node-opcua-pki 6.20.0 → 6.22.0

package/dist/index.js

@@ -31,11 +31,15 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var lib_exports = {};
 __export(lib_exports, {
   CertificateAuthority: () => CertificateAuthority,
+  CertificateAuthorityCore: () => CertificateAuthorityCore,
   CertificateManager: () => CertificateManager,
   CertificateManagerState: () => CertificateManagerState,
   ChainCompletionStatus: () => ChainCompletionStatus,
-  PrivateKeyPassphraseRequiredError: () => import_node_opcua_crypto6.PrivateKeyPassphraseRequiredError,
-  Subject: () => import_node_opcua_crypto.Subject,
+  NativeCaBackend: () => NativeCaBackend,
+  OpenSslCaBackend: () => OpenSslCaBackend,
+  PrivateKeyPassphraseRequiredError: () => import_node_opcua_crypto10.PrivateKeyPassphraseRequiredError,
+  PrivateKeyUnavailableError: () => import_node_opcua_crypto10.PrivateKeyUnavailableError,
+  Subject: () => import_node_opcua_crypto3.Subject,
   VerificationStatus: () => VerificationStatus,
   adjustApplicationUri: () => adjustApplicationUri,
   adjustDate: () => adjustDate,
@@ -51,28 +55,61 @@ __export(lib_exports, {
   install_prerequisite: () => install_prerequisite,
   isIntermediateIssuer: () => isIntermediateIssuer,
   isIssuer: () => isIssuer,
+  isOpaqueSigner: () => isOpaqueSigner,
   isRootIssuer: () => isRootIssuer,
   makeFingerprint: () => makeFingerprint,
   quote: () => quote,
   resolvePrivateKeyPassphrase: () => resolvePrivateKeyPassphrase
 });
 module.exports = __toCommonJS(lib_exports);
-var import_node_opcua_crypto6 = require("node-opcua-crypto");
+var import_node_opcua_crypto10 = require("node-opcua-crypto");
 
-// packages/node-opcua-pki/lib/ca/certificate_authority.ts
-var import_node_assert7 = __toESM(require("assert"));
-var import_node_fs7 = __toESM(require("fs"));
-var import_node_os3 = __toESM(require("os"));
-var import_node_path5 = __toESM(require("path"));
-var import_chalk5 = __toESM(require("chalk"));
+// packages/node-opcua-pki/lib/ca/backends/native_ca_backend.ts
+var import_node_fs3 = __toESM(require("fs"));
+var import_node_path3 = __toESM(require("path"));
 var import_node_opcua_crypto2 = require("node-opcua-crypto");
 
-// packages/node-opcua-pki/lib/pki/toolbox_pfx.ts
-var import_node_assert3 = __toESM(require("assert"));
-var import_node_fs4 = __toESM(require("fs"));
+// packages/node-opcua-pki/lib/toolbox/common.ts
+var import_node_assert = __toESM(require("assert"));
+function quote(str) {
+  return `"${str || ""}"`;
+}
+function isOpaqueSigner(privateKey) {
+  return typeof privateKey !== "string" && typeof privateKey.sign === "function";
+}
+async function resolvePrivateKeyPassphrase(passphrase) {
+  if (passphrase === void 0) {
+    return void 0;
+  }
+  return typeof passphrase === "function" ? await passphrase() : passphrase;
+}
+function adjustDate(params) {
+  (0, import_node_assert.default)(params instanceof Object);
+  params.startDate = params.startDate || /* @__PURE__ */ new Date();
+  (0, import_node_assert.default)(params.startDate instanceof Date);
+  if (params.validityMs !== void 0) {
+    if (params.validityMs <= 0) {
+      throw new RangeError(`validityMs must be > 0 (got ${params.validityMs})`);
+    }
+    params.endDate = new Date(params.startDate.getTime() + params.validityMs);
+    params.validity = Math.ceil(params.validityMs / 864e5);
+  } else {
+    params.validity = params.validity || 365;
+    params.endDate = new Date(params.startDate.getTime());
+    params.endDate.setDate(params.startDate.getDate() + params.validity);
+  }
+  (0, import_node_assert.default)(params.endDate instanceof Date);
+  (0, import_node_assert.default)(params.startDate instanceof Date);
+}
+function adjustApplicationUri(params) {
+  const applicationUri = params.applicationUri || "";
+  if (applicationUri.length > 200) {
+    throw new Error(`Openssl doesn't support urn with length greater than 200${applicationUri}`);
+  }
+}
 
 // packages/node-opcua-pki/lib/toolbox/common2.ts
-var import_node_assert = __toESM(require("assert"));
+var import_node_assert2 = __toESM(require("assert"));
 var import_node_fs = __toESM(require("fs"));
 var import_node_path = __toESM(require("path"));
 var import_chalk = __toESM(require("chalk"));
@@ -137,20 +174,515 @@ function makePath(folderName, filename) {
   if (filename) {
     s = import_node_path.default.join(import_node_path.default.normalize(folderName), filename);
   } else {
-    (0, import_node_assert.default)(folderName);
+    (0, import_node_assert2.default)(folderName);
     s = folderName;
   }
   s = s.replace(/\\/g, "/");
   return s;
 }
 
-// packages/node-opcua-pki/lib/toolbox/with_openssl/execute_openssl.ts
-var import_node_assert2 = __toESM(require("assert"));
-var import_node_child_process2 = __toESM(require("child_process"));
-var import_node_fs3 = __toESM(require("fs"));
-var import_node_os2 = __toESM(require("os"));
-var import_byline2 = __toESM(require("byline"));
-var import_chalk3 = __toESM(require("chalk"));
+// packages/node-opcua-pki/lib/toolbox/display.ts
+var import_chalk2 = __toESM(require("chalk"));
+function displayTitle(str) {
+  if (!g_config.silent) {
+    warningLog("");
+    warningLog(import_chalk2.default.yellowBright(str));
+    warningLog(import_chalk2.default.yellow(new Array(str.length + 1).join("=")), "\n");
+  }
+}
+function displaySubtitle(str) {
+  if (!g_config.silent) {
+    warningLog("");
+    warningLog(`    ${import_chalk2.default.yellowBright(str)}`);
+    warningLog(`    ${import_chalk2.default.white(new Array(str.length + 1).join("-"))}`, "\n");
+  }
+}
+function display(str) {
+  if (!g_config.silent) {
+    warningLog(`       ${str}`);
+  }
+}
+
+// packages/node-opcua-pki/lib/ca/core/ca_database.ts
+var import_node_fs2 = __toESM(require("fs"));
+var import_node_path2 = __toESM(require("path"));
+var import_node_opcua_crypto = require("node-opcua-crypto");
+function parseOpenSSLDate(dateStr) {
+  const raw = dateStr?.split(",")[0] ?? "";
+  if (raw.length < 12) return "";
+  const yy = parseInt(raw.substring(0, 2), 10);
+  const year = yy >= 70 ? 1900 + yy : 2e3 + yy;
+  const month = raw.substring(2, 4);
+  const day = raw.substring(4, 6);
+  const hour = raw.substring(6, 8);
+  const min = raw.substring(8, 10);
+  const sec = raw.substring(10, 12);
+  return `${year}-${month}-${day}T${hour}:${min}:${sec}Z`;
+}
+function formatOpenSSLDate(date) {
+  const yy = String(date.getUTCFullYear() % 100).padStart(2, "0");
+  const mm = String(date.getUTCMonth() + 1).padStart(2, "0");
+  const dd = String(date.getUTCDate()).padStart(2, "0");
+  const hh = String(date.getUTCHours()).padStart(2, "0");
+  const mi = String(date.getUTCMinutes()).padStart(2, "0");
+  const ss = String(date.getUTCSeconds()).padStart(2, "0");
+  return `${yy}${mm}${dd}${hh}${mi}${ss}Z`;
+}
+function parseRevocationReason(dateStr) {
+  const parts = dateStr?.split(",");
+  return parts && parts.length > 1 ? parts[1] : void 0;
+}
+function evenLengthHex(value) {
+  const hex = value.toString(16).toUpperCase();
+  return hex.length % 2 === 0 ? hex : `0${hex}`;
+}
+function escapeIndexField(value) {
+  return value.replace(/[\x00-\x1f\x7f\\]/g, (c) => `\\x${c.charCodeAt(0).toString(16).toUpperCase().padStart(2, "0")}`);
+}
+function assertHexSerial(serial) {
+  if (!/^[0-9A-Fa-f]+$/.test(serial)) {
+    throw new Error(`Invalid certificate serial number: ${JSON.stringify(serial)}`);
+  }
+  return serial.toUpperCase();
+}
+var CaDatabase = class {
+  #rootDir;
+  constructor(rootDir) {
+    this.#rootDir = rootDir;
+  }
+  /** Path to the OpenSSL certificate database file (`index.txt`). */
+  get indexFile() {
+    return import_node_path2.default.join(this.#rootDir, "index.txt");
+  }
+  /**
+   * Parse the OpenSSL `index.txt` certificate database.
+   *
+   * Each line has tab-separated fields:
+   * ```
+   * status  expiry  [revocationDate]  serial  unknown  subject
+   * ```
+   *
+   * - status: `V` (valid), `R` (revoked), `E` (expired)
+   * - expiry: `YYMMDDHHmmssZ`
+   * - revocationDate: present only for revoked certs
+   * - serial: hex string
+   * - unknown: always `"unknown"`
+   * - subject: X.500 slash-delimited string
+   */
+  readIndex() {
+    const indexPath = this.indexFile;
+    if (!import_node_fs2.default.existsSync(indexPath)) {
+      return [];
+    }
+    const content = import_node_fs2.default.readFileSync(indexPath, "utf-8");
+    const lines = content.split("\n").filter((l) => l.trim().length > 0);
+    const records = [];
+    for (const line of lines) {
+      const fields = line.split("	");
+      if (fields.length < 4) continue;
+      const statusChar = fields[0];
+      const expiryStr = fields[1];
+      let serial;
+      let subject;
+      let revocationDate;
+      if (statusChar === "R") {
+        revocationDate = fields[2];
+        serial = fields[3];
+        subject = fields.length >= 6 ? fields[5] : "";
+      } else {
+        serial = fields[3];
+        subject = fields.length >= 6 ? fields[5] : "";
+      }
+      let status;
+      switch (statusChar) {
+        case "V":
+          status = "valid";
+          break;
+        case "R":
+          status = "revoked";
+          break;
+        case "E":
+          status = "expired";
+          break;
+        default:
+          continue;
+      }
+      records.push({
+        serial,
+        status,
+        subject,
+        expiryDate: parseOpenSSLDate(expiryStr),
+        revocationDate: revocationDate ? parseOpenSSLDate(revocationDate) : void 0,
+        reason: revocationDate ? parseRevocationReason(revocationDate) : void 0
+      });
+    }
+    return records;
+  }
+  /** Look up one record by serial number (case-insensitive). */
+  findBySerial(serial) {
+    const upper = serial.toUpperCase();
+    return this.readIndex().find((r) => r.serial.toUpperCase() === upper);
+  }
+  /**
+   * Read a specific issued certificate by serial number.
+   *
+   * OpenSSL stores signed certificates in the `certs/` directory using
+   * the naming convention `<SERIAL>.pem`.
+   *
+   * @param serial - hex-encoded serial number (e.g. `"1000"`)
+   * @returns the DER buffer, or `undefined` if not found
+   */
+  getCertificateBySerial(serial) {
+    const upper = serial.toUpperCase();
+    const certFile = import_node_path2.default.join(this.#rootDir, "certs", `${upper}.pem`);
+    if (!import_node_fs2.default.existsSync(certFile)) {
+      return void 0;
+    }
+    const pem = (0, import_node_opcua_crypto.readCertificatePEM)(certFile);
+    return (0, import_node_opcua_crypto.convertPEMtoDER)(pem);
+  }
+  /**
+   * Read-increment-write a hex counter file (`serial`/`crlnumber`),
+   * returning the value to hand out — matching `openssl ca`'s own
+   * behavior: the file holds the *next* value to assign, and is bumped
+   * to the following one immediately after being read. A `.old` backup
+   * of the pre-bump content is kept, as `openssl` itself does.
+   */
+  #nextHexCounter(fileName) {
+    const counterFile = import_node_path2.default.join(this.#rootDir, fileName);
+    const current = BigInt(`0x${import_node_fs2.default.readFileSync(counterFile, "utf-8").trim()}`);
+    import_node_fs2.default.copyFileSync(counterFile, `${counterFile}.old`);
+    import_node_fs2.default.writeFileSync(counterFile, evenLengthHex(current + 1n));
+    return evenLengthHex(current);
+  }
+  /** Hand out the next certificate serial number, bumping the `serial` file. */
+  nextSerial() {
+    return this.#nextHexCounter("serial");
+  }
+  /** Hand out the next CRL number, bumping the `crlnumber` file. */
+  nextCrlNumber() {
+    return this.#nextHexCounter("crlnumber");
+  }
+  /** Append a newly-issued certificate's `V` (valid) row to `index.txt`. */
+  appendIssued(record) {
+    const serial = assertHexSerial(record.serial);
+    const subject = escapeIndexField(record.subject);
+    const line = `V	${formatOpenSSLDate(record.expiryDate)}		${serial}	unknown	${subject}
+`;
+    import_node_fs2.default.appendFileSync(this.indexFile, line);
+  }
+  /**
+   * Rewrite a certificate's `index.txt` row from `V` to `R` (revoked).
+   * Throws if the serial is not found, or is already revoked — the same
+   * "already revoked" case `openssl ca -revoke` itself rejects.
+   */
+  markRevoked(serial, revocationDate, reason) {
+    const upper = assertHexSerial(serial);
+    if (!/^[A-Za-z]+$/.test(reason)) {
+      throw new Error(`Invalid CRL reason: ${JSON.stringify(reason)}`);
+    }
+    const lines = import_node_fs2.default.readFileSync(this.indexFile, "utf-8").split("\n").filter((l) => l.trim().length > 0);
+    let found = false;
+    const rewritten = lines.map((line) => {
+      const fields = line.split("	");
+      if (fields.length < 4 || fields[3]?.toUpperCase() !== upper) {
+        return line;
+      }
+      if (fields[0] === "R") {
+        throw new Error(`Certificate ${upper} is already revoked`);
+      }
+      found = true;
+      const subject = fields.length >= 6 ? fields[5] : "";
+      return `R	${fields[1]}	${formatOpenSSLDate(revocationDate)},${reason}	${upper}	unknown	${subject}`;
+    });
+    if (!found) {
+      throw new Error(`Certificate ${upper} not found in the certificate database`);
+    }
+    import_node_fs2.default.writeFileSync(this.indexFile, `${rewritten.join("\n")}
+`);
+  }
+  /** Store a signed certificate's PEM under `certs/<SERIAL>.pem`, as `openssl ca` does. */
+  storeCertificate(serial, pem) {
+    const certFile = import_node_path2.default.join(this.#rootDir, "certs", `${assertHexSerial(serial)}.pem`);
+    import_node_fs2.default.writeFileSync(certFile, pem);
+  }
+};
+
+// packages/node-opcua-pki/lib/ca/backends/native_ca_backend.ts
+var CA_CERT_VALIDITY_DAYS = 3650;
+var RSA_SHA256 = { name: "RSASSA-PKCS1-v1_5", hash: { name: "SHA-256" } };
+function signingAlgorithmOf(key) {
+  return (0, import_node_opcua_crypto2.isCaSigner)(key) ? key.algorithm : RSA_SHA256;
+}
+function daysFromNow(notBefore, days) {
+  return new Date(notBefore.getTime() + days * 24 * 60 * 60 * 1e3);
+}
+function caSanUri(ca) {
+  return `urn:${ca.subject.commonName || "NodeOPCUA-CA"}`;
+}
+function sanFromCsr(csrPem) {
+  const request = new import_node_opcua_crypto2.x509.Pkcs10CertificateRequest(csrPem);
+  const extension = request.getExtension("2.5.29.17");
+  const dns = [];
+  const ip = [];
+  let applicationUri;
+  for (const name of extension?.names.toJSON() ?? []) {
+    if (name.type === "dns") {
+      dns.push(name.value);
+    } else if (name.type === "ip") {
+      ip.push(name.value);
+    } else if (name.type === "url" && applicationUri === void 0) {
+      applicationUri = name.value;
+    }
+  }
+  return { dns, ip, applicationUri };
+}
+var REASON_TO_X509_CRL_REASON = {
+  unspecified: import_node_opcua_crypto2.x509.X509CrlReason.unspecified,
+  keyCompromise: import_node_opcua_crypto2.x509.X509CrlReason.keyCompromise,
+  CACompromise: import_node_opcua_crypto2.x509.X509CrlReason.cACompromise,
+  affiliationChanged: import_node_opcua_crypto2.x509.X509CrlReason.affiliationChanged,
+  superseded: import_node_opcua_crypto2.x509.X509CrlReason.superseded,
+  cessationOfOperation: import_node_opcua_crypto2.x509.X509CrlReason.cessationOfOperation,
+  certificateHold: import_node_opcua_crypto2.x509.X509CrlReason.certificateHold,
+  removeFromCRL: import_node_opcua_crypto2.x509.X509CrlReason.removeFromCRL
+};
+function toOpenSslSubjectString(subjectName) {
+  const parts = [];
+  for (const rdn of subjectName.toJSON()) {
+    for (const [type, values] of Object.entries(rdn)) {
+      for (const value of values) {
+        parts.push(`${type}=${value}`);
+      }
+    }
+  }
+  return `/${parts.join("/")}`;
+}
+var NativeCaBackend = class {
+  /** Nothing to check: this backend spawns no process and needs no tool on PATH. */
+  /** Signing goes through `ca._getSigningKey()`, which may be an external signer. */
+  supportsExternalSigner = true;
+  async preflight() {
+  }
+  /**
+   * Write a CSR for the CA's own key, the `[v3_ca_req]` equivalent. The
+   * key comes from the CA rather than from `privateKeyFile`: on a
+   * signer-backed CA that file does not exist.
+   */
+  async generateCaCsr(ca, _caRootDir, _privateKeyFile, csrFile) {
+    displayTitle("Generate a certificate request for the CA key");
+    const signingKey = await ca._getSigningKey();
+    const { csr } = await (0, import_node_opcua_crypto2.createCertificateSigningRequest)({
+      privateKey: signingKey,
+      subject: ca.subject.toString(),
+      applicationUri: caSanUri(ca),
+      purpose: import_node_opcua_crypto2.CertificatePurpose.ForCertificateAuthority
+    });
+    await import_node_fs3.default.promises.writeFile(csrFile, csr);
+  }
+  async bootstrap(ca) {
+    const caRootDir = import_node_path3.default.resolve(ca.rootDir);
+    const csrFile = import_node_path3.default.join(caRootDir, "private/cakey.csr");
+    await this.generateCaCsr(ca, caRootDir, import_node_path3.default.join(caRootDir, "private/cakey.pem"), csrFile);
+    const issuerCA = ca._issuerCA;
+    if (issuerCA) {
+      displayTitle("Generate CA Certificate (signed by issuer CA)");
+      const signWithIssuer = () => this.signSubordinateCsr(issuerCA, csrFile, ca.caCertificate, CA_CERT_VALIDITY_DAYS);
+      if (import_node_path3.default.resolve(issuerCA.rootDir) === caRootDir) {
+        await signWithIssuer();
+      } else {
+        await issuerCA._withCaDirectoryLock(signWithIssuer);
+      }
+    } else {
+      displayTitle("Generate CA Certificate (self-signed)");
+      const csrPem = await import_node_fs3.default.promises.readFile(csrFile, "utf-8");
+      const signingKey = await ca._getSigningKey();
+      const request = new import_node_opcua_crypto2.x509.Pkcs10CertificateRequest(csrPem);
+      const notBefore = /* @__PURE__ */ new Date();
+      const { cert } = await (0, import_node_opcua_crypto2.createCertificateFromCsr)({
+        csr: csrPem,
+        // the CSR's own parsed subject, so issuer and subject are
+        // byte-identical on a self-signed root: re-encoding a string
+        // form could differ and break chain building
+        issuerName: request.subjectName,
+        issuerPublicKey: request.publicKey,
+        signingKey,
+        signingAlgorithm: signingAlgorithmOf(signingKey),
+        notBefore,
+        notAfter: daysFromNow(notBefore, CA_CERT_VALIDITY_DAYS),
+        purpose: import_node_opcua_crypto2.CertificatePurpose.ForCertificateAuthority,
+        applicationUri: caSanUri(ca),
+        revocation: {
+          crlDistributionUrl: ca.crlDistributionUrl,
+          ocspResponderUrl: ca.ocspResponderUrl,
+          caIssuersUrl: ca.caIssuersUrl
+        }
+      });
+      await import_node_fs3.default.promises.writeFile(ca.caCertificate, cert);
+    }
+    displaySubtitle("generate initial CRL (Certificate Revocation List)");
+    await this.#regenerateCrlLocked(ca, new CaDatabase(ca.rootDir));
+    displayTitle("Create Certificate Authority (CA) ---> DONE");
+  }
+  /** Sign a subordinate CA's request with this CA's key, the `[v3_ca]` equivalent. */
+  async signSubordinateCsr(ca, csrFile, certFile, validityDays) {
+    const { signingKey, signingAlgorithm, issuerPublicKey, issuerName } = await this.#issuerContext(ca);
+    const csrPem = await import_node_fs3.default.promises.readFile(csrFile, "utf-8");
+    const db = new CaDatabase(ca.rootDir);
+    const serialNumber = db.nextSerial();
+    const notBefore = /* @__PURE__ */ new Date();
+    const notAfter = daysFromNow(notBefore, validityDays);
+    const { cert } = await (0, import_node_opcua_crypto2.createCertificateFromCsr)({
+      csr: csrPem,
+      issuerName,
+      issuerPublicKey,
+      signingKey,
+      signingAlgorithm,
+      serialNumber,
+      notBefore,
+      notAfter,
+      purpose: import_node_opcua_crypto2.CertificatePurpose.ForCertificateAuthority,
+      // the subordinate's own SAN, not the issuer's
+      ...sanFromCsr(csrPem),
+      revocation: {
+        crlDistributionUrl: ca.crlDistributionUrl,
+        ocspResponderUrl: ca.ocspResponderUrl,
+        caIssuersUrl: ca.caIssuersUrl
+      }
+    });
+    await import_node_fs3.default.promises.writeFile(certFile, cert);
+    this.#record(db, serialNumber, cert, notAfter);
+  }
+  /**
+   * Self-sign a certificate with a caller-supplied key file and record it
+   * in this CA's database: the native equivalent of `openssl req -new`
+   * followed by `openssl ca -selfsign`, which likewise applies the
+   * end-entity profile and updates `index.txt`.
+   */
+  async createSelfSignedCertificate(ca, certificateFile, privateKeyFile, params) {
+    displaySubtitle("- the certificate signing request");
+    const key = await (0, import_node_opcua_crypto2.privateKeyToCryptoKey)((0, import_node_opcua_crypto2.readPrivateKey)(privateKeyFile, await ca._privateKeyPassphrase()));
+    const { csr } = await (0, import_node_opcua_crypto2.createCertificateSigningRequest)({
+      privateKey: key,
+      subject: params.subject ? new import_node_opcua_crypto2.Subject(params.subject).toString() : ca.subject.toString(),
+      dns: params.dns,
+      ip: params.ip,
+      applicationUri: params.applicationUri,
+      purpose: import_node_opcua_crypto2.CertificatePurpose.ForApplication
+    });
+    displaySubtitle("- creating the self-signed certificate");
+    const request = new import_node_opcua_crypto2.x509.Pkcs10CertificateRequest(csr);
+    const db = new CaDatabase(ca.rootDir);
+    const serialNumber = db.nextSerial();
+    const notBefore = params.startDate ?? /* @__PURE__ */ new Date();
+    const notAfter = params.endDate ?? daysFromNow(notBefore, params.validity ?? 365);
+    const { cert } = await (0, import_node_opcua_crypto2.createCertificateFromCsr)({
+      csr,
+      issuerName: request.subjectName,
+      issuerPublicKey: request.publicKey,
+      signingKey: key,
+      signingAlgorithm: RSA_SHA256,
+      serialNumber,
+      notBefore,
+      notAfter,
+      purpose: import_node_opcua_crypto2.CertificatePurpose.ForApplication,
+      ...sanFromCsr(csr)
+    });
+    await import_node_fs3.default.promises.writeFile(certificateFile, cert);
+    this.#record(db, serialNumber, cert, notAfter);
+  }
+  /** `certs/<SERIAL>.pem` plus the `V` row, exactly as `openssl ca` writes them. */
+  #record(db, serialNumber, certPem, notAfter) {
+    db.storeCertificate(serialNumber, certPem);
+    db.appendIssued({
+      serial: serialNumber,
+      expiryDate: notAfter,
+      subject: toOpenSslSubjectString(new import_node_opcua_crypto2.x509.X509Certificate(certPem).subjectName)
+    });
+  }
+  /**
+   * The CA's signing key and issuer identity, resolved fresh on every
+   * call and never cached across operations. The identity is read back
+   * from the CA certificate on disk so that the issuer field of anything
+   * this CA signs is byte-identical to that certificate's subject.
+   */
+  async #issuerContext(ca) {
+    const signingKey = await ca._getSigningKey();
+    const caCertPem = await import_node_fs3.default.promises.readFile(ca.caCertificate, "utf-8");
+    const caCert = new import_node_opcua_crypto2.x509.X509Certificate(caCertPem);
+    return {
+      signingKey,
+      signingAlgorithm: signingAlgorithmOf(signingKey),
+      issuerPublicKey: caCert.publicKey,
+      issuerName: caCert.subjectName
+    };
+  }
+  async signEndEntityCsr(ca, certificate, csr, params, sanOverride) {
+    const { signingKey, signingAlgorithm, issuerPublicKey, issuerName } = await this.#issuerContext(ca);
+    const db = new CaDatabase(ca.rootDir);
+    const serialNumber = db.nextSerial();
+    const csrPem = await import_node_fs3.default.promises.readFile(csr, "utf-8");
+    const notBefore = params.startDate ?? /* @__PURE__ */ new Date();
+    const notAfter = params.endDate ?? new Date(notBefore.getTime() + (params.validity ?? 365) * 24 * 60 * 60 * 1e3);
+    const { cert } = await (0, import_node_opcua_crypto2.createCertificateFromCsr)({
+      csr: csrPem,
+      issuerName,
+      issuerPublicKey,
+      signingKey,
+      signingAlgorithm,
+      serialNumber,
+      notBefore,
+      notAfter,
+      purpose: import_node_opcua_crypto2.CertificatePurpose.ForApplication,
+      dns: sanOverride.dns,
+      ip: sanOverride.ip,
+      applicationUri: sanOverride.applicationUri,
+      revocation: {
+        crlDistributionUrl: ca.crlDistributionUrl,
+        ocspResponderUrl: ca.ocspResponderUrl,
+        caIssuersUrl: ca.caIssuersUrl
+      }
+    });
+    await import_node_fs3.default.promises.writeFile(certificate, cert);
+    this.#record(db, serialNumber, cert, notAfter);
+  }
+  async #regenerateCrlLocked(ca, db) {
+    const { signingKey, signingAlgorithm, issuerPublicKey, issuerName } = await this.#issuerContext(ca);
+    const crlNumber = db.nextCrlNumber();
+    const entries = db.readIndex().filter((r) => r.status === "revoked").map((r) => ({
+      serialNumber: r.serial,
+      revocationDate: r.revocationDate ? new Date(r.revocationDate) : /* @__PURE__ */ new Date(),
+      reason: r.reason ? REASON_TO_X509_CRL_REASON[r.reason] : void 0
+    }));
+    const { crl } = await (0, import_node_opcua_crypto2.createCrl)({
+      issuerName,
+      issuerPublicKey,
+      signingKey,
+      signingAlgorithm,
+      crlNumber: BigInt(`0x${crlNumber}`),
+      entries
+    });
+    await import_node_fs3.default.promises.writeFile(ca.revocationList, crl);
+    const der = new import_node_opcua_crypto2.x509.X509Crl(crl).rawData;
+    await import_node_fs3.default.promises.writeFile(ca.revocationListDER, Buffer.from(der));
+  }
+  async regenerateCrl(ca) {
+    const db = new CaDatabase(ca.rootDir);
+    await this.#regenerateCrlLocked(ca, db);
+  }
+  async revoke(ca, certificate, reason) {
+    const certPem = await import_node_fs3.default.promises.readFile(certificate, "utf-8");
+    const cert = new import_node_opcua_crypto2.x509.X509Certificate(certPem);
+    const db = new CaDatabase(ca.rootDir);
+    db.markRevoked(cert.serialNumber, /* @__PURE__ */ new Date(), reason);
+    await this.#regenerateCrlLocked(ca, db);
+  }
+};
+
+// packages/node-opcua-pki/lib/ca/backends/openssl_ca_backend.ts
+var import_node_fs7 = __toESM(require("fs"));
+var import_node_path6 = __toESM(require("path"));
+var import_node_opcua_crypto4 = require("node-opcua-crypto");
 
 // packages/node-opcua-pki/lib/toolbox/with_openssl/_env.ts
 var SAFE_ENV_PASSTHROUGH = /* @__PURE__ */ new Set([
@@ -224,31 +756,33 @@ function getEnvironmentVarNames() {
     return { key: varName, pattern: `\\$ENV\\:\\:${varName}` };
   });
 }
-function processAltNames(params) {
-  params.dns = params.dns || [];
-  params.ip = params.ip || [];
-  let subjectAltName = [];
-  subjectAltName.push(`URI:${params.applicationUri}`);
-  subjectAltName = [].concat(
-    subjectAltName,
-    params.dns.map((d) => `DNS:${d}`)
-  );
-  subjectAltName = [].concat(
-    subjectAltName,
-    params.ip.map((d) => `IP:${d}`)
-  );
-  const subjectAltNameString = subjectAltName.join(", ");
-  setEnv("ALTNAME", subjectAltNameString);
+function buildSubjectAltNameString(params) {
+  return [
+    `URI:${params.applicationUri}`,
+    ...(params.dns ?? []).map((d) => `DNS:${d}`),
+    ...(params.ip ?? []).map((d) => `IP:${d}`)
+  ].join(", ");
 }
 
+// packages/node-opcua-pki/lib/misc/subject.ts
+var import_node_opcua_crypto3 = require("node-opcua-crypto");
+
+// packages/node-opcua-pki/lib/toolbox/with_openssl/execute_openssl.ts
+var import_node_assert3 = __toESM(require("assert"));
+var import_node_child_process2 = __toESM(require("child_process"));
+var import_node_fs5 = __toESM(require("fs"));
+var import_node_os2 = __toESM(require("os"));
+var import_byline2 = __toESM(require("byline"));
+var import_chalk4 = __toESM(require("chalk"));
+
 // packages/node-opcua-pki/lib/toolbox/with_openssl/install_prerequisite.ts
 var import_node_child_process = __toESM(require("child_process"));
-var import_node_fs2 = __toESM(require("fs"));
+var import_node_fs4 = __toESM(require("fs"));
 var import_node_os = __toESM(require("os"));
-var import_node_path2 = __toESM(require("path"));
+var import_node_path4 = __toESM(require("path"));
 var import_promises = require("stream/promises");
 var import_byline = __toESM(require("byline"));
-var import_chalk2 = __toESM(require("chalk"));
+var import_chalk3 = __toESM(require("chalk"));
 var import_yauzl = __toESM(require("yauzl"));
 var doDebug2 = process.env.NODEOPCUAPKIDEBUG || false;
 async function execute(file, args, cwd) {
@@ -267,7 +801,7 @@ async function execute(file, args, cwd) {
       output += `${line}
 `;
       if (doDebug2) {
-        process.stdout.write(`        stdout ${import_chalk2.default.yellow(line)}
+        process.stdout.write(`        stdout ${import_chalk3.default.yellow(line)}
 `);
       }
     });
@@ -287,8 +821,8 @@ async function getopensslExecPath() {
   const exitCode = result1?.exitCode;
   const output = result1?.output;
   if (exitCode !== 0) {
-    warningLog(import_chalk2.default.yellow(" it seems that ") + import_chalk2.default.cyan("openssl") + import_chalk2.default.yellow(" is not installed on your computer "));
-    warningLog(import_chalk2.default.yellow("Please install it before running this programs"));
+    warningLog(import_chalk3.default.yellow(" it seems that ") + import_chalk3.default.cyan("openssl") + import_chalk3.default.yellow(" is not installed on your computer "));
+    warningLog(import_chalk3.default.yellow("Please install it before running this programs"));
     throw new Error("Cannot find openssl");
   }
   const opensslExecPath = output.replace(/\n\r/g, "").trim();
@@ -297,7 +831,7 @@ async function getopensslExecPath() {
 async function check_system_openssl_version() {
   const opensslExecPath = await getopensslExecPath();
   if (doDebug2) {
-    warningLog(`              OpenSSL found in : ${import_chalk2.default.yellow(opensslExecPath)}`);
+    warningLog(`              OpenSSL found in : ${import_chalk3.default.yellow(opensslExecPath)}`);
   }
   const result = await execute(opensslExecPath, ["version"]);
   const exitCode = result?.exitCode;
@@ -305,35 +839,35 @@ async function check_system_openssl_version() {
   const version = output.trim();
   const versionOK = exitCode === 0 && is_expected_openssl_version(version);
   if (!versionOK) {
-    let message = import_chalk2.default.whiteBright("Warning !!!!!!!!!!!! ") + "\nyour version of openssl is " + version + ". It doesn't match the expected version";
+    let message = import_chalk3.default.whiteBright("Warning !!!!!!!!!!!! ") + "\nyour version of openssl is " + version + ". It doesn't match the expected version";
     if (process.platform === "darwin") {
-      message += import_chalk2.default.cyan("\nplease refer to :") + import_chalk2.default.yellow(" https://github.com/node-opcua/node-opcua/wiki/installing-node-opcua-or-node-red-on-MacOS");
+      message += import_chalk3.default.cyan("\nplease refer to :") + import_chalk3.default.yellow(" https://github.com/node-opcua/node-opcua/wiki/installing-node-opcua-or-node-red-on-MacOS");
     }
     console.log(message);
   }
   return output;
 }
 async function install_and_check_win32_openssl_version() {
-  const downloadFolder = import_node_path2.default.join(import_node_os.default.tmpdir(), ".");
+  const downloadFolder = import_node_path4.default.join(import_node_os.default.tmpdir(), ".");
   function get_openssl_folder_win32() {
     if (process.env.LOCALAPPDATA) {
-      const userProgramFolder = import_node_path2.default.join(process.env.LOCALAPPDATA, "Programs");
-      if (import_node_fs2.default.existsSync(userProgramFolder)) {
-        return import_node_path2.default.join(userProgramFolder, "openssl");
+      const userProgramFolder = import_node_path4.default.join(process.env.LOCALAPPDATA, "Programs");
+      if (import_node_fs4.default.existsSync(userProgramFolder)) {
+        return import_node_path4.default.join(userProgramFolder, "openssl");
       }
     }
-    return import_node_path2.default.join(process.cwd(), "openssl");
+    return import_node_path4.default.join(process.cwd(), "openssl");
   }
   function get_openssl_exec_path_win32() {
     const opensslFolder2 = get_openssl_folder_win32();
-    return import_node_path2.default.join(opensslFolder2, "openssl.exe");
+    return import_node_path4.default.join(opensslFolder2, "openssl.exe");
   }
   async function check_openssl_win32() {
     const opensslExecPath2 = get_openssl_exec_path_win32();
-    const exists = import_node_fs2.default.existsSync(opensslExecPath2);
+    const exists = import_node_fs4.default.existsSync(opensslExecPath2);
     if (!exists) {
       warningLog("checking presence of ", opensslExecPath2);
-      warningLog(import_chalk2.default.red(" cannot find file ") + opensslExecPath2);
+      warningLog(import_chalk3.default.red(" cannot find file ") + opensslExecPath2);
       return {
         opensslOk: false,
         version: `cannot find file ${opensslExecPath2}`
@@ -358,18 +892,18 @@ async function install_and_check_win32_openssl_version() {
         return void 0;
       }
       const opensslPath2 = result.output.split(/\r?\n/)[0].trim();
-      if (!opensslPath2 || !import_node_fs2.default.existsSync(opensslPath2)) {
+      if (!opensslPath2 || !import_node_fs4.default.existsSync(opensslPath2)) {
         return void 0;
       }
       const versionResult = await execute(opensslPath2, ["version"]);
       const version = versionResult.output.trim();
       if (versionResult.exitCode === 0 && is_expected_openssl_version(version)) {
         warningLog(
-          import_chalk2.default.green("Using system OpenSSL: ") + import_chalk2.default.cyan(version) + import_chalk2.default.green(" at ") + import_chalk2.default.cyan(opensslPath2)
+          import_chalk3.default.green("Using system OpenSSL: ") + import_chalk3.default.cyan(version) + import_chalk3.default.green(" at ") + import_chalk3.default.cyan(opensslPath2)
         );
         return opensslPath2;
       }
-      warningLog(import_chalk2.default.yellow("System OpenSSL found but version not accepted: ") + version);
+      warningLog(import_chalk3.default.yellow("System OpenSSL found but version not accepted: ") + version);
       return void 0;
     } catch (_err) {
       return void 0;
@@ -389,9 +923,9 @@ async function install_and_check_win32_openssl_version() {
   }
   async function download_openssl() {
     const url = win32or64() === 64 ? "https://github.com/node-opcua/node-opcua-pki/releases/download/2.14.2/openssl-1.0.2u-x64_86-win64.zip" : "https://github.com/node-opcua/node-opcua-pki/releases/download/2.14.2/openssl-1.0.2u-i386-win32.zip";
-    const outputFilename = import_node_path2.default.join(downloadFolder, import_node_path2.default.basename(url));
-    warningLog(`downloading ${import_chalk2.default.yellow(url)} to ${outputFilename}`);
-    if (import_node_fs2.default.existsSync(outputFilename)) {
+    const outputFilename = import_node_path4.default.join(downloadFolder, import_node_path4.default.basename(url));
+    warningLog(`downloading ${import_chalk3.default.yellow(url)} to ${outputFilename}`);
+    if (import_node_fs4.default.existsSync(outputFilename)) {
       return { downloadedFile: outputFilename };
     }
     const response = await fetch(url, { redirect: "follow" });
@@ -401,7 +935,7 @@ async function install_and_check_win32_openssl_version() {
     const contentLength = parseInt(response.headers.get("content-length") || "0", 10);
     let downloaded = 0;
     let lastPercent = -1;
-    const fileStream = import_node_fs2.default.createWriteStream(outputFilename);
+    const fileStream = import_node_fs4.default.createWriteStream(outputFilename);
     const body = response.body;
     body.on("data", (chunk) => {
       downloaded += chunk.length;
@@ -414,12 +948,12 @@ async function install_and_check_win32_openssl_version() {
       }
     });
     await (0, import_promises.pipeline)(body, fileStream);
-    const stat = import_node_fs2.default.statSync(outputFilename);
+    const stat = import_node_fs4.default.statSync(outputFilename);
     if (stat.size === 0) {
-      import_node_fs2.default.unlinkSync(outputFilename);
+      import_node_fs4.default.unlinkSync(outputFilename);
       throw new Error(`Downloaded file is empty: ${outputFilename}`);
     }
-    warningLog(import_chalk2.default.green("Download complete: ") + `${stat.size} bytes`);
+    warningLog(import_chalk3.default.green("Download complete: ") + `${stat.size} bytes`);
     return { downloadedFile: outputFilename };
   }
   async function unzip_openssl(zipFilename) {
@@ -456,11 +990,11 @@ async function install_and_check_win32_openssl_version() {
           if (err) {
             return reject(err);
           }
-          const file = import_node_path2.default.join(opensslFolder2, entry.fileName);
+          const file = import_node_path4.default.join(opensslFolder2, entry.fileName);
           if (doDebug2) {
             warningLog(" unzipping :", file);
           }
-          const writeStream = import_node_fs2.default.createWriteStream(file, "binary");
+          const writeStream = import_node_fs4.default.createWriteStream(file, "binary");
           readStream?.pipe(writeStream);
           writeStream.on("close", () => {
             zipFile.readEntry();
@@ -475,29 +1009,29 @@ async function install_and_check_win32_openssl_version() {
   }
   const opensslFolder = get_openssl_folder_win32();
   const opensslExecPath = get_openssl_exec_path_win32();
-  if (!import_node_fs2.default.existsSync(opensslFolder)) {
+  if (!import_node_fs4.default.existsSync(opensslFolder)) {
     if (doDebug2) {
       warningLog("creating openssl_folder", opensslFolder);
     }
-    import_node_fs2.default.mkdirSync(opensslFolder);
+    import_node_fs4.default.mkdirSync(opensslFolder);
   }
   const { opensslOk, version: _version } = await check_openssl_win32();
   if (!opensslOk) {
-    warningLog(import_chalk2.default.yellow("openssl seems to be missing and need to be installed"));
+    warningLog(import_chalk3.default.yellow("openssl seems to be missing and need to be installed"));
     const { downloadedFile } = await download_openssl();
     if (doDebug2) {
-      warningLog("deflating ", import_chalk2.default.yellow(downloadedFile));
+      warningLog("deflating ", import_chalk3.default.yellow(downloadedFile));
     }
     await unzip_openssl(downloadedFile);
-    const opensslExists = !!import_node_fs2.default.existsSync(opensslExecPath);
+    const opensslExists = !!import_node_fs4.default.existsSync(opensslExecPath);
     if (doDebug2) {
-      warningLog("verifying ", opensslExists, opensslExists ? import_chalk2.default.green("OK ") : import_chalk2.default.red(" Error"), opensslExecPath);
+      warningLog("verifying ", opensslExists, opensslExists ? import_chalk3.default.green("OK ") : import_chalk3.default.red(" Error"), opensslExecPath);
     }
     const _opensslExecPath2 = await check_openssl_win32();
     return opensslExecPath;
   } else {
     if (doDebug2) {
-      warningLog(import_chalk2.default.green("openssl is already installed and have the expected version."));
+      warningLog(import_chalk3.default.green("openssl is already installed and have the expected version."));
     }
     return opensslExecPath;
   }
@@ -512,7 +1046,7 @@ async function install_prerequisite() {
 async function get_openssl_exec_path() {
   if (process.platform === "win32") {
     const opensslExecPath = await install_prerequisite();
-    if (!import_node_fs2.default.existsSync(opensslExecPath)) {
+    if (!import_node_fs4.default.existsSync(opensslExecPath)) {
       throw new Error(`internal error cannot find ${opensslExecPath}`);
     }
     return opensslExecPath;
@@ -525,13 +1059,9 @@ async function get_openssl_exec_path() {
 var opensslPath;
 var n = makePath;
 var PASSIN_ENV_VAR = "NODE_OPCUA_PKI_OPENSSL_PASSIN";
-var PASSOUT_ENV_VAR = "NODE_OPCUA_PKI_OPENSSL_PASSOUT";
 function passinArg(passphrase = "") {
   return { args: ["-passin", `env:${PASSIN_ENV_VAR}`], env: { [PASSIN_ENV_VAR]: passphrase } };
 }
-function passoutArg(passphrase = "") {
-  return { args: ["-passout", `env:${PASSOUT_ENV_VAR}`], env: { [PASSOUT_ENV_VAR]: passphrase } };
-}
 function renderForDisplay(file, args) {
   return [file, ...args].map((a) => a === "" || /[\s"'`$\\]/.test(a) ? JSON.stringify(a) : a).join(" ");
 }
@@ -539,7 +1069,7 @@ async function execute2(file, args, options) {
   const from = new Error();
   options.cwd = options.cwd || process.cwd();
   if (!g_config.silent) {
-    warningLog(import_chalk3.default.cyan("                  CWD         "), options.cwd);
+    warningLog(import_chalk4.default.cyan("                  CWD         "), options.cwd);
   }
   const outputs = [];
   const errorOutputs = [];
@@ -552,12 +1082,12 @@ async function execute2(file, args, options) {
       stdio: ["ignore", "pipe", "pipe"]
     });
     const fail = (message) => {
-      if (!options.hideErrorMessage) {
+      if (!options.hideErrorMessage && !g_config.silent) {
         const fence = "###########################################";
-        console.error(import_chalk3.default.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
-        console.error(import_chalk3.default.bgWhiteBright.redBright(`CWD = ${options.cwd}`));
-        console.error(import_chalk3.default.bgWhiteBright.redBright(message));
-        console.error(import_chalk3.default.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
+        console.error(import_chalk4.default.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
+        console.error(import_chalk4.default.bgWhiteBright.redBright(`CWD = ${options.cwd}`));
+        console.error(import_chalk4.default.bgWhiteBright.redBright(message));
+        console.error(import_chalk4.default.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
         console.error(from.stack);
       }
       reject(new Error(message));
@@ -583,7 +1113,7 @@ ${errorOutputs.join("")}(${why})`);
         stream2.on("data", (line) => {
           line = line.toString();
           if (doDebug) {
-            process.stdout.write(`${import_chalk3.default.white("        stdout ") + import_chalk3.default.whiteBright(line)}
+            process.stdout.write(`${import_chalk4.default.white("        stdout ") + import_chalk4.default.whiteBright(line)}
 `);
           }
         });
@@ -596,7 +1126,7 @@ ${errorOutputs.join("")}(${why})`);
         errorOutputs.push(`${line}
 `);
         if (!g_config.silent && displayError) {
-          process.stdout.write(`${import_chalk3.default.white("        stderr ") + import_chalk3.default.red(line)}
+          process.stdout.write(`${import_chalk4.default.white("        stderr ") + import_chalk4.default.red(line)}
 `);
         }
       });
@@ -631,154 +1161,26 @@ function getTempFolder() {
 async function execute_openssl(args, options) {
   debugLog("execute_openssl", args, redactEnvForLog(options));
   const empty_config_file = n(getTempFolder(), "empty_config.cnf");
-  if (!import_node_fs3.default.existsSync(empty_config_file)) {
-    await import_node_fs3.default.promises.writeFile(empty_config_file, "# empty config file");
+  if (!import_node_fs5.default.existsSync(empty_config_file)) {
+    await import_node_fs5.default.promises.writeFile(empty_config_file, "# empty config file");
   }
   options = options || {};
   options.openssl_conf = options.openssl_conf || empty_config_file;
-  (0, import_node_assert2.default)(options.openssl_conf);
+  (0, import_node_assert3.default)(options.openssl_conf);
   setEnv("OPENSSL_CONF", options.openssl_conf);
   if (!g_config.silent) {
-    warningLog(import_chalk3.default.cyan("                  OPENSSL_CONF"), process.env.OPENSSL_CONF);
-    warningLog(import_chalk3.default.cyan("                  RANDFILE    "), process.env.RANDFILE);
-    warningLog(import_chalk3.default.cyan("                  CMD         "), import_chalk3.default.cyanBright(renderForDisplay("openssl", args)));
+    warningLog(import_chalk4.default.cyan("                  OPENSSL_CONF"), process.env.OPENSSL_CONF);
+    warningLog(import_chalk4.default.cyan("                  RANDFILE    "), process.env.RANDFILE);
+    warningLog(import_chalk4.default.cyan("                  CMD         "), import_chalk4.default.cyanBright(renderForDisplay("openssl", args)));
   }
   await ensure_openssl_installed();
   return await execute2(opensslPath, args, options);
 }
 
-// packages/node-opcua-pki/lib/pki/toolbox_pfx.ts
-var n2 = makePath;
-async function createPFX(options) {
-  const { certificateFile, privateKeyFile, privateKeyPassphrase, outputFile, passphrase = "", caCertificateFiles } = options;
-  (0, import_node_assert3.default)(import_node_fs4.default.existsSync(certificateFile), `Certificate file does not exist: ${certificateFile}`);
-  (0, import_node_assert3.default)(import_node_fs4.default.existsSync(privateKeyFile), `Private key file does not exist: ${privateKeyFile}`);
-  const args = ["pkcs12", "-export", "-in", n2(certificateFile), "-inkey", n2(privateKeyFile)];
-  if (caCertificateFiles) {
-    for (const caFile of caCertificateFiles) {
-      (0, import_node_assert3.default)(import_node_fs4.default.existsSync(caFile), `CA certificate file does not exist: ${caFile}`);
-      args.push("-certfile", n2(caFile));
-    }
-  }
-  const passin = passinArg(privateKeyPassphrase);
-  const passout = passoutArg(passphrase);
-  args.push("-out", n2(outputFile), ...passin.args, ...passout.args);
-  await execute_openssl(args, { env: { ...passin.env, ...passout.env } });
-}
-async function extractCertificateFromPFX(options) {
-  const { pfxFile, passphrase = "" } = options;
-  (0, import_node_assert3.default)(import_node_fs4.default.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  const passin = passinArg(passphrase);
-  return await execute_openssl(["pkcs12", "-in", n2(pfxFile), "-clcerts", "-nokeys", "-nodes", ...passin.args], {
-    env: passin.env
-  });
-}
-async function extractPrivateKeyFromPFX(options) {
-  const { pfxFile, passphrase = "" } = options;
-  (0, import_node_assert3.default)(import_node_fs4.default.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  const passin = passinArg(passphrase);
-  return await execute_openssl(["pkcs12", "-in", n2(pfxFile), "-nocerts", "-nodes", ...passin.args], { env: passin.env });
-}
-async function extractCACertificatesFromPFX(options) {
-  const { pfxFile, passphrase = "" } = options;
-  (0, import_node_assert3.default)(import_node_fs4.default.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  const passin = passinArg(passphrase);
-  return await execute_openssl(["pkcs12", "-in", n2(pfxFile), "-cacerts", "-nokeys", "-nodes", ...passin.args], {
-    env: passin.env
-  });
-}
-async function extractAllFromPFX(options) {
-  const [certificate, privateKey, caCertificates] = await Promise.all([
-    extractCertificateFromPFX(options),
-    extractPrivateKeyFromPFX(options),
-    extractCACertificatesFromPFX(options)
-  ]);
-  return { certificate, privateKey, caCertificates };
-}
-async function convertPFXtoPEM(pfxFile, pemFile, passphrase = "") {
-  (0, import_node_assert3.default)(import_node_fs4.default.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  const passin = passinArg(passphrase);
-  await execute_openssl(["pkcs12", "-in", n2(pfxFile), "-out", n2(pemFile), "-nodes", ...passin.args], { env: passin.env });
-}
-async function dumpPFX(pfxFile, passphrase = "") {
-  (0, import_node_assert3.default)(import_node_fs4.default.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  const passin = passinArg(passphrase);
-  return await execute_openssl(["pkcs12", "-in", n2(pfxFile), "-info", "-nodes", ...passin.args], { env: passin.env });
-}
-
-// packages/node-opcua-pki/lib/toolbox/common.ts
+// packages/node-opcua-pki/lib/toolbox/with_openssl/toolbox.ts
 var import_node_assert4 = __toESM(require("assert"));
-function quote(str) {
-  return `"${str || ""}"`;
-}
-async function resolvePrivateKeyPassphrase(passphrase) {
-  if (passphrase === void 0) {
-    return void 0;
-  }
-  return typeof passphrase === "function" ? await passphrase() : passphrase;
-}
-function adjustDate(params) {
-  (0, import_node_assert4.default)(params instanceof Object);
-  params.startDate = params.startDate || /* @__PURE__ */ new Date();
-  (0, import_node_assert4.default)(params.startDate instanceof Date);
-  if (params.validityMs !== void 0) {
-    if (params.validityMs <= 0) {
-      throw new RangeError(`validityMs must be > 0 (got ${params.validityMs})`);
-    }
-    params.endDate = new Date(params.startDate.getTime() + params.validityMs);
-    params.validity = Math.ceil(params.validityMs / 864e5);
-  } else {
-    params.validity = params.validity || 365;
-    params.endDate = new Date(params.startDate.getTime());
-    params.endDate.setDate(params.startDate.getDate() + params.validity);
-  }
-  (0, import_node_assert4.default)(params.endDate instanceof Date);
-  (0, import_node_assert4.default)(params.startDate instanceof Date);
-}
-function adjustApplicationUri(params) {
-  const applicationUri = params.applicationUri || "";
-  if (applicationUri.length > 200) {
-    throw new Error(`Openssl doesn't support urn with length greater than 200${applicationUri}`);
-  }
-}
-
-// packages/node-opcua-pki/lib/toolbox/display.ts
-var import_chalk4 = __toESM(require("chalk"));
-function displayTitle(str) {
-  if (!g_config.silent) {
-    warningLog("");
-    warningLog(import_chalk4.default.yellowBright(str));
-    warningLog(import_chalk4.default.yellow(new Array(str.length + 1).join("=")), "\n");
-  }
-}
-function displaySubtitle(str) {
-  if (!g_config.silent) {
-    warningLog("");
-    warningLog(`    ${import_chalk4.default.yellowBright(str)}`);
-    warningLog(`    ${import_chalk4.default.white(new Array(str.length + 1).join("-"))}`, "\n");
-  }
-}
-function display(str) {
-  if (!g_config.silent) {
-    warningLog(`       ${str}`);
-  }
-}
-
-// packages/node-opcua-pki/lib/toolbox/with_openssl/index.ts
-var import_node_constants = __toESM(require("constants"));
-
-// packages/node-opcua-pki/lib/toolbox/with_openssl/create_certificate_signing_request.ts
-var import_node_assert6 = __toESM(require("assert"));
 var import_node_fs6 = __toESM(require("fs"));
-var import_node_path4 = __toESM(require("path"));
-
-// packages/node-opcua-pki/lib/misc/subject.ts
-var import_node_opcua_crypto = require("node-opcua-crypto");
-
-// packages/node-opcua-pki/lib/toolbox/with_openssl/toolbox.ts
-var import_node_assert5 = __toESM(require("assert"));
-var import_node_fs5 = __toESM(require("fs"));
-var import_node_path3 = __toESM(require("path"));
+var import_node_path5 = __toESM(require("path"));
 function openssl_require2DigitYearInDate() {
   if (!g_config.opensslVersion) {
     throw new Error(
@@ -789,29 +1191,40 @@ function openssl_require2DigitYearInDate() {
 }
 g_config.opensslVersion = "";
 var _counter = 0;
-function stripConditionalBlocks(template) {
+function stripConditionalBlocks(template, envOverrides) {
   return template.replace(/\{\{#([A-Z_][A-Z0-9_]*)\}\}([\s\S]*?)\{\{\/\1\}\}\r?\n?/g, (_match, key, content) => {
-    const keep = hasEnv(key) && getEnv(key) !== "";
+    const keep = envOverrides && Object.prototype.hasOwnProperty.call(envOverrides, key) ? envOverrides[key] !== "" : hasEnv(key) && getEnv(key) !== "";
     return keep ? content : "";
   });
 }
-function generateStaticConfig(configPath, options) {
+function generateStaticConfig(configPath, options, envOverrides) {
   const prePath = options?.cwd || "";
-  const originalFilename = !import_node_path3.default.isAbsolute(configPath) ? import_node_path3.default.join(prePath, configPath) : configPath;
-  let staticConfig = import_node_fs5.default.readFileSync(originalFilename, { encoding: "utf8" });
-  staticConfig = stripConditionalBlocks(staticConfig);
+  const originalFilename = !import_node_path5.default.isAbsolute(configPath) ? import_node_path5.default.join(prePath, configPath) : configPath;
+  let staticConfig = import_node_fs6.default.readFileSync(originalFilename, { encoding: "utf8" });
+  staticConfig = stripConditionalBlocks(staticConfig, envOverrides);
   for (const envVar of getEnvironmentVarNames()) {
-    staticConfig = staticConfig.replace(new RegExp(envVar.pattern, "gi"), getEnv(envVar.key));
+    if (envOverrides && Object.prototype.hasOwnProperty.call(envOverrides, envVar.key)) {
+      continue;
+    }
+    staticConfig = staticConfig.replace(new RegExp(envVar.pattern, "gi"), () => getEnv(envVar.key));
+  }
+  if (envOverrides) {
+    for (const [key, value] of Object.entries(envOverrides)) {
+      staticConfig = staticConfig.replace(new RegExp(`\\$ENV\\:\\:${key}`, "gi"), () => value);
+    }
   }
   const staticConfigPath = `${configPath}.${process.pid}-${_counter++}.tmp`;
-  const temporaryConfigPath = !import_node_path3.default.isAbsolute(configPath) ? import_node_path3.default.join(prePath, staticConfigPath) : staticConfigPath;
-  import_node_fs5.default.writeFileSync(temporaryConfigPath, staticConfig);
+  const temporaryConfigPath = !import_node_path5.default.isAbsolute(configPath) ? import_node_path5.default.join(prePath, staticConfigPath) : staticConfigPath;
+  import_node_fs6.default.writeFileSync(temporaryConfigPath, staticConfig);
   if (options?.cwd) {
-    return import_node_path3.default.relative(options.cwd, temporaryConfigPath);
+    return import_node_path5.default.relative(options.cwd, temporaryConfigPath);
   } else {
     return temporaryConfigPath;
   }
 }
+async function cleanupStaticConfig(configFile, options) {
+  await import_node_fs6.default.promises.rm(import_node_path5.default.resolve(options?.cwd ?? "", configFile), { force: true });
+}
 function x509Date(date) {
   date = date || /* @__PURE__ */ new Date();
   const Y = date.getUTCFullYear();
@@ -830,48 +1243,348 @@ function x509Date(date) {
   }
 }
 
-// packages/node-opcua-pki/lib/toolbox/with_openssl/create_certificate_signing_request.ts
-var n3 = makePath;
-async function createCertificateSigningRequestWithOpenSSL(certificateSigningRequestFilename, params) {
-  (0, import_node_assert6.default)(params);
-  (0, import_node_assert6.default)(params.rootDir);
-  (0, import_node_assert6.default)(params.configFile);
-  (0, import_node_assert6.default)(params.privateKey);
-  (0, import_node_assert6.default)(typeof params.privateKey === "string");
-  (0, import_node_assert6.default)(import_node_fs6.default.existsSync(params.configFile), `config file must exist ${params.configFile}`);
-  (0, import_node_assert6.default)(import_node_fs6.default.existsSync(params.privateKey), `Private key must exist${params.privateKey}`);
-  (0, import_node_assert6.default)(import_node_fs6.default.existsSync(params.rootDir), "RootDir key must exist");
-  (0, import_node_assert6.default)(typeof certificateSigningRequestFilename === "string");
-  processAltNames(params);
-  const configFile = generateStaticConfig(params.configFile, { cwd: params.rootDir });
-  const options = { cwd: params.rootDir, openssl_conf: import_node_path4.default.relative(params.rootDir, configFile) };
-  const subject = params.subject ? new import_node_opcua_crypto.Subject(params.subject).toString() : void 0;
-  displaySubtitle("- Creating a Certificate Signing Request with openssl");
-  await execute_openssl(
-    [
-      "req",
-      "-new",
-      "-sha256",
-      "-batch",
-      "-text",
-      "-config",
-      n3(configFile),
-      "-key",
-      n3(params.privateKey),
-      ...subject ? ["-subj", subject] : [],
-      "-out",
-      n3(certificateSigningRequestFilename)
-    ],
-    options
-  );
+// packages/node-opcua-pki/lib/ca/backends/openssl_ca_backend.ts
+var n2 = makePath;
+function caAltName(ca) {
+  return `URI:urn:${ca.subject.commonName || "NodeOPCUA-CA"}`;
+}
+function caConfigEnvOverrides(ca, altName = caAltName(ca)) {
+  const aiaLegs = [];
+  if (ca.ocspResponderUrl) {
+    aiaLegs.push(`OCSP;URI:${ca.ocspResponderUrl}`);
+  }
+  if (ca.caIssuersUrl) {
+    aiaLegs.push(`caIssuers;URI:${ca.caIssuersUrl}`);
+  }
+  return {
+    ALTNAME: altName,
+    CDP_URL: ca.crlDistributionUrl ?? "",
+    AIA_VALUE: aiaLegs.join(",")
+  };
 }
+var OpenSslCaBackend = class {
+  /** This backend is the `openssl` executable, so it has to be there. */
+  /**
+   * `-passin env:` argv and env for an openssl call that has to load this
+   * CA's key. Built here rather than on the CA: the passphrase is the
+   * CA's business, but expressing it as an openssl argument is this
+   * backend's, and the core has no reason to know the flag exists.
+   */
+  async #passin(ca) {
+    return passinArg(await ca._privateKeyPassphrase());
+  }
+  /** The openssl CLI loads its key from a file, so it cannot call out to an HSM. */
+  supportsExternalSigner = false;
+  async preflight() {
+    await ensure_openssl_installed();
+  }
+  /**
+   * Render `conf/caconfig.cnf` once with explicit overrides, run `fn`
+   * with the rendered path, and always remove the temp file. Structural
+   * guarantee that (a) every render carries the three required env
+   * values and (b) no rendered `<name>.<pid>-<n>.tmp` file is ever left
+   * behind — each was previously a per-method discipline.
+   */
+  async #withConfig(ca, altName, fn) {
+    const caRootDir = import_node_path6.default.resolve(ca.rootDir);
+    const options = { cwd: caRootDir };
+    const configFile = generateStaticConfig("conf/caconfig.cnf", options, caConfigEnvOverrides(ca, altName));
+    try {
+      return await fn(configFile, options);
+    } finally {
+      await cleanupStaticConfig(configFile, options);
+    }
+  }
+  async #generateCaCsrWith(ca, configFile, options, privateKeyFile, csrFile) {
+    const passin = await this.#passin(ca);
+    displayTitle("Generate a certificate request for the CA key");
+    await execute_openssl(
+      [
+        "req",
+        "-new",
+        "-sha256",
+        "-extensions",
+        "v3_ca_req",
+        "-config",
+        n2(configFile),
+        "-key",
+        n2(privateKeyFile),
+        "-out",
+        n2(csrFile),
+        "-subj",
+        ca.subject.toString(),
+        ...passin.args
+      ],
+      { ...options, env: passin.env }
+    );
+  }
+  /**
+   * `openssl ca -gencrl` signs the CRL with the CA key it finds through the
+   * config file (`private_key = $dir/private/cakey.pem`), so it needs the
+   * CA passphrase like every other `openssl ca` invocation.
+   */
+  async #regenerateCrlWith(ca, configFile, options) {
+    const passin = await this.#passin(ca);
+    displaySubtitle("regenerate CRL (Certificate Revocation List)");
+    await execute_openssl(["ca", "-gencrl", "-config", n2(configFile), "-out", "crl/revocation_list.crl", ...passin.args], {
+      ...options,
+      env: passin.env
+    });
+    await execute_openssl(
+      ["crl", "-in", "crl/revocation_list.crl", "-out", "crl/revocation_list.der", "-outform", "der"],
+      options
+    );
+    displaySubtitle("Display (Certificate Revocation List)");
+    await execute_openssl(["crl", "-in", n2(ca.revocationList), "-text", "-noout"], options);
+  }
+  async generateCaCsr(ca, _caRootDir, privateKeyFile, csrFile) {
+    await this.#withConfig(
+      ca,
+      caAltName(ca),
+      (configFile, options) => this.#generateCaCsrWith(ca, configFile, options, privateKeyFile, csrFile)
+    );
+  }
+  async bootstrap(ca) {
+    const caRootDir = import_node_path6.default.resolve(ca.rootDir);
+    const privateKeyFilename = import_node_path6.default.join(caRootDir, "private/cakey.pem");
+    const csrFilename = import_node_path6.default.join(caRootDir, "private/cakey.csr");
+    await this.#withConfig(ca, caAltName(ca), async (configFile, options) => {
+      await this.#generateCaCsrWith(ca, configFile, options, privateKeyFilename, csrFilename);
+      const issuerCA = ca._issuerCA;
+      if (issuerCA) {
+        displayTitle("Generate CA Certificate (signed by issuer CA)");
+        const issuerCert = import_node_path6.default.resolve(issuerCA.caCertificate);
+        const issuerKey = import_node_path6.default.resolve(issuerCA.rootDir, "private/cakey.pem");
+        const issuerSerial = import_node_path6.default.resolve(issuerCA.rootDir, "serial");
+        const issuerPassin = await this.#passin(issuerCA);
+        const signWithIssuer = async () => {
+          await execute_openssl(
+            [
+              "x509",
+              "-sha256",
+              "-req",
+              "-days",
+              "3650",
+              "-extensions",
+              "v3_ca",
+              "-extfile",
+              n2(configFile),
+              "-in",
+              "private/cakey.csr",
+              "-CA",
+              n2(issuerCert),
+              "-CAkey",
+              n2(issuerKey),
+              "-CAserial",
+              n2(issuerSerial),
+              "-out",
+              "public/cacert.pem",
+              ...issuerPassin.args
+            ],
+            { ...options, env: issuerPassin.env }
+          );
+        };
+        if (import_node_path6.default.resolve(issuerCA.rootDir) === caRootDir) {
+          await signWithIssuer();
+        } else {
+          await issuerCA._withCaDirectoryLock(signWithIssuer);
+        }
+      } else {
+        displayTitle("Generate CA Certificate (self-signed)");
+        const passin = await this.#passin(ca);
+        await execute_openssl(
+          [
+            "x509",
+            "-sha256",
+            "-req",
+            "-days",
+            "3650",
+            "-extensions",
+            "v3_ca",
+            "-extfile",
+            n2(configFile),
+            "-in",
+            "private/cakey.csr",
+            "-signkey",
+            n2(privateKeyFilename),
+            "-out",
+            "public/cacert.pem",
+            ...passin.args
+          ],
+          { ...options, env: passin.env }
+        );
+      }
+      displaySubtitle("generate initial CRL (Certificate Revocation List)");
+      await this.#regenerateCrlWith(ca, configFile, options);
+    });
+    displayTitle("Create Certificate Authority (CA) ---> DONE");
+  }
+  async regenerateCrl(ca) {
+    await this.#withConfig(ca, caAltName(ca), (configFile, options) => this.#regenerateCrlWith(ca, configFile, options));
+  }
+  async signSubordinateCsr(ca, csrFile, certFile, validityDays) {
+    await this.#withConfig(ca, caAltName(ca), async (configFile, options) => {
+      const caRootDir = options.cwd;
+      const passin = await this.#passin(ca);
+      await execute_openssl(
+        [
+          "x509",
+          "-sha256",
+          "-req",
+          "-days",
+          String(validityDays),
+          "-extensions",
+          "v3_ca",
+          "-extfile",
+          n2(configFile),
+          "-in",
+          n2(csrFile),
+          "-CA",
+          n2(ca.caCertificate),
+          "-CAkey",
+          n2(import_node_path6.default.join(caRootDir, "private/cakey.pem")),
+          "-CAserial",
+          n2(import_node_path6.default.join(caRootDir, "serial")),
+          "-out",
+          n2(certFile),
+          ...passin.args
+        ],
+        { ...options, env: passin.env }
+      );
+    });
+  }
+  async signEndEntityCsr(ca, certificate, csr, params1, sanOverride) {
+    await this.#withConfig(ca, buildSubjectAltNameString(sanOverride), async (configFile, options) => {
+      displaySubtitle("- then we ask the authority to sign the certificate signing request");
+      const passin = await this.#passin(ca);
+      await execute_openssl(
+        [
+          "ca",
+          "-config",
+          configFile,
+          "-startdate",
+          x509Date(params1.startDate),
+          "-enddate",
+          x509Date(params1.endDate),
+          "-batch",
+          "-out",
+          n2(certificate),
+          "-in",
+          n2(csr),
+          ...passin.args
+        ],
+        { ...options, env: passin.env }
+      );
+      displaySubtitle("- dump the certificate for a check");
+      await execute_openssl(["x509", "-in", n2(certificate), "-dates", "-fingerprint", "-purpose", "-noout"], options);
+    });
+  }
+  async revoke(ca, certificate, reason) {
+    setEnv("RANDFILE", import_node_path6.default.join(ca.rootDir, "random.rnd"));
+    await this.#withConfig(ca, caAltName(ca), async (configFile, options) => {
+      displaySubtitle("Revoke certificate");
+      const passin = await this.#passin(ca);
+      await execute_openssl_no_failure(
+        ["ca", "-verbose", "-config", n2(configFile), "-revoke", certificate, "-crl_reason", reason, ...passin.args],
+        { ...options, env: passin.env }
+      );
+      await this.#regenerateCrlWith(ca, configFile, options);
+      displaySubtitle("Verify that certificate is revoked");
+      await execute_openssl_no_failure(
+        [
+          "verify",
+          "-verbose",
+          "-CRLfile",
+          n2(ca.revocationList),
+          "-CAfile",
+          n2(ca.caCertificate),
+          "-crl_check",
+          n2(certificate)
+        ],
+        options
+      );
+      displaySubtitle("Produce CRL in DER form ");
+      await execute_openssl(
+        ["crl", "-in", n2(ca.revocationList), "-out", "crl/revocation_list.der", "-outform", "der"],
+        options
+      );
+      displaySubtitle("Produce CRL in PEM form ");
+      await execute_openssl(
+        ["crl", "-in", n2(ca.revocationList), "-out", "crl/revocation_list.pem", "-outform", "pem", "-text"],
+        options
+      );
+    });
+  }
+  async createSelfSignedCertificate(ca, certificateFile, privateKeyFile, params) {
+    const envOverrides = caConfigEnvOverrides(ca, buildSubjectAltNameString(params));
+    const configFile = generateStaticConfig(ca.configFile, { cwd: ca.rootDir }, envOverrides);
+    const options = {
+      cwd: ca.rootDir,
+      openssl_conf: makePath(configFile)
+    };
+    try {
+      const subject = params.subject ? new import_node_opcua_crypto4.Subject(params.subject).toString() : "";
+      const subjectOptions = subject && subject.length > 1 ? ["-subj", subject] : [];
+      const csrFile = `${certificateFile}_csr`;
+      const passin = await this.#passin(ca);
+      displaySubtitle("- the certificate signing request");
+      await execute_openssl(
+        [
+          "req",
+          "-new",
+          "-sha256",
+          ...subjectOptions,
+          "-batch",
+          "-key",
+          n2(privateKeyFile),
+          "-out",
+          n2(csrFile),
+          ...passin.args
+        ],
+        { ...options, env: passin.env }
+      );
+      displaySubtitle("- creating the self-signed certificate");
+      await execute_openssl(
+        [
+          "ca",
+          "-selfsign",
+          "-keyfile",
+          n2(privateKeyFile),
+          "-startdate",
+          x509Date(params.startDate),
+          "-enddate",
+          x509Date(params.endDate),
+          "-batch",
+          "-out",
+          n2(certificateFile),
+          "-in",
+          n2(csrFile),
+          ...passin.args
+        ],
+        { ...options, env: passin.env }
+      );
+      displaySubtitle("- dump the certificate for a check");
+      await execute_openssl(["x509", "-in", n2(certificateFile), "-dates", "-fingerprint", "-purpose", "-noout"], {});
+      displaySubtitle("- verify self-signed certificate");
+      await execute_openssl_no_failure(["verify", "-verbose", "-CAfile", n2(certificateFile), n2(certificateFile)], options);
+      await import_node_fs7.default.promises.unlink(csrFile);
+    } finally {
+      await cleanupStaticConfig(configFile, { cwd: ca.rootDir });
+    }
+  }
+};
 
-// packages/node-opcua-pki/lib/pki/templates/simple_config_template.cnf.ts
-var config = '##################################################################################################\n## SIMPLE OPENSSL CONFIG FILE FOR SELF-SIGNED CERTIFICATE GENERATION\n################################################################################################################\n\ndistinguished_name       = req_distinguished_name\ndefault_md               = sha1\n\ndefault_md                = sha256                      # The default digest algorithm\n\n[ v3_ca ]\nsubjectKeyIdentifier        = hash\nauthorityKeyIdentifier      = keyid:always,issuer:always\n\n# authorityKeyIdentifier    = keyid\nbasicConstraints            = CA:TRUE\nkeyUsage                    = critical, cRLSign, keyCertSign\nnsComment                   = "Self-signed Certificate for CA generated by Node-OPCUA Certificate utility"\n#nsCertType                 = sslCA, emailCA\n#subjectAltName             = email:copy\n#issuerAltName              = issuer:copy\n#obj                        = DER:02:03\n# crlDistributionPoints       = @crl_info\n# [ crl_info ]\n# URI.0                     = http://localhost:8900/crl.pem\nsubjectAltName              = $ENV::ALTNAME\n\n[ req ]\ndays                      = 390\nreq_extensions            = v3_req\nx509_extensions           = v3_ca\n\n[v3_req]\nbasicConstraints       = CA:false\nkeyUsage               = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment\nsubjectAltName         = $ENV::ALTNAME\n\n[ v3_ca_signed]\nsubjectKeyIdentifier      = hash\nauthorityKeyIdentifier    = keyid,issuer\nbasicConstraints          = critical, CA:FALSE\nkeyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment\nextendedKeyUsage          = clientAuth,serverAuth \nnsComment                 = "certificate generated by Node-OPCUA Certificate utility and signed by a CA"\nsubjectAltName            = $ENV::ALTNAME\n[ v3_selfsigned]\nsubjectKeyIdentifier      = hash\nauthorityKeyIdentifier    = keyid,issuer\nbasicConstraints          = critical, CA:FALSE\nkeyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment\nextendedKeyUsage          = clientAuth,serverAuth \nnsComment                 = "Self-signed certificate generated by Node-OPCUA Certificate utility"\nsubjectAltName            = $ENV::ALTNAME\n[ req_distinguished_name ]\ncountryName             = Country Name (2 letter code)\ncountryName_default     = FR\ncountryName_min         = 2\ncountryName_max         = 2\n# stateOrProvinceName     = State or Province Name (full name)\n# stateOrProvinceName_default = Ile de France\n# localityName            = Locality Name (city, district)\n# localityName_default    = Paris\norganizationName          = Organization Name (company)\norganizationName_default  = NodeOPCUA\n# organizationalUnitName  = Organizational Unit Name (department, division)\n# organizationalUnitName_default = R&D\ncommonName                = Common Name (hostname, FQDN, IP, or your name)\ncommonName_max            = 256\ncommonName_default        = NodeOPCUA\n# emailAddress            = Email Address\n# emailAddress_max        = 40\n# emailAddress_default    = node-opcua (at) node-opcua (dot) com\nsubjectAltName            = $ENV::ALTNAME';
-var simple_config_template_cnf_default = config;
+// packages/node-opcua-pki/lib/ca/core/certificate_authority_core.ts
+var import_node_assert5 = __toESM(require("assert"));
+var import_node_fs8 = __toESM(require("fs"));
+var import_node_os3 = __toESM(require("os"));
+var import_node_path7 = __toESM(require("path"));
+var import_global_mutex = require("@ster5/global-mutex");
+var import_chalk5 = __toESM(require("chalk"));
+var import_node_opcua_crypto5 = require("node-opcua-crypto");
 
 // packages/node-opcua-pki/lib/ca/templates/ca_config_template.cnf.ts
-var config2 = `#.........DO NOT MODIFY BY HAND .........................
+var config = `#.........DO NOT MODIFY BY HAND .........................
 [ ca ]
 default_ca               = CA_default
 [ CA_default ]
@@ -896,7 +1609,7 @@ policy                   = policy_match
 # default_enddate          = YYMMDDHHMMSSZ
 crl_dir                  = $dir/crl
 crl_extensions           = crl_ext
-crl                      = $dir/revocation_list.crl # the Revocation list
+crl                      = $dir/crl/revocation_list.crl # the Revocation list
 crlnumber                = $dir/crlnumber           # CRL number file
 default_crl_days         = 30
 default_crl_hours        = 24
@@ -1002,197 +1715,28 @@ subjectAltName            = $ENV::ALTNAME
 #issuerAltName            = issuer:copy
 authorityKeyIdentifier    = keyid:always,issuer:always
 #authorityInfoAccess       = @issuer_info`;
-var ca_config_template_cnf_default = config2;
+var ca_config_template_cnf_default = config;
 
-// packages/node-opcua-pki/lib/ca/certificate_authority.ts
+// packages/node-opcua-pki/lib/ca/core/certificate_authority_core.ts
 var defaultSubject = "/C=FR/ST=IDF/L=Paris/O=Local NODE-OPCUA Certificate Authority/CN=NodeOPCUA-CA";
 var configurationFileTemplate = ca_config_template_cnf_default;
-var configurationFileSimpleTemplate = simple_config_template_cnf_default;
 function escapeOpensslConfDoubleQuoted(value) {
   return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
 }
 function renderCaConfig(caRootDir) {
   return configurationFileTemplate.replace(/%%ROOT_FOLDER%%/, escapeOpensslConfDoubleQuoted(makePath(caRootDir)));
 }
-var config3 = {
+var config2 = {
   certificateDir: "INVALID",
   forceCA: false,
   pkiDir: "INVALID"
 };
-var n4 = makePath;
+var CA_LOCK_MAX_WAIT_MS = 5 * 6e4;
+var CA_LOCK_RETRY = { minTimeout: 20, maxTimeout: 250 };
 function octetStringToIpAddress(a) {
   return parseInt(a.substring(0, 2), 16).toString() + "." + parseInt(a.substring(2, 4), 16).toString() + "." + parseInt(a.substring(4, 6), 16).toString() + "." + parseInt(a.substring(6, 8), 16).toString();
 }
-(0, import_node_assert7.default)(octetStringToIpAddress("c07b9179") === "192.123.145.121");
-async function construct_CertificateAuthority(certificateAuthority) {
-  const subject = certificateAuthority.subject;
-  const caRootDir = import_node_path5.default.resolve(certificateAuthority.rootDir);
-  async function make_folders() {
-    mkdirRecursiveSync(caRootDir);
-    ensurePrivateDirectory(import_node_path5.default.join(caRootDir, "private"));
-    mkdirRecursiveSync(import_node_path5.default.join(caRootDir, "public"));
-    mkdirRecursiveSync(import_node_path5.default.join(caRootDir, "certs"));
-    mkdirRecursiveSync(import_node_path5.default.join(caRootDir, "crl"));
-    mkdirRecursiveSync(import_node_path5.default.join(caRootDir, "conf"));
-  }
-  await make_folders();
-  async function construct_default_files() {
-    const serial = import_node_path5.default.join(caRootDir, "serial");
-    if (!import_node_fs7.default.existsSync(serial)) {
-      await import_node_fs7.default.promises.writeFile(serial, "1000");
-    }
-    const crlNumber = import_node_path5.default.join(caRootDir, "crlnumber");
-    if (!import_node_fs7.default.existsSync(crlNumber)) {
-      await import_node_fs7.default.promises.writeFile(crlNumber, "1000");
-    }
-    const indexFile = import_node_path5.default.join(caRootDir, "index.txt");
-    if (!import_node_fs7.default.existsSync(indexFile)) {
-      await import_node_fs7.default.promises.writeFile(indexFile, "");
-    }
-  }
-  await construct_default_files();
-  const caKeyExists = import_node_fs7.default.existsSync(import_node_path5.default.join(caRootDir, "private/cakey.pem"));
-  const caCertExists = import_node_fs7.default.existsSync(import_node_path5.default.join(caRootDir, "public/cacert.pem"));
-  if (caKeyExists && caCertExists && !config3.forceCA) {
-    restrictPrivateFilePermissions(import_node_path5.default.join(caRootDir, "private/cakey.pem"), 384);
-    await certificateAuthority._ensurePrivateKeyProtection();
-    debugLog("CA private key and certificate already exist ... skipping");
-    return;
-  }
-  if (caKeyExists && !caCertExists) {
-    debugLog("CA private key exists but cacert.pem is missing \u2014 rebuilding CA");
-    import_node_fs7.default.unlinkSync(import_node_path5.default.join(caRootDir, "private/cakey.pem"));
-    const staleCsr = import_node_path5.default.join(caRootDir, "private/cakey.csr");
-    if (import_node_fs7.default.existsSync(staleCsr)) {
-      import_node_fs7.default.unlinkSync(staleCsr);
-    }
-  }
-  displayTitle("Create Certificate Authority (CA)");
-  const indexFileAttr = import_node_path5.default.join(caRootDir, "index.txt.attr");
-  if (!import_node_fs7.default.existsSync(indexFileAttr)) {
-    await import_node_fs7.default.promises.writeFile(indexFileAttr, "unique_subject = no");
-  }
-  const caConfigFile = certificateAuthority.configFile;
-  if (1) {
-    await import_node_fs7.default.promises.writeFile(caConfigFile, renderCaConfig(caRootDir));
-  }
-  const subjectOpt = ["-subj", subject.toString()];
-  const caCommonName = subject.commonName || "NodeOPCUA-CA";
-  setEnv("ALTNAME", `URI:urn:${caCommonName}`);
-  certificateAuthority._wireRevocationEnvVars();
-  const options = { cwd: caRootDir };
-  const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-  const configOption = ["-config", n4(configFile)];
-  const keySize = certificateAuthority.keySize;
-  const privateKeyFilename = import_node_path5.default.join(caRootDir, "private/cakey.pem");
-  const csrFilename = import_node_path5.default.join(caRootDir, "private/cakey.csr");
-  displayTitle(`Generate the CA private Key - ${keySize}`);
-  const passin = await certificateAuthority._opensslPassin();
-  await (0, import_node_opcua_crypto2.generatePrivateKeyFile)(privateKeyFilename, keySize, { passphrase: await certificateAuthority._privateKeyPassphrase() });
-  restrictPrivateFilePermissions(privateKeyFilename, 384);
-  displayTitle("Generate a certificate request for the CA key");
-  await execute_openssl(
-    [
-      "req",
-      "-new",
-      "-sha256",
-      "-text",
-      "-extensions",
-      "v3_ca_req",
-      ...configOption,
-      "-key",
-      n4(privateKeyFilename),
-      "-out",
-      n4(csrFilename),
-      ...subjectOpt,
-      ...passin.args
-    ],
-    { ...options, env: passin.env }
-  );
-  const issuerCA = certificateAuthority._issuerCA;
-  if (issuerCA) {
-    displayTitle("Generate CA Certificate (signed by issuer CA)");
-    const issuerCert = import_node_path5.default.resolve(issuerCA.caCertificate);
-    const issuerKey = import_node_path5.default.resolve(issuerCA.rootDir, "private/cakey.pem");
-    const issuerSerial = import_node_path5.default.resolve(issuerCA.rootDir, "serial");
-    const issuerPassin = await issuerCA._opensslPassin();
-    await execute_openssl(
-      [
-        "x509",
-        "-sha256",
-        "-req",
-        "-days",
-        "3650",
-        "-text",
-        "-extensions",
-        "v3_ca",
-        "-extfile",
-        n4(configFile),
-        "-in",
-        "private/cakey.csr",
-        "-CA",
-        n4(issuerCert),
-        "-CAkey",
-        n4(issuerKey),
-        "-CAserial",
-        n4(issuerSerial),
-        "-out",
-        "public/cacert.pem",
-        ...issuerPassin.args
-      ],
-      { ...options, env: issuerPassin.env }
-    );
-  } else {
-    displayTitle("Generate CA Certificate (self-signed)");
-    await execute_openssl(
-      [
-        "x509",
-        "-sha256",
-        "-req",
-        "-days",
-        "3650",
-        "-text",
-        "-extensions",
-        "v3_ca",
-        "-extfile",
-        n4(configFile),
-        "-in",
-        "private/cakey.csr",
-        "-signkey",
-        n4(privateKeyFilename),
-        "-out",
-        "public/cacert.pem",
-        ...passin.args
-      ],
-      { ...options, env: passin.env }
-    );
-  }
-  displaySubtitle("generate initial CRL (Certificate Revocation List)");
-  await regenerateCrl(certificateAuthority.revocationList, configOption, options, passin);
-  displayTitle("Create Certificate Authority (CA) ---> DONE");
-}
-async function regenerateCrl(revocationList, configOption, options, passin) {
-  displaySubtitle("regenerate CRL (Certificate Revocation List)");
-  await execute_openssl(["ca", "-gencrl", ...configOption, "-out", "crl/revocation_list.crl", ...passin.args], {
-    ...options,
-    env: passin.env
-  });
-  await execute_openssl(["crl", "-in", "crl/revocation_list.crl", "-out", "crl/revocation_list.der", "-outform", "der"], options);
-  displaySubtitle("Display (Certificate Revocation List)");
-  await execute_openssl(["crl", "-in", n4(revocationList), "-text", "-noout"], options);
-}
-function parseOpenSSLDate(dateStr) {
-  const raw = dateStr?.split(",")[0] ?? "";
-  if (raw.length < 12) return "";
-  const yy = parseInt(raw.substring(0, 2), 10);
-  const year = yy >= 70 ? 1900 + yy : 2e3 + yy;
-  const month = raw.substring(2, 4);
-  const day = raw.substring(4, 6);
-  const hour = raw.substring(6, 8);
-  const min = raw.substring(8, 10);
-  const sec = raw.substring(10, 12);
-  return `${year}-${month}-${day}T${hour}:${min}:${sec}Z`;
-}
+(0, import_node_assert5.default)(octetStringToIpAddress("c07b9179") === "192.123.145.121");
 function validateRevocationUrl(url, fieldName) {
   if (url === void 0) {
     return void 0;
@@ -1220,7 +1764,7 @@ function validateRevocationUrl(url, fieldName) {
   }
   return url;
 }
-var CertificateAuthority = class {
+var CertificateAuthorityCore = class {
   /** RSA key size used when generating the CA private key. */
   keySize;
   /** Root filesystem path of the CA directory structure. */
@@ -1237,14 +1781,41 @@ var CertificateAuthority = class {
   /** resolved once (see `privateKeyPassphrase`); `#passphraseResolved` distinguishes "none" from "not yet" */
   #resolvedPassphrase;
   #passphraseResolved = false;
+  /** Signing backend: `openssl` shells out to the CLI, `native` signs in-process. */
+  #backend;
+  /** External signing key (HSM/KMS), when one was supplied instead of a key file. */
+  #signer;
+  /** Read access to `index.txt` / `certs/<SERIAL>.pem`. */
+  #db;
   constructor(options) {
-    (0, import_node_assert7.default)(Object.prototype.hasOwnProperty.call(options, "location"));
-    (0, import_node_assert7.default)(Object.prototype.hasOwnProperty.call(options, "keySize"));
+    (0, import_node_assert5.default)(Object.prototype.hasOwnProperty.call(options, "location"));
+    (0, import_node_assert5.default)(Object.prototype.hasOwnProperty.call(options, "keySize"));
     this.location = options.location;
     this.keySize = options.keySize || 2048;
-    this.subject = new import_node_opcua_crypto2.Subject(options.subject || defaultSubject);
+    this.subject = new import_node_opcua_crypto5.Subject(options.subject || defaultSubject);
     this._issuerCA = options.issuerCA;
     this.#privateKeyPassphrase = options.privateKeyPassphrase;
+    this.#signer = options.signer;
+    if (options.signer) {
+      const algorithm = options.signer.algorithm;
+      if (algorithm.name !== "RSASSA-PKCS1-v1_5" && algorithm.name !== "ECDSA") {
+        throw new Error(
+          `CertificateAuthority: signer algorithm ${algorithm.name} is not supported - use RSASSA-PKCS1-v1_5 or ECDSA.`
+        );
+      }
+      if (algorithm.name === "ECDSA" && !algorithm.namedCurve) {
+        throw new Error(
+          "CertificateAuthority: an ECDSA signer must declare its namedCurve (P-256, P-384 or P-521) - importing the signer's public key needs the curve, and an SPKI import cannot infer it."
+        );
+      }
+    }
+    if (options.signer && !options.backend.supportsExternalSigner) {
+      throw new Error(
+        "CertificateAuthority: this backend cannot sign with an external signer - it loads its key from a file. Use a backend that supports one, such as NativeCaBackend."
+      );
+    }
+    this.#backend = options.backend;
+    this.#db = new CaDatabase(this.location);
     if (options.crlDistributionUrl !== void 0) {
       this.setCrlDistributionUrl(options.crlDistributionUrl);
     }
@@ -1308,42 +1879,17 @@ var CertificateAuthority = class {
   setCaIssuersUrl(url) {
     this._caIssuersUrl = validateRevocationUrl(url, "caIssuersUrl");
   }
-  /**
-   * @internal
-   * Populate the OpenSSL config substitution env vars (`CDP_URL` and
-   * `AIA_VALUE`) from the configured URLs, or unset them so the
-   * matching `{{#KEY}}...{{/KEY}}` blocks in the templates are
-   * stripped. MUST be called before every `generateStaticConfig`
-   * invocation that signs a certificate.
-   */
-  _wireRevocationEnvVars() {
-    unsetEnv("CDP_URL");
-    unsetEnv("AIA_VALUE");
-    if (this._crlDistributionUrl) {
-      setEnv("CDP_URL", this._crlDistributionUrl);
-    }
-    const aiaLegs = [];
-    if (this._ocspResponderUrl) {
-      aiaLegs.push(`OCSP;URI:${this._ocspResponderUrl}`);
-    }
-    if (this._caIssuersUrl) {
-      aiaLegs.push(`caIssuers;URI:${this._caIssuersUrl}`);
-    }
-    if (aiaLegs.length > 0) {
-      setEnv("AIA_VALUE", aiaLegs.join(","));
-    }
-  }
   /** Absolute path to the CA root directory (alias for {@link location}). */
   get rootDir() {
     return this.location;
   }
   /** Path to the OpenSSL configuration file (`conf/caconfig.cnf`). */
   get configFile() {
-    return import_node_path5.default.normalize(import_node_path5.default.join(this.rootDir, "./conf/caconfig.cnf"));
+    return import_node_path7.default.normalize(import_node_path7.default.join(this.rootDir, "./conf/caconfig.cnf"));
   }
   /** Path to the CA private key (`private/cakey.pem`); may be passphrase-encrypted, see {@link getPrivateKey}. */
   get privateKey() {
-    return import_node_path5.default.join(import_node_path5.default.resolve(this.rootDir), "private/cakey.pem");
+    return import_node_path7.default.join(import_node_path7.default.resolve(this.rootDir), "private/cakey.pem");
   }
   /**
    * The CA private key, decrypted with the configured `privateKeyPassphrase`
@@ -1351,7 +1897,51 @@ var CertificateAuthority = class {
    * on an encrypted key with no or the wrong passphrase.
    */
   async getPrivateKey() {
-    return (0, import_node_opcua_crypto2.readPrivateKey)(this.privateKey, await this._privateKeyPassphrase());
+    this.#assertKeyIsOnDisk("getPrivateKey");
+    return (0, import_node_opcua_crypto5.readPrivateKey)(this.privateKey, await this._privateKeyPassphrase());
+  }
+  /**
+   * True when this CA signs with an external {@link CaSigner} (HSM/KMS)
+   * rather than with `private/cakey.pem`. There is then no private key
+   * file on disk, and never was one.
+   */
+  get hasExternalSigner() {
+    return this.#signer !== void 0;
+  }
+  /**
+   * Does `cert` certify the key this CA signs with? With the key on disk
+   * that is a private-key match; with a signer there is no private key to
+   * match, so compare the certified public key against the signer's own -
+   * the same question, asked the only way an HSM allows.
+   */
+  async #certificateMatchesOurKey(certPem, certDer) {
+    if (this.#signer) {
+      const ours = Buffer.from(await this.#signer.getPublicKey());
+      const certified = Buffer.from(new import_node_opcua_crypto5.x509.X509Certificate(certPem).publicKey.rawData);
+      return ours.equals(certified);
+    }
+    return (0, import_node_opcua_crypto5.certificateMatchesPrivateKey)(certDer, await this.getPrivateKey());
+  }
+  /** Reject the key-file-only operations up front, rather than failing on a missing file later. */
+  #assertKeyIsOnDisk(what) {
+    if (this.#signer) {
+      throw new Error(
+        `CertificateAuthority.${what} is not available on a signer-backed CA: the private key lives in the signer (HSM/KMS) and is never written to disk.`
+      );
+    }
+  }
+  /**
+   * @internal The key every signing operation goes through. An injected
+   * {@link CaSigner} is returned as-is; otherwise the on-disk key is read
+   * (and decrypted) and handed over as a plain `CryptoKey`. Both are
+   * accepted by the `node-opcua-crypto` signing primitives, so callers
+   * never branch on which one they got.
+   */
+  async _getSigningKey() {
+    if (this.#signer) {
+      return this.#signer;
+    }
+    return (0, import_node_opcua_crypto5.privateKeyToCryptoKey)(await this.getPrivateKey());
   }
   /**
    * Enable, disable, or rotate the passphrase protecting `private/cakey.pem`
@@ -1360,18 +1950,19 @@ var CertificateAuthority = class {
    * passphrase to continue using it.
    */
   async reencryptPrivateKey(oldPassphrase, newPassphrase) {
+    this.#assertKeyIsOnDisk("reencryptPrivateKey");
     const oldPass = await resolvePrivateKeyPassphrase(oldPassphrase);
     const newPass = await resolvePrivateKeyPassphrase(newPassphrase);
-    const key = (0, import_node_opcua_crypto2.readPrivateKey)(this.privateKey, oldPass);
+    const key = (0, import_node_opcua_crypto5.readPrivateKey)(this.privateKey, oldPass);
     await this.#rewritePrivateKeyFile(key, newPass);
   }
   async #rewritePrivateKeyFile(privateKey, passphrase) {
     const tmpFilename = `${this.privateKey}.${process.pid}-${Date.now()}.tmp`;
     try {
-      await (0, import_node_opcua_crypto2.writePrivateKeyFile)(tmpFilename, privateKey, { passphrase });
-      await import_node_fs7.default.promises.rename(tmpFilename, this.privateKey);
+      await (0, import_node_opcua_crypto5.writePrivateKeyFile)(tmpFilename, privateKey, { passphrase });
+      await import_node_fs8.default.promises.rename(tmpFilename, this.privateKey);
     } finally {
-      await import_node_fs7.default.promises.rm(tmpFilename, { force: true });
+      await import_node_fs8.default.promises.rm(tmpFilename, { force: true });
     }
   }
   /** @internal resolve the configured passphrase, at most once per instance */
@@ -1382,10 +1973,6 @@ var CertificateAuthority = class {
     }
     return this.#resolvedPassphrase;
   }
-  /** @internal `-passin env:` argv + env for every openssl call that loads this CA's key (always emitted, empty when none) */
-  async _opensslPassin() {
-    return passinArg(await this._privateKeyPassphrase());
-  }
   /**
    * @internal On an existing key: encrypt it in place if a passphrase is
    * configured and it is still plaintext (secure by default: the option
@@ -1394,16 +1981,58 @@ var CertificateAuthority = class {
    * first signing operation.
    */
   async _ensurePrivateKeyProtection() {
-    if (!import_node_fs7.default.existsSync(this.privateKey)) {
+    if (this.#signer || !import_node_fs8.default.existsSync(this.privateKey)) {
       return;
     }
     if (this.#privateKeyPassphrase !== void 0 && !isEncryptedPrivateKeyFile(this.privateKey)) {
       warningLog("CertificateAuthority: private key is plaintext but a passphrase is configured; encrypting it in place");
-      const plaintextKey = (0, import_node_opcua_crypto2.readPrivateKey)(this.privateKey);
+      const plaintextKey = (0, import_node_opcua_crypto5.readPrivateKey)(this.privateKey);
       await this.#rewritePrivateKeyFile(plaintextKey, await this._privateKeyPassphrase());
     }
     await this.getPrivateKey();
   }
+  /**
+   * Acquire a file-based lock on this CA's directory for the duration of
+   * `action` — serializes every operation that mutates the certificate
+   * database (`index.txt`, `serial`, `crlnumber`, `certs/`,
+   * `crl/revocation_list.*`) or the CA's own key/certificate, so
+   * concurrent calls on one `CertificateAuthority` (or two instances
+   * pointed at the same directory, in this or another process) cannot
+   * interleave. Mirrors `CertificateManager.withLock2`.
+   *
+   * Only ever call this from a top-level public operation — nested calls
+   * on the same instance would deadlock, since the underlying file lock
+   * is not reentrant.
+   *
+   * The wait is bounded: a waiter gives up (throws) after
+   * `CA_LOCK_MAX_WAIT_MS`. Without a bound, a holder whose openssl child
+   * hangs would block every CA operation in every process forever and
+   * silently — the lock library's keepalive keeps refreshing the lock
+   * file's mtime as long as the holder process is alive, so stale-lock
+   * recovery never fires for a live-but-stuck holder. A dead holder's
+   * lock goes stale (default 2 minutes) and is taken over well within
+   * this bound.
+   */
+  async #withCaLock(action) {
+    const lockFileName = import_node_path7.default.join(this.rootDir, ".ca.lock");
+    return (0, import_global_mutex.withLock)(
+      {
+        fileToLock: lockFileName,
+        retries: { forever: true, maxRetryTime: CA_LOCK_MAX_WAIT_MS, ...CA_LOCK_RETRY }
+      },
+      action
+    );
+  }
+  /**
+   * @internal Run `action` under this CA's directory lock. For the one
+   * legitimate cross-instance use: a subordinate CA's bootstrap signs its
+   * certificate with `openssl x509 -CAserial`, which read-increment-writes
+   * THIS issuer's `serial` file, and must therefore hold this issuer's
+   * lock (ordering is always subordinate -> issuer, so no cycle).
+   */
+  async _withCaDirectoryLock(action) {
+    return this.#withCaLock(action);
+  }
   /** Path to the CA certificate in PEM format (`public/cacert.pem`). */
   get caCertificate() {
     return makePath(this.rootDir, "./public/cacert.pem");
@@ -1451,8 +2080,8 @@ var CertificateAuthority = class {
    *   (call {@link initialize} first).
    */
   getCACertificateDER() {
-    const pem = (0, import_node_opcua_crypto2.readCertificatePEM)(this.caCertificate);
-    return (0, import_node_opcua_crypto2.convertPEMtoDER)(pem);
+    const pem = (0, import_node_opcua_crypto5.readCertificatePEM)(this.caCertificate);
+    return (0, import_node_opcua_crypto5.convertPEMtoDER)(pem);
   }
   /**
    * Return the CA certificate as a PEM-encoded string.
@@ -1461,7 +2090,7 @@ var CertificateAuthority = class {
    *   (call {@link initialize} first).
    */
   getCACertificatePEM() {
-    const raw = (0, import_node_opcua_crypto2.readCertificatePEM)(this.caCertificate);
+    const raw = (0, import_node_opcua_crypto5.readCertificatePEM)(this.caCertificate);
     const beginMarker = "-----BEGIN CERTIFICATE-----";
     const idx = raw.indexOf(beginMarker);
     if (idx > 0) {
@@ -1477,10 +2106,10 @@ var CertificateAuthority = class {
    */
   getCRLDER() {
     const crlPath = this.revocationListDER;
-    if (!import_node_fs7.default.existsSync(crlPath)) {
+    if (!import_node_fs8.default.existsSync(crlPath)) {
       return Buffer.alloc(0);
     }
-    return import_node_fs7.default.readFileSync(crlPath);
+    return import_node_fs8.default.readFileSync(crlPath);
   }
   /**
    * Return the current Certificate Revocation List as a
@@ -1490,10 +2119,10 @@ var CertificateAuthority = class {
    */
   getCRLPEM() {
     const crlPath = this.revocationList;
-    if (!import_node_fs7.default.existsSync(crlPath)) {
+    if (!import_node_fs8.default.existsSync(crlPath)) {
       return "";
     }
-    const raw = import_node_fs7.default.readFileSync(crlPath, "utf-8");
+    const raw = import_node_fs8.default.readFileSync(crlPath, "utf-8");
     const beginMarker = "-----BEGIN X509 CRL-----";
     const idx = raw.indexOf(beginMarker);
     if (idx > 0) {
@@ -1512,14 +2141,14 @@ var CertificateAuthority = class {
    * expiry date, and (for revoked certs) the revocation date.
    */
   getIssuedCertificates() {
-    return this._parseIndexTxt();
+    return this.#db.readIndex();
   }
   /**
    * Return the total number of certificates recorded in
    * `index.txt`.
    */
   getIssuedCertificateCount() {
-    return this._parseIndexTxt().length;
+    return this.#db.readIndex().length;
   }
   /**
    * Return the status of a certificate by its serial number.
@@ -1529,9 +2158,7 @@ var CertificateAuthority = class {
    *   `undefined` if not found
    */
   getCertificateStatus(serial) {
-    const upper = serial.toUpperCase();
-    const record = this._parseIndexTxt().find((r) => r.serial.toUpperCase() === upper);
-    return record?.status;
+    return this.#db.findBySerial(serial)?.status;
   }
   /**
    * Read a specific issued certificate by serial number and
@@ -1540,86 +2167,17 @@ var CertificateAuthority = class {
    * OpenSSL stores signed certificates in the `certs/`
    * directory using the naming convention `<SERIAL>.pem`.
    *
-   * @param serial - hex-encoded serial number (e.g. `"1000"`)
-   * @returns the DER buffer, or `undefined` if not found
-   */
-  getCertificateBySerial(serial) {
-    const upper = serial.toUpperCase();
-    const certFile = import_node_path5.default.join(this.rootDir, "certs", `${upper}.pem`);
-    if (!import_node_fs7.default.existsSync(certFile)) {
-      return void 0;
-    }
-    const pem = (0, import_node_opcua_crypto2.readCertificatePEM)(certFile);
-    return (0, import_node_opcua_crypto2.convertPEMtoDER)(pem);
-  }
-  /**
-   * Path to the OpenSSL certificate database file.
-   */
-  get indexFile() {
-    return import_node_path5.default.join(this.rootDir, "index.txt");
-  }
-  /**
-   * Parse the OpenSSL `index.txt` certificate database.
-   *
-   * Each line has tab-separated fields:
-   * ```
-   * status  expiry  [revocationDate]  serial  unknown  subject
-   * ```
-   *
-   * - status: `V` (valid), `R` (revoked), `E` (expired)
-   * - expiry: `YYMMDDHHmmssZ`
-   * - revocationDate: present only for revoked certs
-   * - serial: hex string
-   * - unknown: always `"unknown"`
-   * - subject: X.500 slash-delimited string
-   */
-  _parseIndexTxt() {
-    const indexPath = this.indexFile;
-    if (!import_node_fs7.default.existsSync(indexPath)) {
-      return [];
-    }
-    const content = import_node_fs7.default.readFileSync(indexPath, "utf-8");
-    const lines = content.split("\n").filter((l) => l.trim().length > 0);
-    const records = [];
-    for (const line of lines) {
-      const fields = line.split("	");
-      if (fields.length < 4) continue;
-      const statusChar = fields[0];
-      const expiryStr = fields[1];
-      let serial;
-      let subject;
-      let revocationDate;
-      if (statusChar === "R") {
-        revocationDate = fields[2];
-        serial = fields[3];
-        subject = fields.length >= 6 ? fields[5] : "";
-      } else {
-        serial = fields[3];
-        subject = fields.length >= 6 ? fields[5] : "";
-      }
-      let status;
-      switch (statusChar) {
-        case "V":
-          status = "valid";
-          break;
-        case "R":
-          status = "revoked";
-          break;
-        case "E":
-          status = "expired";
-          break;
-        default:
-          continue;
-      }
-      records.push({
-        serial,
-        status,
-        subject,
-        expiryDate: parseOpenSSLDate(expiryStr),
-        revocationDate: revocationDate ? parseOpenSSLDate(revocationDate) : void 0
-      });
-    }
-    return records;
+   * @param serial - hex-encoded serial number (e.g. `"1000"`)
+   * @returns the DER buffer, or `undefined` if not found
+   */
+  getCertificateBySerial(serial) {
+    return this.#db.getCertificateBySerial(serial);
+  }
+  /**
+   * Path to the OpenSSL certificate database file.
+   */
+  get indexFile() {
+    return this.#db.indexFile;
   }
   // ---------------------------------------------------------------
   // Buffer-based CA operations (US-058)
@@ -1641,12 +2199,12 @@ var CertificateAuthority = class {
    * @returns the signed certificate as a DER-encoded buffer
    */
   async signCertificateRequestFromDER(csrDer, options) {
-    const tmpDir = await import_node_fs7.default.promises.mkdtemp(import_node_path5.default.join(import_node_os3.default.tmpdir(), "pki-sign-"));
+    const tmpDir = await import_node_fs8.default.promises.mkdtemp(import_node_path7.default.join(import_node_os3.default.tmpdir(), "pki-sign-"));
     try {
-      const csrFile = import_node_path5.default.join(tmpDir, "request.csr");
-      const certFile = import_node_path5.default.join(tmpDir, "certificate.pem");
-      const csrPem = (0, import_node_opcua_crypto2.toPem)(csrDer, "CERTIFICATE REQUEST");
-      await import_node_fs7.default.promises.writeFile(csrFile, csrPem, "utf-8");
+      const csrFile = import_node_path7.default.join(tmpDir, "request.csr");
+      const certFile = import_node_path7.default.join(tmpDir, "certificate.pem");
+      const csrPem = (0, import_node_opcua_crypto5.toPem)(csrDer, "CERTIFICATE REQUEST");
+      await import_node_fs8.default.promises.writeFile(csrFile, csrPem, "utf-8");
       const signingParams = {};
       if (options?.validityMs !== void 0) signingParams.validityMs = options.validityMs;
       else signingParams.validity = options?.validity ?? 365;
@@ -1656,10 +2214,10 @@ var CertificateAuthority = class {
       if (options?.applicationUri) signingParams.applicationUri = options.applicationUri;
       if (options?.subject) signingParams.subject = options.subject;
       await this.signCertificateRequest(certFile, csrFile, signingParams);
-      const certPem = (0, import_node_opcua_crypto2.readCertificatePEM)(certFile);
-      return (0, import_node_opcua_crypto2.convertPEMtoDER)(certPem);
+      const certPem = (0, import_node_opcua_crypto5.readCertificatePEM)(certFile);
+      return (0, import_node_opcua_crypto5.convertPEMtoDER)(certPem);
     } finally {
-      await import_node_fs7.default.promises.rm(tmpDir, {
+      await import_node_fs8.default.promises.rm(tmpDir, {
         recursive: true,
         force: true
       });
@@ -1709,27 +2267,35 @@ var CertificateAuthority = class {
    * @returns `{ certificateDer, privateKey }` — certificate as DER,
    *   private key as a branded `PrivateKey` buffer
    */
+  /**
+   * An ephemeral key and a CSR for it, written into `tmpDir`. Both
+   * `generateKeyPairAndSign*` methods need exactly this, and neither
+   * needs a subprocess for it: the key comes from node's crypto and the
+   * request is built and self-signed in process, so no `openssl.cnf` has
+   * to be rendered either.
+   */
+  async #createEphemeralKeyAndCsr(tmpDir, keySize, options) {
+    const privateKeyFile = import_node_path7.default.join(tmpDir, "private_key.pem");
+    await (0, import_node_opcua_crypto5.generatePrivateKeyFile)(privateKeyFile, keySize);
+    const { csr } = await (0, import_node_opcua_crypto5.createCertificateSigningRequest)({
+      privateKey: await (0, import_node_opcua_crypto5.privateKeyToCryptoKey)((0, import_node_opcua_crypto5.readPrivateKey)(privateKeyFile)),
+      subject: options.subject ? new import_node_opcua_crypto5.Subject(options.subject).toString() : void 0,
+      applicationUri: options.applicationUri,
+      dns: options.dns ?? [],
+      ip: options.ip ?? [],
+      purpose: import_node_opcua_crypto5.CertificatePurpose.ForApplication
+    });
+    const csrFile = import_node_path7.default.join(tmpDir, "request.csr");
+    await import_node_fs8.default.promises.writeFile(csrFile, csr);
+    return { privateKeyFile, csrFile };
+  }
   async generateKeyPairAndSignDER(options) {
     const keySize = options.keySize ?? 2048;
     const startDate = options.startDate ?? /* @__PURE__ */ new Date();
-    const tmpDir = await import_node_fs7.default.promises.mkdtemp(import_node_path5.default.join(import_node_os3.default.tmpdir(), "pki-keygen-"));
+    const tmpDir = await import_node_fs8.default.promises.mkdtemp(import_node_path7.default.join(import_node_os3.default.tmpdir(), "pki-keygen-"));
     try {
-      const privateKeyFile = import_node_path5.default.join(tmpDir, "private_key.pem");
-      await (0, import_node_opcua_crypto2.generatePrivateKeyFile)(privateKeyFile, keySize);
-      const configFile = import_node_path5.default.join(tmpDir, "openssl.cnf");
-      await import_node_fs7.default.promises.writeFile(configFile, configurationFileSimpleTemplate, "utf-8");
-      const csrFile = import_node_path5.default.join(tmpDir, "request.csr");
-      await createCertificateSigningRequestWithOpenSSL(csrFile, {
-        rootDir: tmpDir,
-        configFile,
-        privateKey: privateKeyFile,
-        applicationUri: options.applicationUri,
-        subject: options.subject,
-        dns: options.dns ?? [],
-        ip: options.ip ?? [],
-        purpose: import_node_opcua_crypto2.CertificatePurpose.ForApplication
-      });
-      const certFile = import_node_path5.default.join(tmpDir, "certificate.pem");
+      const { privateKeyFile, csrFile } = await this.#createEphemeralKeyAndCsr(tmpDir, keySize, options);
+      const certFile = import_node_path7.default.join(tmpDir, "certificate.pem");
       const signingParams = {
         applicationUri: options.applicationUri,
         dns: options.dns,
@@ -1739,12 +2305,12 @@ var CertificateAuthority = class {
       if (options.validityMs !== void 0) signingParams.validityMs = options.validityMs;
       else signingParams.validity = options.validity ?? 365;
       await this.signCertificateRequest(certFile, csrFile, signingParams);
-      const certPem = (0, import_node_opcua_crypto2.readCertificatePEM)(certFile);
-      const certificateDer = (0, import_node_opcua_crypto2.convertPEMtoDER)(certPem);
-      const privateKey = (0, import_node_opcua_crypto2.readPrivateKey)(privateKeyFile);
+      const certPem = (0, import_node_opcua_crypto5.readCertificatePEM)(certFile);
+      const certificateDer = (0, import_node_opcua_crypto5.convertPEMtoDER)(certPem);
+      const privateKey = (0, import_node_opcua_crypto5.readPrivateKey)(privateKeyFile);
       return { certificateDer, privateKey };
     } finally {
-      await import_node_fs7.default.promises.rm(tmpDir, {
+      await import_node_fs8.default.promises.rm(tmpDir, {
         recursive: true,
         force: true
       });
@@ -1765,24 +2331,10 @@ var CertificateAuthority = class {
     const keySize = options.keySize ?? 2048;
     const startDate = options.startDate ?? /* @__PURE__ */ new Date();
     const passphrase = options.passphrase ?? "";
-    const tmpDir = await import_node_fs7.default.promises.mkdtemp(import_node_path5.default.join(import_node_os3.default.tmpdir(), "pki-keygen-pfx-"));
+    const tmpDir = await import_node_fs8.default.promises.mkdtemp(import_node_path7.default.join(import_node_os3.default.tmpdir(), "pki-keygen-pfx-"));
     try {
-      const privateKeyFile = import_node_path5.default.join(tmpDir, "private_key.pem");
-      await (0, import_node_opcua_crypto2.generatePrivateKeyFile)(privateKeyFile, keySize);
-      const configFile = import_node_path5.default.join(tmpDir, "openssl.cnf");
-      await import_node_fs7.default.promises.writeFile(configFile, configurationFileSimpleTemplate, "utf-8");
-      const csrFile = import_node_path5.default.join(tmpDir, "request.csr");
-      await createCertificateSigningRequestWithOpenSSL(csrFile, {
-        rootDir: tmpDir,
-        configFile,
-        privateKey: privateKeyFile,
-        applicationUri: options.applicationUri,
-        subject: options.subject,
-        dns: options.dns ?? [],
-        ip: options.ip ?? [],
-        purpose: import_node_opcua_crypto2.CertificatePurpose.ForApplication
-      });
-      const certFile = import_node_path5.default.join(tmpDir, "certificate.pem");
+      const { privateKeyFile, csrFile } = await this.#createEphemeralKeyAndCsr(tmpDir, keySize, options);
+      const certFile = import_node_path7.default.join(tmpDir, "certificate.pem");
       const signingParams = {
         applicationUri: options.applicationUri,
         dns: options.dns,
@@ -1792,17 +2344,20 @@ var CertificateAuthority = class {
       if (options.validityMs !== void 0) signingParams.validityMs = options.validityMs;
       else signingParams.validity = options.validity ?? 365;
       await this.signCertificateRequest(certFile, csrFile, signingParams);
-      const pfxFile = import_node_path5.default.join(tmpDir, "bundle.pfx");
-      await createPFX({
-        certificateFile: certFile,
-        privateKeyFile,
-        outputFile: pfxFile,
-        passphrase,
-        caCertificateFiles: [this.caCertificate]
+      const blocks = (await import_node_fs8.default.promises.readFile(certFile, "utf-8")).match(
+        /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g
+      );
+      if (!blocks || blocks.length === 0) {
+        throw new Error(`generateKeyPairAndSignPFX: no certificate was produced in ${certFile}`);
+      }
+      return await (0, import_node_opcua_crypto5.createPfx)({
+        certificate: (0, import_node_opcua_crypto5.convertPEMtoDER)(blocks[0]),
+        certificateChain: blocks.slice(1).map(import_node_opcua_crypto5.convertPEMtoDER),
+        privateKey: (0, import_node_opcua_crypto5.readPrivateKey)(privateKeyFile),
+        password: passphrase
       });
-      return await import_node_fs7.default.promises.readFile(pfxFile);
     } finally {
-      await import_node_fs7.default.promises.rm(tmpDir, {
+      await import_node_fs8.default.promises.rm(tmpDir, {
         recursive: true,
         force: true
       });
@@ -1821,10 +2376,10 @@ var CertificateAuthority = class {
    * @throws if the certificate's serial is not found in the CA
    */
   async revokeCertificateDER(certDer, reason) {
-    const info = (0, import_node_opcua_crypto2.exploreCertificate)(certDer);
+    const info = (0, import_node_opcua_crypto5.exploreCertificate)(certDer);
     const serial = info.tbsCertificate.serialNumber.replace(/:/g, "").toUpperCase();
-    const storedCertFile = import_node_path5.default.join(this.rootDir, "certs", `${serial}.pem`);
-    if (!import_node_fs7.default.existsSync(storedCertFile)) {
+    const storedCertFile = import_node_path7.default.join(this.rootDir, "certs", `${serial}.pem`);
+    if (!import_node_fs8.default.existsSync(storedCertFile)) {
       throw new Error(`Cannot revoke: no stored certificate found for serial ${serial} at ${storedCertFile}`);
     }
     await this.revokeCertificate(storedCertFile, {
@@ -1837,7 +2392,69 @@ var CertificateAuthority = class {
    * already exist.
    */
   async initialize() {
-    await construct_CertificateAuthority(this);
+    mkdirRecursiveSync(import_node_path7.default.resolve(this.rootDir));
+    await this.#withCaLock(() => this.#bootstrap());
+  }
+  /**
+   * @internal Shared (backend-agnostic) part of `initialize()`: directory
+   * layout, default database files, the "already initialized" / "partial
+   * init" checks, and the openssl config file — then delegates CSR
+   * generation, CA-certificate signing, and the initial CRL to
+   * {@link CaBackend.bootstrap}. Must be called under {@link #withCaLock}.
+   */
+  async #bootstrap() {
+    const caRootDir = import_node_path7.default.resolve(this.rootDir);
+    mkdirRecursiveSync(caRootDir);
+    ensurePrivateDirectory(import_node_path7.default.join(caRootDir, "private"));
+    mkdirRecursiveSync(import_node_path7.default.join(caRootDir, "public"));
+    mkdirRecursiveSync(import_node_path7.default.join(caRootDir, "certs"));
+    mkdirRecursiveSync(import_node_path7.default.join(caRootDir, "crl"));
+    mkdirRecursiveSync(import_node_path7.default.join(caRootDir, "conf"));
+    const serial = import_node_path7.default.join(caRootDir, "serial");
+    if (!import_node_fs8.default.existsSync(serial)) {
+      await import_node_fs8.default.promises.writeFile(serial, "1000");
+    }
+    const crlNumber = import_node_path7.default.join(caRootDir, "crlnumber");
+    if (!import_node_fs8.default.existsSync(crlNumber)) {
+      await import_node_fs8.default.promises.writeFile(crlNumber, "1000");
+    }
+    const indexFile = import_node_path7.default.join(caRootDir, "index.txt");
+    if (!import_node_fs8.default.existsSync(indexFile)) {
+      await import_node_fs8.default.promises.writeFile(indexFile, "");
+    }
+    const signerBacked = this.hasExternalSigner;
+    const caKeyExists = signerBacked || import_node_fs8.default.existsSync(import_node_path7.default.join(caRootDir, "private/cakey.pem"));
+    const caCertExists = import_node_fs8.default.existsSync(import_node_path7.default.join(caRootDir, "public/cacert.pem"));
+    if (caKeyExists && caCertExists && !config2.forceCA) {
+      if (!signerBacked) {
+        restrictPrivateFilePermissions(import_node_path7.default.join(caRootDir, "private/cakey.pem"), 384);
+        await this._ensurePrivateKeyProtection();
+      }
+      debugLog("CA private key and certificate already exist ... skipping");
+      return;
+    }
+    if (!signerBacked && caKeyExists && !caCertExists) {
+      debugLog("CA private key exists but cacert.pem is missing \u2014 rebuilding CA");
+      import_node_fs8.default.unlinkSync(import_node_path7.default.join(caRootDir, "private/cakey.pem"));
+      const staleCsr = import_node_path7.default.join(caRootDir, "private/cakey.csr");
+      if (import_node_fs8.default.existsSync(staleCsr)) {
+        import_node_fs8.default.unlinkSync(staleCsr);
+      }
+    }
+    displayTitle("Create Certificate Authority (CA)");
+    const indexFileAttr = import_node_path7.default.join(caRootDir, "index.txt.attr");
+    if (!import_node_fs8.default.existsSync(indexFileAttr)) {
+      await import_node_fs8.default.promises.writeFile(indexFileAttr, "unique_subject = no");
+    }
+    const caConfigFile = this.configFile;
+    await import_node_fs8.default.promises.writeFile(caConfigFile, renderCaConfig(caRootDir));
+    if (!signerBacked) {
+      const privateKeyFilename = import_node_path7.default.join(caRootDir, "private/cakey.pem");
+      displayTitle(`Generate the CA private Key - ${this.keySize}`);
+      await (0, import_node_opcua_crypto5.generatePrivateKeyFile)(privateKeyFilename, this.keySize, { passphrase: await this._privateKeyPassphrase() });
+      restrictPrivateFilePermissions(privateKeyFilename, 384);
+    }
+    await this.#backend.bootstrap(this);
   }
   /**
    * Initialize the CA directory structure and generate the
@@ -1859,22 +2476,26 @@ var CertificateAuthority = class {
    * @returns an {@link InitializeCSRResult} describing the CA state
    */
   async initializeCSR() {
-    const caRootDir = import_node_path5.default.resolve(this.rootDir);
+    const caRootDir = import_node_path7.default.resolve(this.rootDir);
     mkdirRecursiveSync(caRootDir);
+    return this.#withCaLock(() => this.#initializeCSRLocked(caRootDir));
+  }
+  async #initializeCSRLocked(caRootDir) {
     for (const dir of ["public", "certs", "crl", "conf"]) {
-      mkdirRecursiveSync(import_node_path5.default.join(caRootDir, dir));
+      mkdirRecursiveSync(import_node_path7.default.join(caRootDir, dir));
     }
-    ensurePrivateDirectory(import_node_path5.default.join(caRootDir, "private"));
+    ensurePrivateDirectory(import_node_path7.default.join(caRootDir, "private"));
     const caCertFile = this.caCertificate;
-    const privateKeyFile = import_node_path5.default.join(caRootDir, "private/cakey.pem");
-    const csrFile = import_node_path5.default.join(caRootDir, "private/cakey.csr");
-    if (import_node_fs7.default.existsSync(privateKeyFile)) {
+    const privateKeyFile = import_node_path7.default.join(caRootDir, "private/cakey.pem");
+    const csrFile = import_node_path7.default.join(caRootDir, "private/cakey.csr");
+    const keyAvailable = this.hasExternalSigner || import_node_fs8.default.existsSync(privateKeyFile);
+    if (!this.hasExternalSigner && import_node_fs8.default.existsSync(privateKeyFile)) {
       restrictPrivateFilePermissions(privateKeyFile, 384);
       await this._ensurePrivateKeyProtection();
     }
-    if (import_node_fs7.default.existsSync(caCertFile)) {
-      const certDer = (0, import_node_opcua_crypto2.convertPEMtoDER)((0, import_node_opcua_crypto2.readCertificatePEM)(caCertFile));
-      const certInfo = (0, import_node_opcua_crypto2.exploreCertificate)(certDer);
+    if (import_node_fs8.default.existsSync(caCertFile)) {
+      const certDer = (0, import_node_opcua_crypto5.convertPEMtoDER)((0, import_node_opcua_crypto5.readCertificatePEM)(caCertFile));
+      const certInfo = (0, import_node_opcua_crypto5.exploreCertificate)(certDer);
       const notAfter = certInfo.tbsCertificate.validity.notAfter;
       if (notAfter.getTime() < Date.now()) {
         debugLog("CA certificate has expired \u2014 generating renewal CSR");
@@ -1884,30 +2505,30 @@ var CertificateAuthority = class {
       debugLog("CA certificate already exists and is valid \u2014 ready");
       return { status: "ready" };
     }
-    if (import_node_fs7.default.existsSync(privateKeyFile) && import_node_fs7.default.existsSync(csrFile)) {
+    if (keyAvailable && import_node_fs8.default.existsSync(csrFile)) {
       debugLog("CA key + CSR already exist \u2014 pending external signing");
       return { status: "pending", csrPath: csrFile };
     }
-    const serial = import_node_path5.default.join(caRootDir, "serial");
-    if (!import_node_fs7.default.existsSync(serial)) {
-      await import_node_fs7.default.promises.writeFile(serial, "1000");
+    const serial = import_node_path7.default.join(caRootDir, "serial");
+    if (!import_node_fs8.default.existsSync(serial)) {
+      await import_node_fs8.default.promises.writeFile(serial, "1000");
     }
-    const crlNumber = import_node_path5.default.join(caRootDir, "crlnumber");
-    if (!import_node_fs7.default.existsSync(crlNumber)) {
-      await import_node_fs7.default.promises.writeFile(crlNumber, "1000");
+    const crlNumber = import_node_path7.default.join(caRootDir, "crlnumber");
+    if (!import_node_fs8.default.existsSync(crlNumber)) {
+      await import_node_fs8.default.promises.writeFile(crlNumber, "1000");
     }
-    const indexFile = import_node_path5.default.join(caRootDir, "index.txt");
-    if (!import_node_fs7.default.existsSync(indexFile)) {
-      await import_node_fs7.default.promises.writeFile(indexFile, "");
+    const indexFile = import_node_path7.default.join(caRootDir, "index.txt");
+    if (!import_node_fs8.default.existsSync(indexFile)) {
+      await import_node_fs8.default.promises.writeFile(indexFile, "");
     }
-    const indexFileAttr = import_node_path5.default.join(caRootDir, "index.txt.attr");
-    if (!import_node_fs7.default.existsSync(indexFileAttr)) {
-      await import_node_fs7.default.promises.writeFile(indexFileAttr, "unique_subject = no");
+    const indexFileAttr = import_node_path7.default.join(caRootDir, "index.txt.attr");
+    if (!import_node_fs8.default.existsSync(indexFileAttr)) {
+      await import_node_fs8.default.promises.writeFile(indexFileAttr, "unique_subject = no");
     }
     const caConfigFile = this.configFile;
-    await import_node_fs7.default.promises.writeFile(caConfigFile, renderCaConfig(caRootDir));
-    if (!import_node_fs7.default.existsSync(privateKeyFile)) {
-      await (0, import_node_opcua_crypto2.generatePrivateKeyFile)(privateKeyFile, this.keySize, { passphrase: await this._privateKeyPassphrase() });
+    await import_node_fs8.default.promises.writeFile(caConfigFile, renderCaConfig(caRootDir));
+    if (!keyAvailable) {
+      await (0, import_node_opcua_crypto5.generatePrivateKeyFile)(privateKeyFile, this.keySize, { passphrase: await this._privateKeyPassphrase() });
       restrictPrivateFilePermissions(privateKeyFile, 384);
     }
     await this._generateCSR(caRootDir, privateKeyFile, csrFile);
@@ -1927,53 +2548,34 @@ var CertificateAuthority = class {
    *   renewal is needed, `"ready"` if the cert is still valid
    */
   async renewCSR(thresholdDays = 30) {
-    const caRootDir = import_node_path5.default.resolve(this.rootDir);
+    const caRootDir = import_node_path7.default.resolve(this.rootDir);
     const caCertFile = this.caCertificate;
-    const privateKeyFile = import_node_path5.default.join(caRootDir, "private/cakey.pem");
-    const csrFile = import_node_path5.default.join(caRootDir, "private/cakey.csr");
-    if (!import_node_fs7.default.existsSync(caCertFile)) {
+    const privateKeyFile = import_node_path7.default.join(caRootDir, "private/cakey.pem");
+    const csrFile = import_node_path7.default.join(caRootDir, "private/cakey.csr");
+    if (!import_node_fs8.default.existsSync(caCertFile)) {
       return this.initializeCSR();
     }
-    const certDer = (0, import_node_opcua_crypto2.convertPEMtoDER)((0, import_node_opcua_crypto2.readCertificatePEM)(caCertFile));
-    const certInfo = (0, import_node_opcua_crypto2.exploreCertificate)(certDer);
+    const certDer = (0, import_node_opcua_crypto5.convertPEMtoDER)((0, import_node_opcua_crypto5.readCertificatePEM)(caCertFile));
+    const certInfo = (0, import_node_opcua_crypto5.exploreCertificate)(certDer);
     const notAfter = certInfo.tbsCertificate.validity.notAfter;
     const thresholdMs = thresholdDays * 24 * 60 * 60 * 1e3;
     if (notAfter.getTime() - Date.now() < thresholdMs) {
       debugLog(`CA certificate expires within ${thresholdDays} days \u2014 generating renewal CSR`);
-      await this._generateCSR(caRootDir, privateKeyFile, csrFile);
+      await this.#withCaLock(() => this._generateCSR(caRootDir, privateKeyFile, csrFile));
       return { status: "expired", csrPath: csrFile, expiryDate: notAfter };
     }
     return { status: "ready" };
   }
   /**
    * Generate a CSR using the existing private key.
+   * Must be called under {@link #withCaLock} — the lock is taken by the
+   * public callers (`initializeCSR`, `renewCSR`), not here, so that
+   * `initializeCSR` can hold one lock across key generation AND CSR
+   * generation without the non-reentrant file lock deadlocking.
    * @internal
    */
   async _generateCSR(caRootDir, privateKeyFile, csrFile) {
-    processAltNames({});
-    const options = { cwd: caRootDir };
-    const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-    const passin = await this._opensslPassin();
-    await execute_openssl(
-      [
-        "req",
-        "-new",
-        "-sha256",
-        "-text",
-        "-extensions",
-        "v3_ca_req",
-        "-config",
-        n4(configFile),
-        "-key",
-        n4(privateKeyFile),
-        "-out",
-        n4(csrFile),
-        "-subj",
-        this.subject.toString(),
-        ...passin.args
-      ],
-      { ...options, env: passin.env }
-    );
+    await this.#backend.generateCaCsr(this, caRootDir, privateKeyFile, csrFile);
   }
   /**
    * Install an externally-signed CA certificate and generate
@@ -1992,43 +2594,41 @@ var CertificateAuthority = class {
    *   `status: "success"` or `status: "error"` and a `reason`
    */
   async installCACertificate(signedCertFile) {
-    const caRootDir = import_node_path5.default.resolve(this.rootDir);
-    const caCertFile = this.caCertificate;
-    const fullPem = await import_node_fs7.default.promises.readFile(signedCertFile, "utf8");
-    const pemBlocks = fullPem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
-    if (!pemBlocks || pemBlocks.length === 0) {
-      return {
-        status: "error",
-        reason: "no_certificate_found",
-        message: "The provided file does not contain any PEM-encoded certificate."
-      };
-    }
-    const certDer = (0, import_node_opcua_crypto2.convertPEMtoDER)(pemBlocks[0]);
-    const privateKey = await this.getPrivateKey();
-    if (!(0, import_node_opcua_crypto2.certificateMatchesPrivateKey)(certDer, privateKey)) {
-      return {
-        status: "error",
-        reason: "certificate_key_mismatch",
-        message: "The provided certificate does not match the CA private key. Ensure the certificate was signed from the CSR generated by initializeCSR()."
-      };
-    }
-    await import_node_fs7.default.promises.writeFile(caCertFile, `${pemBlocks[0]}
+    return this.#withCaLock(async () => {
+      const caCertFile = this.caCertificate;
+      const fullPem = await import_node_fs8.default.promises.readFile(signedCertFile, "utf8");
+      const pemBlocks = fullPem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
+      if (!pemBlocks || pemBlocks.length === 0) {
+        return {
+          status: "error",
+          reason: "no_certificate_found",
+          message: "The provided file does not contain any PEM-encoded certificate."
+        };
+      }
+      const certDer = (0, import_node_opcua_crypto5.convertPEMtoDER)(pemBlocks[0]);
+      if (!await this.#certificateMatchesOurKey(pemBlocks[0], certDer)) {
+        return {
+          status: "error",
+          reason: "certificate_key_mismatch",
+          message: "The provided certificate does not match the CA private key. Ensure the certificate was signed from the CSR generated by initializeCSR()."
+        };
+      }
+      await import_node_fs8.default.promises.writeFile(caCertFile, `${pemBlocks[0]}
 `);
-    const issuerChainFile = this.issuerCertificateChain;
-    if (pemBlocks.length > 1) {
-      const issuerPem = `${pemBlocks.slice(1).join("\n")}
+      const issuerChainFile = this.issuerCertificateChain;
+      if (pemBlocks.length > 1) {
+        const issuerPem = `${pemBlocks.slice(1).join("\n")}
 `;
-      await import_node_fs7.default.promises.writeFile(issuerChainFile, issuerPem);
-      debugLog(`Stored ${pemBlocks.length - 1} issuer certificate(s) in issuer_chain.pem`);
-    } else {
-      if (import_node_fs7.default.existsSync(issuerChainFile)) {
-        await import_node_fs7.default.promises.unlink(issuerChainFile);
+        await import_node_fs8.default.promises.writeFile(issuerChainFile, issuerPem);
+        debugLog(`Stored ${pemBlocks.length - 1} issuer certificate(s) in issuer_chain.pem`);
+      } else {
+        if (import_node_fs8.default.existsSync(issuerChainFile)) {
+          await import_node_fs8.default.promises.unlink(issuerChainFile);
+        }
       }
-    }
-    const options = { cwd: caRootDir };
-    const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-    await regenerateCrl(this.revocationList, ["-config", n4(configFile)], options, await this._opensslPassin());
-    return { status: "success" };
+      await this.#backend.regenerateCrl(this);
+      return { status: "success" };
+    });
   }
   /**
    * Sign a CSR with CA extensions (`v3_ca`), producing a
@@ -2044,39 +2644,11 @@ var CertificateAuthority = class {
    * @param params - signing parameters
    */
   async signCACertificateRequest(certFile, csrFile, params) {
-    const caRootDir = import_node_path5.default.resolve(this.rootDir);
-    const options = { cwd: caRootDir };
-    this._wireRevocationEnvVars();
-    const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-    const validity = params.validity ?? 3650;
-    const passin = await this._opensslPassin();
-    await execute_openssl(
-      [
-        "x509",
-        "-sha256",
-        "-req",
-        "-days",
-        String(validity),
-        "-text",
-        "-extensions",
-        "v3_ca",
-        "-extfile",
-        n4(configFile),
-        "-in",
-        n4(csrFile),
-        "-CA",
-        n4(this.caCertificate),
-        "-CAkey",
-        n4(import_node_path5.default.join(caRootDir, "private/cakey.pem")),
-        "-CAserial",
-        n4(import_node_path5.default.join(caRootDir, "serial")),
-        "-out",
-        n4(certFile),
-        ...passin.args
-      ],
-      { ...options, env: passin.env }
-    );
-    await this.constructCertificateChain(certFile);
+    await this.#withCaLock(async () => {
+      const validity = params.validity ?? 3650;
+      await this.#backend.signSubordinateCsr(this, csrFile, certFile, validity);
+      await this.constructCertificateChain(certFile);
+    });
   }
   /**
    * Rebuild the combined CA certificate + CRL file.
@@ -2087,13 +2659,13 @@ var CertificateAuthority = class {
    */
   async constructCACertificateWithCRL() {
     const cacertWithCRL = this.caCertificateWithCrl;
-    if (import_node_fs7.default.existsSync(this.revocationList)) {
-      await import_node_fs7.default.promises.writeFile(
+    if (import_node_fs8.default.existsSync(this.revocationList)) {
+      await import_node_fs8.default.promises.writeFile(
         cacertWithCRL,
-        import_node_fs7.default.readFileSync(this.caCertificate, "utf8") + import_node_fs7.default.readFileSync(this.revocationList, "utf8")
+        import_node_fs8.default.readFileSync(this.caCertificate, "utf8") + import_node_fs8.default.readFileSync(this.revocationList, "utf8")
       );
     } else {
-      await import_node_fs7.default.promises.writeFile(cacertWithCRL, import_node_fs7.default.readFileSync(this.caCertificate));
+      await import_node_fs8.default.promises.writeFile(cacertWithCRL, import_node_fs8.default.readFileSync(this.caCertificate));
     }
   }
   /**
@@ -2103,15 +2675,15 @@ var CertificateAuthority = class {
    * @param certificate - path to the certificate file to extend
    */
   async constructCertificateChain(certificate) {
-    (0, import_node_assert7.default)(import_node_fs7.default.existsSync(certificate));
-    (0, import_node_assert7.default)(import_node_fs7.default.existsSync(this.caCertificate));
+    (0, import_node_assert5.default)(import_node_fs8.default.existsSync(certificate));
+    (0, import_node_assert5.default)(import_node_fs8.default.existsSync(this.caCertificate));
     debugLog(import_chalk5.default.yellow("        certificate file :"), import_chalk5.default.cyan(certificate));
-    let chain = await import_node_fs7.default.promises.readFile(certificate, "utf8");
-    chain += await import_node_fs7.default.promises.readFile(this.caCertificate, "utf8");
-    if (import_node_fs7.default.existsSync(this.issuerCertificateChain)) {
-      chain += await import_node_fs7.default.promises.readFile(this.issuerCertificateChain, "utf8");
+    let chain = await import_node_fs8.default.promises.readFile(certificate, "utf8");
+    chain += await import_node_fs8.default.promises.readFile(this.caCertificate, "utf8");
+    if (import_node_fs8.default.existsSync(this.issuerCertificateChain)) {
+      chain += await import_node_fs8.default.promises.readFile(this.issuerCertificateChain, "utf8");
     }
-    await import_node_fs7.default.promises.writeFile(certificate, chain);
+    await import_node_fs8.default.promises.writeFile(certificate, chain);
   }
   /**
    * Create a self-signed certificate using OpenSSL.
@@ -2121,52 +2693,30 @@ var CertificateAuthority = class {
    * @param params - certificate parameters (subject, validity, SANs)
    */
   async createSelfSignedCertificate(certificateFile, privateKey, params) {
-    (0, import_node_assert7.default)(typeof privateKey === "string");
-    (0, import_node_assert7.default)(import_node_fs7.default.existsSync(privateKey));
+    (0, import_node_assert5.default)(typeof privateKey === "string");
+    (0, import_node_assert5.default)(import_node_fs8.default.existsSync(privateKey));
     if (!certificateFileExist(certificateFile)) {
       return;
     }
     adjustDate(params);
     adjustApplicationUri(params);
-    processAltNames(params);
-    const csrFile = `${certificateFile}_csr`;
-    (0, import_node_assert7.default)(csrFile);
-    const configFile = generateStaticConfig(this.configFile, { cwd: this.rootDir });
-    const options = {
-      cwd: this.rootDir,
-      openssl_conf: makePath(configFile)
-    };
-    const subject = params.subject ? new import_node_opcua_crypto2.Subject(params.subject).toString() : "";
-    const subjectOptions = subject && subject.length > 1 ? ["-subj", subject] : [];
-    displaySubtitle("- the certificate signing request");
-    await execute_openssl(
-      ["req", "-new", "-sha256", "-text", ...subjectOptions, "-batch", "-key", n4(privateKey), "-out", n4(csrFile)],
-      options
-    );
-    displaySubtitle("- creating the self-signed certificate");
-    await execute_openssl(
-      [
-        "ca",
-        "-selfsign",
-        "-keyfile",
-        n4(privateKey),
-        "-startdate",
-        x509Date(params.startDate),
-        "-enddate",
-        x509Date(params.endDate),
-        "-batch",
-        "-out",
-        n4(certificateFile),
-        "-in",
-        n4(csrFile)
-      ],
-      options
-    );
-    displaySubtitle("- dump the certificate for a check");
-    await execute_openssl(["x509", "-in", n4(certificateFile), "-dates", "-fingerprint", "-purpose", "-noout"], {});
-    displaySubtitle("- verify self-signed certificate");
-    await execute_openssl_no_failure(["verify", "-verbose", "-CAfile", n4(certificateFile), n4(certificateFile)], options);
-    await import_node_fs7.default.promises.unlink(csrFile);
+    params.dns = params.dns || [];
+    params.ip = params.ip || [];
+    await this.#withCaLock(async () => {
+      await this.#backend.createSelfSignedCertificate(this, certificateFile, privateKey, params);
+    });
+  }
+  /**
+   * Regenerate `crl/revocation_list.{crl,der}` from the current database
+   * state, without changing any certificate's status. Normally
+   * unnecessary — `revokeCertificate` already regenerates the CRL as
+   * part of revoking — but useful to force a refresh (e.g. after
+   * switching a CA's `backend` between `"openssl"` and `"native"`).
+   */
+  async regenerateCrl() {
+    await this.#withCaLock(async () => {
+      await this.#backend.regenerateCrl(this);
+    });
   }
   /**
    * Revoke a certificate and regenerate the CRL.
@@ -2187,49 +2737,12 @@ var CertificateAuthority = class {
       "certificateHold",
       "removeFromCRL"
     ];
-    const configFile = generateStaticConfig("conf/caconfig.cnf", { cwd: this.rootDir });
-    const options = {
-      cwd: this.rootDir,
-      openssl_conf: makePath(configFile)
-    };
-    setEnv("ALTNAME", "");
-    const randomFile = import_node_path5.default.join(this.rootDir, "random.rnd");
-    setEnv("RANDFILE", randomFile);
-    const configOption = ["-config", n4(configFile)];
     const reason = params.reason || "keyCompromise";
-    (0, import_node_assert7.default)(crlReasons.indexOf(reason) >= 0);
+    (0, import_node_assert5.default)(crlReasons.indexOf(reason) >= 0);
     displayTitle(`Revoking certificate  ${certificate}`);
-    displaySubtitle("Revoke certificate");
-    const passin = await this._opensslPassin();
-    await execute_openssl_no_failure(
-      ["ca", "-verbose", ...configOption, "-revoke", certificate, "-crl_reason", reason, ...passin.args],
-      { ...options, env: passin.env }
-    );
-    await regenerateCrl(this.revocationList, configOption, options, passin);
-    displaySubtitle("Verify that certificate is revoked");
-    await execute_openssl_no_failure(
-      [
-        "verify",
-        "-verbose",
-        "-CRLfile",
-        n4(this.revocationList),
-        "-CAfile",
-        n4(this.caCertificate),
-        "-crl_check",
-        n4(certificate)
-      ],
-      options
-    );
-    displaySubtitle("Produce CRL in DER form ");
-    await execute_openssl(
-      ["crl", "-in", n4(this.revocationList), "-out", "crl/revocation_list.der", "-outform", "der"],
-      options
-    );
-    displaySubtitle("Produce CRL in PEM form ");
-    await execute_openssl(
-      ["crl", "-in", n4(this.revocationList), "-out", "crl/revocation_list.pem", "-outform", "pem", "-text"],
-      options
-    );
+    await this.#withCaLock(async () => {
+      await this.#backend.revoke(this, certificate, reason);
+    });
   }
   /**
    * Sign a Certificate Signing Request (CSR) with this CA.
@@ -2244,17 +2757,15 @@ var CertificateAuthority = class {
    * @returns the path to the signed certificate
    */
   async signCertificateRequest(certificate, certificateSigningRequestFilename, params1) {
-    await ensure_openssl_installed();
-    (0, import_node_assert7.default)(import_node_fs7.default.existsSync(certificateSigningRequestFilename));
+    await this.#backend.preflight();
+    (0, import_node_assert5.default)(import_node_fs8.default.existsSync(certificateSigningRequestFilename));
     if (!certificateFileExist(certificate)) {
       return "";
     }
     adjustDate(params1);
     adjustApplicationUri(params1);
-    processAltNames(params1);
-    const options = { cwd: this.rootDir };
-    const csr = await (0, import_node_opcua_crypto2.readCertificateSigningRequest)(certificateSigningRequestFilename);
-    const csrInfo = (0, import_node_opcua_crypto2.exploreCertificateSigningRequest)(csr);
+    const csr = await (0, import_node_opcua_crypto5.readCertificateSigningRequest)(certificateSigningRequestFilename);
+    const csrInfo = (0, import_node_opcua_crypto5.exploreCertificateSigningRequest)(csr);
     const applicationUri = csrInfo.extensionRequest.subjectAltName.uniformResourceIdentifier ? csrInfo.extensionRequest.subjectAltName.uniformResourceIdentifier[0] : void 0;
     if (typeof applicationUri !== "string") {
       throw new Error("Cannot find applicationUri in CSR");
@@ -2262,91 +2773,129 @@ var CertificateAuthority = class {
     const dns = csrInfo.extensionRequest.subjectAltName.dNSName || [];
     let ip = csrInfo.extensionRequest.subjectAltName.iPAddress || [];
     ip = ip.map(octetStringToIpAddress);
-    const params = {
-      applicationUri,
-      dns,
-      ip
-    };
-    processAltNames(params);
-    this._wireRevocationEnvVars();
-    const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-    displaySubtitle("- then we ask the authority to sign the certificate signing request");
-    const passin = await this._opensslPassin();
-    await execute_openssl(
-      [
-        "ca",
-        "-config",
-        configFile,
-        "-startdate",
-        x509Date(params1.startDate),
-        "-enddate",
-        x509Date(params1.endDate),
-        "-batch",
-        "-out",
-        n4(certificate),
-        "-in",
-        n4(certificateSigningRequestFilename),
-        ...passin.args
-      ],
-      { ...options, env: passin.env }
-    );
-    displaySubtitle("- dump the certificate for a check");
-    await execute_openssl(["x509", "-in", n4(certificate), "-dates", "-fingerprint", "-purpose", "-noout"], options);
-    displaySubtitle("- construct CA certificate with CRL");
-    await this.constructCACertificateWithCRL();
-    displaySubtitle("- construct certificate chain");
-    await this.constructCertificateChain(certificate);
-    displaySubtitle("- verify certificate against the root CA");
-    await this.verifyCertificate(certificate);
-    return certificate;
+    const sanOverride = { applicationUri, dns, ip };
+    return this.#withCaLock(async () => {
+      await this.#backend.signEndEntityCsr(this, certificate, certificateSigningRequestFilename, params1, sanOverride);
+      displaySubtitle("- construct CA certificate with CRL");
+      await this.constructCACertificateWithCRL();
+      displaySubtitle("- construct certificate chain");
+      await this.constructCertificateChain(certificate);
+      displaySubtitle("- verify certificate against the root CA");
+      await this.verifyCertificate(certificate);
+      return certificate;
+    });
   }
   /**
-   * Verify a certificate against this CA.
+   * Check that `certificate` really was signed by this CA, and throw if it
+   * was not.
    *
-   * @param certificate - path to the certificate file to verify
+   * This used to do nothing: `openssl verify` crashes on Windows, so the
+   * check was left as a placeholder. It no longer needs a subprocess -
+   * `verifyCertificateSignature` does it in pure JS, the same way
+   * {@link CertificateManager} already validates a chain - so the check
+   * that `signCertificateRequest` always claimed to perform now actually
+   * happens on every issuance, whichever backend did the signing.
+   *
+   * Only the leading certificate is examined: the file may be a chain,
+   * and the rest of it is this CA's own certificate and its issuers.
+   *
+   * @param certificate - path to the certificate (or chain) to verify
    */
   async verifyCertificate(certificate) {
-    const isImplemented = false;
-    if (isImplemented) {
-      const options = { cwd: this.rootDir };
-      const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-      setEnv("OPENSSL_CONF", makePath(configFile));
-      await execute_openssl_no_failure(
-        ["verify", "-verbose", "-CAfile", n4(this.caCertificateWithCrl), n4(certificate)],
-        options
+    const pem = await import_node_fs8.default.promises.readFile(certificate, "utf-8");
+    const blocks = pem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
+    if (!blocks || blocks.length === 0) {
+      throw new Error(`verifyCertificate: ${certificate} contains no PEM-encoded certificate`);
+    }
+    const caCertificateDer = (0, import_node_opcua_crypto5.convertPEMtoDER)((0, import_node_opcua_crypto5.readCertificatePEM)(this.caCertificate));
+    if (!(0, import_node_opcua_crypto5.verifyCertificateSignature)((0, import_node_opcua_crypto5.convertPEMtoDER)(blocks[0]), caCertificateDer)) {
+      throw new Error(
+        `verifyCertificate: ${certificate} was not signed by this certificate authority (${this.caCertificate})`
       );
     }
   }
 };
 
+// packages/node-opcua-pki/lib/ca/certificate_authority.ts
+var CertificateAuthority = class extends CertificateAuthorityCore {
+  constructor(options) {
+    if (options.signer && options.backend === "openssl") {
+      throw new Error(
+        "CertificateAuthority: backend 'openssl' cannot be combined with 'signer' - the openssl CLI loads its key from a file and cannot call an external signer. Drop the backend option (a signer implies 'native') or drop the signer."
+      );
+    }
+    const backend = options.signer || options.backend === "native" ? new NativeCaBackend() : new OpenSslCaBackend();
+    super({ ...options, backend });
+  }
+  /**
+   * @internal `-passin env:` argv + env for an openssl call that loads
+   * this CA's key (always emitted, empty when none).
+   *
+   * The openssl backend builds its own now; this remains so that external
+   * code calling it keeps working, and lives here rather than on the core
+   * because the flag means nothing to a backend that spawns nothing.
+   */
+  async _opensslPassin() {
+    return passinArg(await this._privateKeyPassphrase());
+  }
+  /**
+   * @internal
+   * Legacy shim: publish the `CDP_URL` / `AIA_VALUE` config substitution
+   * values to the shared env registry, or unset them so the matching
+   * `{{#KEY}}...{{/KEY}}` blocks are stripped. Nothing in this package
+   * reads the registry any more - every openssl config render receives
+   * these values explicitly, from the same {@link caConfigEnvOverrides}
+   * builder this delegates to, so the two cannot drift - kept only for
+   * external code that renders openssl config templates against the
+   * registry directly.
+   *
+   * It lives on this class rather than the core because it is meaningful
+   * only to the openssl backend.
+   */
+  _wireRevocationEnvVars() {
+    const overrides = caConfigEnvOverrides(this);
+    if (overrides.CDP_URL) {
+      setEnv("CDP_URL", overrides.CDP_URL);
+    } else {
+      unsetEnv("CDP_URL");
+    }
+    if (overrides.AIA_VALUE) {
+      setEnv("AIA_VALUE", overrides.AIA_VALUE);
+    } else {
+      unsetEnv("AIA_VALUE");
+    }
+  }
+};
+
 // packages/node-opcua-pki/lib/pki/certificate_manager.ts
 var import_node_events = require("events");
-var import_node_fs10 = __toESM(require("fs"));
-var import_node_path6 = __toESM(require("path"));
-var import_global_mutex = require("@ster5/global-mutex");
+var import_node_fs11 = __toESM(require("fs"));
+var import_node_path8 = __toESM(require("path"));
+var import_global_mutex2 = require("@ster5/global-mutex");
 var import_chalk6 = __toESM(require("chalk"));
 var import_chokidar = __toESM(require("chokidar"));
-var import_node_opcua_crypto5 = require("node-opcua-crypto");
+var import_node_opcua_crypto8 = require("node-opcua-crypto");
 
 // packages/node-opcua-pki/lib/toolbox/without_openssl/create_certificate_signing_request.ts
-var import_node_assert8 = __toESM(require("assert"));
-var import_node_fs8 = __toESM(require("fs"));
-var import_node_opcua_crypto3 = require("node-opcua-crypto");
+var import_node_assert6 = __toESM(require("assert"));
+var import_node_fs9 = __toESM(require("fs"));
+var import_node_opcua_crypto6 = require("node-opcua-crypto");
 async function createCertificateSigningRequestAsync(certificateSigningRequestFilename, params) {
-  (0, import_node_assert8.default)(params);
-  (0, import_node_assert8.default)(params.rootDir);
-  (0, import_node_assert8.default)(params.configFile);
-  (0, import_node_assert8.default)(params.privateKey);
+  (0, import_node_assert6.default)(params);
+  (0, import_node_assert6.default)(params.rootDir);
+  (0, import_node_assert6.default)(params.configFile);
+  (0, import_node_assert6.default)(params.privateKey);
   if (typeof params.privateKey === "string") {
-    (0, import_node_assert8.default)(import_node_fs8.default.existsSync(params.privateKey), `Private key must exist${params.privateKey}`);
+    (0, import_node_assert6.default)(import_node_fs9.default.existsSync(params.privateKey), `Private key must exist${params.privateKey}`);
   }
-  (0, import_node_assert8.default)(import_node_fs8.default.existsSync(params.rootDir), "RootDir key must exist");
-  (0, import_node_assert8.default)(typeof certificateSigningRequestFilename === "string");
-  const subject = params.subject ? new import_node_opcua_crypto3.Subject(params.subject).toString() : void 0;
+  (0, import_node_assert6.default)(import_node_fs9.default.existsSync(params.rootDir), "RootDir key must exist");
+  (0, import_node_assert6.default)(typeof certificateSigningRequestFilename === "string");
+  const subject = params.subject ? new import_node_opcua_crypto6.Subject(params.subject).toString() : void 0;
   displaySubtitle("- Creating a Certificate Signing Request with subtile");
-  const privateKeyPem = typeof params.privateKey === "string" ? await import_node_fs8.default.promises.readFile(params.privateKey, "utf-8") : (0, import_node_opcua_crypto3.coercePrivateKeyPem)(params.privateKey);
-  const privateKey = await (0, import_node_opcua_crypto3.pemToPrivateKey)(privateKeyPem);
-  const { csr } = await (0, import_node_opcua_crypto3.createCertificateSigningRequest)({
+  const privateKey = isOpaqueSigner(params.privateKey) ? params.privateKey : await (0, import_node_opcua_crypto6.pemToPrivateKey)(
+    typeof params.privateKey === "string" ? await import_node_fs9.default.promises.readFile(params.privateKey, "utf-8") : (0, import_node_opcua_crypto6.coercePrivateKeyPem)(params.privateKey)
+  );
+  const { csr } = await (0, import_node_opcua_crypto6.createCertificateSigningRequest)({
     privateKey,
     dns: params.dns,
     ip: params.ip,
@@ -2354,37 +2903,40 @@ async function createCertificateSigningRequestAsync(certificateSigningRequestFil
     applicationUri: params.applicationUri,
     purpose: params.purpose
   });
-  await import_node_fs8.default.promises.writeFile(certificateSigningRequestFilename, csr, "utf-8");
-  display(`- privateKey ${typeof params.privateKey === "string" ? params.privateKey : "<in-memory>"}`);
+  await import_node_fs9.default.promises.writeFile(certificateSigningRequestFilename, csr, "utf-8");
+  display(
+    `- privateKey ${typeof params.privateKey === "string" ? params.privateKey : isOpaqueSigner(params.privateKey) ? "<opaque-signer>" : "<in-memory>"}`
+  );
   display(`- certificateSigningRequestFilename ${certificateSigningRequestFilename}`);
 }
 
 // packages/node-opcua-pki/lib/toolbox/without_openssl/create_self_signed_certificate.ts
-var import_node_assert9 = __toESM(require("assert"));
-var import_node_fs9 = __toESM(require("fs"));
-var import_node_opcua_crypto4 = require("node-opcua-crypto");
+var import_node_assert7 = __toESM(require("assert"));
+var import_node_fs10 = __toESM(require("fs"));
+var import_node_opcua_crypto7 = require("node-opcua-crypto");
 async function createSelfSignedCertificateAsync(certificate, params) {
-  params.purpose = params.purpose || import_node_opcua_crypto4.CertificatePurpose.ForApplication;
-  (0, import_node_assert9.default)(params.purpose, "Please provide a Certificate Purpose");
-  (0, import_node_assert9.default)(import_node_fs9.default.existsSync(params.configFile));
-  (0, import_node_assert9.default)(import_node_fs9.default.existsSync(params.rootDir));
+  params.purpose = params.purpose || import_node_opcua_crypto7.CertificatePurpose.ForApplication;
+  (0, import_node_assert7.default)(params.purpose, "Please provide a Certificate Purpose");
+  (0, import_node_assert7.default)(import_node_fs10.default.existsSync(params.configFile));
+  (0, import_node_assert7.default)(import_node_fs10.default.existsSync(params.rootDir));
   if (typeof params.privateKey === "string") {
-    (0, import_node_assert9.default)(import_node_fs9.default.existsSync(params.privateKey));
+    (0, import_node_assert7.default)(import_node_fs10.default.existsSync(params.privateKey));
   }
   if (!params.subject) {
     throw Error("Missing subject");
   }
-  (0, import_node_assert9.default)(typeof params.applicationUri === "string");
-  (0, import_node_assert9.default)(Array.isArray(params.dns));
+  (0, import_node_assert7.default)(typeof params.applicationUri === "string");
+  (0, import_node_assert7.default)(Array.isArray(params.dns));
   adjustDate(params);
-  (0, import_node_assert9.default)(Object.prototype.hasOwnProperty.call(params, "validity"));
-  let subject = new import_node_opcua_crypto4.Subject(params.subject);
+  (0, import_node_assert7.default)(Object.prototype.hasOwnProperty.call(params, "validity"));
+  let subject = new import_node_opcua_crypto7.Subject(params.subject);
   subject = subject.toString();
   const purpose = params.purpose;
   displayTitle("Generate a certificate request");
-  const privateKeyPem = typeof params.privateKey === "string" ? await import_node_fs9.default.promises.readFile(params.privateKey, "utf-8") : (0, import_node_opcua_crypto4.coercePrivateKeyPem)(params.privateKey);
-  const privateKey = await (0, import_node_opcua_crypto4.pemToPrivateKey)(privateKeyPem);
-  const { cert } = await (0, import_node_opcua_crypto4.createSelfSignedCertificate)({
+  const privateKey = isOpaqueSigner(params.privateKey) ? params.privateKey : await (0, import_node_opcua_crypto7.pemToPrivateKey)(
+    typeof params.privateKey === "string" ? await import_node_fs10.default.promises.readFile(params.privateKey, "utf-8") : (0, import_node_opcua_crypto7.coercePrivateKeyPem)(params.privateKey)
+  );
+  const { cert } = await (0, import_node_opcua_crypto7.createSelfSignedCertificate)({
     privateKey,
     notBefore: params.startDate,
     notAfter: params.endDate,
@@ -2395,18 +2947,22 @@ async function createSelfSignedCertificateAsync(certificate, params) {
     applicationUri: params.applicationUri,
     purpose
   });
-  await import_node_fs9.default.promises.writeFile(certificate, cert, "utf-8");
+  await import_node_fs10.default.promises.writeFile(certificate, cert, "utf-8");
 }
 async function createSelfSignedCertificate(certificate, params) {
   await createSelfSignedCertificateAsync(certificate, params);
 }
 
+// packages/node-opcua-pki/lib/pki/templates/simple_config_template.cnf.ts
+var config3 = '##################################################################################################\n## SIMPLE OPENSSL CONFIG FILE FOR SELF-SIGNED CERTIFICATE GENERATION\n################################################################################################################\n\ndistinguished_name       = req_distinguished_name\ndefault_md               = sha1\n\ndefault_md                = sha256                      # The default digest algorithm\n\n[ v3_ca ]\nsubjectKeyIdentifier        = hash\nauthorityKeyIdentifier      = keyid:always,issuer:always\n\n# authorityKeyIdentifier    = keyid\nbasicConstraints            = CA:TRUE\nkeyUsage                    = critical, cRLSign, keyCertSign\nnsComment                   = "Self-signed Certificate for CA generated by Node-OPCUA Certificate utility"\n#nsCertType                 = sslCA, emailCA\n#subjectAltName             = email:copy\n#issuerAltName              = issuer:copy\n#obj                        = DER:02:03\n# crlDistributionPoints       = @crl_info\n# [ crl_info ]\n# URI.0                     = http://localhost:8900/crl.pem\nsubjectAltName              = $ENV::ALTNAME\n\n[ req ]\ndays                      = 390\nreq_extensions            = v3_req\nx509_extensions           = v3_ca\n\n[v3_req]\nbasicConstraints       = CA:false\nkeyUsage               = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment\nsubjectAltName         = $ENV::ALTNAME\n\n[ v3_ca_signed]\nsubjectKeyIdentifier      = hash\nauthorityKeyIdentifier    = keyid,issuer\nbasicConstraints          = critical, CA:FALSE\nkeyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment\nextendedKeyUsage          = clientAuth,serverAuth \nnsComment                 = "certificate generated by Node-OPCUA Certificate utility and signed by a CA"\nsubjectAltName            = $ENV::ALTNAME\n[ v3_selfsigned]\nsubjectKeyIdentifier      = hash\nauthorityKeyIdentifier    = keyid,issuer\nbasicConstraints          = critical, CA:FALSE\nkeyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment\nextendedKeyUsage          = clientAuth,serverAuth \nnsComment                 = "Self-signed certificate generated by Node-OPCUA Certificate utility"\nsubjectAltName            = $ENV::ALTNAME\n[ req_distinguished_name ]\ncountryName             = Country Name (2 letter code)\ncountryName_default     = FR\ncountryName_min         = 2\ncountryName_max         = 2\n# stateOrProvinceName     = State or Province Name (full name)\n# stateOrProvinceName_default = Ile de France\n# localityName            = Locality Name (city, district)\n# localityName_default    = Paris\norganizationName          = Organization Name (company)\norganizationName_default  = NodeOPCUA\n# organizationalUnitName  = Organizational Unit Name (department, division)\n# organizationalUnitName_default = R&D\ncommonName                = Common Name (hostname, FQDN, IP, or your name)\ncommonName_max            = 256\ncommonName_default        = NodeOPCUA\n# emailAddress            = Email Address\n# emailAddress_max        = 40\n# emailAddress_default    = node-opcua (at) node-opcua (dot) com\nsubjectAltName            = $ENV::ALTNAME';
+var simple_config_template_cnf_default = config3;
+
 // packages/node-opcua-pki/lib/pki/certificate_manager.ts
-var configurationFileSimpleTemplate2 = simple_config_template_cnf_default;
-var fsWriteFile = import_node_fs10.default.promises.writeFile;
+var configurationFileSimpleTemplate = simple_config_template_cnf_default;
+var fsWriteFile = import_node_fs11.default.promises.writeFile;
 function getOrComputeInfo(entry) {
   if (!entry.info) {
-    entry.info = (0, import_node_opcua_crypto5.exploreCertificate)(entry.certificate);
+    entry.info = (0, import_node_opcua_crypto8.exploreCertificate)(entry.certificate);
   }
   return entry.info;
 }
@@ -2433,14 +2989,14 @@ function coerceCertificateChain(certificate) {
   if (Array.isArray(certificate)) {
     if (certificate.length === 0) return [];
     return certificate.reduce((acc, cert) => {
-      return acc.concat((0, import_node_opcua_crypto5.split_der)(cert));
+      return acc.concat((0, import_node_opcua_crypto8.split_der)(cert));
     }, []);
   }
-  return (0, import_node_opcua_crypto5.split_der)(certificate);
+  return (0, import_node_opcua_crypto8.split_der)(certificate);
 }
 function makeFingerprint(certificate) {
   const chain = coerceCertificateChain(certificate);
-  return (0, import_node_opcua_crypto5.makeSHA1Thumbprint)(chain[0]).toString("hex");
+  return (0, import_node_opcua_crypto8.makeSHA1Thumbprint)(chain[0]).toString("hex");
 }
 function short(stringToShorten) {
   return stringToShorten.substring(0, 10);
@@ -2450,7 +3006,7 @@ function buildIdealCertificateName(certificate) {
   const chain = coerceCertificateChain(certificate);
   const fingerprint = makeFingerprint(chain);
   try {
-    const commonName = (0, import_node_opcua_crypto5.exploreCertificate)(chain[0]).tbsCertificate.subject.commonName || "";
+    const commonName = (0, import_node_opcua_crypto8.exploreCertificate)(chain[0]).tbsCertificate.subject.commonName || "";
     const sanitizedCommonName = commonName.replace(forbiddenChars, "_");
     return `${sanitizedCommonName}[${fingerprint}]`;
   } catch (_err) {
@@ -2467,7 +3023,7 @@ function isSelfSigned2(info) {
   return info.tbsCertificate.extensions?.subjectKeyIdentifier === info.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier;
 }
 function isSelfSigned3(certificate) {
-  const info = (0, import_node_opcua_crypto5.exploreCertificate)(certificate);
+  const info = (0, import_node_opcua_crypto8.exploreCertificate)(certificate);
   return isSelfSigned2(info);
 }
 function _isIssuerInfo(info) {
@@ -2483,7 +3039,7 @@ function _isIssuerInfo(info) {
 }
 function isIssuer(certificate) {
   try {
-    const info = (0, import_node_opcua_crypto5.exploreCertificate)(certificate);
+    const info = (0, import_node_opcua_crypto8.exploreCertificate)(certificate);
     return _isIssuerInfo(info);
   } catch (_err) {
     return false;
@@ -2491,7 +3047,7 @@ function isIssuer(certificate) {
 }
 function isIntermediateIssuer(certificate) {
   try {
-    const info = (0, import_node_opcua_crypto5.exploreCertificate)(certificate);
+    const info = (0, import_node_opcua_crypto8.exploreCertificate)(certificate);
     if (!_isIssuerInfo(info)) {
       return false;
     }
@@ -2502,7 +3058,7 @@ function isIntermediateIssuer(certificate) {
 }
 function isRootIssuer(certificate) {
   try {
-    const info = (0, import_node_opcua_crypto5.exploreCertificate)(certificate);
+    const info = (0, import_node_opcua_crypto8.exploreCertificate)(certificate);
     if (!_isIssuerInfo(info)) {
       return false;
     }
@@ -2517,7 +3073,7 @@ function findIssuerCertificateInChain(certificate, chain) {
   if (!firstCertificate) {
     return null;
   }
-  const certInfo = (0, import_node_opcua_crypto5.exploreCertificate)(firstCertificate);
+  const certInfo = (0, import_node_opcua_crypto8.exploreCertificate)(firstCertificate);
   if (isSelfSigned2(certInfo)) {
     return firstCertificate;
   }
@@ -2528,7 +3084,7 @@ function findIssuerCertificateInChain(certificate, chain) {
   }
   const coercedChain = coerceCertificateChain(chain);
   const potentialIssuers = coercedChain.filter((c) => {
-    const info = (0, import_node_opcua_crypto5.exploreCertificate)(c);
+    const info = (0, import_node_opcua_crypto8.exploreCertificate)(c);
     return info.tbsCertificate.extensions && info.tbsCertificate.extensions.subjectKeyIdentifier === wantedIssuerKey;
   });
   if (potentialIssuers.length === 1) {
@@ -2563,7 +3119,31 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
   // even if the consumer forgets to call dispose().
   static #activeInstances = /* @__PURE__ */ new Set();
   static #cleanupInstalled = false;
-  static #installProcessCleanup() {
+  static #exitHandler;
+  /**
+   * Install a best-effort `exit` hook that closes any watcher
+   * still open when the process terminates.
+   *
+   * **This library never terminates the host process.** No
+   * SIGINT/SIGTERM handler is installed: deciding how (and
+   * whether) to shut down on a signal is the application's
+   * responsibility, and a listener registered here would both
+   * pre-empt the application's own graceful shutdown and
+   * silently suppress Node's default signal behaviour.
+   *
+   * Nothing here is load-bearing for process exit. The native
+   * `fs.watch` handles are `unref()`'d when the watchers are
+   * created (see `#readCertificates`), so an undisposed
+   * CertificateManager never keeps the event loop alive. This
+   * hook is only tidiness on the way out.
+   *
+   * `exit` rather than `beforeExit`: `beforeExit` fires when
+   * the loop merely drains and the loop can subsequently be
+   * resurrected, which would leave a still-in-use instance
+   * marked Disposed. `exit` is terminal, synchronous-only and
+   * cannot alter the exit code.
+   */
+  static #installExitCleanup() {
     if (_CertificateManager.#cleanupInstalled) return;
     _CertificateManager.#cleanupInstalled = true;
     const closeDanglingWatchers = () => {
@@ -2579,13 +3159,22 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
       }
       _CertificateManager.#activeInstances.clear();
     };
-    process.on("beforeExit", closeDanglingWatchers);
-    for (const signal of ["SIGINT", "SIGTERM"]) {
-      process.once(signal, () => {
-        closeDanglingWatchers();
-        process.exit();
-      });
+    _CertificateManager.#exitHandler = closeDanglingWatchers;
+    process.on("exit", closeDanglingWatchers);
+  }
+  /**
+   * Remove the `exit` hook once the last instance is disposed,
+   * so a library that is initialized and disposed repeatedly
+   * does not accumulate process listeners. A later
+   * `initialize()` re-arms it.
+   */
+  static #uninstallExitCleanupIfIdle() {
+    if (_CertificateManager.#activeInstances.size > 0) return;
+    if (_CertificateManager.#exitHandler) {
+      process.removeListener("exit", _CertificateManager.#exitHandler);
+      _CertificateManager.#exitHandler = void 0;
     }
+    _CertificateManager.#cleanupInstalled = false;
   }
   /**
    * Dispose **all** active CertificateManager instances,
@@ -2651,6 +3240,9 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
   #disableFileWatchers;
   #privateKeyPassphrase;
   #privateKeyProvider;
+  #keyOperations;
+  /** The stable lazy wrap handed out by {@link getKeyOperations} for non-opaque configurations. */
+  #lazyLocalKeyOperations;
   /**
    * The on-disk key, decrypted once and kept for the instance's lifetime,
    * so the passphrase (or its resolver function) is consulted at most
@@ -2694,14 +3286,25 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     this.#disableFileWatchers = options.disableFileWatchers ?? process.env.OPCUA_PKI_DISABLE_FILE_WATCHERS === "true";
     this.#privateKeyPassphrase = options.privateKeyPassphrase;
     this.#privateKeyProvider = options.privateKeyProvider;
+    this.#keyOperations = options.keyOperations;
+    if (this.#keyOperations && this.#privateKeyProvider) {
+      throw new Error(
+        "CertificateManager: 'keyOperations' and 'privateKeyProvider' are mutually exclusive: one hides the key, the other sources its material"
+      );
+    }
+    if (this.#keyOperations && this.#privateKeyPassphrase) {
+      throw new Error(
+        "CertificateManager: 'privateKeyPassphrase' is meaningless with 'keyOperations': there is no key material for a passphrase to protect"
+      );
+    }
     mkdirRecursiveSync(options.location);
-    if (!import_node_fs10.default.existsSync(this.#location)) {
+    if (!import_node_fs11.default.existsSync(this.#location)) {
       throw new Error(`CertificateManager cannot access location ${this.#location}`);
     }
   }
   /** Path to the OpenSSL configuration file. */
   get configFile() {
-    return import_node_path6.default.join(this.rootDir, "own/openssl.cnf");
+    return import_node_path8.default.join(this.rootDir, "own/openssl.cnf");
   }
   /** Root directory of the PKI store. */
   get rootDir() {
@@ -2717,7 +3320,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
    * be no meaningful file in that case).
    */
   get privateKey() {
-    return import_node_path6.default.join(this.rootDir, "own/private/private_key.pem");
+    return import_node_path8.default.join(this.rootDir, "own/private/private_key.pem");
   }
   /**
    * Resolve the private key: from `privateKeyProvider` if configured,
@@ -2735,6 +3338,11 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
    * authority on what the current key is.
    */
   async getPrivateKey() {
+    if (this.#keyOperations) {
+      throw new import_node_opcua_crypto8.PrivateKeyUnavailableError(
+        "CertificateManager.getPrivateKey is not available when keyOperations is configured: the private key is held by the key-operations provider (HSM/KMS) and cannot be read \u2014 use getKeyOperations() instead"
+      );
+    }
     if (this.#privateKeyProvider) {
       return await this.#privateKeyProvider.getPrivateKey();
     }
@@ -2744,7 +3352,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     if (!this.#privateKeyPromise) {
       this.#privateKeyPromise = (async () => {
         const passphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
-        return (0, import_node_opcua_crypto5.readPrivateKey)(this.privateKey, passphrase);
+        return (0, import_node_opcua_crypto8.readPrivateKey)(this.privateKey, passphrase);
       })().then(
         (key) => {
           this.#cachedPrivateKey = key;
@@ -2760,6 +3368,75 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
   }
   /** In-flight first read of the on-disk key, so concurrent callers share one passphrase resolution. */
   #privateKeyPromise;
+  /**
+   * True when this manager's key is opaque — configured through
+   * `keyOperations`, held by an HSM/KMS, never obtainable as material.
+   * When true, {@link getPrivateKey} throws `PrivateKeyUnavailableError`
+   * and {@link getKeyOperations} is the only way to use the key.
+   */
+  isPrivateKeyOpaque() {
+    return !!this.#keyOperations;
+  }
+  /**
+   * The key as an opaque {@link IKeyOperations} — the recommended way to
+   * *use* the private key regardless of where it lives.
+   *
+   * Returns the configured `keyOperations` object when the key is opaque.
+   * Otherwise returns a stable lazy wrap over {@link getPrivateKey}: its
+   * methods resolve the key on first use (disk read, passphrase,
+   * `privateKeyProvider` — all async), so the wrap offers no synchronous
+   * fast path; callers that need one resolve the key themselves and build
+   * a `LocalKeyOperations` over it. The wrap follows key rotation: a
+   * `privateKeyProvider` that starts returning a different key gets a
+   * fresh underlying `LocalKeyOperations`.
+   */
+  getKeyOperations() {
+    if (this.#keyOperations) {
+      return this.#keyOperations;
+    }
+    if (!this.#lazyLocalKeyOperations) {
+      let cached;
+      const resolve = async () => {
+        const key = await this.getPrivateKey();
+        if (!cached || cached.key !== key) {
+          cached = { key, ops: (0, import_node_opcua_crypto8.keyOperationsFromPrivateKey)(key) };
+        }
+        return cached.ops;
+      };
+      this.#lazyLocalKeyOperations = {
+        sign: async (data, params) => (await resolve()).sign(data, params),
+        decryptBlock: async (block, params) => (await resolve()).decryptBlock(block, params),
+        getKeyMetadata: async () => (await resolve()).getKeyMetadata(),
+        getPublicKey: async () => (await resolve()).getPublicKey()
+      };
+    }
+    return this.#lazyLocalKeyOperations;
+  }
+  /**
+   * Fail closed at `initialize()` time, not on the first certificate
+   * operation, if the key cannot actually be used: wrong/missing
+   * passphrase on an encrypted key, a broken `privateKeyProvider`, or an
+   * unreachable `keyOperations` provider (probed via `getKeyMetadata`).
+   */
+  async #probePrivateKey() {
+    if (this.#keyOperations) {
+      await this.#keyOperations.getKeyMetadata();
+      return;
+    }
+    await this.getPrivateKey();
+  }
+  /**
+   * The key to hand to a certificate-issuance primitive: the raw
+   * {@link PrivateKey} for a local configuration, or a {@link CaSigner}
+   * adapted from `keyOperations` when the key is opaque — which requires
+   * the provider to implement `getPublicKey` (the adapter says so if not).
+   */
+  async #resolveSigningKey() {
+    if (this.#keyOperations) {
+      return (0, import_node_opcua_crypto8.caSignerFromKeyOperations)(this.#keyOperations);
+    }
+    return await this.getPrivateKey();
+  }
   /**
    * Enable, disable, or rotate the passphrase protecting the on-disk
    * private key: decrypt with `oldPassphrase` (omit if the key is
@@ -2781,13 +3458,18 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
    * disk file for this method to rewrite).
    */
   async reencryptPrivateKey(oldPassphrase, newPassphrase) {
+    if (this.#keyOperations) {
+      throw new import_node_opcua_crypto8.PrivateKeyUnavailableError(
+        "reencryptPrivateKey: not supported when keyOperations is configured \u2014 there is no key material to rewrite"
+      );
+    }
     if (this.#privateKeyProvider) {
       throw new Error("reencryptPrivateKey: not supported when a privateKeyProvider is configured");
     }
     const oldPass = await resolvePrivateKeyPassphrase(oldPassphrase);
     const newPass = await resolvePrivateKeyPassphrase(newPassphrase);
     await this.withLock2(async () => {
-      const privateKey = (0, import_node_opcua_crypto5.readPrivateKey)(this.privateKey, oldPass);
+      const privateKey = (0, import_node_opcua_crypto8.readPrivateKey)(this.privateKey, oldPass);
       await this.#rewritePrivateKeyFile(privateKey, newPass);
     });
     this.#cachedPrivateKey = void 0;
@@ -2803,15 +3485,15 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
   async #rewritePrivateKeyFile(privateKey, passphrase) {
     const tmpFilename = `${this.privateKey}.${process.pid}-${Date.now()}.tmp`;
     try {
-      await (0, import_node_opcua_crypto5.writePrivateKeyFile)(tmpFilename, privateKey, { passphrase });
-      await import_node_fs10.default.promises.rename(tmpFilename, this.privateKey);
+      await (0, import_node_opcua_crypto8.writePrivateKeyFile)(tmpFilename, privateKey, { passphrase });
+      await import_node_fs11.default.promises.rename(tmpFilename, this.privateKey);
     } finally {
-      await import_node_fs10.default.promises.rm(tmpFilename, { force: true });
+      await import_node_fs11.default.promises.rm(tmpFilename, { force: true });
     }
   }
   /** Path to the OpenSSL random seed file. */
   get randomFile() {
-    return import_node_path6.default.join(this.rootDir, "./random.rnd");
+    return import_node_path8.default.join(this.rootDir, "./random.rnd");
   }
   /**
    * Move a certificate to the rejected store.
@@ -2848,30 +3530,30 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
   }
   /** Path to the rejected certificates folder. */
   get rejectedFolder() {
-    return import_node_path6.default.join(this.rootDir, "rejected");
+    return import_node_path8.default.join(this.rootDir, "rejected");
   }
   /** Path to the trusted certificates folder. */
   get trustedFolder() {
-    return import_node_path6.default.join(this.rootDir, "trusted/certs");
+    return import_node_path8.default.join(this.rootDir, "trusted/certs");
   }
   /** Path to the trusted CRL folder. */
   get crlFolder() {
-    return import_node_path6.default.join(this.rootDir, "trusted/crl");
+    return import_node_path8.default.join(this.rootDir, "trusted/crl");
   }
   /** Path to the issuer (CA) certificates folder. */
   get issuersCertFolder() {
-    return import_node_path6.default.join(this.rootDir, "issuers/certs");
+    return import_node_path8.default.join(this.rootDir, "issuers/certs");
   }
   /** Path to the issuer CRL folder. */
   get issuersCrlFolder() {
-    return import_node_path6.default.join(this.rootDir, "issuers/crl");
+    return import_node_path8.default.join(this.rootDir, "issuers/crl");
   }
   /** Path to the own certificate folder. */
   get ownCertFolder() {
-    return import_node_path6.default.join(this.rootDir, "own/certs");
+    return import_node_path8.default.join(this.rootDir, "own/certs");
   }
   get ownPrivateFolder() {
-    return import_node_path6.default.join(this.rootDir, "own/private");
+    return import_node_path8.default.join(this.rootDir, "own/private");
   }
   /**
    * Check if a certificate is in the trusted store.
@@ -2902,13 +3584,13 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
           return "Good";
         }
         try {
-          (0, import_node_opcua_crypto5.exploreCertificateInfo)(chain[0]);
+          (0, import_node_opcua_crypto8.exploreCertificateInfo)(chain[0]);
         } catch (_err) {
           return "BadCertificateInvalid";
         }
-        const filename = import_node_path6.default.join(this.rejectedFolder, `${buildIdealCertificateName(leafCertificate)}.pem`);
+        const filename = import_node_path8.default.join(this.rejectedFolder, `${buildIdealCertificateName(leafCertificate)}.pem`);
         debugLog("certificate has never been seen before and is now rejected (untrusted) ", filename);
-        await fsWriteFile(filename, (0, import_node_opcua_crypto5.toPem)(chain, "CERTIFICATE"));
+        await fsWriteFile(filename, (0, import_node_opcua_crypto8.toPem)(chain, "CERTIFICATE"));
         this.#thumbs.rejected.set(fingerprint, { certificate: leafCertificate, filename });
       }
       return "BadCertificateUntrusted";
@@ -2922,7 +3604,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     }
     const chain = coerceCertificateChain(certificateOrChain);
     debugLog("NB CERTIFICATE IN CHAIN = ", chain.length);
-    const info = (0, import_node_opcua_crypto5.exploreCertificate)(chain[0]);
+    const info = (0, import_node_opcua_crypto8.exploreCertificate)(chain[0]);
     let hasValidIssuer = false;
     let hasTrustedIssuer = false;
     const hasIssuerKey = info.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier;
@@ -2969,7 +3651,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
         if (issuerStatus !== "Good" /* Good */ && issuerStatus !== "BadCertificateUntrusted" /* BadCertificateUntrusted */) {
           return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
         }
-        const isCertificateSignatureOK = (0, import_node_opcua_crypto5.verifyCertificateSignature)(chain[0], issuerCertificate);
+        const isCertificateSignatureOK = (0, import_node_opcua_crypto8.verifyCertificateSignature)(chain[0], issuerCertificate);
         if (!isCertificateSignatureOK) {
           debugLog(" the certificate was not signed by the issuer as it claim to be ! Danger");
           return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
@@ -2995,7 +3677,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
           return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
         }
       } else {
-        const isCertificateSignatureOK = (0, import_node_opcua_crypto5.verifyCertificateSignature)(chain[0], chain[0]);
+        const isCertificateSignatureOK = (0, import_node_opcua_crypto8.verifyCertificateSignature)(chain[0], chain[0]);
         if (!isCertificateSignatureOK) {
           debugLog("Self-signed Certificate signature is not valid");
           return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
@@ -3010,23 +3692,19 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
         return "BadCertificateUntrusted" /* BadCertificateUntrusted */;
       }
     }
-    const _c2 = chain[1] ? (0, import_node_opcua_crypto5.exploreCertificateInfo)(chain[1]) : "non";
-    debugLog("chain[1] info=", _c2);
-    const certificateInfo = (0, import_node_opcua_crypto5.exploreCertificateInfo)(chain[0]);
+    const { validity } = (0, import_node_opcua_crypto8.exploreCertificate)(chain[0]).tbsCertificate;
     const now = /* @__PURE__ */ new Date();
     let isTimeInvalid = false;
-    if (certificateInfo.notBefore.getTime() > now.getTime()) {
+    if (validity.notBefore.getTime() > now.getTime()) {
       debugLog(
-        `${import_chalk6.default.red("certificate is invalid : certificate is not active yet !")} not before date =${certificateInfo.notBefore}`
+        `${import_chalk6.default.red("certificate is invalid : certificate is not active yet !")} not before date =${validity.notBefore}`
       );
       if (!options.acceptPendingCertificate) {
         isTimeInvalid = true;
       }
     }
-    if (certificateInfo.notAfter.getTime() <= now.getTime()) {
-      debugLog(
-        `${import_chalk6.default.red("certificate is invalid : certificate has expired !")} not after date =${certificateInfo.notAfter}`
-      );
+    if (validity.notAfter.getTime() <= now.getTime()) {
+      debugLog(`${import_chalk6.default.red("certificate is invalid : certificate has expired !")} not after date =${validity.notAfter}`);
       if (!options.acceptOutdatedCertificate) {
         isTimeInvalid = true;
       }
@@ -3065,7 +3743,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     const chain = coerceCertificateChain(certificate);
     for (const element of chain) {
       try {
-        (0, import_node_opcua_crypto5.exploreCertificateInfo)(element);
+        (0, import_node_opcua_crypto8.exploreCertificate)(element);
       } catch (_err) {
         return "BadCertificateInvalid" /* BadCertificateInvalid */;
       }
@@ -3118,55 +3796,55 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     this.#initializingPromise = void 0;
     this.state = 2 /* Initialized */;
     _CertificateManager.#activeInstances.add(this);
-    _CertificateManager.#installProcessCleanup();
+    _CertificateManager.#installExitCleanup();
   }
   async #initialize() {
     const pkiDir = this.#location;
     mkdirRecursiveSync(pkiDir);
-    mkdirRecursiveSync(import_node_path6.default.join(pkiDir, "own"));
-    mkdirRecursiveSync(import_node_path6.default.join(pkiDir, "own/certs"));
-    ensurePrivateDirectory(import_node_path6.default.join(pkiDir, "own/private"));
-    mkdirRecursiveSync(import_node_path6.default.join(pkiDir, "rejected"));
-    mkdirRecursiveSync(import_node_path6.default.join(pkiDir, "trusted"));
-    mkdirRecursiveSync(import_node_path6.default.join(pkiDir, "trusted/certs"));
-    mkdirRecursiveSync(import_node_path6.default.join(pkiDir, "trusted/crl"));
-    mkdirRecursiveSync(import_node_path6.default.join(pkiDir, "issuers"));
-    mkdirRecursiveSync(import_node_path6.default.join(pkiDir, "issuers/certs"));
-    mkdirRecursiveSync(import_node_path6.default.join(pkiDir, "issuers/crl"));
-    const ownsDiskKey = !this.#privateKeyProvider;
-    const needsKeyGeneration = ownsDiskKey && !import_node_fs10.default.existsSync(this.privateKey);
+    mkdirRecursiveSync(import_node_path8.default.join(pkiDir, "own"));
+    mkdirRecursiveSync(import_node_path8.default.join(pkiDir, "own/certs"));
+    ensurePrivateDirectory(import_node_path8.default.join(pkiDir, "own/private"));
+    mkdirRecursiveSync(import_node_path8.default.join(pkiDir, "rejected"));
+    mkdirRecursiveSync(import_node_path8.default.join(pkiDir, "trusted"));
+    mkdirRecursiveSync(import_node_path8.default.join(pkiDir, "trusted/certs"));
+    mkdirRecursiveSync(import_node_path8.default.join(pkiDir, "trusted/crl"));
+    mkdirRecursiveSync(import_node_path8.default.join(pkiDir, "issuers"));
+    mkdirRecursiveSync(import_node_path8.default.join(pkiDir, "issuers/certs"));
+    mkdirRecursiveSync(import_node_path8.default.join(pkiDir, "issuers/crl"));
+    const ownsDiskKey = !this.#privateKeyProvider && !this.#keyOperations;
+    const needsKeyGeneration = ownsDiskKey && !import_node_fs11.default.existsSync(this.privateKey);
     const needsKeyEncryption = ownsDiskKey && !needsKeyGeneration && this.#privateKeyPassphrase !== void 0 && !isEncryptedPrivateKeyFile(this.privateKey);
-    if (!import_node_fs10.default.existsSync(this.configFile) || needsKeyGeneration || needsKeyEncryption) {
+    if (!import_node_fs11.default.existsSync(this.configFile) || needsKeyGeneration || needsKeyEncryption) {
       return await this.withLock2(async () => {
         if (this.state === 3 /* Disposing */ || this.state === 4 /* Disposed */) {
           return;
         }
-        if (!import_node_fs10.default.existsSync(this.configFile)) {
-          import_node_fs10.default.writeFileSync(this.configFile, configurationFileSimpleTemplate2);
+        if (!import_node_fs11.default.existsSync(this.configFile)) {
+          import_node_fs11.default.writeFileSync(this.configFile, configurationFileSimpleTemplate);
         }
-        if (ownsDiskKey && !import_node_fs10.default.existsSync(this.privateKey)) {
+        if (ownsDiskKey && !import_node_fs11.default.existsSync(this.privateKey)) {
           debugLog("generating private key ...");
           const passphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
-          await (0, import_node_opcua_crypto5.generatePrivateKeyFile)(this.privateKey, this.keySize, { passphrase });
-          this.#cachedPrivateKey = (0, import_node_opcua_crypto5.readPrivateKey)(this.privateKey, passphrase);
+          await (0, import_node_opcua_crypto8.generatePrivateKeyFile)(this.privateKey, this.keySize, { passphrase });
+          this.#cachedPrivateKey = (0, import_node_opcua_crypto8.readPrivateKey)(this.privateKey, passphrase);
         } else if (ownsDiskKey && this.#privateKeyPassphrase !== void 0 && !isEncryptedPrivateKeyFile(this.privateKey)) {
           warningLog("initialize: private key is plaintext but a passphrase is configured; encrypting it in place");
           const passphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
-          const plaintextKey = (0, import_node_opcua_crypto5.readPrivateKey)(this.privateKey);
+          const plaintextKey = (0, import_node_opcua_crypto8.readPrivateKey)(this.privateKey);
           await this.#rewritePrivateKeyFile(plaintextKey, passphrase);
           this.#cachedPrivateKey = plaintextKey;
         }
         if (ownsDiskKey) {
           restrictPrivateFilePermissions(this.privateKey, 384);
         }
-        await this.getPrivateKey();
+        await this.#probePrivateKey();
         await this.#readCertificates();
       });
     } else {
       if (ownsDiskKey) {
         restrictPrivateFilePermissions(this.privateKey, 384);
       }
-      await this.getPrivateKey();
+      await this.#probePrivateKey();
       await this.#readCertificates();
     }
   }
@@ -3190,7 +3868,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     }
     try {
       this.state = 3 /* Disposing */;
-      await (0, import_global_mutex.drainPendingLocks)();
+      await (0, import_global_mutex2.drainPendingLocks)();
       for (const unreff of this.#pendingUnrefs) {
         unreff();
       }
@@ -3205,6 +3883,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
       this.#cachedPrivateKey = void 0;
       this.#privateKeyPromise = void 0;
       _CertificateManager.#activeInstances.delete(this);
+      _CertificateManager.#uninstallExitCleanupIfIdle();
     }
   }
   /**
@@ -3232,8 +3911,8 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     await this.#readCertificates();
   }
   async withLock2(action) {
-    const lockFileName = import_node_path6.default.join(this.rootDir, "mutex");
-    return (0, import_global_mutex.withLock)({ fileToLock: lockFileName }, async () => {
+    const lockFileName = import_node_path8.default.join(this.rootDir, "mutex");
+    return (0, import_global_mutex2.withLock)({ fileToLock: lockFileName }, async () => {
       return await action();
     });
   }
@@ -3250,16 +3929,16 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     if (typeof params.applicationUri !== "string") {
       throw new Error("createSelfSignedCertificate: expecting applicationUri to be a string");
     }
-    if (!this.#privateKeyProvider && !import_node_fs10.default.existsSync(this.privateKey)) {
+    if (!this.#privateKeyProvider && !this.#keyOperations && !import_node_fs11.default.existsSync(this.privateKey)) {
       throw new Error(`Cannot find private key ${this.privateKey}`);
     }
-    let certificateFilename = import_node_path6.default.join(this.rootDir, "own/certs/self_signed_certificate.pem");
+    let certificateFilename = import_node_path8.default.join(this.rootDir, "own/certs/self_signed_certificate.pem");
     certificateFilename = params.outputFile || certificateFilename;
     const _params = {
       ...params,
       rootDir: this.rootDir,
       configFile: this.configFile,
-      privateKey: await this.getPrivateKey(),
+      privateKey: await this.#resolveSigningKey(),
       subject: params.subject || "CN=FIXME"
     };
     await this.withLock2(async () => {
@@ -3285,14 +3964,14 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     }
     const _params = {
       ...params,
-      rootDir: import_node_path6.default.resolve(this.rootDir),
-      configFile: import_node_path6.default.resolve(this.configFile),
-      privateKey: await this.getPrivateKey()
+      rootDir: import_node_path8.default.resolve(this.rootDir),
+      configFile: import_node_path8.default.resolve(this.configFile),
+      privateKey: await this.#resolveSigningKey()
     };
     return await this.withLock2(async () => {
       const now = /* @__PURE__ */ new Date();
       const today = `${now.toISOString().slice(0, 10)}_${now.getTime()}`;
-      const certificateSigningRequestFilename = import_node_path6.default.join(this.rootDir, "own/certs", `certificate_${today}.csr`);
+      const certificateSigningRequestFilename = import_node_path8.default.join(this.rootDir, "own/certs", `certificate_${today}.csr`);
       await createCertificateSigningRequestAsync(certificateSigningRequestFilename, _params);
       return certificateSigningRequestFilename;
     });
@@ -3312,13 +3991,13 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
         return status;
       }
     }
-    const pemCertificate = (0, import_node_opcua_crypto5.toPem)(certificate, "CERTIFICATE");
+    const pemCertificate = (0, import_node_opcua_crypto8.toPem)(certificate, "CERTIFICATE");
     const fingerprint = makeFingerprint(certificate);
     if (this.#thumbs.issuers.certs.has(fingerprint)) {
       return "Good" /* Good */;
     }
-    const filename = import_node_path6.default.join(this.issuersCertFolder, `issuer_${buildIdealCertificateName(certificate)}.pem`);
-    await import_node_fs10.default.promises.writeFile(filename, pemCertificate, "ascii");
+    const filename = import_node_path8.default.join(this.issuersCertFolder, `issuer_${buildIdealCertificateName(certificate)}.pem`);
+    await import_node_fs11.default.promises.writeFile(filename, pemCertificate, "ascii");
     this.#thumbs.issuers.certs.set(fingerprint, { certificate, filename });
     if (addInTrustList) {
       await this.trustCertificate(certificate);
@@ -3352,15 +4031,15 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
       try {
         const index = target === "trusted" ? this.#thumbs.crl : this.#thumbs.issuersCrl;
         const folder = target === "trusted" ? this.crlFolder : this.issuersCrlFolder;
-        const crlInfo = (0, import_node_opcua_crypto5.exploreCertificateRevocationList)(crl);
+        const crlInfo = (0, import_node_opcua_crypto8.exploreCertificateRevocationList)(crl);
         const key = crlInfo.tbsCertList.issuerFingerprint;
         if (!index.has(key)) {
           index.set(key, { crls: [], serialNumbers: {} });
         }
-        const pemCertificate = (0, import_node_opcua_crypto5.toPem)(crl, "X509 CRL");
+        const pemCertificate = (0, import_node_opcua_crypto8.toPem)(crl, "X509 CRL");
         const sanitizedKey = key.replace(/:/g, "");
-        const filename = import_node_path6.default.join(folder, `crl_[${sanitizedKey}].pem`);
-        await import_node_fs10.default.promises.writeFile(filename, pemCertificate, "ascii");
+        const filename = import_node_path8.default.join(folder, `crl_[${sanitizedKey}].pem`);
+        await import_node_fs11.default.promises.writeFile(filename, pemCertificate, "ascii");
         await this.#onCrlFileAdded(index, filename);
         await this.#waitAndCheckCRLProcessingStatus();
         return "Good" /* Good */;
@@ -3379,11 +4058,11 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
   async clearRevocationLists(target) {
     const clearFolder = async (folder, index) => {
       try {
-        const files = await import_node_fs10.default.promises.readdir(folder);
+        const files = await import_node_fs11.default.promises.readdir(folder);
         for (const file of files) {
-          const ext = import_node_path6.default.extname(file).toLowerCase();
+          const ext = import_node_path8.default.extname(file).toLowerCase();
           if (ext === ".crl" || ext === ".pem" || ext === ".der") {
-            await import_node_fs10.default.promises.unlink(import_node_path6.default.join(folder, file));
+            await import_node_fs11.default.promises.unlink(import_node_path8.default.join(folder, file));
           }
         }
       } catch (err) {
@@ -3425,7 +4104,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
       return null;
     }
     try {
-      await import_node_fs10.default.promises.unlink(entry.filename);
+      await import_node_fs11.default.promises.unlink(entry.filename);
     } catch (err) {
       if (err.code !== "ENOENT") {
         throw err;
@@ -3449,7 +4128,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
       return null;
     }
     try {
-      await import_node_fs10.default.promises.unlink(entry.filename);
+      await import_node_fs11.default.promises.unlink(entry.filename);
     } catch (err) {
       if (err.code !== "ENOENT") {
         throw err;
@@ -3465,14 +4144,14 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
    * @param target - "issuers", "trusted", or "all" (default "all")
    */
   async removeRevocationListsForIssuer(issuerCertificate, target = "all") {
-    const issuerInfo = (0, import_node_opcua_crypto5.exploreCertificate)(issuerCertificate);
+    const issuerInfo = (0, import_node_opcua_crypto8.exploreCertificate)(issuerCertificate);
     const issuerFingerprint = issuerInfo.tbsCertificate.subjectFingerPrint;
     const processIndex = async (index) => {
       const crlData = index.get(issuerFingerprint);
       if (!crlData) return;
       for (const crlEntry of crlData.crls) {
         try {
-          await import_node_fs10.default.promises.unlink(crlEntry.filename);
+          await import_node_fs11.default.promises.unlink(crlEntry.filename);
         } catch (err) {
           if (err.code !== "ENOENT") {
             throw err;
@@ -3539,7 +4218,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     const opts = this.#addCertValidation;
     let leafInfo;
     try {
-      leafInfo = (0, import_node_opcua_crypto5.exploreCertificate)(leafCertificate);
+      leafInfo = (0, import_node_opcua_crypto8.exploreCertificate)(leafCertificate);
     } catch (_err) {
       return "BadCertificateInvalid" /* BadCertificateInvalid */;
     }
@@ -3553,23 +4232,18 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
         return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
       }
       if (!opts.acceptExpiredCertificate) {
-        let certDetails;
-        try {
-          certDetails = (0, import_node_opcua_crypto5.exploreCertificateInfo)(currentCert);
-        } catch (_err) {
-          return "BadCertificateInvalid" /* BadCertificateInvalid */;
-        }
+        const { validity } = currentInfo.tbsCertificate;
         const now = /* @__PURE__ */ new Date();
-        if (certDetails.notBefore.getTime() > now.getTime()) {
+        if (validity.notBefore.getTime() > now.getTime()) {
           return "BadCertificateTimeInvalid" /* BadCertificateTimeInvalid */;
         }
-        if (certDetails.notAfter.getTime() <= now.getTime()) {
+        if (validity.notAfter.getTime() <= now.getTime()) {
           return depth === 1 ? "BadCertificateTimeInvalid" /* BadCertificateTimeInvalid */ : "BadCertificateIssuerTimeInvalid" /* BadCertificateIssuerTimeInvalid */;
         }
       }
       if (isSelfSigned2(currentInfo)) {
         try {
-          if (!(0, import_node_opcua_crypto5.verifyCertificateSignature)(currentCert, currentCert)) {
+          if (!(0, import_node_opcua_crypto8.verifyCertificateSignature)(currentCert, currentCert)) {
             return "BadCertificateInvalid" /* BadCertificateInvalid */;
           }
         } catch (_err) {
@@ -3585,7 +4259,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
         }
       }
       try {
-        if (!(0, import_node_opcua_crypto5.verifyCertificateSignature)(currentCert, issuerCert)) {
+        if (!(0, import_node_opcua_crypto8.verifyCertificateSignature)(currentCert, issuerCert)) {
           return "BadCertificateInvalid" /* BadCertificateInvalid */;
         }
       } catch (_err) {
@@ -3607,7 +4281,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
       }
       currentCert = issuerCert;
       try {
-        currentInfo = (0, import_node_opcua_crypto5.exploreCertificate)(currentCert);
+        currentInfo = (0, import_node_opcua_crypto8.exploreCertificate)(currentCert);
       } catch (_err) {
         return "BadCertificateInvalid" /* BadCertificateInvalid */;
       }
@@ -3632,7 +4306,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     for (const entry of this.#thumbs.trusted.values()) {
       if (!entry.certificate) continue;
       try {
-        if ((0, import_node_opcua_crypto5.verifyCertificateSignature)(entry.certificate, issuerCertificate)) {
+        if ((0, import_node_opcua_crypto8.verifyCertificateSignature)(entry.certificate, issuerCertificate)) {
           return true;
         }
       } catch (_err) {
@@ -3656,7 +4330,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
    */
   async findIssuerCertificate(certificate) {
     const firstCertificate = coerceCertificateChain(certificate)[0];
-    const certInfo = (0, import_node_opcua_crypto5.exploreCertificate)(firstCertificate);
+    const certInfo = (0, import_node_opcua_crypto8.exploreCertificate)(firstCertificate);
     if (isSelfSigned2(certInfo)) {
       return firstCertificate;
     }
@@ -3714,7 +4388,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     let depth = 0;
     while (depth < maxDepth) {
       const lastCert = result[result.length - 1];
-      const lastInfo = (0, import_node_opcua_crypto5.exploreCertificate)(lastCert);
+      const lastInfo = (0, import_node_opcua_crypto8.exploreCertificate)(lastCert);
       if (isSelfSigned2(lastInfo)) {
         const wasExtended = result.length > chain.length;
         return {
@@ -3741,7 +4415,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
         return {
           chain: result,
           status: "AlreadyComplete" /* AlreadyComplete */,
-          message: `Chain ends at root "${(0, import_node_opcua_crypto5.exploreCertificate)(issuerCert).tbsCertificate.subject.commonName}" (already present in chain).`
+          message: `Chain ends at root "${(0, import_node_opcua_crypto8.exploreCertificate)(issuerCert).tbsCertificate.subject.commonName}" (already present in chain).`
         };
       }
       result.push(issuerCert);
@@ -3780,9 +4454,9 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
       const fingerprint = makeFingerprint(certificate);
       let status = await this.#checkRejectedOrTrusted(certificate);
       if (status === "unknown") {
-        const pem = (0, import_node_opcua_crypto5.toPem)(chain, "CERTIFICATE");
-        const filename = import_node_path6.default.join(this.rejectedFolder, `${buildIdealCertificateName(certificate)}.pem`);
-        await import_node_fs10.default.promises.writeFile(filename, pem);
+        const pem = (0, import_node_opcua_crypto8.toPem)(chain, "CERTIFICATE");
+        const filename = import_node_path8.default.join(this.rejectedFolder, `${buildIdealCertificateName(certificate)}.pem`);
+        await import_node_fs11.default.promises.writeFile(filename, pem);
         this.#thumbs.rejected.set(fingerprint, { certificate, filename });
         status = "rejected";
       }
@@ -3798,10 +4472,10 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
           throw new Error(`#moveCertificate: certificate ${fingerprint.substring(0, 10)} not found in ${status} index`);
         }
         const destFolder = newStatus === "trusted" ? this.trustedFolder : this.rejectedFolder;
-        const certificateDest = import_node_path6.default.join(destFolder, import_node_path6.default.basename(srcEntry.filename));
+        const certificateDest = import_node_path8.default.join(destFolder, import_node_path8.default.basename(srcEntry.filename));
         debugLog("#moveCertificate", fingerprint.substring(0, 10), "old name", srcEntry.filename);
         debugLog("#moveCertificate", fingerprint.substring(0, 10), "new name", certificateDest);
-        await import_node_fs10.default.promises.rename(srcEntry.filename, certificateDest);
+        await import_node_fs11.default.promises.rename(srcEntry.filename, certificateDest);
         indexSrc.delete(fingerprint);
         const indexDest = newStatus === "trusted" ? this.#thumbs.trusted : this.#thumbs.rejected;
         indexDest.set(fingerprint, { certificate, filename: certificateDest });
@@ -3809,7 +4483,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     });
   }
   #findAssociatedCRLs(issuerCertificate) {
-    const issuerCertificateInfo = (0, import_node_opcua_crypto5.exploreCertificate)(issuerCertificate);
+    const issuerCertificateInfo = (0, import_node_opcua_crypto8.exploreCertificate)(issuerCertificate);
     const key = issuerCertificateInfo.tbsCertificate.subjectFingerPrint;
     return this.#thumbs.issuersCrl.get(key) ?? this.#thumbs.crl.get(key) ?? null;
   }
@@ -3848,7 +4522,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     if (!crls) {
       return "BadCertificateRevocationUnknown" /* BadCertificateRevocationUnknown */;
     }
-    const certInfo = (0, import_node_opcua_crypto5.exploreCertificate)(firstCertificate);
+    const certInfo = (0, import_node_opcua_crypto8.exploreCertificate)(firstCertificate);
     const serialNumber = certInfo.tbsCertificate.serialNumber || certInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.serial || "";
     const key = certInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.authorityCertIssuerFingerPrint || "<unknown>";
     const crl2 = this.#thumbs.crl.get(key) ?? null;
@@ -3872,8 +4546,8 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
       const nextCRL = this.#queue.shift();
       if (!nextCRL) return;
       const { index, filename } = nextCRL;
-      const crl = await (0, import_node_opcua_crypto5.readCertificateRevocationList)(filename);
-      const crlInfo = (0, import_node_opcua_crypto5.exploreCertificateRevocationList)(crl);
+      const crl = await (0, import_node_opcua_crypto8.readCertificateRevocationList)(filename);
+      const crlInfo = (0, import_node_opcua_crypto8.exploreCertificateRevocationList)(crl);
       debugLog(import_chalk6.default.cyan("add CRL in folder "), filename);
       const fingerprint = crlInfo.tbsCertList.issuerFingerprint;
       if (!index.has(fingerprint)) {
@@ -3913,14 +4587,15 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     const chokidarOptions = {
       usePolling,
       ...usePolling ? { interval: pollingInterval } : {},
+      depth: 0,
       persistent: false
     };
     const allCapturedHandles = [];
-    const origWatch = import_node_fs10.default.watch;
+    const origWatch = import_node_fs11.default.watch;
     let watcherReadyCount = 0;
     const totalWatchers = 5;
-    import_node_fs10.default.watch = ((...args) => {
-      const handle = origWatch.apply(import_node_fs10.default, args);
+    import_node_fs11.default.watch = ((...args) => {
+      const handle = origWatch.apply(import_node_fs11.default, args);
       handle.setMaxListeners(handle.getMaxListeners() + 1);
       handle.on("error", () => {
       });
@@ -3936,7 +4611,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
         }
         watcherReadyCount++;
         if (watcherReadyCount >= totalWatchers) {
-          import_node_fs10.default.watch = origWatch;
+          import_node_fs11.default.watch = origWatch;
         }
       };
       return { w, capturedHandles: allCapturedHandles.slice(startIdx), unreffAll };
@@ -3949,7 +4624,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
       this.#scanCrlFolder(this.issuersCrlFolder, this.#thumbs.issuersCrl)
     ]);
     if (this.#disableFileWatchers) {
-      import_node_fs10.default.watch = origWatch;
+      import_node_fs11.default.watch = origWatch;
     } else {
       this.#startWatcher(this.trustedFolder, this.#thumbs.trusted, createUnreffedWatcher, "trusted");
       this.#startWatcher(this.issuersCertFolder, this.#thumbs.issuers.certs, createUnreffedWatcher, "issuersCerts");
@@ -3964,19 +4639,19 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
    * file reads, preventing main-loop stalls with large folders.
    */
   async #scanCertFolder(folder, index) {
-    if (!import_node_fs10.default.existsSync(folder)) return;
-    const files = await import_node_fs10.default.promises.readdir(folder);
+    if (!import_node_fs11.default.existsSync(folder)) return;
+    const files = await import_node_fs11.default.promises.readdir(folder);
     for (const file of files) {
-      const filename = import_node_path6.default.join(folder, file);
+      const filename = import_node_path8.default.join(folder, file);
       try {
-        const stat = await import_node_fs10.default.promises.stat(filename);
+        const stat = await import_node_fs11.default.promises.stat(filename);
         if (!stat.isFile()) continue;
-        const certs = await (0, import_node_opcua_crypto5.readCertificateChainAsync)(filename);
+        const certs = await (0, import_node_opcua_crypto8.readCertificateChainAsync)(filename);
         if (certs.length === 0) continue;
         const certificate = certs[0];
         if (certs.length > 1) {
           try {
-            await import_node_fs10.default.promises.writeFile(filename, (0, import_node_opcua_crypto5.toPem)(certs, "CERTIFICATE"), "ascii");
+            await import_node_fs11.default.promises.writeFile(filename, (0, import_node_opcua_crypto8.toPem)(certs, "CERTIFICATE"), "ascii");
           } catch (writeErr) {
             debugLog(`scanCertFolder: could not rewrite legacy PEM ${filename} (read-only fs?)`, writeErr);
           }
@@ -3990,7 +4665,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
             }
           }
         }
-        const info = (0, import_node_opcua_crypto5.exploreCertificate)(certificate);
+        const info = (0, import_node_opcua_crypto8.exploreCertificate)(certificate);
         const fingerprint = makeFingerprint(certificate);
         index.set(fingerprint, { certificate, filename, info });
         this.#filenameToHash.set(filename, fingerprint);
@@ -4003,12 +4678,12 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
    * Scan a CRL folder and populate the in-memory CRL index.
    */
   async #scanCrlFolder(folder, index) {
-    if (!import_node_fs10.default.existsSync(folder)) return;
-    const files = await import_node_fs10.default.promises.readdir(folder);
+    if (!import_node_fs11.default.existsSync(folder)) return;
+    const files = await import_node_fs11.default.promises.readdir(folder);
     for (const file of files) {
-      const filename = import_node_path6.default.join(folder, file);
+      const filename = import_node_path8.default.join(folder, file);
       try {
-        const stat = await import_node_fs10.default.promises.stat(filename);
+        const stat = await import_node_fs11.default.promises.stat(filename);
         if (!stat.isFile()) continue;
         this.#onCrlFileAdded(index, filename);
       } catch (err) {
@@ -4076,8 +4751,8 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     w.on("add", (filename) => {
       debugLog(import_chalk6.default.cyan(`add in folder ${folder}`), filename);
       try {
-        const certificate = (0, import_node_opcua_crypto5.readCertificateChain)(filename)[0];
-        const info = (0, import_node_opcua_crypto5.exploreCertificate)(certificate);
+        const certificate = (0, import_node_opcua_crypto8.readCertificateChain)(filename)[0];
+        const info = (0, import_node_opcua_crypto8.exploreCertificate)(certificate);
         const fingerprint = makeFingerprint(certificate);
         const isNew = !index.has(fingerprint);
         index.set(fingerprint, { certificate, filename, info });
@@ -4099,13 +4774,13 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     w.on("change", (changedPath) => {
       debugLog(import_chalk6.default.cyan(`change in folder ${folder}`), changedPath);
       try {
-        const certificate = (0, import_node_opcua_crypto5.readCertificateChain)(changedPath)[0];
+        const certificate = (0, import_node_opcua_crypto8.readCertificateChain)(changedPath)[0];
         const newFingerprint = makeFingerprint(certificate);
         const oldHash = this.#filenameToHash.get(changedPath);
         if (oldHash && oldHash !== newFingerprint) {
           index.delete(oldHash);
         }
-        index.set(newFingerprint, { certificate, filename: changedPath, info: (0, import_node_opcua_crypto5.exploreCertificate)(certificate) });
+        index.set(newFingerprint, { certificate, filename: changedPath, info: (0, import_node_opcua_crypto8.exploreCertificate)(certificate) });
         this.#filenameToHash.set(changedPath, newFingerprint);
         this.emit("certificateChange", { store, certificate, fingerprint: newFingerprint, filename: changedPath });
       } catch (err) {
@@ -4133,13 +4808,141 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     });
   }
 };
+
+// packages/node-opcua-pki/lib/pki/toolbox_pfx.ts
+var import_node_assert8 = __toESM(require("assert"));
+var import_node_fs12 = __toESM(require("fs"));
+var import_node_opcua_crypto9 = require("node-opcua-crypto");
+async function readPfxFile(options) {
+  const { pfxFile, passphrase = "" } = options;
+  (0, import_node_assert8.default)(import_node_fs12.default.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
+  try {
+    return await (0, import_node_opcua_crypto9.parsePfx)(await import_node_fs12.default.promises.readFile(pfxFile), passphrase);
+  } catch (err) {
+    if (err instanceof import_node_opcua_crypto9.Pkcs12UnsupportedAlgorithmError) {
+      const explained = new Error(
+        [
+          `${pfxFile} uses an encryption algorithm that is not supported (${err.message}).`,
+          "Bundles written by openssl 1.x default to 40-bit RC2, which openssl 3 itself",
+          "rejects unless given -legacy. Convert the file once with:",
+          "  openssl pkcs12 -legacy -in old.pfx -nodes -out tmp.pem",
+          "  openssl pkcs12 -export -in tmp.pem -out new.pfx"
+        ].join("\n")
+      );
+      explained.cause = err;
+      throw explained;
+    }
+    throw err;
+  }
+}
+async function createPFX(options) {
+  const { certificateFile, privateKeyFile, privateKeyPassphrase, outputFile, passphrase = "", caCertificateFiles } = options;
+  (0, import_node_assert8.default)(import_node_fs12.default.existsSync(certificateFile), `Certificate file does not exist: ${certificateFile}`);
+  (0, import_node_assert8.default)(import_node_fs12.default.existsSync(privateKeyFile), `Private key file does not exist: ${privateKeyFile}`);
+  const [certificate, ...bundledIssuers] = (0, import_node_opcua_crypto9.readCertificateChain)(certificateFile);
+  if (!certificate) {
+    throw new Error(`Certificate file holds no certificate: ${certificateFile}`);
+  }
+  const certificateChain = [...bundledIssuers];
+  for (const caFile of caCertificateFiles ?? []) {
+    (0, import_node_assert8.default)(import_node_fs12.default.existsSync(caFile), `CA certificate file does not exist: ${caFile}`);
+    certificateChain.push(...(0, import_node_opcua_crypto9.readCertificateChain)(caFile));
+  }
+  const privateKey = (0, import_node_opcua_crypto9.readPrivateKey)(privateKeyFile, privateKeyPassphrase);
+  if (!(0, import_node_opcua_crypto9.certificateMatchesPrivateKey)(certificate, privateKey)) {
+    throw new Error(`The private key ${privateKeyFile} does not match the certificate ${certificateFile}`);
+  }
+  const pfx = await (0, import_node_opcua_crypto9.createPfx)({
+    certificate,
+    certificateChain,
+    privateKey,
+    password: passphrase,
+    friendlyName: options.friendlyName
+  });
+  await import_node_fs12.default.promises.writeFile(outputFile, pfx);
+}
+async function extractCertificateFromPFX(options) {
+  const { certificate } = await readPfxFile(options);
+  return (0, import_node_opcua_crypto9.toPem)(certificate, "CERTIFICATE");
+}
+async function extractPrivateKeyFromPFX(options) {
+  const { privateKey } = await readPfxFile(options);
+  return (0, import_node_opcua_crypto9.coercePrivateKeyPem)(privateKey);
+}
+async function extractCACertificatesFromPFX(options) {
+  const { certificateChain } = await readPfxFile(options);
+  return certificateChain.length === 0 ? "" : (0, import_node_opcua_crypto9.certificatesToPem)(certificateChain);
+}
+async function extractAllFromPFX(options) {
+  const { certificate, certificateChain, privateKey, friendlyName } = await readPfxFile(options);
+  return {
+    certificate: (0, import_node_opcua_crypto9.toPem)(certificate, "CERTIFICATE"),
+    privateKey: (0, import_node_opcua_crypto9.coercePrivateKeyPem)(privateKey),
+    caCertificates: certificateChain.length === 0 ? "" : (0, import_node_opcua_crypto9.certificatesToPem)(certificateChain),
+    friendlyName
+  };
+}
+async function convertPFXtoPEM(pfxFile, pemFile, passphrase = "") {
+  const { certificate, certificateChain, privateKey } = await readPfxFile({ pfxFile, passphrase });
+  const parts = [(0, import_node_opcua_crypto9.coercePrivateKeyPem)(privateKey), (0, import_node_opcua_crypto9.toPem)(certificate, "CERTIFICATE")];
+  if (certificateChain.length > 0) {
+    parts.push((0, import_node_opcua_crypto9.certificatesToPem)(certificateChain));
+  }
+  await import_node_fs12.default.promises.writeFile(pemFile, `${parts.map((part) => part.trimEnd()).join("\n")}
+`, "utf-8");
+}
+function formatThumbprint(certificate) {
+  return ((0, import_node_opcua_crypto9.makeSHA1Thumbprint)(certificate).toString("hex").toUpperCase().match(/../g) ?? []).join(":");
+}
+function describePublicKey(certificate) {
+  const algorithm = certificate.publicKey.algorithm;
+  if (algorithm.modulusLength) {
+    return `${algorithm.name} ${algorithm.modulusLength} bits`;
+  }
+  if (algorithm.namedCurve) {
+    return `${algorithm.name} ${algorithm.namedCurve}`;
+  }
+  return algorithm.name;
+}
+function describeCertificate(der, indent) {
+  const certificate = new import_node_opcua_crypto9.x509.X509Certificate(der);
+  return [
+    `${indent}subject          : ${certificate.subject}`,
+    `${indent}issuer           : ${certificate.issuer}`,
+    `${indent}serial number    : ${certificate.serialNumber}`,
+    `${indent}not before       : ${certificate.notBefore.toISOString()}`,
+    `${indent}not after        : ${certificate.notAfter.toISOString()}`,
+    `${indent}public key       : ${describePublicKey(certificate)}`,
+    `${indent}signature        : ${certificate.signatureAlgorithm.name}`,
+    `${indent}SHA-1 thumbprint : ${formatThumbprint(der)}`
+  ];
+}
+async function dumpPFX(pfxFile, passphrase = "") {
+  const { certificate, certificateChain, privateKey, friendlyName } = await readPfxFile({ pfxFile, passphrase });
+  const lines = [`PFX bundle : ${pfxFile}`];
+  if (friendlyName) {
+    lines.push(`friendly name : ${friendlyName}`);
+  }
+  const keyVerdict = (0, import_node_opcua_crypto9.certificateMatchesPrivateKey)(certificate, privateKey) ? "matches this certificate" : "DOES NOT match this certificate";
+  lines.push("", "certificate", ...describeCertificate(certificate, "  "), `  private key      : ${keyVerdict}`);
+  lines.push("", `issuer chain : ${certificateChain.length} certificate(s)`);
+  for (const [index, issuer] of certificateChain.entries()) {
+    lines.push(`  [${index}]`, ...describeCertificate(issuer, "    "));
+  }
+  return `${lines.join("\n")}
+`;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   CertificateAuthority,
+  CertificateAuthorityCore,
   CertificateManager,
   CertificateManagerState,
   ChainCompletionStatus,
+  NativeCaBackend,
+  OpenSslCaBackend,
   PrivateKeyPassphraseRequiredError,
+  PrivateKeyUnavailableError,
   Subject,
   VerificationStatus,
   adjustApplicationUri,
@@ -4156,6 +4959,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
   install_prerequisite,
   isIntermediateIssuer,
   isIssuer,
+  isOpaqueSigner,
   isRootIssuer,
   makeFingerprint,
   quote,