: async (data, params) => (await resolve()).sign(data, params),
+            decryptBlock: async (block, params) => (await resolve()).decryptBlock(block, params),
+            getKeyMetadata: async () => (await resolve()).getKeyMetadata(),
+            getPublicKey: async () => (await resolve()).getPublicKey()
+          };
+        }
+        return this.#lazyLocalKeyOperations;
+      }
+      /**
+       * Fail closed at `initialize()` time, not on the first certificate
+       * operation, if the key cannot actually be used: wrong/missing
+       * passphrase on an encrypted key, a broken `privateKeyProvider`, or an
+       * unreachable `keyOperations` provider (probed via `getKeyMetadata`).
+       */
+      async #probePrivateKey() {
+        if (this.#keyOperations) {
+          await this.#keyOperations.getKeyMetadata();
+          return;
+        }
+        await this.getPrivateKey();
+      }
+      /**
+       * The key to hand to a certificate-issuance primitive: the raw
+       * {@link PrivateKey} for a local configuration, or a {@link CaSigner}
+       * adapted from `keyOperations` when the key is opaque — which requires
+       * the provider to implement `getPublicKey` (the adapter says so if not).
+       */
+      async #resolveSigningKey() {
+        if (this.#keyOperations) {
+          return caSignerFromKeyOperations(this.#keyOperations);
+        }
+        return await this.getPrivateKey();
+      }
       /**
        * Enable, disable, or rotate the passphrase protecting the on-disk
        * private key: decrypt with `oldPassphrase` (omit if the key is
@@ -737,6 +869,11 @@ var init_certificate_manager = __esm({
        * disk file for this method to rewrite).
        */
       async reencryptPrivateKey(oldPassphrase, newPassphrase) {
+        if (this.#keyOperations) {
+          throw new PrivateKeyUnavailableError(
+            "reencryptPrivateKey: not supported when keyOperations is configured \u2014 there is no key material to rewrite"
+          );
+        }
         if (this.#privateKeyProvider) {
           throw new Error("reencryptPrivateKey: not supported when a privateKeyProvider is configured");
         }
@@ -966,23 +1103,19 @@ var init_certificate_manager = __esm({
             return "BadCertificateUntrusted" /* BadCertificateUntrusted */;
           }
         }
-        const _c2 = chain[1] ? exploreCertificateInfo(chain[1]) : "non";
-        debugLog("chain[1] info=", _c2);
-        const certificateInfo = exploreCertificateInfo(chain[0]);
+        const { validity } = exploreCertificate(chain[0]).tbsCertificate;
         const now = /* @__PURE__ */ new Date();
         let isTimeInvalid = false;
-        if (certificateInfo.notBefore.getTime() > now.getTime()) {
+        if (validity.notBefore.getTime() > now.getTime()) {
           debugLog(
-            `${chalk3.red("certificate is invalid : certificate is not active yet !")} not before date =${certificateInfo.notBefore}`
+            `${chalk3.red("certificate is invalid : certificate is not active yet !")} not before date =${validity.notBefore}`
           );
           if (!options.acceptPendingCertificate) {
             isTimeInvalid = true;
           }
         }
-        if (certificateInfo.notAfter.getTime() <= now.getTime()) {
-          debugLog(
-            `${chalk3.red("certificate is invalid : certificate has expired !")} not after date =${certificateInfo.notAfter}`
-          );
+        if (validity.notAfter.getTime() <= now.getTime()) {
+          debugLog(`${chalk3.red("certificate is invalid : certificate has expired !")} not after date =${validity.notAfter}`);
           if (!options.acceptOutdatedCertificate) {
             isTimeInvalid = true;
           }
@@ -1021,7 +1154,7 @@ var init_certificate_manager = __esm({
         const chain = coerceCertificateChain(certificate);
         for (const element of chain) {
           try {
-            exploreCertificateInfo(element);
+            exploreCertificate(element);
           } catch (_err) {
             return "BadCertificateInvalid" /* BadCertificateInvalid */;
           }
@@ -1074,7 +1207,7 @@ var init_certificate_manager = __esm({
         this.#initializingPromise = void 0;
         this.state = 2 /* Initialized */;
         _CertificateManager.#activeInstances.add(this);
-        _CertificateManager.#installProcessCleanup();
+        _CertificateManager.#installExitCleanup();
       }
       async #initialize() {
         const pkiDir = this.#location;
@@ -1089,7 +1222,7 @@ var init_certificate_manager = __esm({
         mkdirRecursiveSync(path2.join(pkiDir, "issuers"));
         mkdirRecursiveSync(path2.join(pkiDir, "issuers/certs"));
         mkdirRecursiveSync(path2.join(pkiDir, "issuers/crl"));
-        const ownsDiskKey = !this.#privateKeyProvider;
+        const ownsDiskKey = !this.#privateKeyProvider && !this.#keyOperations;
         const needsKeyGeneration = ownsDiskKey && !fs4.existsSync(this.privateKey);
         const needsKeyEncryption = ownsDiskKey && !needsKeyGeneration && this.#privateKeyPassphrase !== void 0 && !isEncryptedPrivateKeyFile(this.privateKey);
         if (!fs4.existsSync(this.configFile) || needsKeyGeneration || needsKeyEncryption) {
@@ -1115,14 +1248,14 @@ var init_certificate_manager = __esm({
             if (ownsDiskKey) {
               restrictPrivateFilePermissions(this.privateKey, 384);
             }
-            await this.getPrivateKey();
+            await this.#probePrivateKey();
             await this.#readCertificates();
           });
         } else {
           if (ownsDiskKey) {
             restrictPrivateFilePermissions(this.privateKey, 384);
           }
-          await this.getPrivateKey();
+          await this.#probePrivateKey();
           await this.#readCertificates();
         }
       }
@@ -1161,6 +1294,7 @@ var init_certificate_manager = __esm({
           this.#cachedPrivateKey = void 0;
           this.#privateKeyPromise = void 0;
           _CertificateManager.#activeInstances.delete(this);
+          _CertificateManager.#uninstallExitCleanupIfIdle();
         }
       }
       /**
@@ -1206,7 +1340,7 @@ var init_certificate_manager = __esm({
         if (typeof params.applicationUri !== "string") {
           throw new Error("createSelfSignedCertificate: expecting applicationUri to be a string");
         }
-        if (!this.#privateKeyProvider && !fs4.existsSync(this.privateKey)) {
+        if (!this.#privateKeyProvider && !this.#keyOperations && !fs4.existsSync(this.privateKey)) {
           throw new Error(`Cannot find private key ${this.privateKey}`);
         }
         let certificateFilename = path2.join(this.rootDir, "own/certs/self_signed_certificate.pem");
@@ -1215,7 +1349,7 @@ var init_certificate_manager = __esm({
           ...params,
           rootDir: this.rootDir,
           configFile: this.configFile,
-          privateKey: await this.getPrivateKey(),
+          privateKey: await this.#resolveSigningKey(),
           subject: params.subject || "CN=FIXME"
         };
         await this.withLock2(async () => {
@@ -1243,7 +1377,7 @@ var init_certificate_manager = __esm({
           ...params,
           rootDir: path2.resolve(this.rootDir),
           configFile: path2.resolve(this.configFile),
-          privateKey: await this.getPrivateKey()
+          privateKey: await this.#resolveSigningKey()
         };
         return await this.withLock2(async () => {
           const now = /* @__PURE__ */ new Date();
@@ -1509,17 +1643,12 @@ var init_certificate_manager = __esm({
             return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
           }
           if (!opts.acceptExpiredCertificate) {
-            let certDetails;
-            try {
-              certDetails = exploreCertificateInfo(currentCert);
-            } catch (_err) {
-              return "BadCertificateInvalid" /* BadCertificateInvalid */;
-            }
+            const { validity } = currentInfo.tbsCertificate;
             const now = /* @__PURE__ */ new Date();
-            if (certDetails.notBefore.getTime() > now.getTime()) {
+            if (validity.notBefore.getTime() > now.getTime()) {
               return "BadCertificateTimeInvalid" /* BadCertificateTimeInvalid */;
             }
-            if (certDetails.notAfter.getTime() <= now.getTime()) {
+            if (validity.notAfter.getTime() <= now.getTime()) {
               return depth === 1 ? "BadCertificateTimeInvalid" /* BadCertificateTimeInvalid */ : "BadCertificateIssuerTimeInvalid" /* BadCertificateIssuerTimeInvalid */;
             }
           }
@@ -1869,6 +1998,7 @@ var init_certificate_manager = __esm({
         const chokidarOptions = {
           usePolling,
           ...usePolling ? { interval: pollingInterval } : {},
+          depth: 0,
           persistent: false
         };
         const allCapturedHandles = [];
@@ -2145,21 +2275,17 @@ function getEnvironmentVarNames() {
     return { key: varName, pattern: `\\$ENV\\:\\:${varName}` };
   });
 }
+function buildSubjectAltNameString(params) {
+  return [
+    `URI:${params.applicationUri}`,
+    ...(params.dns ?? []).map((d) => `DNS:${d}`),
+    ...(params.ip ?? []).map((d) => `IP:${d}`)
+  ].join(", ");
+}
 function processAltNames(params) {
   params.dns = params.dns || [];
   params.ip = params.ip || [];
-  let subjectAltName = [];
-  subjectAltName.push(`URI:${params.applicationUri}`);
-  subjectAltName = [].concat(
-    subjectAltName,
-    params.dns.map((d) => `DNS:${d}`)
-  );
-  subjectAltName = [].concat(
-    subjectAltName,
-    params.ip.map((d) => `IP:${d}`)
-  );
-  const subjectAltNameString = subjectAltName.join(", ");
-  setEnv("ALTNAME", subjectAltNameString);
+  setEnv("ALTNAME", buildSubjectAltNameString(params));
 }
 var SAFE_ENV_PASSTHROUGH, exportedEnvVars;
 var init_env = __esm({
@@ -2511,9 +2637,6 @@ import chalk5 from "chalk";
 function passinArg(passphrase = "") {
   return { args: ["-passin", `env:${PASSIN_ENV_VAR}`], env: { [PASSIN_ENV_VAR]: passphrase } };
 }
-function passoutArg(passphrase = "") {
-  return { args: ["-passout", `env:${PASSOUT_ENV_VAR}`], env: { [PASSOUT_ENV_VAR]: passphrase } };
-}
 function renderForDisplay(file, args) {
   return [file, ...args].map((a) => a === "" || /[\s"'`$\\]/.test(a) ? JSON.stringify(a) : a).join(" ");
 }
@@ -2534,7 +2657,7 @@ async function execute2(file, args, options) {
       stdio: ["ignore", "pipe", "pipe"]
     });
     const fail = (message) => {
-      if (!options.hideErrorMessage) {
+      if (!options.hideErrorMessage && !g_config.silent) {
         const fence = "###########################################";
         console.error(chalk5.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
         console.error(chalk5.bgWhiteBright.redBright(`CWD = ${options.cwd}`));
@@ -2628,7 +2751,7 @@ async function execute_openssl(args, options) {
   await ensure_openssl_installed();
   return await execute2(opensslPath, args, options);
 }
-var opensslPath, n, PASSIN_ENV_VAR, PASSOUT_ENV_VAR;
+var opensslPath, n, PASSIN_ENV_VAR;
 var init_execute_openssl = __esm({
   "packages/node-opcua-pki/lib/toolbox/with_openssl/execute_openssl.ts"() {
     "use strict";
@@ -2640,7 +2763,6 @@ var init_execute_openssl = __esm({
     init_install_prerequisite();
     n = makePath;
     PASSIN_ENV_VAR = "NODE_OPCUA_PKI_OPENSSL_PASSIN";
-    PASSOUT_ENV_VAR = "NODE_OPCUA_PKI_OPENSSL_PASSOUT";
   }
 });
 
@@ -2656,19 +2778,27 @@ function openssl_require2DigitYearInDate() {
   }
   return g_config.opensslVersion.match(/OpenSSL 0\.9/);
 }
-function stripConditionalBlocks(template) {
+function stripConditionalBlocks(template, envOverrides) {
   return template.replace(/\{\{#([A-Z_][A-Z0-9_]*)\}\}([\s\S]*?)\{\{\/\1\}\}\r?\n?/g, (_match, key, content) => {
-    const keep = hasEnv(key) && getEnv(key) !== "";
+    const keep = envOverrides && Object.prototype.hasOwnProperty.call(envOverrides, key) ? envOverrides[key] !== "" : hasEnv(key) && getEnv(key) !== "";
     return keep ? content : "";
   });
 }
-function generateStaticConfig(configPath, options) {
+function generateStaticConfig(configPath, options, envOverrides) {
   const prePath = options?.cwd || "";
   const originalFilename = !path4.isAbsolute(configPath) ? path4.join(prePath, configPath) : configPath;
   let staticConfig = fs7.readFileSync(originalFilename, { encoding: "utf8" });
-  staticConfig = stripConditionalBlocks(staticConfig);
+  staticConfig = stripConditionalBlocks(staticConfig, envOverrides);
   for (const envVar of getEnvironmentVarNames()) {
-    staticConfig = staticConfig.replace(new RegExp(envVar.pattern, "gi"), getEnv(envVar.key));
+    if (envOverrides && Object.prototype.hasOwnProperty.call(envOverrides, envVar.key)) {
+      continue;
+    }
+    staticConfig = staticConfig.replace(new RegExp(envVar.pattern, "gi"), () => getEnv(envVar.key));
+  }
+  if (envOverrides) {
+    for (const [key, value] of Object.entries(envOverrides)) {
+      staticConfig = staticConfig.replace(new RegExp(`\\$ENV\\:\\:${key}`, "gi"), () => value);
+    }
   }
   const staticConfigPath = `${configPath}.${process.pid}-${_counter++}.tmp`;
   const temporaryConfigPath = !path4.isAbsolute(configPath) ? path4.join(prePath, staticConfigPath) : staticConfigPath;
@@ -2679,6 +2809,9 @@ function generateStaticConfig(configPath, options) {
     return temporaryConfigPath;
   }
 }
+async function cleanupStaticConfig(configFile, options) {
+  await fs7.promises.rm(path4.resolve(options?.cwd ?? "", configFile), { force: true });
+}
 async function getPublicKeyFromPrivateKey(privateKeyFilename, publicKeyFilename, passphrase) {
   assert7(fs7.existsSync(privateKeyFilename));
   const passin = passinArg(passphrase);
@@ -2747,26 +2880,30 @@ async function createCertificateSigningRequestWithOpenSSL(certificateSigningRequ
   assert8(typeof certificateSigningRequestFilename === "string");
   processAltNames(params);
   const configFile = generateStaticConfig(params.configFile, { cwd: params.rootDir });
-  const options = { cwd: params.rootDir, openssl_conf: path5.relative(params.rootDir, configFile) };
-  const subject = params.subject ? new Subject3(params.subject).toString() : void 0;
-  displaySubtitle("- Creating a Certificate Signing Request with openssl");
-  await execute_openssl(
-    [
-      "req",
-      "-new",
-      "-sha256",
-      "-batch",
-      "-text",
-      "-config",
-      n3(configFile),
-      "-key",
-      n3(params.privateKey),
-      ...subject ? ["-subj", subject] : [],
-      "-out",
-      n3(certificateSigningRequestFilename)
-    ],
-    options
-  );
+  try {
+    const options = { cwd: params.rootDir, openssl_conf: path5.relative(params.rootDir, configFile) };
+    const subject = params.subject ? new Subject3(params.subject).toString() : void 0;
+    displaySubtitle("- Creating a Certificate Signing Request with openssl");
+    await execute_openssl(
+      [
+        "req",
+        "-new",
+        "-sha256",
+        "-batch",
+        "-text",
+        "-config",
+        n3(configFile),
+        "-key",
+        n3(params.privateKey),
+        ...subject ? ["-subj", subject] : [],
+        "-out",
+        n3(certificateSigningRequestFilename)
+      ],
+      options
+    );
+  } finally {
+    await cleanupStaticConfig(configFile, { cwd: params.rootDir });
+  }
 }
 var n3;
 var init_create_certificate_signing_request2 = __esm({
@@ -2797,57 +2934,875 @@ var init_with_openssl = __esm({
   }
 });
 
-// packages/node-opcua-pki/lib/pki/toolbox_pfx.ts
-import assert9 from "assert";
+// packages/node-opcua-pki/lib/ca/core/ca_database.ts
 import fs9 from "fs";
-async function createPFX(options) {
-  const { certificateFile, privateKeyFile, privateKeyPassphrase, outputFile, passphrase = "", caCertificateFiles } = options;
-  assert9(fs9.existsSync(certificateFile), `Certificate file does not exist: ${certificateFile}`);
-  assert9(fs9.existsSync(privateKeyFile), `Private key file does not exist: ${privateKeyFile}`);
-  const args = ["pkcs12", "-export", "-in", n4(certificateFile), "-inkey", n4(privateKeyFile)];
-  if (caCertificateFiles) {
-    for (const caFile of caCertificateFiles) {
-      assert9(fs9.existsSync(caFile), `CA certificate file does not exist: ${caFile}`);
-      args.push("-certfile", n4(caFile));
-    }
+import path6 from "path";
+import { convertPEMtoDER, readCertificatePEM } from "node-opcua-crypto";
+function parseOpenSSLDate(dateStr) {
+  const raw = dateStr?.split(",")[0] ?? "";
+  if (raw.length < 12) return "";
+  const yy = parseInt(raw.substring(0, 2), 10);
+  const year = yy >= 70 ? 1900 + yy : 2e3 + yy;
+  const month = raw.substring(2, 4);
+  const day = raw.substring(4, 6);
+  const hour = raw.substring(6, 8);
+  const min = raw.substring(8, 10);
+  const sec = raw.substring(10, 12);
+  return `${year}-${month}-${day}T${hour}:${min}:${sec}Z`;
+}
+function formatOpenSSLDate(date) {
+  const yy = String(date.getUTCFullYear() % 100).padStart(2, "0");
+  const mm = String(date.getUTCMonth() + 1).padStart(2, "0");
+  const dd = String(date.getUTCDate()).padStart(2, "0");
+  const hh = String(date.getUTCHours()).padStart(2, "0");
+  const mi = String(date.getUTCMinutes()).padStart(2, "0");
+  const ss = String(date.getUTCSeconds()).padStart(2, "0");
+  return `${yy}${mm}${dd}${hh}${mi}${ss}Z`;
+}
+function parseRevocationReason(dateStr) {
+  const parts = dateStr?.split(",");
+  return parts && parts.length > 1 ? parts[1] : void 0;
+}
+function evenLengthHex(value) {
+  const hex = value.toString(16).toUpperCase();
+  return hex.length % 2 === 0 ? hex : `0${hex}`;
+}
+function escapeIndexField(value) {
+  return value.replace(/[\x00-\x1f\x7f\\]/g, (c) => `\\x${c.charCodeAt(0).toString(16).toUpperCase().padStart(2, "0")}`);
+}
+function assertHexSerial(serial) {
+  if (!/^[0-9A-Fa-f]+$/.test(serial)) {
+    throw new Error(`Invalid certificate serial number: ${JSON.stringify(serial)}`);
   }
-  const passin = passinArg(privateKeyPassphrase);
-  const passout = passoutArg(passphrase);
-  args.push("-out", n4(outputFile), ...passin.args, ...passout.args);
-  await execute_openssl(args, { env: { ...passin.env, ...passout.env } });
+  return serial.toUpperCase();
 }
-var n4;
-var init_toolbox_pfx = __esm({
-  "packages/node-opcua-pki/lib/pki/toolbox_pfx.ts"() {
+var CaDatabase;
+var init_ca_database = __esm({
+  "packages/node-opcua-pki/lib/ca/core/ca_database.ts"() {
     "use strict";
     init_esm_shims();
-    init_common2();
-    init_execute_openssl();
-    n4 = makePath;
+    CaDatabase = class {
+      #rootDir;
+      constructor(rootDir) {
+        this.#rootDir = rootDir;
+      }
+      /** Path to the OpenSSL certificate database file (`index.txt`). */
+      get indexFile() {
+        return path6.join(this.#rootDir, "index.txt");
+      }
+      /**
+       * Parse the OpenSSL `index.txt` certificate database.
+       *
+       * Each line has tab-separated fields:
+       * ```
+       * status  expiry  [revocationDate]  serial  unknown  subject
+       * ```
+       *
+       * - status: `V` (valid), `R` (revoked), `E` (expired)
+       * - expiry: `YYMMDDHHmmssZ`
+       * - revocationDate: present only for revoked certs
+       * - serial: hex string
+       * - unknown: always `"unknown"`
+       * - subject: X.500 slash-delimited string
+       */
+      readIndex() {
+        const indexPath = this.indexFile;
+        if (!fs9.existsSync(indexPath)) {
+          return [];
+        }
+        const content = fs9.readFileSync(indexPath, "utf-8");
+        const lines = content.split("\n").filter((l) => l.trim().length > 0);
+        const records = [];
+        for (const line of lines) {
+          const fields = line.split("	");
+          if (fields.length < 4) continue;
+          const statusChar = fields[0];
+          const expiryStr = fields[1];
+          let serial;
+          let subject;
+          let revocationDate;
+          if (statusChar === "R") {
+            revocationDate = fields[2];
+            serial = fields[3];
+            subject = fields.length >= 6 ? fields[5] : "";
+          } else {
+            serial = fields[3];
+            subject = fields.length >= 6 ? fields[5] : "";
+          }
+          let status;
+          switch (statusChar) {
+            case "V":
+              status = "valid";
+              break;
+            case "R":
+              status = "revoked";
+              break;
+            case "E":
+              status = "expired";
+              break;
+            default:
+              continue;
+          }
+          records.push({
+            serial,
+            status,
+            subject,
+            expiryDate: parseOpenSSLDate(expiryStr),
+            revocationDate: revocationDate ? parseOpenSSLDate(revocationDate) : void 0,
+            reason: revocationDate ? parseRevocationReason(revocationDate) : void 0
+          });
+        }
+        return records;
+      }
+      /** Look up one record by serial number (case-insensitive). */
+      findBySerial(serial) {
+        const upper = serial.toUpperCase();
+        return this.readIndex().find((r) => r.serial.toUpperCase() === upper);
+      }
+      /**
+       * Read a specific issued certificate by serial number.
+       *
+       * OpenSSL stores signed certificates in the `certs/` directory using
+       * the naming convention `<SERIAL>.pem`.
+       *
+       * @param serial - hex-encoded serial number (e.g. `"1000"`)
+       * @returns the DER buffer, or `undefined` if not found
+       */
+      getCertificateBySerial(serial) {
+        const upper = serial.toUpperCase();
+        const certFile = path6.join(this.#rootDir, "certs", `${upper}.pem`);
+        if (!fs9.existsSync(certFile)) {
+          return void 0;
+        }
+        const pem = readCertificatePEM(certFile);
+        return convertPEMtoDER(pem);
+      }
+      /**
+       * Read-increment-write a hex counter file (`serial`/`crlnumber`),
+       * returning the value to hand out — matching `openssl ca`'s own
+       * behavior: the file holds the *next* value to assign, and is bumped
+       * to the following one immediately after being read. A `.old` backup
+       * of the pre-bump content is kept, as `openssl` itself does.
+       */
+      #nextHexCounter(fileName) {
+        const counterFile = path6.join(this.#rootDir, fileName);
+        const current = BigInt(`0x${fs9.readFileSync(counterFile, "utf-8").trim()}`);
+        fs9.copyFileSync(counterFile, `${counterFile}.old`);
+        fs9.writeFileSync(counterFile, evenLengthHex(current + 1n));
+        return evenLengthHex(current);
+      }
+      /** Hand out the next certificate serial number, bumping the `serial` file. */
+      nextSerial() {
+        return this.#nextHexCounter("serial");
+      }
+      /** Hand out the next CRL number, bumping the `crlnumber` file. */
+      nextCrlNumber() {
+        return this.#nextHexCounter("crlnumber");
+      }
+      /** Append a newly-issued certificate's `V` (valid) row to `index.txt`. */
+      appendIssued(record) {
+        const serial = assertHexSerial(record.serial);
+        const subject = escapeIndexField(record.subject);
+        const line = `V	${formatOpenSSLDate(record.expiryDate)}		${serial}	unknown	${subject}
+`;
+        fs9.appendFileSync(this.indexFile, line);
+      }
+      /**
+       * Rewrite a certificate's `index.txt` row from `V` to `R` (revoked).
+       * Throws if the serial is not found, or is already revoked — the same
+       * "already revoked" case `openssl ca -revoke` itself rejects.
+       */
+      markRevoked(serial, revocationDate, reason) {
+        const upper = assertHexSerial(serial);
+        if (!/^[A-Za-z]+$/.test(reason)) {
+          throw new Error(`Invalid CRL reason: ${JSON.stringify(reason)}`);
+        }
+        const lines = fs9.readFileSync(this.indexFile, "utf-8").split("\n").filter((l) => l.trim().length > 0);
+        let found = false;
+        const rewritten = lines.map((line) => {
+          const fields = line.split("	");
+          if (fields.length < 4 || fields[3]?.toUpperCase() !== upper) {
+            return line;
+          }
+          if (fields[0] === "R") {
+            throw new Error(`Certificate ${upper} is already revoked`);
+          }
+          found = true;
+          const subject = fields.length >= 6 ? fields[5] : "";
+          return `R	${fields[1]}	${formatOpenSSLDate(revocationDate)},${reason}	${upper}	unknown	${subject}`;
+        });
+        if (!found) {
+          throw new Error(`Certificate ${upper} not found in the certificate database`);
+        }
+        fs9.writeFileSync(this.indexFile, `${rewritten.join("\n")}
+`);
+      }
+      /** Store a signed certificate's PEM under `certs/<SERIAL>.pem`, as `openssl ca` does. */
+      storeCertificate(serial, pem) {
+        const certFile = path6.join(this.#rootDir, "certs", `${assertHexSerial(serial)}.pem`);
+        fs9.writeFileSync(certFile, pem);
+      }
+    };
   }
 });
 
-// packages/node-opcua-pki/lib/ca/templates/ca_config_template.cnf.ts
-var config2, ca_config_template_cnf_default;
-var init_ca_config_template_cnf = __esm({
-  "packages/node-opcua-pki/lib/ca/templates/ca_config_template.cnf.ts"() {
+// packages/node-opcua-pki/lib/ca/backends/native_ca_backend.ts
+import fs10 from "fs";
+import path7 from "path";
+import {
+  CertificatePurpose as CertificatePurpose2,
+  createCertificateFromCsr,
+  createCertificateSigningRequest as createCertificateSigningRequest2,
+  createCrl,
+  isCaSigner,
+  privateKeyToCryptoKey,
+  readPrivateKey as readPrivateKey2,
+  Subject as Subject4,
+  x509
+} from "node-opcua-crypto";
+function signingAlgorithmOf(key) {
+  return isCaSigner(key) ? key.algorithm : RSA_SHA256;
+}
+function daysFromNow(notBefore, days) {
+  return new Date(notBefore.getTime() + days * 24 * 60 * 60 * 1e3);
+}
+function caSanUri(ca) {
+  return `urn:${ca.subject.commonName || "NodeOPCUA-CA"}`;
+}
+function sanFromCsr(csrPem) {
+  const request = new x509.Pkcs10CertificateRequest(csrPem);
+  const extension = request.getExtension("2.5.29.17");
+  const dns2 = [];
+  const ip = [];
+  let applicationUri;
+  for (const name of extension?.names.toJSON() ?? []) {
+    if (name.type === "dns") {
+      dns2.push(name.value);
+    } else if (name.type === "ip") {
+      ip.push(name.value);
+    } else if (name.type === "url" && applicationUri === void 0) {
+      applicationUri = name.value;
+    }
+  }
+  return { dns: dns2, ip, applicationUri };
+}
+function toOpenSslSubjectString(subjectName) {
+  const parts = [];
+  for (const rdn of subjectName.toJSON()) {
+    for (const [type, values] of Object.entries(rdn)) {
+      for (const value of values) {
+        parts.push(`${type}=${value}`);
+      }
+    }
+  }
+  return `/${parts.join("/")}`;
+}
+var CA_CERT_VALIDITY_DAYS, RSA_SHA256, REASON_TO_X509_CRL_REASON, NativeCaBackend;
+var init_native_ca_backend = __esm({
+  "packages/node-opcua-pki/lib/ca/backends/native_ca_backend.ts"() {
     "use strict";
     init_esm_shims();
-    config2 = `#.........DO NOT MODIFY BY HAND .........................
-[ ca ]
-default_ca               = CA_default
-[ CA_default ]
-dir                      = "%%ROOT_FOLDER%%"        # the main CA folder (quoted: see renderCaConfig)
-certs                    = $dir/certs                 # where to store certificates
-new_certs_dir            = $dir/certs                 #
-database                 = $dir/index.txt             # the certificate database
-serial                   = $dir/serial                # the serial number counter
-certificate              = $dir/public/cacert.pem     # The root CA certificate
-private_key              = $dir/private/cakey.pem     # the CA private key
-x509_extensions          = usr_cert                   #
-default_days             = 3650                       # default validity : 10 years
+    init_toolbox();
+    init_ca_database();
+    CA_CERT_VALIDITY_DAYS = 3650;
+    RSA_SHA256 = { name: "RSASSA-PKCS1-v1_5", hash: { name: "SHA-256" } };
+    REASON_TO_X509_CRL_REASON = {
+      unspecified: x509.X509CrlReason.unspecified,
+      keyCompromise: x509.X509CrlReason.keyCompromise,
+      CACompromise: x509.X509CrlReason.cACompromise,
+      affiliationChanged: x509.X509CrlReason.affiliationChanged,
+      superseded: x509.X509CrlReason.superseded,
+      cessationOfOperation: x509.X509CrlReason.cessationOfOperation,
+      certificateHold: x509.X509CrlReason.certificateHold,
+      removeFromCRL: x509.X509CrlReason.removeFromCRL
+    };
+    NativeCaBackend = class {
+      /** Nothing to check: this backend spawns no process and needs no tool on PATH. */
+      /** Signing goes through `ca._getSigningKey()`, which may be an external signer. */
+      supportsExternalSigner = true;
+      async preflight() {
+      }
+      /**
+       * Write a CSR for the CA's own key, the `[v3_ca_req]` equivalent. The
+       * key comes from the CA rather than from `privateKeyFile`: on a
+       * signer-backed CA that file does not exist.
+       */
+      async generateCaCsr(ca, _caRootDir, _privateKeyFile, csrFile) {
+        displayTitle("Generate a certificate request for the CA key");
+        const signingKey = await ca._getSigningKey();
+        const { csr } = await createCertificateSigningRequest2({
+          privateKey: signingKey,
+          subject: ca.subject.toString(),
+          applicationUri: caSanUri(ca),
+          purpose: CertificatePurpose2.ForCertificateAuthority
+        });
+        await fs10.promises.writeFile(csrFile, csr);
+      }
+      async bootstrap(ca) {
+        const caRootDir = path7.resolve(ca.rootDir);
+        const csrFile = path7.join(caRootDir, "private/cakey.csr");
+        await this.generateCaCsr(ca, caRootDir, path7.join(caRootDir, "private/cakey.pem"), csrFile);
+        const issuerCA = ca._issuerCA;
+        if (issuerCA) {
+          displayTitle("Generate CA Certificate (signed by issuer CA)");
+          const signWithIssuer = () => this.signSubordinateCsr(issuerCA, csrFile, ca.caCertificate, CA_CERT_VALIDITY_DAYS);
+          if (path7.resolve(issuerCA.rootDir) === caRootDir) {
+            await signWithIssuer();
+          } else {
+            await issuerCA._withCaDirectoryLock(signWithIssuer);
+          }
+        } else {
+          displayTitle("Generate CA Certificate (self-signed)");
+          const csrPem = await fs10.promises.readFile(csrFile, "utf-8");
+          const signingKey = await ca._getSigningKey();
+          const request = new x509.Pkcs10CertificateRequest(csrPem);
+          const notBefore = /* @__PURE__ */ new Date();
+          const { cert } = await createCertificateFromCsr({
+            csr: csrPem,
+            // the CSR's own parsed subject, so issuer and subject are
+            // byte-identical on a self-signed root: re-encoding a string
+            // form could differ and break chain building
+            issuerName: request.subjectName,
+            issuerPublicKey: request.publicKey,
+            signingKey,
+            signingAlgorithm: signingAlgorithmOf(signingKey),
+            notBefore,
+            notAfter: daysFromNow(notBefore, CA_CERT_VALIDITY_DAYS),
+            purpose: CertificatePurpose2.ForCertificateAuthority,
+            applicationUri: caSanUri(ca),
+            revocation: {
+              crlDistributionUrl: ca.crlDistributionUrl,
+              ocspResponderUrl: ca.ocspResponderUrl,
+              caIssuersUrl: ca.caIssuersUrl
+            }
+          });
+          await fs10.promises.writeFile(ca.caCertificate, cert);
+        }
+        displaySubtitle("generate initial CRL (Certificate Revocation List)");
+        await this.#regenerateCrlLocked(ca, new CaDatabase(ca.rootDir));
+        displayTitle("Create Certificate Authority (CA) ---> DONE");
+      }
+      /** Sign a subordinate CA's request with this CA's key, the `[v3_ca]` equivalent. */
+      async signSubordinateCsr(ca, csrFile, certFile, validityDays) {
+        const { signingKey, signingAlgorithm, issuerPublicKey, issuerName } = await this.#issuerContext(ca);
+        const csrPem = await fs10.promises.readFile(csrFile, "utf-8");
+        const db = new CaDatabase(ca.rootDir);
+        const serialNumber = db.nextSerial();
+        const notBefore = /* @__PURE__ */ new Date();
+        const notAfter = daysFromNow(notBefore, validityDays);
+        const { cert } = await createCertificateFromCsr({
+          csr: csrPem,
+          issuerName,
+          issuerPublicKey,
+          signingKey,
+          signingAlgorithm,
+          serialNumber,
+          notBefore,
+          notAfter,
+          purpose: CertificatePurpose2.ForCertificateAuthority,
+          // the subordinate's own SAN, not the issuer's
+          ...sanFromCsr(csrPem),
+          revocation: {
+            crlDistributionUrl: ca.crlDistributionUrl,
+            ocspResponderUrl: ca.ocspResponderUrl,
+            caIssuersUrl: ca.caIssuersUrl
+          }
+        });
+        await fs10.promises.writeFile(certFile, cert);
+        this.#record(db, serialNumber, cert, notAfter);
+      }
+      /**
+       * Self-sign a certificate with a caller-supplied key file and record it
+       * in this CA's database: the native equivalent of `openssl req -new`
+       * followed by `openssl ca -selfsign`, which likewise applies the
+       * end-entity profile and updates `index.txt`.
+       */
+      async createSelfSignedCertificate(ca, certificateFile, privateKeyFile, params) {
+        displaySubtitle("- the certificate signing request");
+        const key = await privateKeyToCryptoKey(readPrivateKey2(privateKeyFile, await ca._privateKeyPassphrase()));
+        const { csr } = await createCertificateSigningRequest2({
+          privateKey: key,
+          subject: params.subject ? new Subject4(params.subject).toString() : ca.subject.toString(),
+          dns: params.dns,
+          ip: params.ip,
+          applicationUri: params.applicationUri,
+          purpose: CertificatePurpose2.ForApplication
+        });
+        displaySubtitle("- creating the self-signed certificate");
+        const request = new x509.Pkcs10CertificateRequest(csr);
+        const db = new CaDatabase(ca.rootDir);
+        const serialNumber = db.nextSerial();
+        const notBefore = params.startDate ?? /* @__PURE__ */ new Date();
+        const notAfter = params.endDate ?? daysFromNow(notBefore, params.validity ?? 365);
+        const { cert } = await createCertificateFromCsr({
+          csr,
+          issuerName: request.subjectName,
+          issuerPublicKey: request.publicKey,
+          signingKey: key,
+          signingAlgorithm: RSA_SHA256,
+          serialNumber,
+          notBefore,
+          notAfter,
+          purpose: CertificatePurpose2.ForApplication,
+          ...sanFromCsr(csr)
+        });
+        await fs10.promises.writeFile(certificateFile, cert);
+        this.#record(db, serialNumber, cert, notAfter);
+      }
+      /** `certs/<SERIAL>.pem` plus the `V` row, exactly as `openssl ca` writes them. */
+      #record(db, serialNumber, certPem, notAfter) {
+        db.storeCertificate(serialNumber, certPem);
+        db.appendIssued({
+          serial: serialNumber,
+          expiryDate: notAfter,
+          subject: toOpenSslSubjectString(new x509.X509Certificate(certPem).subjectName)
+        });
+      }
+      /**
+       * The CA's signing key and issuer identity, resolved fresh on every
+       * call and never cached across operations. The identity is read back
+       * from the CA certificate on disk so that the issuer field of anything
+       * this CA signs is byte-identical to that certificate's subject.
+       */
+      async #issuerContext(ca) {
+        const signingKey = await ca._getSigningKey();
+        const caCertPem = await fs10.promises.readFile(ca.caCertificate, "utf-8");
+        const caCert = new x509.X509Certificate(caCertPem);
+        return {
+          signingKey,
+          signingAlgorithm: signingAlgorithmOf(signingKey),
+          issuerPublicKey: caCert.publicKey,
+          issuerName: caCert.subjectName
+        };
+      }
+      async signEndEntityCsr(ca, certificate, csr, params, sanOverride) {
+        const { signingKey, signingAlgorithm, issuerPublicKey, issuerName } = await this.#issuerContext(ca);
+        const db = new CaDatabase(ca.rootDir);
+        const serialNumber = db.nextSerial();
+        const csrPem = await fs10.promises.readFile(csr, "utf-8");
+        const notBefore = params.startDate ?? /* @__PURE__ */ new Date();
+        const notAfter = params.endDate ?? new Date(notBefore.getTime() + (params.validity ?? 365) * 24 * 60 * 60 * 1e3);
+        const { cert } = await createCertificateFromCsr({
+          csr: csrPem,
+          issuerName,
+          issuerPublicKey,
+          signingKey,
+          signingAlgorithm,
+          serialNumber,
+          notBefore,
+          notAfter,
+          purpose: CertificatePurpose2.ForApplication,
+          dns: sanOverride.dns,
+          ip: sanOverride.ip,
+          applicationUri: sanOverride.applicationUri,
+          revocation: {
+            crlDistributionUrl: ca.crlDistributionUrl,
+            ocspResponderUrl: ca.ocspResponderUrl,
+            caIssuersUrl: ca.caIssuersUrl
+          }
+        });
+        await fs10.promises.writeFile(certificate, cert);
+        this.#record(db, serialNumber, cert, notAfter);
+      }
+      async #regenerateCrlLocked(ca, db) {
+        const { signingKey, signingAlgorithm, issuerPublicKey, issuerName } = await this.#issuerContext(ca);
+        const crlNumber = db.nextCrlNumber();
+        const entries = db.readIndex().filter((r) => r.status === "revoked").map((r) => ({
+          serialNumber: r.serial,
+          revocationDate: r.revocationDate ? new Date(r.revocationDate) : /* @__PURE__ */ new Date(),
+          reason: r.reason ? REASON_TO_X509_CRL_REASON[r.reason] : void 0
+        }));
+        const { crl } = await createCrl({
+          issuerName,
+          issuerPublicKey,
+          signingKey,
+          signingAlgorithm,
+          crlNumber: BigInt(`0x${crlNumber}`),
+          entries
+        });
+        await fs10.promises.writeFile(ca.revocationList, crl);
+        const der = new x509.X509Crl(crl).rawData;
+        await fs10.promises.writeFile(ca.revocationListDER, Buffer.from(der));
+      }
+      async regenerateCrl(ca) {
+        const db = new CaDatabase(ca.rootDir);
+        await this.#regenerateCrlLocked(ca, db);
+      }
+      async revoke(ca, certificate, reason) {
+        const certPem = await fs10.promises.readFile(certificate, "utf-8");
+        const cert = new x509.X509Certificate(certPem);
+        const db = new CaDatabase(ca.rootDir);
+        db.markRevoked(cert.serialNumber, /* @__PURE__ */ new Date(), reason);
+        await this.#regenerateCrlLocked(ca, db);
+      }
+    };
+  }
+});
 
-# default_md               = sha1
+// packages/node-opcua-pki/lib/ca/backends/openssl_ca_backend.ts
+import fs11 from "fs";
+import path8 from "path";
+import { Subject as Subject5 } from "node-opcua-crypto";
+function caAltName(ca) {
+  return `URI:urn:${ca.subject.commonName || "NodeOPCUA-CA"}`;
+}
+function caConfigEnvOverrides(ca, altName = caAltName(ca)) {
+  const aiaLegs = [];
+  if (ca.ocspResponderUrl) {
+    aiaLegs.push(`OCSP;URI:${ca.ocspResponderUrl}`);
+  }
+  if (ca.caIssuersUrl) {
+    aiaLegs.push(`caIssuers;URI:${ca.caIssuersUrl}`);
+  }
+  return {
+    ALTNAME: altName,
+    CDP_URL: ca.crlDistributionUrl ?? "",
+    AIA_VALUE: aiaLegs.join(",")
+  };
+}
+var n4, OpenSslCaBackend;
+var init_openssl_ca_backend = __esm({
+  "packages/node-opcua-pki/lib/ca/backends/openssl_ca_backend.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_toolbox();
+    init_with_openssl();
+    n4 = makePath;
+    OpenSslCaBackend = class {
+      /** This backend is the `openssl` executable, so it has to be there. */
+      /**
+       * `-passin env:` argv and env for an openssl call that has to load this
+       * CA's key. Built here rather than on the CA: the passphrase is the
+       * CA's business, but expressing it as an openssl argument is this
+       * backend's, and the core has no reason to know the flag exists.
+       */
+      async #passin(ca) {
+        return passinArg(await ca._privateKeyPassphrase());
+      }
+      /** The openssl CLI loads its key from a file, so it cannot call out to an HSM. */
+      supportsExternalSigner = false;
+      async preflight() {
+        await ensure_openssl_installed();
+      }
+      /**
+       * Render `conf/caconfig.cnf` once with explicit overrides, run `fn`
+       * with the rendered path, and always remove the temp file. Structural
+       * guarantee that (a) every render carries the three required env
+       * values and (b) no rendered `<name>.<pid>-<n>.tmp` file is ever left
+       * behind — each was previously a per-method discipline.
+       */
+      async #withConfig(ca, altName, fn) {
+        const caRootDir = path8.resolve(ca.rootDir);
+        const options = { cwd: caRootDir };
+        const configFile = generateStaticConfig("conf/caconfig.cnf", options, caConfigEnvOverrides(ca, altName));
+        try {
+          return await fn(configFile, options);
+        } finally {
+          await cleanupStaticConfig(configFile, options);
+        }
+      }
+      async #generateCaCsrWith(ca, configFile, options, privateKeyFile, csrFile) {
+        const passin = await this.#passin(ca);
+        displayTitle("Generate a certificate request for the CA key");
+        await execute_openssl(
+          [
+            "req",
+            "-new",
+            "-sha256",
+            "-extensions",
+            "v3_ca_req",
+            "-config",
+            n4(configFile),
+            "-key",
+            n4(privateKeyFile),
+            "-out",
+            n4(csrFile),
+            "-subj",
+            ca.subject.toString(),
+            ...passin.args
+          ],
+          { ...options, env: passin.env }
+        );
+      }
+      /**
+       * `openssl ca -gencrl` signs the CRL with the CA key it finds through the
+       * config file (`private_key = $dir/private/cakey.pem`), so it needs the
+       * CA passphrase like every other `openssl ca` invocation.
+       */
+      async #regenerateCrlWith(ca, configFile, options) {
+        const passin = await this.#passin(ca);
+        displaySubtitle("regenerate CRL (Certificate Revocation List)");
+        await execute_openssl(["ca", "-gencrl", "-config", n4(configFile), "-out", "crl/revocation_list.crl", ...passin.args], {
+          ...options,
+          env: passin.env
+        });
+        await execute_openssl(
+          ["crl", "-in", "crl/revocation_list.crl", "-out", "crl/revocation_list.der", "-outform", "der"],
+          options
+        );
+        displaySubtitle("Display (Certificate Revocation List)");
+        await execute_openssl(["crl", "-in", n4(ca.revocationList), "-text", "-noout"], options);
+      }
+      async generateCaCsr(ca, _caRootDir, privateKeyFile, csrFile) {
+        await this.#withConfig(
+          ca,
+          caAltName(ca),
+          (configFile, options) => this.#generateCaCsrWith(ca, configFile, options, privateKeyFile, csrFile)
+        );
+      }
+      async bootstrap(ca) {
+        const caRootDir = path8.resolve(ca.rootDir);
+        const privateKeyFilename = path8.join(caRootDir, "private/cakey.pem");
+        const csrFilename = path8.join(caRootDir, "private/cakey.csr");
+        await this.#withConfig(ca, caAltName(ca), async (configFile, options) => {
+          await this.#generateCaCsrWith(ca, configFile, options, privateKeyFilename, csrFilename);
+          const issuerCA = ca._issuerCA;
+          if (issuerCA) {
+            displayTitle("Generate CA Certificate (signed by issuer CA)");
+            const issuerCert = path8.resolve(issuerCA.caCertificate);
+            const issuerKey = path8.resolve(issuerCA.rootDir, "private/cakey.pem");
+            const issuerSerial = path8.resolve(issuerCA.rootDir, "serial");
+            const issuerPassin = await this.#passin(issuerCA);
+            const signWithIssuer = async () => {
+              await execute_openssl(
+                [
+                  "x509",
+                  "-sha256",
+                  "-req",
+                  "-days",
+                  "3650",
+                  "-extensions",
+                  "v3_ca",
+                  "-extfile",
+                  n4(configFile),
+                  "-in",
+                  "private/cakey.csr",
+                  "-CA",
+                  n4(issuerCert),
+                  "-CAkey",
+                  n4(issuerKey),
+                  "-CAserial",
+                  n4(issuerSerial),
+                  "-out",
+                  "public/cacert.pem",
+                  ...issuerPassin.args
+                ],
+                { ...options, env: issuerPassin.env }
+              );
+            };
+            if (path8.resolve(issuerCA.rootDir) === caRootDir) {
+              await signWithIssuer();
+            } else {
+              await issuerCA._withCaDirectoryLock(signWithIssuer);
+            }
+          } else {
+            displayTitle("Generate CA Certificate (self-signed)");
+            const passin = await this.#passin(ca);
+            await execute_openssl(
+              [
+                "x509",
+                "-sha256",
+                "-req",
+                "-days",
+                "3650",
+                "-extensions",
+                "v3_ca",
+                "-extfile",
+                n4(configFile),
+                "-in",
+                "private/cakey.csr",
+                "-signkey",
+                n4(privateKeyFilename),
+                "-out",
+                "public/cacert.pem",
+                ...passin.args
+              ],
+              { ...options, env: passin.env }
+            );
+          }
+          displaySubtitle("generate initial CRL (Certificate Revocation List)");
+          await this.#regenerateCrlWith(ca, configFile, options);
+        });
+        displayTitle("Create Certificate Authority (CA) ---> DONE");
+      }
+      async regenerateCrl(ca) {
+        await this.#withConfig(ca, caAltName(ca), (configFile, options) => this.#regenerateCrlWith(ca, configFile, options));
+      }
+      async signSubordinateCsr(ca, csrFile, certFile, validityDays) {
+        await this.#withConfig(ca, caAltName(ca), async (configFile, options) => {
+          const caRootDir = options.cwd;
+          const passin = await this.#passin(ca);
+          await execute_openssl(
+            [
+              "x509",
+              "-sha256",
+              "-req",
+              "-days",
+              String(validityDays),
+              "-extensions",
+              "v3_ca",
+              "-extfile",
+              n4(configFile),
+              "-in",
+              n4(csrFile),
+              "-CA",
+              n4(ca.caCertificate),
+              "-CAkey",
+              n4(path8.join(caRootDir, "private/cakey.pem")),
+              "-CAserial",
+              n4(path8.join(caRootDir, "serial")),
+              "-out",
+              n4(certFile),
+              ...passin.args
+            ],
+            { ...options, env: passin.env }
+          );
+        });
+      }
+      async signEndEntityCsr(ca, certificate, csr, params1, sanOverride) {
+        await this.#withConfig(ca, buildSubjectAltNameString(sanOverride), async (configFile, options) => {
+          displaySubtitle("- then we ask the authority to sign the certificate signing request");
+          const passin = await this.#passin(ca);
+          await execute_openssl(
+            [
+              "ca",
+              "-config",
+              configFile,
+              "-startdate",
+              x509Date(params1.startDate),
+              "-enddate",
+              x509Date(params1.endDate),
+              "-batch",
+              "-out",
+              n4(certificate),
+              "-in",
+              n4(csr),
+              ...passin.args
+            ],
+            { ...options, env: passin.env }
+          );
+          displaySubtitle("- dump the certificate for a check");
+          await execute_openssl(["x509", "-in", n4(certificate), "-dates", "-fingerprint", "-purpose", "-noout"], options);
+        });
+      }
+      async revoke(ca, certificate, reason) {
+        setEnv("RANDFILE", path8.join(ca.rootDir, "random.rnd"));
+        await this.#withConfig(ca, caAltName(ca), async (configFile, options) => {
+          displaySubtitle("Revoke certificate");
+          const passin = await this.#passin(ca);
+          await execute_openssl_no_failure(
+            ["ca", "-verbose", "-config", n4(configFile), "-revoke", certificate, "-crl_reason", reason, ...passin.args],
+            { ...options, env: passin.env }
+          );
+          await this.#regenerateCrlWith(ca, configFile, options);
+          displaySubtitle("Verify that certificate is revoked");
+          await execute_openssl_no_failure(
+            [
+              "verify",
+              "-verbose",
+              "-CRLfile",
+              n4(ca.revocationList),
+              "-CAfile",
+              n4(ca.caCertificate),
+              "-crl_check",
+              n4(certificate)
+            ],
+            options
+          );
+          displaySubtitle("Produce CRL in DER form ");
+          await execute_openssl(
+            ["crl", "-in", n4(ca.revocationList), "-out", "crl/revocation_list.der", "-outform", "der"],
+            options
+          );
+          displaySubtitle("Produce CRL in PEM form ");
+          await execute_openssl(
+            ["crl", "-in", n4(ca.revocationList), "-out", "crl/revocation_list.pem", "-outform", "pem", "-text"],
+            options
+          );
+        });
+      }
+      async createSelfSignedCertificate(ca, certificateFile, privateKeyFile, params) {
+        const envOverrides = caConfigEnvOverrides(ca, buildSubjectAltNameString(params));
+        const configFile = generateStaticConfig(ca.configFile, { cwd: ca.rootDir }, envOverrides);
+        const options = {
+          cwd: ca.rootDir,
+          openssl_conf: makePath(configFile)
+        };
+        try {
+          const subject = params.subject ? new Subject5(params.subject).toString() : "";
+          const subjectOptions = subject && subject.length > 1 ? ["-subj", subject] : [];
+          const csrFile = `${certificateFile}_csr`;
+          const passin = await this.#passin(ca);
+          displaySubtitle("- the certificate signing request");
+          await execute_openssl(
+            [
+              "req",
+              "-new",
+              "-sha256",
+              ...subjectOptions,
+              "-batch",
+              "-key",
+              n4(privateKeyFile),
+              "-out",
+              n4(csrFile),
+              ...passin.args
+            ],
+            { ...options, env: passin.env }
+          );
+          displaySubtitle("- creating the self-signed certificate");
+          await execute_openssl(
+            [
+              "ca",
+              "-selfsign",
+              "-keyfile",
+              n4(privateKeyFile),
+              "-startdate",
+              x509Date(params.startDate),
+              "-enddate",
+              x509Date(params.endDate),
+              "-batch",
+              "-out",
+              n4(certificateFile),
+              "-in",
+              n4(csrFile),
+              ...passin.args
+            ],
+            { ...options, env: passin.env }
+          );
+          displaySubtitle("- dump the certificate for a check");
+          await execute_openssl(["x509", "-in", n4(certificateFile), "-dates", "-fingerprint", "-purpose", "-noout"], {});
+          displaySubtitle("- verify self-signed certificate");
+          await execute_openssl_no_failure(["verify", "-verbose", "-CAfile", n4(certificateFile), n4(certificateFile)], options);
+          await fs11.promises.unlink(csrFile);
+        } finally {
+          await cleanupStaticConfig(configFile, { cwd: ca.rootDir });
+        }
+      }
+    };
+  }
+});
+
+// packages/node-opcua-pki/lib/ca/templates/ca_config_template.cnf.ts
+var config2, ca_config_template_cnf_default;
+var init_ca_config_template_cnf = __esm({
+  "packages/node-opcua-pki/lib/ca/templates/ca_config_template.cnf.ts"() {
+    "use strict";
+    init_esm_shims();
+    config2 = `#.........DO NOT MODIFY BY HAND .........................
+[ ca ]
+default_ca               = CA_default
+[ CA_default ]
+dir                      = "%%ROOT_FOLDER%%"        # the main CA folder (quoted: see renderCaConfig)
+certs                    = $dir/certs                 # where to store certificates
+new_certs_dir            = $dir/certs                 #
+database                 = $dir/index.txt             # the certificate database
+serial                   = $dir/serial                # the serial number counter
+certificate              = $dir/public/cacert.pem     # The root CA certificate
+private_key              = $dir/private/cakey.pem     # the CA private key
+x509_extensions          = usr_cert                   #
+default_days             = 3650                       # default validity : 10 years
+
+# default_md               = sha1
 
 default_md                = sha256                      # The default digest algorithm
 
@@ -2858,7 +3813,7 @@ policy                   = policy_match
 # default_enddate          = YYMMDDHHMMSSZ
 crl_dir                  = $dir/crl
 crl_extensions           = crl_ext
-crl                      = $dir/revocation_list.crl # the Revocation list
+crl                      = $dir/crl/revocation_list.crl # the Revocation list
 crlnumber                = $dir/crlnumber           # CRL number file
 default_crl_days         = 30
 default_crl_hours        = 24
@@ -2968,25 +3923,31 @@ authorityKeyIdentifier    = keyid:always,issuer:always
   }
 });
 
-// packages/node-opcua-pki/lib/ca/certificate_authority.ts
-import assert10 from "assert";
-import fs10 from "fs";
+// packages/node-opcua-pki/lib/ca/core/certificate_authority_core.ts
+import assert9 from "assert";
+import fs12 from "fs";
 import os4 from "os";
-import path6 from "path";
+import path9 from "path";
+import { withLock as withLock2 } from "@ster5/global-mutex";
 import chalk6 from "chalk";
 import {
-  CertificatePurpose as CertificatePurpose2,
+  CertificatePurpose as CertificatePurpose3,
   certificateMatchesPrivateKey,
-  convertPEMtoDER,
+  convertPEMtoDER as convertPEMtoDER2,
+  createCertificateSigningRequest as createCertificateSigningRequest3,
+  createPfx,
   exploreCertificate as exploreCertificate2,
   exploreCertificateSigningRequest,
   generatePrivateKeyFile as generatePrivateKeyFile2,
-  readCertificatePEM,
+  privateKeyToCryptoKey as privateKeyToCryptoKey2,
+  readCertificatePEM as readCertificatePEM2,
   readCertificateSigningRequest,
-  readPrivateKey as readPrivateKey2,
-  Subject as Subject4,
+  readPrivateKey as readPrivateKey3,
+  Subject as Subject6,
   toPem as toPem2,
-  writePrivateKeyFile as writePrivateKeyFile2
+  verifyCertificateSignature as verifyCertificateSignature2,
+  writePrivateKeyFile as writePrivateKeyFile2,
+  x509 as x5092
 } from "node-opcua-crypto";
 function escapeOpensslConfDoubleQuoted(value) {
   return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
@@ -2997,175 +3958,6 @@ function renderCaConfig(caRootDir) {
 function octetStringToIpAddress(a) {
   return parseInt(a.substring(0, 2), 16).toString() + "." + parseInt(a.substring(2, 4), 16).toString() + "." + parseInt(a.substring(4, 6), 16).toString() + "." + parseInt(a.substring(6, 8), 16).toString();
 }
-async function construct_CertificateAuthority(certificateAuthority) {
-  const subject = certificateAuthority.subject;
-  const caRootDir = path6.resolve(certificateAuthority.rootDir);
-  async function make_folders() {
-    mkdirRecursiveSync(caRootDir);
-    ensurePrivateDirectory(path6.join(caRootDir, "private"));
-    mkdirRecursiveSync(path6.join(caRootDir, "public"));
-    mkdirRecursiveSync(path6.join(caRootDir, "certs"));
-    mkdirRecursiveSync(path6.join(caRootDir, "crl"));
-    mkdirRecursiveSync(path6.join(caRootDir, "conf"));
-  }
-  await make_folders();
-  async function construct_default_files() {
-    const serial = path6.join(caRootDir, "serial");
-    if (!fs10.existsSync(serial)) {
-      await fs10.promises.writeFile(serial, "1000");
-    }
-    const crlNumber = path6.join(caRootDir, "crlnumber");
-    if (!fs10.existsSync(crlNumber)) {
-      await fs10.promises.writeFile(crlNumber, "1000");
-    }
-    const indexFile = path6.join(caRootDir, "index.txt");
-    if (!fs10.existsSync(indexFile)) {
-      await fs10.promises.writeFile(indexFile, "");
-    }
-  }
-  await construct_default_files();
-  const caKeyExists = fs10.existsSync(path6.join(caRootDir, "private/cakey.pem"));
-  const caCertExists = fs10.existsSync(path6.join(caRootDir, "public/cacert.pem"));
-  if (caKeyExists && caCertExists && !config3.forceCA) {
-    restrictPrivateFilePermissions(path6.join(caRootDir, "private/cakey.pem"), 384);
-    await certificateAuthority._ensurePrivateKeyProtection();
-    debugLog("CA private key and certificate already exist ... skipping");
-    return;
-  }
-  if (caKeyExists && !caCertExists) {
-    debugLog("CA private key exists but cacert.pem is missing \u2014 rebuilding CA");
-    fs10.unlinkSync(path6.join(caRootDir, "private/cakey.pem"));
-    const staleCsr = path6.join(caRootDir, "private/cakey.csr");
-    if (fs10.existsSync(staleCsr)) {
-      fs10.unlinkSync(staleCsr);
-    }
-  }
-  displayTitle("Create Certificate Authority (CA)");
-  const indexFileAttr = path6.join(caRootDir, "index.txt.attr");
-  if (!fs10.existsSync(indexFileAttr)) {
-    await fs10.promises.writeFile(indexFileAttr, "unique_subject = no");
-  }
-  const caConfigFile = certificateAuthority.configFile;
-  if (1) {
-    await fs10.promises.writeFile(caConfigFile, renderCaConfig(caRootDir));
-  }
-  const subjectOpt = ["-subj", subject.toString()];
-  const caCommonName = subject.commonName || "NodeOPCUA-CA";
-  setEnv("ALTNAME", `URI:urn:${caCommonName}`);
-  certificateAuthority._wireRevocationEnvVars();
-  const options = { cwd: caRootDir };
-  const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-  const configOption = ["-config", n5(configFile)];
-  const keySize = certificateAuthority.keySize;
-  const privateKeyFilename = path6.join(caRootDir, "private/cakey.pem");
-  const csrFilename = path6.join(caRootDir, "private/cakey.csr");
-  displayTitle(`Generate the CA private Key - ${keySize}`);
-  const passin = await certificateAuthority._opensslPassin();
-  await generatePrivateKeyFile2(privateKeyFilename, keySize, { passphrase: await certificateAuthority._privateKeyPassphrase() });
-  restrictPrivateFilePermissions(privateKeyFilename, 384);
-  displayTitle("Generate a certificate request for the CA key");
-  await execute_openssl(
-    [
-      "req",
-      "-new",
-      "-sha256",
-      "-text",
-      "-extensions",
-      "v3_ca_req",
-      ...configOption,
-      "-key",
-      n5(privateKeyFilename),
-      "-out",
-      n5(csrFilename),
-      ...subjectOpt,
-      ...passin.args
-    ],
-    { ...options, env: passin.env }
-  );
-  const issuerCA = certificateAuthority._issuerCA;
-  if (issuerCA) {
-    displayTitle("Generate CA Certificate (signed by issuer CA)");
-    const issuerCert = path6.resolve(issuerCA.caCertificate);
-    const issuerKey = path6.resolve(issuerCA.rootDir, "private/cakey.pem");
-    const issuerSerial = path6.resolve(issuerCA.rootDir, "serial");
-    const issuerPassin = await issuerCA._opensslPassin();
-    await execute_openssl(
-      [
-        "x509",
-        "-sha256",
-        "-req",
-        "-days",
-        "3650",
-        "-text",
-        "-extensions",
-        "v3_ca",
-        "-extfile",
-        n5(configFile),
-        "-in",
-        "private/cakey.csr",
-        "-CA",
-        n5(issuerCert),
-        "-CAkey",
-        n5(issuerKey),
-        "-CAserial",
-        n5(issuerSerial),
-        "-out",
-        "public/cacert.pem",
-        ...issuerPassin.args
-      ],
-      { ...options, env: issuerPassin.env }
-    );
-  } else {
-    displayTitle("Generate CA Certificate (self-signed)");
-    await execute_openssl(
-      [
-        "x509",
-        "-sha256",
-        "-req",
-        "-days",
-        "3650",
-        "-text",
-        "-extensions",
-        "v3_ca",
-        "-extfile",
-        n5(configFile),
-        "-in",
-        "private/cakey.csr",
-        "-signkey",
-        n5(privateKeyFilename),
-        "-out",
-        "public/cacert.pem",
-        ...passin.args
-      ],
-      { ...options, env: passin.env }
-    );
-  }
-  displaySubtitle("generate initial CRL (Certificate Revocation List)");
-  await regenerateCrl(certificateAuthority.revocationList, configOption, options, passin);
-  displayTitle("Create Certificate Authority (CA) ---> DONE");
-}
-async function regenerateCrl(revocationList, configOption, options, passin) {
-  displaySubtitle("regenerate CRL (Certificate Revocation List)");
-  await execute_openssl(["ca", "-gencrl", ...configOption, "-out", "crl/revocation_list.crl", ...passin.args], {
-    ...options,
-    env: passin.env
-  });
-  await execute_openssl(["crl", "-in", "crl/revocation_list.crl", "-out", "crl/revocation_list.der", "-outform", "der"], options);
-  displaySubtitle("Display (Certificate Revocation List)");
-  await execute_openssl(["crl", "-in", n5(revocationList), "-text", "-noout"], options);
-}
-function parseOpenSSLDate(dateStr) {
-  const raw = dateStr?.split(",")[0] ?? "";
-  if (raw.length < 12) return "";
-  const yy = parseInt(raw.substring(0, 2), 10);
-  const year = yy >= 70 ? 1900 + yy : 2e3 + yy;
-  const month = raw.substring(2, 4);
-  const day = raw.substring(4, 6);
-  const hour = raw.substring(6, 8);
-  const min = raw.substring(8, 10);
-  const sec = raw.substring(10, 12);
-  return `${year}-${month}-${day}T${hour}:${min}:${sec}Z`;
-}
 function validateRevocationUrl(url, fieldName) {
   if (url === void 0) {
     return void 0;
@@ -3193,27 +3985,25 @@ function validateRevocationUrl(url, fieldName) {
   }
   return url;
 }
-var defaultSubject, configurationFileTemplate, configurationFileSimpleTemplate2, config3, n5, CertificateAuthority;
-var init_certificate_authority = __esm({
-  "packages/node-opcua-pki/lib/ca/certificate_authority.ts"() {
+var defaultSubject, configurationFileTemplate, config3, CA_LOCK_MAX_WAIT_MS, CA_LOCK_RETRY, CertificateAuthorityCore;
+var init_certificate_authority_core = __esm({
+  "packages/node-opcua-pki/lib/ca/core/certificate_authority_core.ts"() {
     "use strict";
     init_esm_shims();
-    init_toolbox_pfx();
     init_toolbox();
-    init_with_openssl();
-    init_simple_config_template_cnf();
+    init_ca_database();
     init_ca_config_template_cnf();
     defaultSubject = "/C=FR/ST=IDF/L=Paris/O=Local NODE-OPCUA Certificate Authority/CN=NodeOPCUA-CA";
     configurationFileTemplate = ca_config_template_cnf_default;
-    configurationFileSimpleTemplate2 = simple_config_template_cnf_default;
     config3 = {
       certificateDir: "INVALID",
       forceCA: false,
       pkiDir: "INVALID"
     };
-    n5 = makePath;
-    assert10(octetStringToIpAddress("c07b9179") === "192.123.145.121");
-    CertificateAuthority = class {
+    CA_LOCK_MAX_WAIT_MS = 5 * 6e4;
+    CA_LOCK_RETRY = { minTimeout: 20, maxTimeout: 250 };
+    assert9(octetStringToIpAddress("c07b9179") === "192.123.145.121");
+    CertificateAuthorityCore = class {
       /** RSA key size used when generating the CA private key. */
       keySize;
       /** Root filesystem path of the CA directory structure. */
@@ -3230,14 +4020,41 @@ var init_certificate_authority = __esm({
       /** resolved once (see `privateKeyPassphrase`); `#passphraseResolved` distinguishes "none" from "not yet" */
       #resolvedPassphrase;
       #passphraseResolved = false;
+      /** Signing backend: `openssl` shells out to the CLI, `native` signs in-process. */
+      #backend;
+      /** External signing key (HSM/KMS), when one was supplied instead of a key file. */
+      #signer;
+      /** Read access to `index.txt` / `certs/<SERIAL>.pem`. */
+      #db;
       constructor(options) {
-        assert10(Object.prototype.hasOwnProperty.call(options, "location"));
-        assert10(Object.prototype.hasOwnProperty.call(options, "keySize"));
+        assert9(Object.prototype.hasOwnProperty.call(options, "location"));
+        assert9(Object.prototype.hasOwnProperty.call(options, "keySize"));
         this.location = options.location;
         this.keySize = options.keySize || 2048;
-        this.subject = new Subject4(options.subject || defaultSubject);
+        this.subject = new Subject6(options.subject || defaultSubject);
         this._issuerCA = options.issuerCA;
         this.#privateKeyPassphrase = options.privateKeyPassphrase;
+        this.#signer = options.signer;
+        if (options.signer) {
+          const algorithm = options.signer.algorithm;
+          if (algorithm.name !== "RSASSA-PKCS1-v1_5" && algorithm.name !== "ECDSA") {
+            throw new Error(
+              `CertificateAuthority: signer algorithm ${algorithm.name} is not supported - use RSASSA-PKCS1-v1_5 or ECDSA.`
+            );
+          }
+          if (algorithm.name === "ECDSA" && !algorithm.namedCurve) {
+            throw new Error(
+              "CertificateAuthority: an ECDSA signer must declare its namedCurve (P-256, P-384 or P-521) - importing the signer's public key needs the curve, and an SPKI import cannot infer it."
+            );
+          }
+        }
+        if (options.signer && !options.backend.supportsExternalSigner) {
+          throw new Error(
+            "CertificateAuthority: this backend cannot sign with an external signer - it loads its key from a file. Use a backend that supports one, such as NativeCaBackend."
+          );
+        }
+        this.#backend = options.backend;
+        this.#db = new CaDatabase(this.location);
         if (options.crlDistributionUrl !== void 0) {
           this.setCrlDistributionUrl(options.crlDistributionUrl);
         }
@@ -3301,42 +4118,17 @@ var init_certificate_authority = __esm({
       setCaIssuersUrl(url) {
         this._caIssuersUrl = validateRevocationUrl(url, "caIssuersUrl");
       }
-      /**
-       * @internal
-       * Populate the OpenSSL config substitution env vars (`CDP_URL` and
-       * `AIA_VALUE`) from the configured URLs, or unset them so the
-       * matching `{{#KEY}}...{{/KEY}}` blocks in the templates are
-       * stripped. MUST be called before every `generateStaticConfig`
-       * invocation that signs a certificate.
-       */
-      _wireRevocationEnvVars() {
-        unsetEnv("CDP_URL");
-        unsetEnv("AIA_VALUE");
-        if (this._crlDistributionUrl) {
-          setEnv("CDP_URL", this._crlDistributionUrl);
-        }
-        const aiaLegs = [];
-        if (this._ocspResponderUrl) {
-          aiaLegs.push(`OCSP;URI:${this._ocspResponderUrl}`);
-        }
-        if (this._caIssuersUrl) {
-          aiaLegs.push(`caIssuers;URI:${this._caIssuersUrl}`);
-        }
-        if (aiaLegs.length > 0) {
-          setEnv("AIA_VALUE", aiaLegs.join(","));
-        }
-      }
       /** Absolute path to the CA root directory (alias for {@link location}). */
       get rootDir() {
         return this.location;
       }
       /** Path to the OpenSSL configuration file (`conf/caconfig.cnf`). */
       get configFile() {
-        return path6.normalize(path6.join(this.rootDir, "./conf/caconfig.cnf"));
+        return path9.normalize(path9.join(this.rootDir, "./conf/caconfig.cnf"));
       }
       /** Path to the CA private key (`private/cakey.pem`); may be passphrase-encrypted, see {@link getPrivateKey}. */
       get privateKey() {
-        return path6.join(path6.resolve(this.rootDir), "private/cakey.pem");
+        return path9.join(path9.resolve(this.rootDir), "private/cakey.pem");
       }
       /**
        * The CA private key, decrypted with the configured `privateKeyPassphrase`
@@ -3344,7 +4136,51 @@ var init_certificate_authority = __esm({
        * on an encrypted key with no or the wrong passphrase.
        */
       async getPrivateKey() {
-        return readPrivateKey2(this.privateKey, await this._privateKeyPassphrase());
+        this.#assertKeyIsOnDisk("getPrivateKey");
+        return readPrivateKey3(this.privateKey, await this._privateKeyPassphrase());
+      }
+      /**
+       * True when this CA signs with an external {@link CaSigner} (HSM/KMS)
+       * rather than with `private/cakey.pem`. There is then no private key
+       * file on disk, and never was one.
+       */
+      get hasExternalSigner() {
+        return this.#signer !== void 0;
+      }
+      /**
+       * Does `cert` certify the key this CA signs with? With the key on disk
+       * that is a private-key match; with a signer there is no private key to
+       * match, so compare the certified public key against the signer's own -
+       * the same question, asked the only way an HSM allows.
+       */
+      async #certificateMatchesOurKey(certPem, certDer) {
+        if (this.#signer) {
+          const ours = Buffer.from(await this.#signer.getPublicKey());
+          const certified = Buffer.from(new x5092.X509Certificate(certPem).publicKey.rawData);
+          return ours.equals(certified);
+        }
+        return certificateMatchesPrivateKey(certDer, await this.getPrivateKey());
+      }
+      /** Reject the key-file-only operations up front, rather than failing on a missing file later. */
+      #assertKeyIsOnDisk(what) {
+        if (this.#signer) {
+          throw new Error(
+            `CertificateAuthority.${what} is not available on a signer-backed CA: the private key lives in the signer (HSM/KMS) and is never written to disk.`
+          );
+        }
+      }
+      /**
+       * @internal The key every signing operation goes through. An injected
+       * {@link CaSigner} is returned as-is; otherwise the on-disk key is read
+       * (and decrypted) and handed over as a plain `CryptoKey`. Both are
+       * accepted by the `node-opcua-crypto` signing primitives, so callers
+       * never branch on which one they got.
+       */
+      async _getSigningKey() {
+        if (this.#signer) {
+          return this.#signer;
+        }
+        return privateKeyToCryptoKey2(await this.getPrivateKey());
       }
       /**
        * Enable, disable, or rotate the passphrase protecting `private/cakey.pem`
@@ -3353,18 +4189,19 @@ var init_certificate_authority = __esm({
        * passphrase to continue using it.
        */
       async reencryptPrivateKey(oldPassphrase, newPassphrase) {
+        this.#assertKeyIsOnDisk("reencryptPrivateKey");
         const oldPass = await resolvePrivateKeyPassphrase(oldPassphrase);
         const newPass = await resolvePrivateKeyPassphrase(newPassphrase);
-        const key = readPrivateKey2(this.privateKey, oldPass);
+        const key = readPrivateKey3(this.privateKey, oldPass);
         await this.#rewritePrivateKeyFile(key, newPass);
       }
       async #rewritePrivateKeyFile(privateKey, passphrase) {
         const tmpFilename = `${this.privateKey}.${process.pid}-${Date.now()}.tmp`;
         try {
           await writePrivateKeyFile2(tmpFilename, privateKey, { passphrase });
-          await fs10.promises.rename(tmpFilename, this.privateKey);
+          await fs12.promises.rename(tmpFilename, this.privateKey);
         } finally {
-          await fs10.promises.rm(tmpFilename, { force: true });
+          await fs12.promises.rm(tmpFilename, { force: true });
         }
       }
       /** @internal resolve the configured passphrase, at most once per instance */
@@ -3375,10 +4212,6 @@ var init_certificate_authority = __esm({
         }
         return this.#resolvedPassphrase;
       }
-      /** @internal `-passin env:` argv + env for every openssl call that loads this CA's key (always emitted, empty when none) */
-      async _opensslPassin() {
-        return passinArg(await this._privateKeyPassphrase());
-      }
       /**
        * @internal On an existing key: encrypt it in place if a passphrase is
        * configured and it is still plaintext (secure by default: the option
@@ -3387,16 +4220,58 @@ var init_certificate_authority = __esm({
        * first signing operation.
        */
       async _ensurePrivateKeyProtection() {
-        if (!fs10.existsSync(this.privateKey)) {
+        if (this.#signer || !fs12.existsSync(this.privateKey)) {
           return;
         }
         if (this.#privateKeyPassphrase !== void 0 && !isEncryptedPrivateKeyFile(this.privateKey)) {
           warningLog("CertificateAuthority: private key is plaintext but a passphrase is configured; encrypting it in place");
-          const plaintextKey = readPrivateKey2(this.privateKey);
+          const plaintextKey = readPrivateKey3(this.privateKey);
           await this.#rewritePrivateKeyFile(plaintextKey, await this._privateKeyPassphrase());
         }
         await this.getPrivateKey();
       }
+      /**
+       * Acquire a file-based lock on this CA's directory for the duration of
+       * `action` — serializes every operation that mutates the certificate
+       * database (`index.txt`, `serial`, `crlnumber`, `certs/`,
+       * `crl/revocation_list.*`) or the CA's own key/certificate, so
+       * concurrent calls on one `CertificateAuthority` (or two instances
+       * pointed at the same directory, in this or another process) cannot
+       * interleave. Mirrors `CertificateManager.withLock2`.
+       *
+       * Only ever call this from a top-level public operation — nested calls
+       * on the same instance would deadlock, since the underlying file lock
+       * is not reentrant.
+       *
+       * The wait is bounded: a waiter gives up (throws) after
+       * `CA_LOCK_MAX_WAIT_MS`. Without a bound, a holder whose openssl child
+       * hangs would block every CA operation in every process forever and
+       * silently — the lock library's keepalive keeps refreshing the lock
+       * file's mtime as long as the holder process is alive, so stale-lock
+       * recovery never fires for a live-but-stuck holder. A dead holder's
+       * lock goes stale (default 2 minutes) and is taken over well within
+       * this bound.
+       */
+      async #withCaLock(action) {
+        const lockFileName = path9.join(this.rootDir, ".ca.lock");
+        return withLock2(
+          {
+            fileToLock: lockFileName,
+            retries: { forever: true, maxRetryTime: CA_LOCK_MAX_WAIT_MS, ...CA_LOCK_RETRY }
+          },
+          action
+        );
+      }
+      /**
+       * @internal Run `action` under this CA's directory lock. For the one
+       * legitimate cross-instance use: a subordinate CA's bootstrap signs its
+       * certificate with `openssl x509 -CAserial`, which read-increment-writes
+       * THIS issuer's `serial` file, and must therefore hold this issuer's
+       * lock (ordering is always subordinate -> issuer, so no cycle).
+       */
+      async _withCaDirectoryLock(action) {
+        return this.#withCaLock(action);
+      }
       /** Path to the CA certificate in PEM format (`public/cacert.pem`). */
       get caCertificate() {
         return makePath(this.rootDir, "./public/cacert.pem");
@@ -3444,8 +4319,8 @@ var init_certificate_authority = __esm({
        *   (call {@link initialize} first).
        */
       getCACertificateDER() {
-        const pem = readCertificatePEM(this.caCertificate);
-        return convertPEMtoDER(pem);
+        const pem = readCertificatePEM2(this.caCertificate);
+        return convertPEMtoDER2(pem);
       }
       /**
        * Return the CA certificate as a PEM-encoded string.
@@ -3454,7 +4329,7 @@ var init_certificate_authority = __esm({
        *   (call {@link initialize} first).
        */
       getCACertificatePEM() {
-        const raw = readCertificatePEM(this.caCertificate);
+        const raw = readCertificatePEM2(this.caCertificate);
         const beginMarker = "-----BEGIN CERTIFICATE-----";
         const idx = raw.indexOf(beginMarker);
         if (idx > 0) {
@@ -3470,10 +4345,10 @@ var init_certificate_authority = __esm({
        */
       getCRLDER() {
         const crlPath = this.revocationListDER;
-        if (!fs10.existsSync(crlPath)) {
+        if (!fs12.existsSync(crlPath)) {
           return Buffer.alloc(0);
         }
-        return fs10.readFileSync(crlPath);
+        return fs12.readFileSync(crlPath);
       }
       /**
        * Return the current Certificate Revocation List as a
@@ -3483,10 +4358,10 @@ var init_certificate_authority = __esm({
        */
       getCRLPEM() {
         const crlPath = this.revocationList;
-        if (!fs10.existsSync(crlPath)) {
+        if (!fs12.existsSync(crlPath)) {
           return "";
         }
-        const raw = fs10.readFileSync(crlPath, "utf-8");
+        const raw = fs12.readFileSync(crlPath, "utf-8");
         const beginMarker = "-----BEGIN X509 CRL-----";
         const idx = raw.indexOf(beginMarker);
         if (idx > 0) {
@@ -3505,14 +4380,14 @@ var init_certificate_authority = __esm({
        * expiry date, and (for revoked certs) the revocation date.
        */
       getIssuedCertificates() {
-        return this._parseIndexTxt();
+        return this.#db.readIndex();
       }
       /**
        * Return the total number of certificates recorded in
        * `index.txt`.
        */
       getIssuedCertificateCount() {
-        return this._parseIndexTxt().length;
+        return this.#db.readIndex().length;
       }
       /**
        * Return the status of a certificate by its serial number.
@@ -3522,9 +4397,7 @@ var init_certificate_authority = __esm({
        *   `undefined` if not found
        */
       getCertificateStatus(serial) {
-        const upper = serial.toUpperCase();
-        const record = this._parseIndexTxt().find((r) => r.serial.toUpperCase() === upper);
-        return record?.status;
+        return this.#db.findBySerial(serial)?.status;
       }
       /**
        * Read a specific issued certificate by serial number and
@@ -3537,82 +4410,13 @@ var init_certificate_authority = __esm({
        * @returns the DER buffer, or `undefined` if not found
        */
       getCertificateBySerial(serial) {
-        const upper = serial.toUpperCase();
-        const certFile = path6.join(this.rootDir, "certs", `${upper}.pem`);
-        if (!fs10.existsSync(certFile)) {
-          return void 0;
-        }
-        const pem = readCertificatePEM(certFile);
-        return convertPEMtoDER(pem);
+        return this.#db.getCertificateBySerial(serial);
       }
       /**
        * Path to the OpenSSL certificate database file.
        */
       get indexFile() {
-        return path6.join(this.rootDir, "index.txt");
-      }
-      /**
-       * Parse the OpenSSL `index.txt` certificate database.
-       *
-       * Each line has tab-separated fields:
-       * ```
-       * status  expiry  [revocationDate]  serial  unknown  subject
-       * ```
-       *
-       * - status: `V` (valid), `R` (revoked), `E` (expired)
-       * - expiry: `YYMMDDHHmmssZ`
-       * - revocationDate: present only for revoked certs
-       * - serial: hex string
-       * - unknown: always `"unknown"`
-       * - subject: X.500 slash-delimited string
-       */
-      _parseIndexTxt() {
-        const indexPath = this.indexFile;
-        if (!fs10.existsSync(indexPath)) {
-          return [];
-        }
-        const content = fs10.readFileSync(indexPath, "utf-8");
-        const lines = content.split("\n").filter((l) => l.trim().length > 0);
-        const records = [];
-        for (const line of lines) {
-          const fields = line.split("	");
-          if (fields.length < 4) continue;
-          const statusChar = fields[0];
-          const expiryStr = fields[1];
-          let serial;
-          let subject;
-          let revocationDate;
-          if (statusChar === "R") {
-            revocationDate = fields[2];
-            serial = fields[3];
-            subject = fields.length >= 6 ? fields[5] : "";
-          } else {
-            serial = fields[3];
-            subject = fields.length >= 6 ? fields[5] : "";
-          }
-          let status;
-          switch (statusChar) {
-            case "V":
-              status = "valid";
-              break;
-            case "R":
-              status = "revoked";
-              break;
-            case "E":
-              status = "expired";
-              break;
-            default:
-              continue;
-          }
-          records.push({
-            serial,
-            status,
-            subject,
-            expiryDate: parseOpenSSLDate(expiryStr),
-            revocationDate: revocationDate ? parseOpenSSLDate(revocationDate) : void 0
-          });
-        }
-        return records;
+        return this.#db.indexFile;
       }
       // ---------------------------------------------------------------
       // Buffer-based CA operations (US-058)
@@ -3634,12 +4438,12 @@ var init_certificate_authority = __esm({
        * @returns the signed certificate as a DER-encoded buffer
        */
       async signCertificateRequestFromDER(csrDer, options) {
-        const tmpDir = await fs10.promises.mkdtemp(path6.join(os4.tmpdir(), "pki-sign-"));
+        const tmpDir = await fs12.promises.mkdtemp(path9.join(os4.tmpdir(), "pki-sign-"));
         try {
-          const csrFile = path6.join(tmpDir, "request.csr");
-          const certFile = path6.join(tmpDir, "certificate.pem");
+          const csrFile = path9.join(tmpDir, "request.csr");
+          const certFile = path9.join(tmpDir, "certificate.pem");
           const csrPem = toPem2(csrDer, "CERTIFICATE REQUEST");
-          await fs10.promises.writeFile(csrFile, csrPem, "utf-8");
+          await fs12.promises.writeFile(csrFile, csrPem, "utf-8");
           const signingParams = {};
           if (options?.validityMs !== void 0) signingParams.validityMs = options.validityMs;
           else signingParams.validity = options?.validity ?? 365;
@@ -3649,10 +4453,10 @@ var init_certificate_authority = __esm({
           if (options?.applicationUri) signingParams.applicationUri = options.applicationUri;
           if (options?.subject) signingParams.subject = options.subject;
           await this.signCertificateRequest(certFile, csrFile, signingParams);
-          const certPem = readCertificatePEM(certFile);
-          return convertPEMtoDER(certPem);
+          const certPem = readCertificatePEM2(certFile);
+          return convertPEMtoDER2(certPem);
         } finally {
-          await fs10.promises.rm(tmpDir, {
+          await fs12.promises.rm(tmpDir, {
             recursive: true,
             force: true
           });
@@ -3702,27 +4506,35 @@ var init_certificate_authority = __esm({
        * @returns `{ certificateDer, privateKey }` — certificate as DER,
        *   private key as a branded `PrivateKey` buffer
        */
+      /**
+       * An ephemeral key and a CSR for it, written into `tmpDir`. Both
+       * `generateKeyPairAndSign*` methods need exactly this, and neither
+       * needs a subprocess for it: the key comes from node's crypto and the
+       * request is built and self-signed in process, so no `openssl.cnf` has
+       * to be rendered either.
+       */
+      async #createEphemeralKeyAndCsr(tmpDir, keySize, options) {
+        const privateKeyFile = path9.join(tmpDir, "private_key.pem");
+        await generatePrivateKeyFile2(privateKeyFile, keySize);
+        const { csr } = await createCertificateSigningRequest3({
+          privateKey: await privateKeyToCryptoKey2(readPrivateKey3(privateKeyFile)),
+          subject: options.subject ? new Subject6(options.subject).toString() : void 0,
+          applicationUri: options.applicationUri,
+          dns: options.dns ?? [],
+          ip: options.ip ?? [],
+          purpose: CertificatePurpose3.ForApplication
+        });
+        const csrFile = path9.join(tmpDir, "request.csr");
+        await fs12.promises.writeFile(csrFile, csr);
+        return { privateKeyFile, csrFile };
+      }
       async generateKeyPairAndSignDER(options) {
         const keySize = options.keySize ?? 2048;
         const startDate = options.startDate ?? /* @__PURE__ */ new Date();
-        const tmpDir = await fs10.promises.mkdtemp(path6.join(os4.tmpdir(), "pki-keygen-"));
+        const tmpDir = await fs12.promises.mkdtemp(path9.join(os4.tmpdir(), "pki-keygen-"));
         try {
-          const privateKeyFile = path6.join(tmpDir, "private_key.pem");
-          await generatePrivateKeyFile2(privateKeyFile, keySize);
-          const configFile = path6.join(tmpDir, "openssl.cnf");
-          await fs10.promises.writeFile(configFile, configurationFileSimpleTemplate2, "utf-8");
-          const csrFile = path6.join(tmpDir, "request.csr");
-          await createCertificateSigningRequestWithOpenSSL(csrFile, {
-            rootDir: tmpDir,
-            configFile,
-            privateKey: privateKeyFile,
-            applicationUri: options.applicationUri,
-            subject: options.subject,
-            dns: options.dns ?? [],
-            ip: options.ip ?? [],
-            purpose: CertificatePurpose2.ForApplication
-          });
-          const certFile = path6.join(tmpDir, "certificate.pem");
+          const { privateKeyFile, csrFile } = await this.#createEphemeralKeyAndCsr(tmpDir, keySize, options);
+          const certFile = path9.join(tmpDir, "certificate.pem");
           const signingParams = {
             applicationUri: options.applicationUri,
             dns: options.dns,
@@ -3732,12 +4544,12 @@ var init_certificate_authority = __esm({
           if (options.validityMs !== void 0) signingParams.validityMs = options.validityMs;
           else signingParams.validity = options.validity ?? 365;
           await this.signCertificateRequest(certFile, csrFile, signingParams);
-          const certPem = readCertificatePEM(certFile);
-          const certificateDer = convertPEMtoDER(certPem);
-          const privateKey = readPrivateKey2(privateKeyFile);
+          const certPem = readCertificatePEM2(certFile);
+          const certificateDer = convertPEMtoDER2(certPem);
+          const privateKey = readPrivateKey3(privateKeyFile);
           return { certificateDer, privateKey };
         } finally {
-          await fs10.promises.rm(tmpDir, {
+          await fs12.promises.rm(tmpDir, {
             recursive: true,
             force: true
           });
@@ -3758,24 +4570,10 @@ var init_certificate_authority = __esm({
         const keySize = options.keySize ?? 2048;
         const startDate = options.startDate ?? /* @__PURE__ */ new Date();
         const passphrase = options.passphrase ?? "";
-        const tmpDir = await fs10.promises.mkdtemp(path6.join(os4.tmpdir(), "pki-keygen-pfx-"));
+        const tmpDir = await fs12.promises.mkdtemp(path9.join(os4.tmpdir(), "pki-keygen-pfx-"));
         try {
-          const privateKeyFile = path6.join(tmpDir, "private_key.pem");
-          await generatePrivateKeyFile2(privateKeyFile, keySize);
-          const configFile = path6.join(tmpDir, "openssl.cnf");
-          await fs10.promises.writeFile(configFile, configurationFileSimpleTemplate2, "utf-8");
-          const csrFile = path6.join(tmpDir, "request.csr");
-          await createCertificateSigningRequestWithOpenSSL(csrFile, {
-            rootDir: tmpDir,
-            configFile,
-            privateKey: privateKeyFile,
-            applicationUri: options.applicationUri,
-            subject: options.subject,
-            dns: options.dns ?? [],
-            ip: options.ip ?? [],
-            purpose: CertificatePurpose2.ForApplication
-          });
-          const certFile = path6.join(tmpDir, "certificate.pem");
+          const { privateKeyFile, csrFile } = await this.#createEphemeralKeyAndCsr(tmpDir, keySize, options);
+          const certFile = path9.join(tmpDir, "certificate.pem");
           const signingParams = {
             applicationUri: options.applicationUri,
             dns: options.dns,
@@ -3785,17 +4583,20 @@ var init_certificate_authority = __esm({
           if (options.validityMs !== void 0) signingParams.validityMs = options.validityMs;
           else signingParams.validity = options.validity ?? 365;
           await this.signCertificateRequest(certFile, csrFile, signingParams);
-          const pfxFile = path6.join(tmpDir, "bundle.pfx");
-          await createPFX({
-            certificateFile: certFile,
-            privateKeyFile,
-            outputFile: pfxFile,
-            passphrase,
-            caCertificateFiles: [this.caCertificate]
+          const blocks = (await fs12.promises.readFile(certFile, "utf-8")).match(
+            /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g
+          );
+          if (!blocks || blocks.length === 0) {
+            throw new Error(`generateKeyPairAndSignPFX: no certificate was produced in ${certFile}`);
+          }
+          return await createPfx({
+            certificate: convertPEMtoDER2(blocks[0]),
+            certificateChain: blocks.slice(1).map(convertPEMtoDER2),
+            privateKey: readPrivateKey3(privateKeyFile),
+            password: passphrase
           });
-          return await fs10.promises.readFile(pfxFile);
         } finally {
-          await fs10.promises.rm(tmpDir, {
+          await fs12.promises.rm(tmpDir, {
             recursive: true,
             force: true
           });
@@ -3816,8 +4617,8 @@ var init_certificate_authority = __esm({
       async revokeCertificateDER(certDer, reason) {
         const info = exploreCertificate2(certDer);
         const serial = info.tbsCertificate.serialNumber.replace(/:/g, "").toUpperCase();
-        const storedCertFile = path6.join(this.rootDir, "certs", `${serial}.pem`);
-        if (!fs10.existsSync(storedCertFile)) {
+        const storedCertFile = path9.join(this.rootDir, "certs", `${serial}.pem`);
+        if (!fs12.existsSync(storedCertFile)) {
           throw new Error(`Cannot revoke: no stored certificate found for serial ${serial} at ${storedCertFile}`);
         }
         await this.revokeCertificate(storedCertFile, {
@@ -3830,7 +4631,69 @@ var init_certificate_authority = __esm({
        * already exist.
        */
       async initialize() {
-        await construct_CertificateAuthority(this);
+        mkdirRecursiveSync(path9.resolve(this.rootDir));
+        await this.#withCaLock(() => this.#bootstrap());
+      }
+      /**
+       * @internal Shared (backend-agnostic) part of `initialize()`: directory
+       * layout, default database files, the "already initialized" / "partial
+       * init" checks, and the openssl config file — then delegates CSR
+       * generation, CA-certificate signing, and the initial CRL to
+       * {@link CaBackend.bootstrap}. Must be called under {@link #withCaLock}.
+       */
+      async #bootstrap() {
+        const caRootDir = path9.resolve(this.rootDir);
+        mkdirRecursiveSync(caRootDir);
+        ensurePrivateDirectory(path9.join(caRootDir, "private"));
+        mkdirRecursiveSync(path9.join(caRootDir, "public"));
+        mkdirRecursiveSync(path9.join(caRootDir, "certs"));
+        mkdirRecursiveSync(path9.join(caRootDir, "crl"));
+        mkdirRecursiveSync(path9.join(caRootDir, "conf"));
+        const serial = path9.join(caRootDir, "serial");
+        if (!fs12.existsSync(serial)) {
+          await fs12.promises.writeFile(serial, "1000");
+        }
+        const crlNumber = path9.join(caRootDir, "crlnumber");
+        if (!fs12.existsSync(crlNumber)) {
+          await fs12.promises.writeFile(crlNumber, "1000");
+        }
+        const indexFile = path9.join(caRootDir, "index.txt");
+        if (!fs12.existsSync(indexFile)) {
+          await fs12.promises.writeFile(indexFile, "");
+        }
+        const signerBacked = this.hasExternalSigner;
+        const caKeyExists = signerBacked || fs12.existsSync(path9.join(caRootDir, "private/cakey.pem"));
+        const caCertExists = fs12.existsSync(path9.join(caRootDir, "public/cacert.pem"));
+        if (caKeyExists && caCertExists && !config3.forceCA) {
+          if (!signerBacked) {
+            restrictPrivateFilePermissions(path9.join(caRootDir, "private/cakey.pem"), 384);
+            await this._ensurePrivateKeyProtection();
+          }
+          debugLog("CA private key and certificate already exist ... skipping");
+          return;
+        }
+        if (!signerBacked && caKeyExists && !caCertExists) {
+          debugLog("CA private key exists but cacert.pem is missing \u2014 rebuilding CA");
+          fs12.unlinkSync(path9.join(caRootDir, "private/cakey.pem"));
+          const staleCsr = path9.join(caRootDir, "private/cakey.csr");
+          if (fs12.existsSync(staleCsr)) {
+            fs12.unlinkSync(staleCsr);
+          }
+        }
+        displayTitle("Create Certificate Authority (CA)");
+        const indexFileAttr = path9.join(caRootDir, "index.txt.attr");
+        if (!fs12.existsSync(indexFileAttr)) {
+          await fs12.promises.writeFile(indexFileAttr, "unique_subject = no");
+        }
+        const caConfigFile = this.configFile;
+        await fs12.promises.writeFile(caConfigFile, renderCaConfig(caRootDir));
+        if (!signerBacked) {
+          const privateKeyFilename = path9.join(caRootDir, "private/cakey.pem");
+          displayTitle(`Generate the CA private Key - ${this.keySize}`);
+          await generatePrivateKeyFile2(privateKeyFilename, this.keySize, { passphrase: await this._privateKeyPassphrase() });
+          restrictPrivateFilePermissions(privateKeyFilename, 384);
+        }
+        await this.#backend.bootstrap(this);
       }
       /**
        * Initialize the CA directory structure and generate the
@@ -3852,21 +4715,25 @@ var init_certificate_authority = __esm({
        * @returns an {@link InitializeCSRResult} describing the CA state
        */
       async initializeCSR() {
-        const caRootDir = path6.resolve(this.rootDir);
+        const caRootDir = path9.resolve(this.rootDir);
         mkdirRecursiveSync(caRootDir);
+        return this.#withCaLock(() => this.#initializeCSRLocked(caRootDir));
+      }
+      async #initializeCSRLocked(caRootDir) {
         for (const dir of ["public", "certs", "crl", "conf"]) {
-          mkdirRecursiveSync(path6.join(caRootDir, dir));
+          mkdirRecursiveSync(path9.join(caRootDir, dir));
         }
-        ensurePrivateDirectory(path6.join(caRootDir, "private"));
+        ensurePrivateDirectory(path9.join(caRootDir, "private"));
         const caCertFile = this.caCertificate;
-        const privateKeyFile = path6.join(caRootDir, "private/cakey.pem");
-        const csrFile = path6.join(caRootDir, "private/cakey.csr");
-        if (fs10.existsSync(privateKeyFile)) {
+        const privateKeyFile = path9.join(caRootDir, "private/cakey.pem");
+        const csrFile = path9.join(caRootDir, "private/cakey.csr");
+        const keyAvailable = this.hasExternalSigner || fs12.existsSync(privateKeyFile);
+        if (!this.hasExternalSigner && fs12.existsSync(privateKeyFile)) {
           restrictPrivateFilePermissions(privateKeyFile, 384);
           await this._ensurePrivateKeyProtection();
         }
-        if (fs10.existsSync(caCertFile)) {
-          const certDer = convertPEMtoDER(readCertificatePEM(caCertFile));
+        if (fs12.existsSync(caCertFile)) {
+          const certDer = convertPEMtoDER2(readCertificatePEM2(caCertFile));
           const certInfo = exploreCertificate2(certDer);
           const notAfter = certInfo.tbsCertificate.validity.notAfter;
           if (notAfter.getTime() < Date.now()) {
@@ -3877,29 +4744,29 @@ var init_certificate_authority = __esm({
           debugLog("CA certificate already exists and is valid \u2014 ready");
           return { status: "ready" };
         }
-        if (fs10.existsSync(privateKeyFile) && fs10.existsSync(csrFile)) {
+        if (keyAvailable && fs12.existsSync(csrFile)) {
           debugLog("CA key + CSR already exist \u2014 pending external signing");
           return { status: "pending", csrPath: csrFile };
         }
-        const serial = path6.join(caRootDir, "serial");
-        if (!fs10.existsSync(serial)) {
-          await fs10.promises.writeFile(serial, "1000");
+        const serial = path9.join(caRootDir, "serial");
+        if (!fs12.existsSync(serial)) {
+          await fs12.promises.writeFile(serial, "1000");
         }
-        const crlNumber = path6.join(caRootDir, "crlnumber");
-        if (!fs10.existsSync(crlNumber)) {
-          await fs10.promises.writeFile(crlNumber, "1000");
+        const crlNumber = path9.join(caRootDir, "crlnumber");
+        if (!fs12.existsSync(crlNumber)) {
+          await fs12.promises.writeFile(crlNumber, "1000");
         }
-        const indexFile = path6.join(caRootDir, "index.txt");
-        if (!fs10.existsSync(indexFile)) {
-          await fs10.promises.writeFile(indexFile, "");
+        const indexFile = path9.join(caRootDir, "index.txt");
+        if (!fs12.existsSync(indexFile)) {
+          await fs12.promises.writeFile(indexFile, "");
         }
-        const indexFileAttr = path6.join(caRootDir, "index.txt.attr");
-        if (!fs10.existsSync(indexFileAttr)) {
-          await fs10.promises.writeFile(indexFileAttr, "unique_subject = no");
+        const indexFileAttr = path9.join(caRootDir, "index.txt.attr");
+        if (!fs12.existsSync(indexFileAttr)) {
+          await fs12.promises.writeFile(indexFileAttr, "unique_subject = no");
         }
         const caConfigFile = this.configFile;
-        await fs10.promises.writeFile(caConfigFile, renderCaConfig(caRootDir));
-        if (!fs10.existsSync(privateKeyFile)) {
+        await fs12.promises.writeFile(caConfigFile, renderCaConfig(caRootDir));
+        if (!keyAvailable) {
           await generatePrivateKeyFile2(privateKeyFile, this.keySize, { passphrase: await this._privateKeyPassphrase() });
           restrictPrivateFilePermissions(privateKeyFile, 384);
         }
@@ -3920,53 +4787,34 @@ var init_certificate_authority = __esm({
        *   renewal is needed, `"ready"` if the cert is still valid
        */
       async renewCSR(thresholdDays = 30) {
-        const caRootDir = path6.resolve(this.rootDir);
+        const caRootDir = path9.resolve(this.rootDir);
         const caCertFile = this.caCertificate;
-        const privateKeyFile = path6.join(caRootDir, "private/cakey.pem");
-        const csrFile = path6.join(caRootDir, "private/cakey.csr");
-        if (!fs10.existsSync(caCertFile)) {
+        const privateKeyFile = path9.join(caRootDir, "private/cakey.pem");
+        const csrFile = path9.join(caRootDir, "private/cakey.csr");
+        if (!fs12.existsSync(caCertFile)) {
           return this.initializeCSR();
         }
-        const certDer = convertPEMtoDER(readCertificatePEM(caCertFile));
+        const certDer = convertPEMtoDER2(readCertificatePEM2(caCertFile));
         const certInfo = exploreCertificate2(certDer);
         const notAfter = certInfo.tbsCertificate.validity.notAfter;
         const thresholdMs = thresholdDays * 24 * 60 * 60 * 1e3;
         if (notAfter.getTime() - Date.now() < thresholdMs) {
           debugLog(`CA certificate expires within ${thresholdDays} days \u2014 generating renewal CSR`);
-          await this._generateCSR(caRootDir, privateKeyFile, csrFile);
+          await this.#withCaLock(() => this._generateCSR(caRootDir, privateKeyFile, csrFile));
           return { status: "expired", csrPath: csrFile, expiryDate: notAfter };
         }
         return { status: "ready" };
       }
       /**
        * Generate a CSR using the existing private key.
+       * Must be called under {@link #withCaLock} — the lock is taken by the
+       * public callers (`initializeCSR`, `renewCSR`), not here, so that
+       * `initializeCSR` can hold one lock across key generation AND CSR
+       * generation without the non-reentrant file lock deadlocking.
        * @internal
        */
       async _generateCSR(caRootDir, privateKeyFile, csrFile) {
-        processAltNames({});
-        const options = { cwd: caRootDir };
-        const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-        const passin = await this._opensslPassin();
-        await execute_openssl(
-          [
-            "req",
-            "-new",
-            "-sha256",
-            "-text",
-            "-extensions",
-            "v3_ca_req",
-            "-config",
-            n5(configFile),
-            "-key",
-            n5(privateKeyFile),
-            "-out",
-            n5(csrFile),
-            "-subj",
-            this.subject.toString(),
-            ...passin.args
-          ],
-          { ...options, env: passin.env }
-        );
+        await this.#backend.generateCaCsr(this, caRootDir, privateKeyFile, csrFile);
       }
       /**
        * Install an externally-signed CA certificate and generate
@@ -3985,43 +4833,41 @@ var init_certificate_authority = __esm({
        *   `status: "success"` or `status: "error"` and a `reason`
        */
       async installCACertificate(signedCertFile) {
-        const caRootDir = path6.resolve(this.rootDir);
-        const caCertFile = this.caCertificate;
-        const fullPem = await fs10.promises.readFile(signedCertFile, "utf8");
-        const pemBlocks = fullPem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
-        if (!pemBlocks || pemBlocks.length === 0) {
-          return {
-            status: "error",
-            reason: "no_certificate_found",
-            message: "The provided file does not contain any PEM-encoded certificate."
-          };
-        }
-        const certDer = convertPEMtoDER(pemBlocks[0]);
-        const privateKey = await this.getPrivateKey();
-        if (!certificateMatchesPrivateKey(certDer, privateKey)) {
-          return {
-            status: "error",
-            reason: "certificate_key_mismatch",
-            message: "The provided certificate does not match the CA private key. Ensure the certificate was signed from the CSR generated by initializeCSR()."
-          };
-        }
-        await fs10.promises.writeFile(caCertFile, `${pemBlocks[0]}
+        return this.#withCaLock(async () => {
+          const caCertFile = this.caCertificate;
+          const fullPem = await fs12.promises.readFile(signedCertFile, "utf8");
+          const pemBlocks = fullPem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
+          if (!pemBlocks || pemBlocks.length === 0) {
+            return {
+              status: "error",
+              reason: "no_certificate_found",
+              message: "The provided file does not contain any PEM-encoded certificate."
+            };
+          }
+          const certDer = convertPEMtoDER2(pemBlocks[0]);
+          if (!await this.#certificateMatchesOurKey(pemBlocks[0], certDer)) {
+            return {
+              status: "error",
+              reason: "certificate_key_mismatch",
+              message: "The provided certificate does not match the CA private key. Ensure the certificate was signed from the CSR generated by initializeCSR()."
+            };
+          }
+          await fs12.promises.writeFile(caCertFile, `${pemBlocks[0]}
 `);
-        const issuerChainFile = this.issuerCertificateChain;
-        if (pemBlocks.length > 1) {
-          const issuerPem = `${pemBlocks.slice(1).join("\n")}
+          const issuerChainFile = this.issuerCertificateChain;
+          if (pemBlocks.length > 1) {
+            const issuerPem = `${pemBlocks.slice(1).join("\n")}
 `;
-          await fs10.promises.writeFile(issuerChainFile, issuerPem);
-          debugLog(`Stored ${pemBlocks.length - 1} issuer certificate(s) in issuer_chain.pem`);
-        } else {
-          if (fs10.existsSync(issuerChainFile)) {
-            await fs10.promises.unlink(issuerChainFile);
+            await fs12.promises.writeFile(issuerChainFile, issuerPem);
+            debugLog(`Stored ${pemBlocks.length - 1} issuer certificate(s) in issuer_chain.pem`);
+          } else {
+            if (fs12.existsSync(issuerChainFile)) {
+              await fs12.promises.unlink(issuerChainFile);
+            }
           }
-        }
-        const options = { cwd: caRootDir };
-        const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-        await regenerateCrl(this.revocationList, ["-config", n5(configFile)], options, await this._opensslPassin());
-        return { status: "success" };
+          await this.#backend.regenerateCrl(this);
+          return { status: "success" };
+        });
       }
       /**
        * Sign a CSR with CA extensions (`v3_ca`), producing a
@@ -4037,39 +4883,11 @@ var init_certificate_authority = __esm({
        * @param params - signing parameters
        */
       async signCACertificateRequest(certFile, csrFile, params) {
-        const caRootDir = path6.resolve(this.rootDir);
-        const options = { cwd: caRootDir };
-        this._wireRevocationEnvVars();
-        const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-        const validity = params.validity ?? 3650;
-        const passin = await this._opensslPassin();
-        await execute_openssl(
-          [
-            "x509",
-            "-sha256",
-            "-req",
-            "-days",
-            String(validity),
-            "-text",
-            "-extensions",
-            "v3_ca",
-            "-extfile",
-            n5(configFile),
-            "-in",
-            n5(csrFile),
-            "-CA",
-            n5(this.caCertificate),
-            "-CAkey",
-            n5(path6.join(caRootDir, "private/cakey.pem")),
-            "-CAserial",
-            n5(path6.join(caRootDir, "serial")),
-            "-out",
-            n5(certFile),
-            ...passin.args
-          ],
-          { ...options, env: passin.env }
-        );
-        await this.constructCertificateChain(certFile);
+        await this.#withCaLock(async () => {
+          const validity = params.validity ?? 3650;
+          await this.#backend.signSubordinateCsr(this, csrFile, certFile, validity);
+          await this.constructCertificateChain(certFile);
+        });
       }
       /**
        * Rebuild the combined CA certificate + CRL file.
@@ -4080,13 +4898,13 @@ var init_certificate_authority = __esm({
        */
       async constructCACertificateWithCRL() {
         const cacertWithCRL = this.caCertificateWithCrl;
-        if (fs10.existsSync(this.revocationList)) {
-          await fs10.promises.writeFile(
+        if (fs12.existsSync(this.revocationList)) {
+          await fs12.promises.writeFile(
             cacertWithCRL,
-            fs10.readFileSync(this.caCertificate, "utf8") + fs10.readFileSync(this.revocationList, "utf8")
+            fs12.readFileSync(this.caCertificate, "utf8") + fs12.readFileSync(this.revocationList, "utf8")
           );
         } else {
-          await fs10.promises.writeFile(cacertWithCRL, fs10.readFileSync(this.caCertificate));
+          await fs12.promises.writeFile(cacertWithCRL, fs12.readFileSync(this.caCertificate));
         }
       }
       /**
@@ -4096,15 +4914,15 @@ var init_certificate_authority = __esm({
        * @param certificate - path to the certificate file to extend
        */
       async constructCertificateChain(certificate) {
-        assert10(fs10.existsSync(certificate));
-        assert10(fs10.existsSync(this.caCertificate));
+        assert9(fs12.existsSync(certificate));
+        assert9(fs12.existsSync(this.caCertificate));
         debugLog(chalk6.yellow("        certificate file :"), chalk6.cyan(certificate));
-        let chain = await fs10.promises.readFile(certificate, "utf8");
-        chain += await fs10.promises.readFile(this.caCertificate, "utf8");
-        if (fs10.existsSync(this.issuerCertificateChain)) {
-          chain += await fs10.promises.readFile(this.issuerCertificateChain, "utf8");
+        let chain = await fs12.promises.readFile(certificate, "utf8");
+        chain += await fs12.promises.readFile(this.caCertificate, "utf8");
+        if (fs12.existsSync(this.issuerCertificateChain)) {
+          chain += await fs12.promises.readFile(this.issuerCertificateChain, "utf8");
         }
-        await fs10.promises.writeFile(certificate, chain);
+        await fs12.promises.writeFile(certificate, chain);
       }
       /**
        * Create a self-signed certificate using OpenSSL.
@@ -4114,52 +4932,30 @@ var init_certificate_authority = __esm({
        * @param params - certificate parameters (subject, validity, SANs)
        */
       async createSelfSignedCertificate(certificateFile, privateKey, params) {
-        assert10(typeof privateKey === "string");
-        assert10(fs10.existsSync(privateKey));
+        assert9(typeof privateKey === "string");
+        assert9(fs12.existsSync(privateKey));
         if (!certificateFileExist(certificateFile)) {
           return;
         }
         adjustDate(params);
         adjustApplicationUri(params);
-        processAltNames(params);
-        const csrFile = `${certificateFile}_csr`;
-        assert10(csrFile);
-        const configFile = generateStaticConfig(this.configFile, { cwd: this.rootDir });
-        const options = {
-          cwd: this.rootDir,
-          openssl_conf: makePath(configFile)
-        };
-        const subject = params.subject ? new Subject4(params.subject).toString() : "";
-        const subjectOptions = subject && subject.length > 1 ? ["-subj", subject] : [];
-        displaySubtitle("- the certificate signing request");
-        await execute_openssl(
-          ["req", "-new", "-sha256", "-text", ...subjectOptions, "-batch", "-key", n5(privateKey), "-out", n5(csrFile)],
-          options
-        );
-        displaySubtitle("- creating the self-signed certificate");
-        await execute_openssl(
-          [
-            "ca",
-            "-selfsign",
-            "-keyfile",
-            n5(privateKey),
-            "-startdate",
-            x509Date(params.startDate),
-            "-enddate",
-            x509Date(params.endDate),
-            "-batch",
-            "-out",
-            n5(certificateFile),
-            "-in",
-            n5(csrFile)
-          ],
-          options
-        );
-        displaySubtitle("- dump the certificate for a check");
-        await execute_openssl(["x509", "-in", n5(certificateFile), "-dates", "-fingerprint", "-purpose", "-noout"], {});
-        displaySubtitle("- verify self-signed certificate");
-        await execute_openssl_no_failure(["verify", "-verbose", "-CAfile", n5(certificateFile), n5(certificateFile)], options);
-        await fs10.promises.unlink(csrFile);
+        params.dns = params.dns || [];
+        params.ip = params.ip || [];
+        await this.#withCaLock(async () => {
+          await this.#backend.createSelfSignedCertificate(this, certificateFile, privateKey, params);
+        });
+      }
+      /**
+       * Regenerate `crl/revocation_list.{crl,der}` from the current database
+       * state, without changing any certificate's status. Normally
+       * unnecessary — `revokeCertificate` already regenerates the CRL as
+       * part of revoking — but useful to force a refresh (e.g. after
+       * switching a CA's `backend` between `"openssl"` and `"native"`).
+       */
+      async regenerateCrl() {
+        await this.#withCaLock(async () => {
+          await this.#backend.regenerateCrl(this);
+        });
       }
       /**
        * Revoke a certificate and regenerate the CRL.
@@ -4180,49 +4976,12 @@ var init_certificate_authority = __esm({
           "certificateHold",
           "removeFromCRL"
         ];
-        const configFile = generateStaticConfig("conf/caconfig.cnf", { cwd: this.rootDir });
-        const options = {
-          cwd: this.rootDir,
-          openssl_conf: makePath(configFile)
-        };
-        setEnv("ALTNAME", "");
-        const randomFile = path6.join(this.rootDir, "random.rnd");
-        setEnv("RANDFILE", randomFile);
-        const configOption = ["-config", n5(configFile)];
         const reason = params.reason || "keyCompromise";
-        assert10(crlReasons.indexOf(reason) >= 0);
+        assert9(crlReasons.indexOf(reason) >= 0);
         displayTitle(`Revoking certificate  ${certificate}`);
-        displaySubtitle("Revoke certificate");
-        const passin = await this._opensslPassin();
-        await execute_openssl_no_failure(
-          ["ca", "-verbose", ...configOption, "-revoke", certificate, "-crl_reason", reason, ...passin.args],
-          { ...options, env: passin.env }
-        );
-        await regenerateCrl(this.revocationList, configOption, options, passin);
-        displaySubtitle("Verify that certificate is revoked");
-        await execute_openssl_no_failure(
-          [
-            "verify",
-            "-verbose",
-            "-CRLfile",
-            n5(this.revocationList),
-            "-CAfile",
-            n5(this.caCertificate),
-            "-crl_check",
-            n5(certificate)
-          ],
-          options
-        );
-        displaySubtitle("Produce CRL in DER form ");
-        await execute_openssl(
-          ["crl", "-in", n5(this.revocationList), "-out", "crl/revocation_list.der", "-outform", "der"],
-          options
-        );
-        displaySubtitle("Produce CRL in PEM form ");
-        await execute_openssl(
-          ["crl", "-in", n5(this.revocationList), "-out", "crl/revocation_list.pem", "-outform", "pem", "-text"],
-          options
-        );
+        await this.#withCaLock(async () => {
+          await this.#backend.revoke(this, certificate, reason);
+        });
       }
       /**
        * Sign a Certificate Signing Request (CSR) with this CA.
@@ -4237,15 +4996,13 @@ var init_certificate_authority = __esm({
        * @returns the path to the signed certificate
        */
       async signCertificateRequest(certificate, certificateSigningRequestFilename, params1) {
-        await ensure_openssl_installed();
-        assert10(fs10.existsSync(certificateSigningRequestFilename));
+        await this.#backend.preflight();
+        assert9(fs12.existsSync(certificateSigningRequestFilename));
         if (!certificateFileExist(certificate)) {
           return "";
         }
         adjustDate(params1);
         adjustApplicationUri(params1);
-        processAltNames(params1);
-        const options = { cwd: this.rootDir };
         const csr = await readCertificateSigningRequest(certificateSigningRequestFilename);
         const csrInfo = exploreCertificateSigningRequest(csr);
         const applicationUri = csrInfo.extensionRequest.subjectAltName.uniformResourceIdentifier ? csrInfo.extensionRequest.subjectAltName.uniformResourceIdentifier[0] : void 0;
@@ -4255,73 +5012,122 @@ var init_certificate_authority = __esm({
         const dns2 = csrInfo.extensionRequest.subjectAltName.dNSName || [];
         let ip = csrInfo.extensionRequest.subjectAltName.iPAddress || [];
         ip = ip.map(octetStringToIpAddress);
-        const params = {
-          applicationUri,
-          dns: dns2,
-          ip
-        };
-        processAltNames(params);
-        this._wireRevocationEnvVars();
-        const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-        displaySubtitle("- then we ask the authority to sign the certificate signing request");
-        const passin = await this._opensslPassin();
-        await execute_openssl(
-          [
-            "ca",
-            "-config",
-            configFile,
-            "-startdate",
-            x509Date(params1.startDate),
-            "-enddate",
-            x509Date(params1.endDate),
-            "-batch",
-            "-out",
-            n5(certificate),
-            "-in",
-            n5(certificateSigningRequestFilename),
-            ...passin.args
-          ],
-          { ...options, env: passin.env }
-        );
-        displaySubtitle("- dump the certificate for a check");
-        await execute_openssl(["x509", "-in", n5(certificate), "-dates", "-fingerprint", "-purpose", "-noout"], options);
-        displaySubtitle("- construct CA certificate with CRL");
-        await this.constructCACertificateWithCRL();
-        displaySubtitle("- construct certificate chain");
-        await this.constructCertificateChain(certificate);
-        displaySubtitle("- verify certificate against the root CA");
-        await this.verifyCertificate(certificate);
-        return certificate;
+        const sanOverride = { applicationUri, dns: dns2, ip };
+        return this.#withCaLock(async () => {
+          await this.#backend.signEndEntityCsr(this, certificate, certificateSigningRequestFilename, params1, sanOverride);
+          displaySubtitle("- construct CA certificate with CRL");
+          await this.constructCACertificateWithCRL();
+          displaySubtitle("- construct certificate chain");
+          await this.constructCertificateChain(certificate);
+          displaySubtitle("- verify certificate against the root CA");
+          await this.verifyCertificate(certificate);
+          return certificate;
+        });
       }
       /**
-       * Verify a certificate against this CA.
+       * Check that `certificate` really was signed by this CA, and throw if it
+       * was not.
+       *
+       * This used to do nothing: `openssl verify` crashes on Windows, so the
+       * check was left as a placeholder. It no longer needs a subprocess -
+       * `verifyCertificateSignature` does it in pure JS, the same way
+       * {@link CertificateManager} already validates a chain - so the check
+       * that `signCertificateRequest` always claimed to perform now actually
+       * happens on every issuance, whichever backend did the signing.
        *
-       * @param certificate - path to the certificate file to verify
+       * Only the leading certificate is examined: the file may be a chain,
+       * and the rest of it is this CA's own certificate and its issuers.
+       *
+       * @param certificate - path to the certificate (or chain) to verify
        */
       async verifyCertificate(certificate) {
-        const isImplemented = false;
-        if (isImplemented) {
-          const options = { cwd: this.rootDir };
-          const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-          setEnv("OPENSSL_CONF", makePath(configFile));
-          await execute_openssl_no_failure(
-            ["verify", "-verbose", "-CAfile", n5(this.caCertificateWithCrl), n5(certificate)],
-            options
+        const pem = await fs12.promises.readFile(certificate, "utf-8");
+        const blocks = pem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
+        if (!blocks || blocks.length === 0) {
+          throw new Error(`verifyCertificate: ${certificate} contains no PEM-encoded certificate`);
+        }
+        const caCertificateDer = convertPEMtoDER2(readCertificatePEM2(this.caCertificate));
+        if (!verifyCertificateSignature2(convertPEMtoDER2(blocks[0]), caCertificateDer)) {
+          throw new Error(
+            `verifyCertificate: ${certificate} was not signed by this certificate authority (${this.caCertificate})`
+          );
+        }
+      }
+    };
+  }
+});
+
+// packages/node-opcua-pki/lib/ca/certificate_authority.ts
+var CertificateAuthority;
+var init_certificate_authority = __esm({
+  "packages/node-opcua-pki/lib/ca/certificate_authority.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_with_openssl();
+    init_native_ca_backend();
+    init_openssl_ca_backend();
+    init_certificate_authority_core();
+    init_certificate_authority_core();
+    CertificateAuthority = class extends CertificateAuthorityCore {
+      constructor(options) {
+        if (options.signer && options.backend === "openssl") {
+          throw new Error(
+            "CertificateAuthority: backend 'openssl' cannot be combined with 'signer' - the openssl CLI loads its key from a file and cannot call an external signer. Drop the backend option (a signer implies 'native') or drop the signer."
           );
         }
+        const backend = options.signer || options.backend === "native" ? new NativeCaBackend() : new OpenSslCaBackend();
+        super({ ...options, backend });
+      }
+      /**
+       * @internal `-passin env:` argv + env for an openssl call that loads
+       * this CA's key (always emitted, empty when none).
+       *
+       * The openssl backend builds its own now; this remains so that external
+       * code calling it keeps working, and lives here rather than on the core
+       * because the flag means nothing to a backend that spawns nothing.
+       */
+      async _opensslPassin() {
+        return passinArg(await this._privateKeyPassphrase());
+      }
+      /**
+       * @internal
+       * Legacy shim: publish the `CDP_URL` / `AIA_VALUE` config substitution
+       * values to the shared env registry, or unset them so the matching
+       * `{{#KEY}}...{{/KEY}}` blocks are stripped. Nothing in this package
+       * reads the registry any more - every openssl config render receives
+       * these values explicitly, from the same {@link caConfigEnvOverrides}
+       * builder this delegates to, so the two cannot drift - kept only for
+       * external code that renders openssl config templates against the
+       * registry directly.
+       *
+       * It lives on this class rather than the core because it is meaningful
+       * only to the openssl backend.
+       */
+      _wireRevocationEnvVars() {
+        const overrides = caConfigEnvOverrides(this);
+        if (overrides.CDP_URL) {
+          setEnv("CDP_URL", overrides.CDP_URL);
+        } else {
+          unsetEnv("CDP_URL");
+        }
+        if (overrides.AIA_VALUE) {
+          setEnv("AIA_VALUE", overrides.AIA_VALUE);
+        } else {
+          unsetEnv("AIA_VALUE");
+        }
       }
     };
   }
 });
 
 // packages/node-opcua-pki/lib/ca/crypto_create_CA.ts
-import assert11 from "assert";
-import fs11 from "fs";
+import assert10 from "assert";
+import fs13 from "fs";
 import { createRequire } from "module";
 import os5 from "os";
-import path7 from "path";
+import path10 from "path";
 import chalk7 from "chalk";
-import { CertificatePurpose as CertificatePurpose3, generatePrivateKeyFile as generatePrivateKeyFile3, Subject as Subject5 } from "node-opcua-crypto";
+import { CertificatePurpose as CertificatePurpose4, generatePrivateKeyFile as generatePrivateKeyFile3, Subject as Subject7 } from "node-opcua-crypto";
 import commandLineArgs from "command-line-args";
 import commandLineUsage from "command-line-usage";
 function get_offset_date(date, nbDays) {
@@ -4329,9 +5135,9 @@ function get_offset_date(date, nbDays) {
   d.setDate(d.getDate() + nbDays);
   return d;
 }
-async function construct_CertificateAuthority2(subject) {
-  assert11(typeof gLocalConfig.CAFolder === "string", "expecting a CAFolder in config");
-  assert11(typeof gLocalConfig.keySize === "number", "expecting a keySize in config");
+async function construct_CertificateAuthority(subject) {
+  assert10(typeof gLocalConfig.CAFolder === "string", "expecting a CAFolder in config");
+  assert10(typeof gLocalConfig.keySize === "number", "expecting a keySize in config");
   if (!g_certificateAuthority) {
     g_certificateAuthority = new CertificateAuthority({
       keySize: gLocalConfig.keySize,
@@ -4342,7 +5148,7 @@ async function construct_CertificateAuthority2(subject) {
   }
 }
 async function construct_CertificateManager() {
-  assert11(typeof gLocalConfig.PKIFolder === "string", "expecting a PKIFolder in config");
+  assert10(typeof gLocalConfig.PKIFolder === "string", "expecting a PKIFolder in config");
   if (!certificateManager) {
     certificateManager = new CertificateManager({
       keySize: gLocalConfig.keySize,
@@ -4353,35 +5159,35 @@ async function construct_CertificateManager() {
 }
 function default_template_content() {
   if (process.pkg?.entrypoint) {
-    const a = fs11.readFileSync(path7.join(__dirname, "../../bin/pki_config.example.js"), "utf8");
+    const a = fs13.readFileSync(path10.join(__dirname, "../../bin/pki_config.example.js"), "utf8");
     return a;
   }
   function find_default_config_template() {
     const rootFolder = find_module_root_folder();
     const configName = "pki_config.example.js";
-    let default_config_template2 = path7.join(rootFolder, "bin", configName);
-    if (!fs11.existsSync(default_config_template2)) {
-      default_config_template2 = path7.join(__dirname, "..", configName);
-      if (!fs11.existsSync(default_config_template2)) {
-        default_config_template2 = path7.join(__dirname, `../bin/${configName}`);
+    let default_config_template2 = path10.join(rootFolder, "bin", configName);
+    if (!fs13.existsSync(default_config_template2)) {
+      default_config_template2 = path10.join(__dirname, "..", configName);
+      if (!fs13.existsSync(default_config_template2)) {
+        default_config_template2 = path10.join(__dirname, `../bin/${configName}`);
       }
     }
     return default_config_template2;
   }
   const default_config_template = find_default_config_template();
-  assert11(fs11.existsSync(default_config_template));
-  const default_config_template_content = fs11.readFileSync(default_config_template, "utf8");
+  assert10(fs13.existsSync(default_config_template));
+  const default_config_template_content = fs13.readFileSync(default_config_template, "utf8");
   return default_config_template_content;
 }
 function find_module_root_folder() {
-  let rootFolder = path7.join(__dirname);
+  let rootFolder = path10.join(__dirname);
   for (let i = 0; i < 4; i++) {
-    if (fs11.existsSync(path7.join(rootFolder, "package.json"))) {
+    if (fs13.existsSync(path10.join(rootFolder, "package.json"))) {
       return rootFolder;
     }
-    rootFolder = path7.join(rootFolder, "..");
+    rootFolder = path10.join(rootFolder, "..");
   }
-  assert11(fs11.existsSync(path7.join(rootFolder, "package.json")), "root folder must have a package.json file");
+  assert10(fs13.existsSync(path10.join(rootFolder, "package.json")), "root folder must have a package.json file");
   return rootFolder;
 }
 async function readConfiguration(argv) {
@@ -4406,41 +5212,41 @@ async function readConfiguration(argv) {
     return str;
   }
   function prepare(file) {
-    const tmp = path7.resolve(performSubstitution(file));
+    const tmp = path10.resolve(performSubstitution(file));
     return makePath(tmp);
   }
   certificateDir = argv.root;
-  assert11(typeof certificateDir === "string");
+  assert10(typeof certificateDir === "string");
   certificateDir = prepare(certificateDir);
   mkdirRecursiveSync(certificateDir);
-  assert11(fs11.existsSync(certificateDir));
-  const default_config = path7.join(certificateDir, "config.js");
-  if (!fs11.existsSync(default_config)) {
+  assert10(fs13.existsSync(certificateDir));
+  const default_config = path10.join(certificateDir, "config.js");
+  if (!fs13.existsSync(default_config)) {
     debugLog(chalk7.yellow(" Creating default g_config file "), chalk7.cyan(default_config));
     const default_config_template_content = default_template_content();
-    fs11.writeFileSync(default_config, default_config_template_content);
+    fs13.writeFileSync(default_config, default_config_template_content);
   } else {
     debugLog(chalk7.yellow(" using  g_config file "), chalk7.cyan(default_config));
   }
-  if (!fs11.existsSync(default_config)) {
+  if (!fs13.existsSync(default_config)) {
     debugLog(chalk7.redBright(" cannot find config file ", default_config));
   }
-  const defaultRandomFile = path7.join(path7.dirname(default_config), "random.rnd");
+  const defaultRandomFile = path10.join(path10.dirname(default_config), "random.rnd");
   setEnv("RANDFILE", defaultRandomFile);
   const _require = createRequire(__filename);
   gLocalConfig = _require(default_config);
-  gLocalConfig.subject = new Subject5(gLocalConfig.subject || "");
+  gLocalConfig.subject = new Subject7(gLocalConfig.subject || "");
   if (argv.subject) {
-    gLocalConfig.subject = new Subject5(argv.subject);
+    gLocalConfig.subject = new Subject7(argv.subject);
   }
   if (!gLocalConfig.subject.commonName) {
     throw new Error("subject must have a Common Name");
   }
   gLocalConfig.certificateDir = certificateDir;
-  let CAFolder = argv.CAFolder || path7.join(certificateDir, "CA");
+  let CAFolder = argv.CAFolder || path10.join(certificateDir, "CA");
   CAFolder = prepare(CAFolder);
   gLocalConfig.CAFolder = CAFolder;
-  gLocalConfig.PKIFolder = path7.join(gLocalConfig.certificateDir, "PKI");
+  gLocalConfig.PKIFolder = path10.join(gLocalConfig.certificateDir, "PKI");
   if (argv.PKIFolder) {
     gLocalConfig.PKIFolder = prepare(argv.PKIFolder);
   }
@@ -4478,7 +5284,7 @@ async function readConfiguration(argv) {
   }
 }
 async function createDefaultCertificate(base_name, prefix, key_length, applicationUri, dev) {
-  assert11(key_length === 1024 || key_length === 2048 || key_length === 3072 || key_length === 4096);
+  assert10(key_length === 1024 || key_length === 2048 || key_length === 3072 || key_length === 4096);
   const private_key_file = makePath(base_name, `${prefix}key_${key_length}.pem`);
   const public_key_file = makePath(base_name, `${prefix}public_key_${key_length}.pub`);
   const certificate_file = makePath(base_name, `${prefix}cert_${key_length}.pem`);
@@ -4498,7 +5304,7 @@ async function createDefaultCertificate(base_name, prefix, key_length, applicati
   }
   const ip = [];
   async function createCertificateIfNotExist(certificate, private_key, applicationUri2, startDate, validity) {
-    if (fs11.existsSync(certificate)) {
+    if (fs13.existsSync(certificate)) {
       warningLog(chalk7.yellow("         certificate"), chalk7.cyan(certificate), chalk7.yellow(" already exists => skipping"));
       return "";
     } else {
@@ -4517,7 +5323,7 @@ async function createDefaultCertificate(base_name, prefix, key_length, applicati
       configFile,
       dns: dns3,
       ip: ip2,
-      purpose: CertificatePurpose3.ForApplication
+      purpose: CertificatePurpose4.ForApplication
     };
     await createCertificateSigningRequestWithOpenSSL(certificateSigningRequestFile, params);
     return await g_certificateAuthority.signCertificateRequest(certificate, certificateSigningRequestFile, {
@@ -4541,7 +5347,7 @@ async function createDefaultCertificate(base_name, prefix, key_length, applicati
     await g_certificateAuthority.revokeCertificate(certificate, {});
   }
   async function createPrivateKeyIfNotExist(privateKey, keyLength) {
-    if (fs11.existsSync(privateKey)) {
+    if (fs13.existsSync(privateKey)) {
       warningLog(chalk7.yellow("         privateKey"), chalk7.cyan(privateKey), chalk7.yellow(" already exists => skipping"));
       return;
     } else {
@@ -4555,14 +5361,14 @@ async function createDefaultCertificate(base_name, prefix, key_length, applicati
   displaySubtitle(` create Certificate ${certificate_file}`);
   await createCertificateIfNotExist(certificate_file, private_key_file, applicationUri, yesterday, 365);
   displaySubtitle(` create self signed Certificate ${self_signed_certificate_file}`);
-  if (fs11.existsSync(self_signed_certificate_file)) {
+  if (fs13.existsSync(self_signed_certificate_file)) {
     return;
   }
   await createSelfSignedCertificate2(self_signed_certificate_file, private_key_file, applicationUri, yesterday, 365);
   if (dev) {
     await createCertificateIfNotExist(certificate_file_outofdate, private_key_file, applicationUri, two_years_ago, 365);
     await createCertificateIfNotExist(certificate_file_not_active_yet, private_key_file, applicationUri, next_year, 365);
-    if (!fs11.existsSync(certificate_revoked)) {
+    if (!fs13.existsSync(certificate_revoked)) {
       const certificate = await createCertificateIfNotExist(
         certificate_revoked,
         private_key_file,
@@ -4584,9 +5390,9 @@ async function wrap(func) {
   }
 }
 async function create_default_certificates(dev) {
-  assert11(gLocalConfig);
+  assert10(gLocalConfig);
   const base_name = gLocalConfig.certificateDir || "";
-  assert11(fs11.existsSync(base_name));
+  assert10(fs13.existsSync(base_name));
   let clientURN;
   let serverURN;
   let discoveryServerURN;
@@ -4617,7 +5423,7 @@ async function create_default_certificates(dev) {
   });
 }
 async function createDefaultCertificates(dev) {
-  await construct_CertificateAuthority2("");
+  await construct_CertificateAuthority("");
   await construct_CertificateManager();
   await create_default_certificates(dev);
 }
@@ -4683,7 +5489,7 @@ ${epilog}`
   }
   if (command === "version") {
     const rootFolder = find_module_root_folder();
-    const pkg = JSON.parse(fs11.readFileSync(path7.join(rootFolder, "package.json"), "utf-8"));
+    const pkg = JSON.parse(fs13.readFileSync(path10.join(rootFolder, "package.json"), "utf-8"));
     console.log(pkg.version);
     return;
   }
@@ -4708,12 +5514,12 @@ ${epilog}`
       await readConfiguration(local_argv);
       if (local_argv.clean) {
         displayTitle("Cleaning old certificates");
-        assert11(gLocalConfig);
+        assert10(gLocalConfig);
         const certificateDir = gLocalConfig.certificateDir || "";
-        const files = await fs11.promises.readdir(certificateDir);
+        const files = await fs13.promises.readdir(certificateDir);
         for (const file of files) {
           if (file.includes(".pem") || file.includes(".pub")) {
-            await fs11.promises.unlink(path7.join(certificateDir, file));
+            await fs13.promises.unlink(path10.join(certificateDir, file));
           }
         }
         mkdirRecursiveSync(certificateDir);
@@ -4734,7 +5540,7 @@ ${epilog}`
     await wrap(async () => {
       await ensure_openssl_installed();
       await readConfiguration(local_argv);
-      await construct_CertificateAuthority2(local_argv.subject);
+      await construct_CertificateAuthority(local_argv.subject);
     });
     return;
   }
@@ -4803,7 +5609,7 @@ ${epilog}`
       await readConfiguration(local_argv2);
       await construct_CertificateManager();
       displaySubtitle(` create self signed Certificate ${gLocalConfig.outputFile}`);
-      let subject = local_argv2.subject && local_argv2.subject.length > 1 ? new Subject5(local_argv2.subject) : gLocalConfig.subject || "";
+      let subject = local_argv2.subject && local_argv2.subject.length > 1 ? new Subject7(local_argv2.subject) : gLocalConfig.subject || "";
       subject = JSON.parse(JSON.stringify(subject));
       const params = {
         applicationUri: gLocalConfig.applicationUri || "",
@@ -4819,8 +5625,8 @@ ${epilog}`
     async function command_full_certificate(local_argv2) {
       await readConfiguration(local_argv2);
       await construct_CertificateManager();
-      await construct_CertificateAuthority2("");
-      assert11(fs11.existsSync(gLocalConfig.CAFolder || ""), " CA folder must exist");
+      await construct_CertificateAuthority("");
+      assert10(fs13.existsSync(gLocalConfig.CAFolder || ""), " CA folder must exist");
       gLocalConfig.privateKey = void 0;
       gLocalConfig.subject = local_argv2.subject && local_argv2.subject.length > 1 ? local_argv2.subject : gLocalConfig.subject;
       const csr_file = await certificateManager.createCertificateRequest(
@@ -4831,7 +5637,7 @@ ${epilog}`
       }
       warningLog(" csr_file = ", csr_file);
       const certificate = csr_file.replace(".csr", ".pem");
-      if (fs11.existsSync(certificate)) {
+      if (fs13.existsSync(certificate)) {
         throw new Error(` File ${certificate} already exist`);
       }
       await g_certificateAuthority.signCertificateRequest(
@@ -4839,8 +5645,8 @@ ${epilog}`
         csr_file,
         gLocalConfig
       );
-      assert11(typeof gLocalConfig.outputFile === "string");
-      fs11.writeFileSync(gLocalConfig.outputFile || "", fs11.readFileSync(certificate, "ascii"));
+      assert10(typeof gLocalConfig.outputFile === "string");
+      fs13.writeFileSync(gLocalConfig.outputFile || "", fs13.readFileSync(certificate, "ascii"));
     }
     await wrap(async () => await command_certificate(local_argv));
     return;
@@ -4859,13 +5665,13 @@ ${epilog}`
       await g_certificateAuthority.revokeCertificate(certificate, {});
     }
     await wrap(async () => {
-      const certificate = path7.resolve(local_argv.certificateFile);
+      const certificate = path10.resolve(local_argv.certificateFile);
       warningLog(chalk7.yellow(" Certificate to revoke : "), chalk7.cyan(certificate));
-      if (!fs11.existsSync(certificate)) {
+      if (!fs13.existsSync(certificate)) {
         throw new Error(`cannot find certificate to revoke ${certificate}`);
       }
       await readConfiguration(local_argv);
-      await construct_CertificateAuthority2("");
+      await construct_CertificateAuthority("");
       await revoke_certificate(certificate);
       warningLog("done ... ");
       warningLog("  crl = ", g_certificateAuthority.revocationList);
@@ -4908,11 +5714,11 @@ ${epilog}`
     if (local_argv.help) return showHelp("csr", "create a certificate signing request", optionsDef);
     await wrap(async () => {
       await readConfiguration(local_argv);
-      if (!fs11.existsSync(gLocalConfig.PKIFolder || "")) {
+      if (!fs13.existsSync(gLocalConfig.PKIFolder || "")) {
         warningLog("PKI folder must exist");
       }
       await construct_CertificateManager();
-      if (!gLocalConfig.outputFile || fs11.existsSync(gLocalConfig.outputFile)) {
+      if (!gLocalConfig.outputFile || fs13.existsSync(gLocalConfig.outputFile)) {
         throw new Error(` File ${gLocalConfig.outputFile} already exist`);
       }
       gLocalConfig.privateKey = void 0;
@@ -4927,8 +5733,8 @@ ${epilog}`
         warningLog("please specify a output file");
         return;
       }
-      const csr = await fs11.promises.readFile(internal_csr_file, "utf-8");
-      fs11.writeFileSync(gLocalConfig.outputFile || "", csr, "utf-8");
+      const csr = await fs13.promises.readFile(internal_csr_file, "utf-8");
+      fs13.writeFileSync(gLocalConfig.outputFile || "", csr, "utf-8");
       warningLog("Subject        = ", gLocalConfig.subject);
       warningLog("applicationUri = ", gLocalConfig.applicationUri);
       warningLog("altNames       = ", gLocalConfig.altNames);
@@ -4956,16 +5762,16 @@ ${epilog}`
       return showHelp("sign", "validate a certificate signing request and generate a certificate", optionsDef);
     await wrap(async () => {
       await readConfiguration(local_argv);
-      if (!fs11.existsSync(gLocalConfig.CAFolder || "")) {
+      if (!fs13.existsSync(gLocalConfig.CAFolder || "")) {
         throw new Error(`CA folder must exist:${gLocalConfig.CAFolder}`);
       }
-      await construct_CertificateAuthority2("");
-      const csr_file = path7.resolve(local_argv.csr || "");
-      if (!fs11.existsSync(csr_file)) {
+      await construct_CertificateAuthority("");
+      const csr_file = path10.resolve(local_argv.csr || "");
+      if (!fs13.existsSync(csr_file)) {
         throw new Error(`Certificate signing request doesn't exist: ${csr_file}`);
       }
-      const certificate = path7.resolve(local_argv.output || csr_file.replace(".csr", ".pem"));
-      if (fs11.existsSync(certificate)) {
+      const certificate = path10.resolve(local_argv.output || csr_file.replace(".csr", ".pem"));
+      if (fs13.existsSync(certificate)) {
         throw new Error(` File ${certificate} already exist`);
       }
       await g_certificateAuthority.signCertificateRequest(
@@ -4973,8 +5779,8 @@ ${epilog}`
         csr_file,
         gLocalConfig
       );
-      assert11(typeof gLocalConfig.outputFile === "string");
-      fs11.writeFileSync(gLocalConfig.outputFile || "", fs11.readFileSync(certificate, "ascii"));
+      assert10(typeof gLocalConfig.outputFile === "string");
+      fs13.writeFileSync(gLocalConfig.outputFile || "", fs13.readFileSync(certificate, "ascii"));
     });
     return;
   }