node-opcua-pki 6.20.0 → 6.22.0

package/dist/index.mjs

@@ -1,111 +1,37 @@
-// packages/node-opcua-pki/lib/index.ts
-import { PrivateKeyPassphraseRequiredError } from "node-opcua-crypto";
+import {
+  CertificateAuthorityCore,
+  NativeCaBackend,
+  Subject,
+  adjustApplicationUri,
+  adjustDate,
+  debugLog,
+  display,
+  displayError,
+  displaySubtitle,
+  displayTitle,
+  doDebug,
+  ensurePrivateDirectory,
+  g_config,
+  isEncryptedPrivateKeyFile,
+  isOpaqueSigner,
+  makePath,
+  mkdirRecursiveSync,
+  quote,
+  resolvePrivateKeyPassphrase,
+  restrictPrivateFilePermissions,
+  warningLog
+} from "./chunk-EQ4DGI4M.mjs";
 
-// packages/node-opcua-pki/lib/ca/certificate_authority.ts
-import assert7 from "assert";
-import fs7 from "fs";
-import os3 from "os";
-import path5 from "path";
-import chalk5 from "chalk";
+// packages/node-opcua-pki/lib/index.ts
 import {
-  CertificatePurpose,
-  certificateMatchesPrivateKey,
-  convertPEMtoDER,
-  exploreCertificate,
-  exploreCertificateSigningRequest,
-  generatePrivateKeyFile,
-  readCertificatePEM,
-  readCertificateSigningRequest,
-  readPrivateKey,
-  Subject as Subject2,
-  toPem,
-  writePrivateKeyFile
+  PrivateKeyPassphraseRequiredError,
+  PrivateKeyUnavailableError as PrivateKeyUnavailableError2
 } from "node-opcua-crypto";
 
-// packages/node-opcua-pki/lib/pki/toolbox_pfx.ts
-import assert3 from "assert";
+// packages/node-opcua-pki/lib/ca/backends/openssl_ca_backend.ts
 import fs4 from "fs";
-
-// packages/node-opcua-pki/lib/toolbox/common2.ts
-import assert from "assert";
-import fs from "fs";
-import path from "path";
-import chalk from "chalk";
-
-// packages/node-opcua-pki/lib/toolbox/config.ts
-var g_config = {
-  opensslVersion: "unset",
-  silent: process.env.VERBOSE ? !process.env.VERBOSE : true,
-  force: false
-};
-
-// packages/node-opcua-pki/lib/toolbox/debug.ts
-var doDebug = process.env.NODEOPCUAPKIDEBUG || false;
-var displayError = true;
-var displayDebug = !!process.env.NODEOPCUAPKIDEBUG || false;
-function debugLog(...args) {
-  if (displayDebug) {
-    console.log.apply(null, args);
-  }
-}
-function warningLog(...args) {
-  console.log.apply(null, args);
-}
-
-// packages/node-opcua-pki/lib/toolbox/common2.ts
-function certificateFileExist(certificateFile) {
-  if (fs.existsSync(certificateFile) && !g_config.force) {
-    warningLog(
-      chalk.yellow("        certificate ") + chalk.cyan(certificateFile) + chalk.yellow(" already exists => do not overwrite")
-    );
-    return false;
-  }
-  return true;
-}
-function mkdirRecursiveSync(folder) {
-  if (!fs.existsSync(folder)) {
-    debugLog(chalk.white(" .. constructing "), folder);
-    fs.mkdirSync(folder, { recursive: true });
-  }
-}
-function restrictPrivateFilePermissions(target, mode) {
-  if (process.platform === "win32") {
-    return;
-  }
-  try {
-    fs.chmodSync(target, mode);
-  } catch (err) {
-    warningLog(chalk.yellow("        could not restrict permissions on "), target, err.message);
-  }
-}
-function ensurePrivateDirectory(dir) {
-  if (!fs.existsSync(dir)) {
-    fs.mkdirSync(dir, { recursive: true, mode: 448 });
-  }
-  restrictPrivateFilePermissions(dir, 448);
-}
-function isEncryptedPrivateKeyFile(filename) {
-  return fs.readFileSync(filename, "utf-8").includes("-----BEGIN ENCRYPTED PRIVATE KEY-----");
-}
-function makePath(folderName, filename) {
-  let s;
-  if (filename) {
-    s = path.join(path.normalize(folderName), filename);
-  } else {
-    assert(folderName);
-    s = folderName;
-  }
-  s = s.replace(/\\/g, "/");
-  return s;
-}
-
-// packages/node-opcua-pki/lib/toolbox/with_openssl/execute_openssl.ts
-import assert2 from "assert";
-import child_process2 from "child_process";
-import fs3 from "fs";
-import os2 from "os";
-import byline2 from "byline";
-import chalk3 from "chalk";
+import path3 from "path";
+import { Subject as Subject2 } from "node-opcua-crypto";
 
 // packages/node-opcua-pki/lib/toolbox/with_openssl/_env.ts
 var SAFE_ENV_PASSTHROUGH = /* @__PURE__ */ new Set([
@@ -179,31 +105,30 @@ function getEnvironmentVarNames() {
     return { key: varName, pattern: `\\$ENV\\:\\:${varName}` };
   });
 }
-function processAltNames(params) {
-  params.dns = params.dns || [];
-  params.ip = params.ip || [];
-  let subjectAltName = [];
-  subjectAltName.push(`URI:${params.applicationUri}`);
-  subjectAltName = [].concat(
-    subjectAltName,
-    params.dns.map((d) => `DNS:${d}`)
-  );
-  subjectAltName = [].concat(
-    subjectAltName,
-    params.ip.map((d) => `IP:${d}`)
-  );
-  const subjectAltNameString = subjectAltName.join(", ");
-  setEnv("ALTNAME", subjectAltNameString);
+function buildSubjectAltNameString(params) {
+  return [
+    `URI:${params.applicationUri}`,
+    ...(params.dns ?? []).map((d) => `DNS:${d}`),
+    ...(params.ip ?? []).map((d) => `IP:${d}`)
+  ].join(", ");
 }
 
+// packages/node-opcua-pki/lib/toolbox/with_openssl/execute_openssl.ts
+import assert from "assert";
+import child_process2 from "child_process";
+import fs2 from "fs";
+import os2 from "os";
+import byline2 from "byline";
+import chalk2 from "chalk";
+
 // packages/node-opcua-pki/lib/toolbox/with_openssl/install_prerequisite.ts
 import child_process from "child_process";
-import fs2 from "fs";
+import fs from "fs";
 import os from "os";
-import path2 from "path";
+import path from "path";
 import { pipeline } from "stream/promises";
 import byline from "byline";
-import chalk2 from "chalk";
+import chalk from "chalk";
 import yauzl from "yauzl";
 var doDebug2 = process.env.NODEOPCUAPKIDEBUG || false;
 async function execute(file, args, cwd) {
@@ -222,7 +147,7 @@ async function execute(file, args, cwd) {
       output += `${line}
 `;
       if (doDebug2) {
-        process.stdout.write(`        stdout ${chalk2.yellow(line)}
+        process.stdout.write(`        stdout ${chalk.yellow(line)}
 `);
       }
     });
@@ -242,8 +167,8 @@ async function getopensslExecPath() {
   const exitCode = result1?.exitCode;
   const output = result1?.output;
   if (exitCode !== 0) {
-    warningLog(chalk2.yellow(" it seems that ") + chalk2.cyan("openssl") + chalk2.yellow(" is not installed on your computer "));
-    warningLog(chalk2.yellow("Please install it before running this programs"));
+    warningLog(chalk.yellow(" it seems that ") + chalk.cyan("openssl") + chalk.yellow(" is not installed on your computer "));
+    warningLog(chalk.yellow("Please install it before running this programs"));
     throw new Error("Cannot find openssl");
   }
   const opensslExecPath = output.replace(/\n\r/g, "").trim();
@@ -252,7 +177,7 @@ async function getopensslExecPath() {
 async function check_system_openssl_version() {
   const opensslExecPath = await getopensslExecPath();
   if (doDebug2) {
-    warningLog(`              OpenSSL found in : ${chalk2.yellow(opensslExecPath)}`);
+    warningLog(`              OpenSSL found in : ${chalk.yellow(opensslExecPath)}`);
   }
   const result = await execute(opensslExecPath, ["version"]);
   const exitCode = result?.exitCode;
@@ -260,35 +185,35 @@ async function check_system_openssl_version() {
   const version = output.trim();
   const versionOK = exitCode === 0 && is_expected_openssl_version(version);
   if (!versionOK) {
-    let message = chalk2.whiteBright("Warning !!!!!!!!!!!! ") + "\nyour version of openssl is " + version + ". It doesn't match the expected version";
+    let message = chalk.whiteBright("Warning !!!!!!!!!!!! ") + "\nyour version of openssl is " + version + ". It doesn't match the expected version";
     if (process.platform === "darwin") {
-      message += chalk2.cyan("\nplease refer to :") + chalk2.yellow(" https://github.com/node-opcua/node-opcua/wiki/installing-node-opcua-or-node-red-on-MacOS");
+      message += chalk.cyan("\nplease refer to :") + chalk.yellow(" https://github.com/node-opcua/node-opcua/wiki/installing-node-opcua-or-node-red-on-MacOS");
     }
     console.log(message);
   }
   return output;
 }
 async function install_and_check_win32_openssl_version() {
-  const downloadFolder = path2.join(os.tmpdir(), ".");
+  const downloadFolder = path.join(os.tmpdir(), ".");
   function get_openssl_folder_win32() {
     if (process.env.LOCALAPPDATA) {
-      const userProgramFolder = path2.join(process.env.LOCALAPPDATA, "Programs");
-      if (fs2.existsSync(userProgramFolder)) {
-        return path2.join(userProgramFolder, "openssl");
+      const userProgramFolder = path.join(process.env.LOCALAPPDATA, "Programs");
+      if (fs.existsSync(userProgramFolder)) {
+        return path.join(userProgramFolder, "openssl");
       }
     }
-    return path2.join(process.cwd(), "openssl");
+    return path.join(process.cwd(), "openssl");
   }
   function get_openssl_exec_path_win32() {
     const opensslFolder2 = get_openssl_folder_win32();
-    return path2.join(opensslFolder2, "openssl.exe");
+    return path.join(opensslFolder2, "openssl.exe");
   }
   async function check_openssl_win32() {
     const opensslExecPath2 = get_openssl_exec_path_win32();
-    const exists = fs2.existsSync(opensslExecPath2);
+    const exists = fs.existsSync(opensslExecPath2);
     if (!exists) {
       warningLog("checking presence of ", opensslExecPath2);
-      warningLog(chalk2.red(" cannot find file ") + opensslExecPath2);
+      warningLog(chalk.red(" cannot find file ") + opensslExecPath2);
       return {
         opensslOk: false,
         version: `cannot find file ${opensslExecPath2}`
@@ -313,18 +238,18 @@ async function install_and_check_win32_openssl_version() {
         return void 0;
       }
       const opensslPath2 = result.output.split(/\r?\n/)[0].trim();
-      if (!opensslPath2 || !fs2.existsSync(opensslPath2)) {
+      if (!opensslPath2 || !fs.existsSync(opensslPath2)) {
         return void 0;
       }
       const versionResult = await execute(opensslPath2, ["version"]);
       const version = versionResult.output.trim();
       if (versionResult.exitCode === 0 && is_expected_openssl_version(version)) {
         warningLog(
-          chalk2.green("Using system OpenSSL: ") + chalk2.cyan(version) + chalk2.green(" at ") + chalk2.cyan(opensslPath2)
+          chalk.green("Using system OpenSSL: ") + chalk.cyan(version) + chalk.green(" at ") + chalk.cyan(opensslPath2)
         );
         return opensslPath2;
       }
-      warningLog(chalk2.yellow("System OpenSSL found but version not accepted: ") + version);
+      warningLog(chalk.yellow("System OpenSSL found but version not accepted: ") + version);
       return void 0;
     } catch (_err) {
       return void 0;
@@ -344,9 +269,9 @@ async function install_and_check_win32_openssl_version() {
   }
   async function download_openssl() {
     const url = win32or64() === 64 ? "https://github.com/node-opcua/node-opcua-pki/releases/download/2.14.2/openssl-1.0.2u-x64_86-win64.zip" : "https://github.com/node-opcua/node-opcua-pki/releases/download/2.14.2/openssl-1.0.2u-i386-win32.zip";
-    const outputFilename = path2.join(downloadFolder, path2.basename(url));
-    warningLog(`downloading ${chalk2.yellow(url)} to ${outputFilename}`);
-    if (fs2.existsSync(outputFilename)) {
+    const outputFilename = path.join(downloadFolder, path.basename(url));
+    warningLog(`downloading ${chalk.yellow(url)} to ${outputFilename}`);
+    if (fs.existsSync(outputFilename)) {
       return { downloadedFile: outputFilename };
     }
     const response = await fetch(url, { redirect: "follow" });
@@ -356,7 +281,7 @@ async function install_and_check_win32_openssl_version() {
     const contentLength = parseInt(response.headers.get("content-length") || "0", 10);
     let downloaded = 0;
     let lastPercent = -1;
-    const fileStream = fs2.createWriteStream(outputFilename);
+    const fileStream = fs.createWriteStream(outputFilename);
     const body = response.body;
     body.on("data", (chunk) => {
       downloaded += chunk.length;
@@ -369,12 +294,12 @@ async function install_and_check_win32_openssl_version() {
       }
     });
     await pipeline(body, fileStream);
-    const stat = fs2.statSync(outputFilename);
+    const stat = fs.statSync(outputFilename);
     if (stat.size === 0) {
-      fs2.unlinkSync(outputFilename);
+      fs.unlinkSync(outputFilename);
       throw new Error(`Downloaded file is empty: ${outputFilename}`);
     }
-    warningLog(chalk2.green("Download complete: ") + `${stat.size} bytes`);
+    warningLog(chalk.green("Download complete: ") + `${stat.size} bytes`);
     return { downloadedFile: outputFilename };
   }
   async function unzip_openssl(zipFilename) {
@@ -411,11 +336,11 @@ async function install_and_check_win32_openssl_version() {
           if (err) {
             return reject(err);
           }
-          const file = path2.join(opensslFolder2, entry.fileName);
+          const file = path.join(opensslFolder2, entry.fileName);
           if (doDebug2) {
             warningLog(" unzipping :", file);
           }
-          const writeStream = fs2.createWriteStream(file, "binary");
+          const writeStream = fs.createWriteStream(file, "binary");
           readStream?.pipe(writeStream);
           writeStream.on("close", () => {
             zipFile.readEntry();
@@ -430,29 +355,29 @@ async function install_and_check_win32_openssl_version() {
   }
   const opensslFolder = get_openssl_folder_win32();
   const opensslExecPath = get_openssl_exec_path_win32();
-  if (!fs2.existsSync(opensslFolder)) {
+  if (!fs.existsSync(opensslFolder)) {
     if (doDebug2) {
       warningLog("creating openssl_folder", opensslFolder);
     }
-    fs2.mkdirSync(opensslFolder);
+    fs.mkdirSync(opensslFolder);
   }
   const { opensslOk, version: _version } = await check_openssl_win32();
   if (!opensslOk) {
-    warningLog(chalk2.yellow("openssl seems to be missing and need to be installed"));
+    warningLog(chalk.yellow("openssl seems to be missing and need to be installed"));
     const { downloadedFile } = await download_openssl();
     if (doDebug2) {
-      warningLog("deflating ", chalk2.yellow(downloadedFile));
+      warningLog("deflating ", chalk.yellow(downloadedFile));
     }
     await unzip_openssl(downloadedFile);
-    const opensslExists = !!fs2.existsSync(opensslExecPath);
+    const opensslExists = !!fs.existsSync(opensslExecPath);
     if (doDebug2) {
-      warningLog("verifying ", opensslExists, opensslExists ? chalk2.green("OK ") : chalk2.red(" Error"), opensslExecPath);
+      warningLog("verifying ", opensslExists, opensslExists ? chalk.green("OK ") : chalk.red(" Error"), opensslExecPath);
     }
     const _opensslExecPath2 = await check_openssl_win32();
     return opensslExecPath;
   } else {
     if (doDebug2) {
-      warningLog(chalk2.green("openssl is already installed and have the expected version."));
+      warningLog(chalk.green("openssl is already installed and have the expected version."));
     }
     return opensslExecPath;
   }
@@ -467,7 +392,7 @@ async function install_prerequisite() {
 async function get_openssl_exec_path() {
   if (process.platform === "win32") {
     const opensslExecPath = await install_prerequisite();
-    if (!fs2.existsSync(opensslExecPath)) {
+    if (!fs.existsSync(opensslExecPath)) {
       throw new Error(`internal error cannot find ${opensslExecPath}`);
     }
     return opensslExecPath;
@@ -480,13 +405,9 @@ async function get_openssl_exec_path() {
 var opensslPath;
 var n = makePath;
 var PASSIN_ENV_VAR = "NODE_OPCUA_PKI_OPENSSL_PASSIN";
-var PASSOUT_ENV_VAR = "NODE_OPCUA_PKI_OPENSSL_PASSOUT";
 function passinArg(passphrase = "") {
   return { args: ["-passin", `env:${PASSIN_ENV_VAR}`], env: { [PASSIN_ENV_VAR]: passphrase } };
 }
-function passoutArg(passphrase = "") {
-  return { args: ["-passout", `env:${PASSOUT_ENV_VAR}`], env: { [PASSOUT_ENV_VAR]: passphrase } };
-}
 function renderForDisplay(file, args) {
   return [file, ...args].map((a) => a === "" || /[\s"'`$\\]/.test(a) ? JSON.stringify(a) : a).join(" ");
 }
@@ -494,7 +415,7 @@ async function execute2(file, args, options) {
   const from = new Error();
   options.cwd = options.cwd || process.cwd();
   if (!g_config.silent) {
-    warningLog(chalk3.cyan("                  CWD         "), options.cwd);
+    warningLog(chalk2.cyan("                  CWD         "), options.cwd);
   }
   const outputs = [];
   const errorOutputs = [];
@@ -507,12 +428,12 @@ async function execute2(file, args, options) {
       stdio: ["ignore", "pipe", "pipe"]
     });
     const fail = (message) => {
-      if (!options.hideErrorMessage) {
+      if (!options.hideErrorMessage && !g_config.silent) {
         const fence = "###########################################";
-        console.error(chalk3.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
-        console.error(chalk3.bgWhiteBright.redBright(`CWD = ${options.cwd}`));
-        console.error(chalk3.bgWhiteBright.redBright(message));
-        console.error(chalk3.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
+        console.error(chalk2.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
+        console.error(chalk2.bgWhiteBright.redBright(`CWD = ${options.cwd}`));
+        console.error(chalk2.bgWhiteBright.redBright(message));
+        console.error(chalk2.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
         console.error(from.stack);
       }
       reject(new Error(message));
@@ -538,7 +459,7 @@ ${errorOutputs.join("")}(${why})`);
         stream2.on("data", (line) => {
           line = line.toString();
           if (doDebug) {
-            process.stdout.write(`${chalk3.white("        stdout ") + chalk3.whiteBright(line)}
+            process.stdout.write(`${chalk2.white("        stdout ") + chalk2.whiteBright(line)}
 `);
           }
         });
@@ -551,7 +472,7 @@ ${errorOutputs.join("")}(${why})`);
         errorOutputs.push(`${line}
 `);
         if (!g_config.silent && displayError) {
-          process.stdout.write(`${chalk3.white("        stderr ") + chalk3.red(line)}
+          process.stdout.write(`${chalk2.white("        stderr ") + chalk2.red(line)}
 `);
         }
       });
@@ -586,154 +507,26 @@ function getTempFolder() {
 async function execute_openssl(args, options) {
   debugLog("execute_openssl", args, redactEnvForLog(options));
   const empty_config_file = n(getTempFolder(), "empty_config.cnf");
-  if (!fs3.existsSync(empty_config_file)) {
-    await fs3.promises.writeFile(empty_config_file, "# empty config file");
+  if (!fs2.existsSync(empty_config_file)) {
+    await fs2.promises.writeFile(empty_config_file, "# empty config file");
   }
   options = options || {};
   options.openssl_conf = options.openssl_conf || empty_config_file;
-  assert2(options.openssl_conf);
+  assert(options.openssl_conf);
   setEnv("OPENSSL_CONF", options.openssl_conf);
   if (!g_config.silent) {
-    warningLog(chalk3.cyan("                  OPENSSL_CONF"), process.env.OPENSSL_CONF);
-    warningLog(chalk3.cyan("                  RANDFILE    "), process.env.RANDFILE);
-    warningLog(chalk3.cyan("                  CMD         "), chalk3.cyanBright(renderForDisplay("openssl", args)));
+    warningLog(chalk2.cyan("                  OPENSSL_CONF"), process.env.OPENSSL_CONF);
+    warningLog(chalk2.cyan("                  RANDFILE    "), process.env.RANDFILE);
+    warningLog(chalk2.cyan("                  CMD         "), chalk2.cyanBright(renderForDisplay("openssl", args)));
   }
   await ensure_openssl_installed();
   return await execute2(opensslPath, args, options);
 }
 
-// packages/node-opcua-pki/lib/pki/toolbox_pfx.ts
-var n2 = makePath;
-async function createPFX(options) {
-  const { certificateFile, privateKeyFile, privateKeyPassphrase, outputFile, passphrase = "", caCertificateFiles } = options;
-  assert3(fs4.existsSync(certificateFile), `Certificate file does not exist: ${certificateFile}`);
-  assert3(fs4.existsSync(privateKeyFile), `Private key file does not exist: ${privateKeyFile}`);
-  const args = ["pkcs12", "-export", "-in", n2(certificateFile), "-inkey", n2(privateKeyFile)];
-  if (caCertificateFiles) {
-    for (const caFile of caCertificateFiles) {
-      assert3(fs4.existsSync(caFile), `CA certificate file does not exist: ${caFile}`);
-      args.push("-certfile", n2(caFile));
-    }
-  }
-  const passin = passinArg(privateKeyPassphrase);
-  const passout = passoutArg(passphrase);
-  args.push("-out", n2(outputFile), ...passin.args, ...passout.args);
-  await execute_openssl(args, { env: { ...passin.env, ...passout.env } });
-}
-async function extractCertificateFromPFX(options) {
-  const { pfxFile, passphrase = "" } = options;
-  assert3(fs4.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  const passin = passinArg(passphrase);
-  return await execute_openssl(["pkcs12", "-in", n2(pfxFile), "-clcerts", "-nokeys", "-nodes", ...passin.args], {
-    env: passin.env
-  });
-}
-async function extractPrivateKeyFromPFX(options) {
-  const { pfxFile, passphrase = "" } = options;
-  assert3(fs4.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  const passin = passinArg(passphrase);
-  return await execute_openssl(["pkcs12", "-in", n2(pfxFile), "-nocerts", "-nodes", ...passin.args], { env: passin.env });
-}
-async function extractCACertificatesFromPFX(options) {
-  const { pfxFile, passphrase = "" } = options;
-  assert3(fs4.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  const passin = passinArg(passphrase);
-  return await execute_openssl(["pkcs12", "-in", n2(pfxFile), "-cacerts", "-nokeys", "-nodes", ...passin.args], {
-    env: passin.env
-  });
-}
-async function extractAllFromPFX(options) {
-  const [certificate, privateKey, caCertificates] = await Promise.all([
-    extractCertificateFromPFX(options),
-    extractPrivateKeyFromPFX(options),
-    extractCACertificatesFromPFX(options)
-  ]);
-  return { certificate, privateKey, caCertificates };
-}
-async function convertPFXtoPEM(pfxFile, pemFile, passphrase = "") {
-  assert3(fs4.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  const passin = passinArg(passphrase);
-  await execute_openssl(["pkcs12", "-in", n2(pfxFile), "-out", n2(pemFile), "-nodes", ...passin.args], { env: passin.env });
-}
-async function dumpPFX(pfxFile, passphrase = "") {
-  assert3(fs4.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  const passin = passinArg(passphrase);
-  return await execute_openssl(["pkcs12", "-in", n2(pfxFile), "-info", "-nodes", ...passin.args], { env: passin.env });
-}
-
-// packages/node-opcua-pki/lib/toolbox/common.ts
-import assert4 from "assert";
-function quote(str) {
-  return `"${str || ""}"`;
-}
-async function resolvePrivateKeyPassphrase(passphrase) {
-  if (passphrase === void 0) {
-    return void 0;
-  }
-  return typeof passphrase === "function" ? await passphrase() : passphrase;
-}
-function adjustDate(params) {
-  assert4(params instanceof Object);
-  params.startDate = params.startDate || /* @__PURE__ */ new Date();
-  assert4(params.startDate instanceof Date);
-  if (params.validityMs !== void 0) {
-    if (params.validityMs <= 0) {
-      throw new RangeError(`validityMs must be > 0 (got ${params.validityMs})`);
-    }
-    params.endDate = new Date(params.startDate.getTime() + params.validityMs);
-    params.validity = Math.ceil(params.validityMs / 864e5);
-  } else {
-    params.validity = params.validity || 365;
-    params.endDate = new Date(params.startDate.getTime());
-    params.endDate.setDate(params.startDate.getDate() + params.validity);
-  }
-  assert4(params.endDate instanceof Date);
-  assert4(params.startDate instanceof Date);
-}
-function adjustApplicationUri(params) {
-  const applicationUri = params.applicationUri || "";
-  if (applicationUri.length > 200) {
-    throw new Error(`Openssl doesn't support urn with length greater than 200${applicationUri}`);
-  }
-}
-
-// packages/node-opcua-pki/lib/toolbox/display.ts
-import chalk4 from "chalk";
-function displayTitle(str) {
-  if (!g_config.silent) {
-    warningLog("");
-    warningLog(chalk4.yellowBright(str));
-    warningLog(chalk4.yellow(new Array(str.length + 1).join("=")), "\n");
-  }
-}
-function displaySubtitle(str) {
-  if (!g_config.silent) {
-    warningLog("");
-    warningLog(`    ${chalk4.yellowBright(str)}`);
-    warningLog(`    ${chalk4.white(new Array(str.length + 1).join("-"))}`, "\n");
-  }
-}
-function display(str) {
-  if (!g_config.silent) {
-    warningLog(`       ${str}`);
-  }
-}
-
-// packages/node-opcua-pki/lib/toolbox/with_openssl/index.ts
-import exp from "constants";
-
-// packages/node-opcua-pki/lib/toolbox/with_openssl/create_certificate_signing_request.ts
-import assert6 from "assert";
-import fs6 from "fs";
-import path4 from "path";
-
-// packages/node-opcua-pki/lib/misc/subject.ts
-import { Subject } from "node-opcua-crypto";
-
 // packages/node-opcua-pki/lib/toolbox/with_openssl/toolbox.ts
-import assert5 from "assert";
-import fs5 from "fs";
-import path3 from "path";
+import assert2 from "assert";
+import fs3 from "fs";
+import path2 from "path";
 function openssl_require2DigitYearInDate() {
   if (!g_config.opensslVersion) {
     throw new Error(
@@ -744,29 +537,40 @@ function openssl_require2DigitYearInDate() {
 }
 g_config.opensslVersion = "";
 var _counter = 0;
-function stripConditionalBlocks(template) {
+function stripConditionalBlocks(template, envOverrides) {
   return template.replace(/\{\{#([A-Z_][A-Z0-9_]*)\}\}([\s\S]*?)\{\{\/\1\}\}\r?\n?/g, (_match, key, content) => {
-    const keep = hasEnv(key) && getEnv(key) !== "";
+    const keep = envOverrides && Object.prototype.hasOwnProperty.call(envOverrides, key) ? envOverrides[key] !== "" : hasEnv(key) && getEnv(key) !== "";
     return keep ? content : "";
   });
 }
-function generateStaticConfig(configPath, options) {
+function generateStaticConfig(configPath, options, envOverrides) {
   const prePath = options?.cwd || "";
-  const originalFilename = !path3.isAbsolute(configPath) ? path3.join(prePath, configPath) : configPath;
-  let staticConfig = fs5.readFileSync(originalFilename, { encoding: "utf8" });
-  staticConfig = stripConditionalBlocks(staticConfig);
+  const originalFilename = !path2.isAbsolute(configPath) ? path2.join(prePath, configPath) : configPath;
+  let staticConfig = fs3.readFileSync(originalFilename, { encoding: "utf8" });
+  staticConfig = stripConditionalBlocks(staticConfig, envOverrides);
   for (const envVar of getEnvironmentVarNames()) {
-    staticConfig = staticConfig.replace(new RegExp(envVar.pattern, "gi"), getEnv(envVar.key));
+    if (envOverrides && Object.prototype.hasOwnProperty.call(envOverrides, envVar.key)) {
+      continue;
+    }
+    staticConfig = staticConfig.replace(new RegExp(envVar.pattern, "gi"), () => getEnv(envVar.key));
+  }
+  if (envOverrides) {
+    for (const [key, value] of Object.entries(envOverrides)) {
+      staticConfig = staticConfig.replace(new RegExp(`\\$ENV\\:\\:${key}`, "gi"), () => value);
+    }
   }
   const staticConfigPath = `${configPath}.${process.pid}-${_counter++}.tmp`;
-  const temporaryConfigPath = !path3.isAbsolute(configPath) ? path3.join(prePath, staticConfigPath) : staticConfigPath;
-  fs5.writeFileSync(temporaryConfigPath, staticConfig);
+  const temporaryConfigPath = !path2.isAbsolute(configPath) ? path2.join(prePath, staticConfigPath) : staticConfigPath;
+  fs3.writeFileSync(temporaryConfigPath, staticConfig);
   if (options?.cwd) {
-    return path3.relative(options.cwd, temporaryConfigPath);
+    return path2.relative(options.cwd, temporaryConfigPath);
   } else {
     return temporaryConfigPath;
   }
 }
+async function cleanupStaticConfig(configFile, options) {
+  await fs3.promises.rm(path2.resolve(options?.cwd ?? "", configFile), { force: true });
+}
 function x509Date(date) {
   date = date || /* @__PURE__ */ new Date();
   const Y = date.getUTCFullYear();
@@ -785,1536 +589,433 @@ function x509Date(date) {
   }
 }
 
-// packages/node-opcua-pki/lib/toolbox/with_openssl/create_certificate_signing_request.ts
-var n3 = makePath;
-async function createCertificateSigningRequestWithOpenSSL(certificateSigningRequestFilename, params) {
-  assert6(params);
-  assert6(params.rootDir);
-  assert6(params.configFile);
-  assert6(params.privateKey);
-  assert6(typeof params.privateKey === "string");
-  assert6(fs6.existsSync(params.configFile), `config file must exist ${params.configFile}`);
-  assert6(fs6.existsSync(params.privateKey), `Private key must exist${params.privateKey}`);
-  assert6(fs6.existsSync(params.rootDir), "RootDir key must exist");
-  assert6(typeof certificateSigningRequestFilename === "string");
-  processAltNames(params);
-  const configFile = generateStaticConfig(params.configFile, { cwd: params.rootDir });
-  const options = { cwd: params.rootDir, openssl_conf: path4.relative(params.rootDir, configFile) };
-  const subject = params.subject ? new Subject(params.subject).toString() : void 0;
-  displaySubtitle("- Creating a Certificate Signing Request with openssl");
-  await execute_openssl(
-    [
-      "req",
-      "-new",
-      "-sha256",
-      "-batch",
-      "-text",
-      "-config",
-      n3(configFile),
-      "-key",
-      n3(params.privateKey),
-      ...subject ? ["-subj", subject] : [],
-      "-out",
-      n3(certificateSigningRequestFilename)
-    ],
-    options
-  );
-}
-
-// packages/node-opcua-pki/lib/pki/templates/simple_config_template.cnf.ts
-var config = '##################################################################################################\n## SIMPLE OPENSSL CONFIG FILE FOR SELF-SIGNED CERTIFICATE GENERATION\n################################################################################################################\n\ndistinguished_name       = req_distinguished_name\ndefault_md               = sha1\n\ndefault_md                = sha256                      # The default digest algorithm\n\n[ v3_ca ]\nsubjectKeyIdentifier        = hash\nauthorityKeyIdentifier      = keyid:always,issuer:always\n\n# authorityKeyIdentifier    = keyid\nbasicConstraints            = CA:TRUE\nkeyUsage                    = critical, cRLSign, keyCertSign\nnsComment                   = "Self-signed Certificate for CA generated by Node-OPCUA Certificate utility"\n#nsCertType                 = sslCA, emailCA\n#subjectAltName             = email:copy\n#issuerAltName              = issuer:copy\n#obj                        = DER:02:03\n# crlDistributionPoints       = @crl_info\n# [ crl_info ]\n# URI.0                     = http://localhost:8900/crl.pem\nsubjectAltName              = $ENV::ALTNAME\n\n[ req ]\ndays                      = 390\nreq_extensions            = v3_req\nx509_extensions           = v3_ca\n\n[v3_req]\nbasicConstraints       = CA:false\nkeyUsage               = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment\nsubjectAltName         = $ENV::ALTNAME\n\n[ v3_ca_signed]\nsubjectKeyIdentifier      = hash\nauthorityKeyIdentifier    = keyid,issuer\nbasicConstraints          = critical, CA:FALSE\nkeyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment\nextendedKeyUsage          = clientAuth,serverAuth \nnsComment                 = "certificate generated by Node-OPCUA Certificate utility and signed by a CA"\nsubjectAltName            = $ENV::ALTNAME\n[ v3_selfsigned]\nsubjectKeyIdentifier      = hash\nauthorityKeyIdentifier    = keyid,issuer\nbasicConstraints          = critical, CA:FALSE\nkeyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment\nextendedKeyUsage          = clientAuth,serverAuth \nnsComment                 = "Self-signed certificate generated by Node-OPCUA Certificate utility"\nsubjectAltName            = $ENV::ALTNAME\n[ req_distinguished_name ]\ncountryName             = Country Name (2 letter code)\ncountryName_default     = FR\ncountryName_min         = 2\ncountryName_max         = 2\n# stateOrProvinceName     = State or Province Name (full name)\n# stateOrProvinceName_default = Ile de France\n# localityName            = Locality Name (city, district)\n# localityName_default    = Paris\norganizationName          = Organization Name (company)\norganizationName_default  = NodeOPCUA\n# organizationalUnitName  = Organizational Unit Name (department, division)\n# organizationalUnitName_default = R&D\ncommonName                = Common Name (hostname, FQDN, IP, or your name)\ncommonName_max            = 256\ncommonName_default        = NodeOPCUA\n# emailAddress            = Email Address\n# emailAddress_max        = 40\n# emailAddress_default    = node-opcua (at) node-opcua (dot) com\nsubjectAltName            = $ENV::ALTNAME';
-var simple_config_template_cnf_default = config;
-
-// packages/node-opcua-pki/lib/ca/templates/ca_config_template.cnf.ts
-var config2 = `#.........DO NOT MODIFY BY HAND .........................
-[ ca ]
-default_ca               = CA_default
-[ CA_default ]
-dir                      = "%%ROOT_FOLDER%%"        # the main CA folder (quoted: see renderCaConfig)
-certs                    = $dir/certs                 # where to store certificates
-new_certs_dir            = $dir/certs                 #
-database                 = $dir/index.txt             # the certificate database
-serial                   = $dir/serial                # the serial number counter
-certificate              = $dir/public/cacert.pem     # The root CA certificate
-private_key              = $dir/private/cakey.pem     # the CA private key
-x509_extensions          = usr_cert                   #
-default_days             = 3650                       # default validity : 10 years
-
-# default_md               = sha1
-
-default_md                = sha256                      # The default digest algorithm
-
-preserve                 = no
-policy                   = policy_match
-# randfile                 = $dir/random.rnd
-# default_startdate        = YYMMDDHHMMSSZ
-# default_enddate          = YYMMDDHHMMSSZ
-crl_dir                  = $dir/crl
-crl_extensions           = crl_ext
-crl                      = $dir/revocation_list.crl # the Revocation list
-crlnumber                = $dir/crlnumber           # CRL number file
-default_crl_days         = 30
-default_crl_hours        = 24
-#msie_hack
-
-[ policy_match ]
-countryName              = optional
-stateOrProvinceName      = optional
-localityName             = optional
-organizationName         = optional
-organizationalUnitName   = optional
-commonName               = optional
-emailAddress             = optional
-
-[ req ]
-default_bits             = 4096                     # Size of keys
-default_keyfile          = key.pem                  # name of generated keys
-distinguished_name       = req_distinguished_name
-attributes               = req_attributes
-x509_extensions          = v3_ca
-#input_password
-#output_password
-string_mask              = nombstr                  # permitted characters
-req_extensions           = v3_req
-
-[ req_distinguished_name ]
-
-#0 countryName             = Country Name (2 letter code)
-# countryName_default     = FR
-# countryName_min         = 2
-# countryName_max         = 2
-# stateOrProvinceName     = State or Province Name (full name)
-# stateOrProvinceName_default = Ile de France
-# localityName            = Locality Name (city, district)
-# localityName_default    = Paris
-organizationName          = Organization Name (company)
-organizationName_default  = NodeOPCUA
-# organizationalUnitName  = Organizational Unit Name (department, division)
-# organizationalUnitName_default = R&D
-commonName                = Common Name (hostname, FQDN, IP, or your name)
-commonName_max            = 256
-commonName_default        = NodeOPCUA
-# emailAddress            = Email Address
-# emailAddress_max        = 40
-# emailAddress_default    = node-opcua (at) node-opcua (dot) com
-
-[ req_attributes ]
-#challengePassword        = A challenge password
-#challengePassword_min    = 4
-#challengePassword_max    = 20
-#unstructuredName         = An optional company name
-[ usr_cert ]
-basicConstraints          = critical, CA:FALSE
-subjectKeyIdentifier      = hash
-authorityKeyIdentifier    = keyid,issuer:always
-#authorityKeyIdentifier    = keyid
-subjectAltName            = $ENV::ALTNAME
-# issuerAltName            = issuer:copy
-nsComment                 = ''OpenSSL Generated Certificate''
-#nsCertType               = client, email, objsign for ''everything including object signing''
-#nsCaRevocationUrl        = http://www.domain.dom/ca-crl.pem
-#nsBaseUrl                =
-#nsRenewalUrl             =
-#nsCaPolicyUrl            =
-#nsSslServerName          =
-keyUsage                  = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement
-extendedKeyUsage          = critical,serverAuth ,clientAuth
-{{#CDP_URL}}crlDistributionPoints     = URI:$ENV::CDP_URL
-{{/CDP_URL}}{{#AIA_VALUE}}authorityInfoAccess       = $ENV::AIA_VALUE
-{{/AIA_VALUE}}
-[ v3_req ]
-basicConstraints          = critical, CA:FALSE
-keyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyAgreement
-extendedKeyUsage          = critical,serverAuth ,clientAuth
-subjectAltName            = $ENV::ALTNAME
-nsComment                 = "CA Generated by Node-OPCUA Certificate utility using openssl"
-[ v3_ca_req ]
-subjectKeyIdentifier      = hash
-basicConstraints          = CA:TRUE
-keyUsage                  = critical, cRLSign, keyCertSign
-subjectAltName            = $ENV::ALTNAME
-nsComment                 = "CA CSR generated by Node-OPCUA Certificate utility using openssl"
-[ v3_ca ]
-subjectKeyIdentifier      = hash
-authorityKeyIdentifier    = keyid:always,issuer:always
-basicConstraints          = CA:TRUE
-keyUsage                  = critical, cRLSign, keyCertSign
-subjectAltName            = $ENV::ALTNAME
-nsComment                 = "CA Certificate generated by Node-OPCUA Certificate utility using openssl"
-#nsCertType                 = sslCA, emailCA
-#issuerAltName              = issuer:copy
-#obj                        = DER:02:03
-{{#CDP_URL}}crlDistributionPoints     = URI:$ENV::CDP_URL
-{{/CDP_URL}}{{#AIA_VALUE}}authorityInfoAccess       = $ENV::AIA_VALUE
-{{/AIA_VALUE}}[ v3_selfsigned]
-basicConstraints          = critical, CA:FALSE
-keyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyAgreement
-extendedKeyUsage          = critical,serverAuth ,clientAuth
-nsComment                 = "Self-signed certificate, generated by NodeOPCUA"
-subjectAltName            = $ENV::ALTNAME
-
-[ crl_ext ]
-#issuerAltName            = issuer:copy
-authorityKeyIdentifier    = keyid:always,issuer:always
-#authorityInfoAccess       = @issuer_info`;
-var ca_config_template_cnf_default = config2;
-
-// packages/node-opcua-pki/lib/ca/certificate_authority.ts
-var defaultSubject = "/C=FR/ST=IDF/L=Paris/O=Local NODE-OPCUA Certificate Authority/CN=NodeOPCUA-CA";
-var configurationFileTemplate = ca_config_template_cnf_default;
-var configurationFileSimpleTemplate = simple_config_template_cnf_default;
-function escapeOpensslConfDoubleQuoted(value) {
-  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-}
-function renderCaConfig(caRootDir) {
-  return configurationFileTemplate.replace(/%%ROOT_FOLDER%%/, escapeOpensslConfDoubleQuoted(makePath(caRootDir)));
-}
-var config3 = {
-  certificateDir: "INVALID",
-  forceCA: false,
-  pkiDir: "INVALID"
-};
-var n4 = makePath;
-function octetStringToIpAddress(a) {
-  return parseInt(a.substring(0, 2), 16).toString() + "." + parseInt(a.substring(2, 4), 16).toString() + "." + parseInt(a.substring(4, 6), 16).toString() + "." + parseInt(a.substring(6, 8), 16).toString();
-}
-assert7(octetStringToIpAddress("c07b9179") === "192.123.145.121");
-async function construct_CertificateAuthority(certificateAuthority) {
-  const subject = certificateAuthority.subject;
-  const caRootDir = path5.resolve(certificateAuthority.rootDir);
-  async function make_folders() {
-    mkdirRecursiveSync(caRootDir);
-    ensurePrivateDirectory(path5.join(caRootDir, "private"));
-    mkdirRecursiveSync(path5.join(caRootDir, "public"));
-    mkdirRecursiveSync(path5.join(caRootDir, "certs"));
-    mkdirRecursiveSync(path5.join(caRootDir, "crl"));
-    mkdirRecursiveSync(path5.join(caRootDir, "conf"));
-  }
-  await make_folders();
-  async function construct_default_files() {
-    const serial = path5.join(caRootDir, "serial");
-    if (!fs7.existsSync(serial)) {
-      await fs7.promises.writeFile(serial, "1000");
-    }
-    const crlNumber = path5.join(caRootDir, "crlnumber");
-    if (!fs7.existsSync(crlNumber)) {
-      await fs7.promises.writeFile(crlNumber, "1000");
-    }
-    const indexFile = path5.join(caRootDir, "index.txt");
-    if (!fs7.existsSync(indexFile)) {
-      await fs7.promises.writeFile(indexFile, "");
-    }
-  }
-  await construct_default_files();
-  const caKeyExists = fs7.existsSync(path5.join(caRootDir, "private/cakey.pem"));
-  const caCertExists = fs7.existsSync(path5.join(caRootDir, "public/cacert.pem"));
-  if (caKeyExists && caCertExists && !config3.forceCA) {
-    restrictPrivateFilePermissions(path5.join(caRootDir, "private/cakey.pem"), 384);
-    await certificateAuthority._ensurePrivateKeyProtection();
-    debugLog("CA private key and certificate already exist ... skipping");
-    return;
-  }
-  if (caKeyExists && !caCertExists) {
-    debugLog("CA private key exists but cacert.pem is missing \u2014 rebuilding CA");
-    fs7.unlinkSync(path5.join(caRootDir, "private/cakey.pem"));
-    const staleCsr = path5.join(caRootDir, "private/cakey.csr");
-    if (fs7.existsSync(staleCsr)) {
-      fs7.unlinkSync(staleCsr);
-    }
-  }
-  displayTitle("Create Certificate Authority (CA)");
-  const indexFileAttr = path5.join(caRootDir, "index.txt.attr");
-  if (!fs7.existsSync(indexFileAttr)) {
-    await fs7.promises.writeFile(indexFileAttr, "unique_subject = no");
-  }
-  const caConfigFile = certificateAuthority.configFile;
-  if (1) {
-    await fs7.promises.writeFile(caConfigFile, renderCaConfig(caRootDir));
-  }
-  const subjectOpt = ["-subj", subject.toString()];
-  const caCommonName = subject.commonName || "NodeOPCUA-CA";
-  setEnv("ALTNAME", `URI:urn:${caCommonName}`);
-  certificateAuthority._wireRevocationEnvVars();
-  const options = { cwd: caRootDir };
-  const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-  const configOption = ["-config", n4(configFile)];
-  const keySize = certificateAuthority.keySize;
-  const privateKeyFilename = path5.join(caRootDir, "private/cakey.pem");
-  const csrFilename = path5.join(caRootDir, "private/cakey.csr");
-  displayTitle(`Generate the CA private Key - ${keySize}`);
-  const passin = await certificateAuthority._opensslPassin();
-  await generatePrivateKeyFile(privateKeyFilename, keySize, { passphrase: await certificateAuthority._privateKeyPassphrase() });
-  restrictPrivateFilePermissions(privateKeyFilename, 384);
-  displayTitle("Generate a certificate request for the CA key");
-  await execute_openssl(
-    [
-      "req",
-      "-new",
-      "-sha256",
-      "-text",
-      "-extensions",
-      "v3_ca_req",
-      ...configOption,
-      "-key",
-      n4(privateKeyFilename),
-      "-out",
-      n4(csrFilename),
-      ...subjectOpt,
-      ...passin.args
-    ],
-    { ...options, env: passin.env }
-  );
-  const issuerCA = certificateAuthority._issuerCA;
-  if (issuerCA) {
-    displayTitle("Generate CA Certificate (signed by issuer CA)");
-    const issuerCert = path5.resolve(issuerCA.caCertificate);
-    const issuerKey = path5.resolve(issuerCA.rootDir, "private/cakey.pem");
-    const issuerSerial = path5.resolve(issuerCA.rootDir, "serial");
-    const issuerPassin = await issuerCA._opensslPassin();
-    await execute_openssl(
-      [
-        "x509",
-        "-sha256",
-        "-req",
-        "-days",
-        "3650",
-        "-text",
-        "-extensions",
-        "v3_ca",
-        "-extfile",
-        n4(configFile),
-        "-in",
-        "private/cakey.csr",
-        "-CA",
-        n4(issuerCert),
-        "-CAkey",
-        n4(issuerKey),
-        "-CAserial",
-        n4(issuerSerial),
-        "-out",
-        "public/cacert.pem",
-        ...issuerPassin.args
-      ],
-      { ...options, env: issuerPassin.env }
-    );
-  } else {
-    displayTitle("Generate CA Certificate (self-signed)");
-    await execute_openssl(
-      [
-        "x509",
-        "-sha256",
-        "-req",
-        "-days",
-        "3650",
-        "-text",
-        "-extensions",
-        "v3_ca",
-        "-extfile",
-        n4(configFile),
-        "-in",
-        "private/cakey.csr",
-        "-signkey",
-        n4(privateKeyFilename),
-        "-out",
-        "public/cacert.pem",
-        ...passin.args
-      ],
-      { ...options, env: passin.env }
-    );
-  }
-  displaySubtitle("generate initial CRL (Certificate Revocation List)");
-  await regenerateCrl(certificateAuthority.revocationList, configOption, options, passin);
-  displayTitle("Create Certificate Authority (CA) ---> DONE");
-}
-async function regenerateCrl(revocationList, configOption, options, passin) {
-  displaySubtitle("regenerate CRL (Certificate Revocation List)");
-  await execute_openssl(["ca", "-gencrl", ...configOption, "-out", "crl/revocation_list.crl", ...passin.args], {
-    ...options,
-    env: passin.env
-  });
-  await execute_openssl(["crl", "-in", "crl/revocation_list.crl", "-out", "crl/revocation_list.der", "-outform", "der"], options);
-  displaySubtitle("Display (Certificate Revocation List)");
-  await execute_openssl(["crl", "-in", n4(revocationList), "-text", "-noout"], options);
-}
-function parseOpenSSLDate(dateStr) {
-  const raw = dateStr?.split(",")[0] ?? "";
-  if (raw.length < 12) return "";
-  const yy = parseInt(raw.substring(0, 2), 10);
-  const year = yy >= 70 ? 1900 + yy : 2e3 + yy;
-  const month = raw.substring(2, 4);
-  const day = raw.substring(4, 6);
-  const hour = raw.substring(6, 8);
-  const min = raw.substring(8, 10);
-  const sec = raw.substring(10, 12);
-  return `${year}-${month}-${day}T${hour}:${min}:${sec}Z`;
-}
-function validateRevocationUrl(url, fieldName) {
-  if (url === void 0) {
-    return void 0;
-  }
-  if (url === "") {
-    throw new Error(`${fieldName} must not be empty \u2014 pass undefined to disable the extension`);
-  }
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new Error(`${fieldName} is not a valid URL: ${url}`);
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error(`${fieldName} must use http: or https: (got ${parsed.protocol} in ${url})`);
-  }
-  if (!parsed.pathname || parsed.pathname === "/") {
-    throw new Error(`${fieldName} must include a path component (got ${url})`);
-  }
-  const isLoopback = parsed.hostname === "localhost" || parsed.hostname === "::1" || parsed.hostname.startsWith("127.");
-  if (isLoopback) {
-    console.warn(
-      `[node-opcua-pki] ${fieldName} points at loopback (${url}) \u2014 certificates issued with this URL will be unreachable from any other host.`
-    );
-  }
-  return url;
-}
-var CertificateAuthority = class {
-  /** RSA key size used when generating the CA private key. */
-  keySize;
-  /** Root filesystem path of the CA directory structure. */
-  location;
-  /** X.500 subject of the CA certificate. */
-  subject;
-  /** @internal Parent CA (undefined for root CAs). */
-  _issuerCA;
-  /** @internal Configured CDP / AIA URLs (US-202). */
-  _crlDistributionUrl;
-  _ocspResponderUrl;
-  _caIssuersUrl;
-  #privateKeyPassphrase;
-  /** resolved once (see `privateKeyPassphrase`); `#passphraseResolved` distinguishes "none" from "not yet" */
-  #resolvedPassphrase;
-  #passphraseResolved = false;
-  constructor(options) {
-    assert7(Object.prototype.hasOwnProperty.call(options, "location"));
-    assert7(Object.prototype.hasOwnProperty.call(options, "keySize"));
-    this.location = options.location;
-    this.keySize = options.keySize || 2048;
-    this.subject = new Subject2(options.subject || defaultSubject);
-    this._issuerCA = options.issuerCA;
-    this.#privateKeyPassphrase = options.privateKeyPassphrase;
-    if (options.crlDistributionUrl !== void 0) {
-      this.setCrlDistributionUrl(options.crlDistributionUrl);
-    }
-    if (options.ocspResponderUrl !== void 0) {
-      this.setOcspResponderUrl(options.ocspResponderUrl);
-    }
-    if (options.caIssuersUrl !== void 0) {
-      this.setCaIssuersUrl(options.caIssuersUrl);
-    }
-  }
-  /**
-   * Public URL where the CRL produced by this CA is reachable, or
-   * `undefined` if no CDP extension should be emitted on issued certs.
-   */
-  get crlDistributionUrl() {
-    return this._crlDistributionUrl;
-  }
-  /**
-   * Public URL of the OCSP responder, or `undefined` if no AIA OCSP
-   * leg should be emitted on issued certs.
-   */
-  get ocspResponderUrl() {
-    return this._ocspResponderUrl;
-  }
-  /**
-   * Public URL where the issuer's certificate can be fetched, or
-   * `undefined` if no AIA caIssuers leg should be emitted.
-   */
-  get caIssuersUrl() {
-    return this._caIssuersUrl;
-  }
-  /**
-   * Configure the URL embedded as `crlDistributionPoints` in every
-   * subsequently-issued certificate. Pass `undefined` to disable
-   * the extension entirely. Validated synchronously — throws on
-   * empty string, non-http(s) protocol, missing path. Warns (does
-   * not throw) when the URL points at loopback.
-   *
-   * @see US-202
-   */
-  setCrlDistributionUrl(url) {
-    this._crlDistributionUrl = validateRevocationUrl(url, "crlDistributionUrl");
-  }
-  /**
-   * Configure the OCSP responder URL embedded as the `OCSP` leg of
-   * the `authorityInfoAccess` extension on every subsequently-issued
-   * certificate. Pass `undefined` to disable.
-   *
-   * @see US-202
-   */
-  setOcspResponderUrl(url) {
-    this._ocspResponderUrl = validateRevocationUrl(url, "ocspResponderUrl");
-  }
-  /**
-   * Configure the caIssuers URL embedded as the `caIssuers` leg of
-   * the `authorityInfoAccess` extension on every subsequently-issued
-   * certificate. Pass `undefined` to disable.
-   *
-   * @see US-202
-   */
-  setCaIssuersUrl(url) {
-    this._caIssuersUrl = validateRevocationUrl(url, "caIssuersUrl");
-  }
-  /**
-   * @internal
-   * Populate the OpenSSL config substitution env vars (`CDP_URL` and
-   * `AIA_VALUE`) from the configured URLs, or unset them so the
-   * matching `{{#KEY}}...{{/KEY}}` blocks in the templates are
-   * stripped. MUST be called before every `generateStaticConfig`
-   * invocation that signs a certificate.
-   */
-  _wireRevocationEnvVars() {
-    unsetEnv("CDP_URL");
-    unsetEnv("AIA_VALUE");
-    if (this._crlDistributionUrl) {
-      setEnv("CDP_URL", this._crlDistributionUrl);
-    }
-    const aiaLegs = [];
-    if (this._ocspResponderUrl) {
-      aiaLegs.push(`OCSP;URI:${this._ocspResponderUrl}`);
-    }
-    if (this._caIssuersUrl) {
-      aiaLegs.push(`caIssuers;URI:${this._caIssuersUrl}`);
-    }
-    if (aiaLegs.length > 0) {
-      setEnv("AIA_VALUE", aiaLegs.join(","));
-    }
-  }
-  /** Absolute path to the CA root directory (alias for {@link location}). */
-  get rootDir() {
-    return this.location;
-  }
-  /** Path to the OpenSSL configuration file (`conf/caconfig.cnf`). */
-  get configFile() {
-    return path5.normalize(path5.join(this.rootDir, "./conf/caconfig.cnf"));
-  }
-  /** Path to the CA private key (`private/cakey.pem`); may be passphrase-encrypted, see {@link getPrivateKey}. */
-  get privateKey() {
-    return path5.join(path5.resolve(this.rootDir), "private/cakey.pem");
-  }
-  /**
-   * The CA private key, decrypted with the configured `privateKeyPassphrase`
-   * if it is encrypted. Fails closed (`PrivateKeyPassphraseRequiredError`)
-   * on an encrypted key with no or the wrong passphrase.
-   */
-  async getPrivateKey() {
-    return readPrivateKey(this.privateKey, await this._privateKeyPassphrase());
-  }
-  /**
-   * Enable, disable, or rotate the passphrase protecting `private/cakey.pem`
-   * (temp file + atomic rename, temp file removed on failure). Only
-   * rewrites the file: construct a new `CertificateAuthority` with the new
-   * passphrase to continue using it.
-   */
-  async reencryptPrivateKey(oldPassphrase, newPassphrase) {
-    const oldPass = await resolvePrivateKeyPassphrase(oldPassphrase);
-    const newPass = await resolvePrivateKeyPassphrase(newPassphrase);
-    const key = readPrivateKey(this.privateKey, oldPass);
-    await this.#rewritePrivateKeyFile(key, newPass);
-  }
-  async #rewritePrivateKeyFile(privateKey, passphrase) {
-    const tmpFilename = `${this.privateKey}.${process.pid}-${Date.now()}.tmp`;
-    try {
-      await writePrivateKeyFile(tmpFilename, privateKey, { passphrase });
-      await fs7.promises.rename(tmpFilename, this.privateKey);
-    } finally {
-      await fs7.promises.rm(tmpFilename, { force: true });
-    }
-  }
-  /** @internal resolve the configured passphrase, at most once per instance */
-  async _privateKeyPassphrase() {
-    if (!this.#passphraseResolved) {
-      this.#resolvedPassphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
-      this.#passphraseResolved = true;
-    }
-    return this.#resolvedPassphrase;
-  }
-  /** @internal `-passin env:` argv + env for every openssl call that loads this CA's key (always emitted, empty when none) */
-  async _opensslPassin() {
-    return passinArg(await this._privateKeyPassphrase());
-  }
-  /**
-   * @internal On an existing key: encrypt it in place if a passphrase is
-   * configured and it is still plaintext (secure by default: the option
-   * means "protect this key", not "ignore me"), then read it back so a
-   * wrong or missing passphrase fails initialize() closed rather than the
-   * first signing operation.
-   */
-  async _ensurePrivateKeyProtection() {
-    if (!fs7.existsSync(this.privateKey)) {
-      return;
-    }
-    if (this.#privateKeyPassphrase !== void 0 && !isEncryptedPrivateKeyFile(this.privateKey)) {
-      warningLog("CertificateAuthority: private key is plaintext but a passphrase is configured; encrypting it in place");
-      const plaintextKey = readPrivateKey(this.privateKey);
-      await this.#rewritePrivateKeyFile(plaintextKey, await this._privateKeyPassphrase());
-    }
-    await this.getPrivateKey();
-  }
-  /** Path to the CA certificate in PEM format (`public/cacert.pem`). */
-  get caCertificate() {
-    return makePath(this.rootDir, "./public/cacert.pem");
-  }
-  /**
-   * Path to the issuer certificate chain (`public/issuer_chain.pem`).
-   *
-   * This file is created by {@link installCACertificate} when the
-   * provided cert file contains additional issuer certificates
-   * (e.g. intermediate + root). It is appended to signed certs
-   * by {@link constructCertificateChain} to produce a full chain
-   * per OPC UA Part 6 §6.2.6.
-   */
-  get issuerCertificateChain() {
-    return makePath(this.rootDir, "./public/issuer_chain.pem");
-  }
-  /**
-   * Path to the current Certificate Revocation List in DER format.
-   * (`crl/revocation_list.der`)
-   */
-  get revocationListDER() {
-    return makePath(this.rootDir, "./crl/revocation_list.der");
-  }
-  /**
-   * Path to the current Certificate Revocation List in PEM format.
-   * (`crl/revocation_list.crl`)
-   */
-  get revocationList() {
-    return makePath(this.rootDir, "./crl/revocation_list.crl");
-  }
-  /**
-   * Path to the concatenated CA certificate + CRL file.
-   * Used by OpenSSL for CRL-based verification.
-   */
-  get caCertificateWithCrl() {
-    return makePath(this.rootDir, "./public/cacertificate_with_crl.pem");
-  }
-  // ---------------------------------------------------------------
-  // Buffer-based accessors (US-059)
-  // ---------------------------------------------------------------
-  /**
-   * Return the CA certificate as a DER-encoded buffer.
-   *
-   * @throws if the CA certificate file does not exist
-   *   (call {@link initialize} first).
-   */
-  getCACertificateDER() {
-    const pem = readCertificatePEM(this.caCertificate);
-    return convertPEMtoDER(pem);
-  }
-  /**
-   * Return the CA certificate as a PEM-encoded string.
-   *
-   * @throws if the CA certificate file does not exist
-   *   (call {@link initialize} first).
-   */
-  getCACertificatePEM() {
-    const raw = readCertificatePEM(this.caCertificate);
-    const beginMarker = "-----BEGIN CERTIFICATE-----";
-    const idx = raw.indexOf(beginMarker);
-    if (idx > 0) {
-      return raw.substring(idx);
-    }
-    return raw;
-  }
-  /**
-   * Return the current Certificate Revocation List as a
-   * DER-encoded buffer.
-   *
-   * Returns an empty buffer if no CRL has been generated yet.
-   */
-  getCRLDER() {
-    const crlPath = this.revocationListDER;
-    if (!fs7.existsSync(crlPath)) {
-      return Buffer.alloc(0);
-    }
-    return fs7.readFileSync(crlPath);
-  }
-  /**
-   * Return the current Certificate Revocation List as a
-   * PEM-encoded string.
-   *
-   * Returns an empty string if no CRL has been generated yet.
-   */
-  getCRLPEM() {
-    const crlPath = this.revocationList;
-    if (!fs7.existsSync(crlPath)) {
-      return "";
-    }
-    const raw = fs7.readFileSync(crlPath, "utf-8");
-    const beginMarker = "-----BEGIN X509 CRL-----";
-    const idx = raw.indexOf(beginMarker);
-    if (idx > 0) {
-      return raw.substring(idx);
-    }
-    return raw;
-  }
-  // ---------------------------------------------------------------
-  // Certificate database API (US-057)
-  // ---------------------------------------------------------------
-  /**
-   * Return a list of all issued certificates recorded in the
-   * OpenSSL `index.txt` database.
-   *
-   * Each entry includes the serial number, subject, status,
-   * expiry date, and (for revoked certs) the revocation date.
-   */
-  getIssuedCertificates() {
-    return this._parseIndexTxt();
-  }
-  /**
-   * Return the total number of certificates recorded in
-   * `index.txt`.
-   */
-  getIssuedCertificateCount() {
-    return this._parseIndexTxt().length;
-  }
-  /**
-   * Return the status of a certificate by its serial number.
-   *
-   * @param serial - hex-encoded serial number (e.g. `"1000"`)
-   * @returns `"valid"`, `"revoked"`, `"expired"`, or
-   *   `undefined` if not found
-   */
-  getCertificateStatus(serial) {
-    const upper = serial.toUpperCase();
-    const record = this._parseIndexTxt().find((r) => r.serial.toUpperCase() === upper);
-    return record?.status;
-  }
-  /**
-   * Read a specific issued certificate by serial number and
-   * return its content as a DER-encoded buffer.
-   *
-   * OpenSSL stores signed certificates in the `certs/`
-   * directory using the naming convention `<SERIAL>.pem`.
-   *
-   * @param serial - hex-encoded serial number (e.g. `"1000"`)
-   * @returns the DER buffer, or `undefined` if not found
-   */
-  getCertificateBySerial(serial) {
-    const upper = serial.toUpperCase();
-    const certFile = path5.join(this.rootDir, "certs", `${upper}.pem`);
-    if (!fs7.existsSync(certFile)) {
-      return void 0;
-    }
-    const pem = readCertificatePEM(certFile);
-    return convertPEMtoDER(pem);
-  }
-  /**
-   * Path to the OpenSSL certificate database file.
-   */
-  get indexFile() {
-    return path5.join(this.rootDir, "index.txt");
-  }
-  /**
-   * Parse the OpenSSL `index.txt` certificate database.
-   *
-   * Each line has tab-separated fields:
-   * ```
-   * status  expiry  [revocationDate]  serial  unknown  subject
-   * ```
-   *
-   * - status: `V` (valid), `R` (revoked), `E` (expired)
-   * - expiry: `YYMMDDHHmmssZ`
-   * - revocationDate: present only for revoked certs
-   * - serial: hex string
-   * - unknown: always `"unknown"`
-   * - subject: X.500 slash-delimited string
-   */
-  _parseIndexTxt() {
-    const indexPath = this.indexFile;
-    if (!fs7.existsSync(indexPath)) {
-      return [];
-    }
-    const content = fs7.readFileSync(indexPath, "utf-8");
-    const lines = content.split("\n").filter((l) => l.trim().length > 0);
-    const records = [];
-    for (const line of lines) {
-      const fields = line.split("	");
-      if (fields.length < 4) continue;
-      const statusChar = fields[0];
-      const expiryStr = fields[1];
-      let serial;
-      let subject;
-      let revocationDate;
-      if (statusChar === "R") {
-        revocationDate = fields[2];
-        serial = fields[3];
-        subject = fields.length >= 6 ? fields[5] : "";
-      } else {
-        serial = fields[3];
-        subject = fields.length >= 6 ? fields[5] : "";
-      }
-      let status;
-      switch (statusChar) {
-        case "V":
-          status = "valid";
-          break;
-        case "R":
-          status = "revoked";
-          break;
-        case "E":
-          status = "expired";
-          break;
-        default:
-          continue;
-      }
-      records.push({
-        serial,
-        status,
-        subject,
-        expiryDate: parseOpenSSLDate(expiryStr),
-        revocationDate: revocationDate ? parseOpenSSLDate(revocationDate) : void 0
-      });
-    }
-    return records;
-  }
-  // ---------------------------------------------------------------
-  // Buffer-based CA operations (US-058)
-  // ---------------------------------------------------------------
-  /**
-   * Sign a DER-encoded Certificate Signing Request and return
-   * the signed certificate as a DER buffer.
-   *
-   * This method handles temp-file creation and cleanup
-   * internally so that callers can work with in-memory
-   * buffers only.
-   *
-   * The CA can override fields from the CSR by passing
-   * `options.dns`, `options.ip`, `options.applicationUri`,
-   * `options.startDate`, or `options.subject`.
-   *
-   * @param csrDer - the CSR as a DER-encoded buffer
-   * @param options - signing options and CA overrides
-   * @returns the signed certificate as a DER-encoded buffer
-   */
-  async signCertificateRequestFromDER(csrDer, options) {
-    const tmpDir = await fs7.promises.mkdtemp(path5.join(os3.tmpdir(), "pki-sign-"));
-    try {
-      const csrFile = path5.join(tmpDir, "request.csr");
-      const certFile = path5.join(tmpDir, "certificate.pem");
-      const csrPem = toPem(csrDer, "CERTIFICATE REQUEST");
-      await fs7.promises.writeFile(csrFile, csrPem, "utf-8");
-      const signingParams = {};
-      if (options?.validityMs !== void 0) signingParams.validityMs = options.validityMs;
-      else signingParams.validity = options?.validity ?? 365;
-      if (options?.startDate) signingParams.startDate = options.startDate;
-      if (options?.dns) signingParams.dns = options.dns;
-      if (options?.ip) signingParams.ip = options.ip;
-      if (options?.applicationUri) signingParams.applicationUri = options.applicationUri;
-      if (options?.subject) signingParams.subject = options.subject;
-      await this.signCertificateRequest(certFile, csrFile, signingParams);
-      const certPem = readCertificatePEM(certFile);
-      return convertPEMtoDER(certPem);
-    } finally {
-      await fs7.promises.rm(tmpDir, {
-        recursive: true,
-        force: true
-      });
-    }
-  }
-  /**
-   * Advertise the validity limits this CA can honor.
-   *
-   * Consumers (notably the GDS server in [`cert_auth.ts`](https://github.com/sterfive/node-opcua-gds))
-   * clamp a requested validity against these bounds before calling
-   * {@link signCertificateRequestFromDER}, so a misconfigured
-   * `defaultCertValidity` cannot ask the CA for something it cannot
-   * produce.
-   *
-   * Defaults match the OpenSSL-backed implementation:
-   * - `minValidityMs = 60_000` (1 minute) — practical floor; the
-   *   X.509 spec floor is 1 second but very short certs are rarely
-   *   useful and pathological for any real deployment.
-   * - `maxValidityMs = 10 * 365 * 86_400_000` (≈ 10 years) — long
-   *   enough for root CAs.
-   * - `validityGranularityMs = 1_000` (1 second) — RFC 5280 §4.1.2.5
-   *   floor on `notBefore` / `notAfter`.
-   * - `nativeUnit = "second"` — what `x509Date()` actually encodes.
-   *
-   * @see US-208 — the consumer-side capability story.
-   */
-  getCapabilities() {
-    return {
-      minValidityMs: 6e4,
-      maxValidityMs: 10 * 365 * 864e5,
-      validityGranularityMs: 1e3,
-      nativeUnit: "second"
-    };
-  }
-  /**
-   * Generate a new RSA key pair, create an internal CSR, sign it
-   * with this CA, and return both the certificate and private key
-   * as DER-encoded buffers.
-   *
-   * The private key is **never stored** by the CA — it exists only
-   * in a temporary directory that is cleaned up after the operation.
-   *
-   * This is used by `StartNewKeyPairRequest` (OPC UA Part 12) for
-   * constrained devices that cannot generate their own keys.
-   *
-   * @param options - key generation and certificate parameters
-   * @returns `{ certificateDer, privateKey }` — certificate as DER,
-   *   private key as a branded `PrivateKey` buffer
-   */
-  async generateKeyPairAndSignDER(options) {
-    const keySize = options.keySize ?? 2048;
-    const startDate = options.startDate ?? /* @__PURE__ */ new Date();
-    const tmpDir = await fs7.promises.mkdtemp(path5.join(os3.tmpdir(), "pki-keygen-"));
-    try {
-      const privateKeyFile = path5.join(tmpDir, "private_key.pem");
-      await generatePrivateKeyFile(privateKeyFile, keySize);
-      const configFile = path5.join(tmpDir, "openssl.cnf");
-      await fs7.promises.writeFile(configFile, configurationFileSimpleTemplate, "utf-8");
-      const csrFile = path5.join(tmpDir, "request.csr");
-      await createCertificateSigningRequestWithOpenSSL(csrFile, {
-        rootDir: tmpDir,
-        configFile,
-        privateKey: privateKeyFile,
-        applicationUri: options.applicationUri,
-        subject: options.subject,
-        dns: options.dns ?? [],
-        ip: options.ip ?? [],
-        purpose: CertificatePurpose.ForApplication
-      });
-      const certFile = path5.join(tmpDir, "certificate.pem");
-      const signingParams = {
-        applicationUri: options.applicationUri,
-        dns: options.dns,
-        ip: options.ip,
-        startDate
-      };
-      if (options.validityMs !== void 0) signingParams.validityMs = options.validityMs;
-      else signingParams.validity = options.validity ?? 365;
-      await this.signCertificateRequest(certFile, csrFile, signingParams);
-      const certPem = readCertificatePEM(certFile);
-      const certificateDer = convertPEMtoDER(certPem);
-      const privateKey = readPrivateKey(privateKeyFile);
-      return { certificateDer, privateKey };
-    } finally {
-      await fs7.promises.rm(tmpDir, {
-        recursive: true,
-        force: true
-      });
-    }
-  }
-  /**
-   * Generate a new RSA key pair, create an internal CSR, sign it
-   * with this CA, and return the result as a PKCS#12 (PFX)
-   * buffer bundling the certificate, private key, and CA chain.
-   *
-   * The private key is **never stored** by the CA — it exists only
-   * in a temporary directory that is cleaned up after the operation.
-   *
-   * @param options - key generation, certificate, and PFX options
-   * @returns the PFX as a `Buffer`
-   */
-  async generateKeyPairAndSignPFX(options) {
-    const keySize = options.keySize ?? 2048;
-    const startDate = options.startDate ?? /* @__PURE__ */ new Date();
-    const passphrase = options.passphrase ?? "";
-    const tmpDir = await fs7.promises.mkdtemp(path5.join(os3.tmpdir(), "pki-keygen-pfx-"));
-    try {
-      const privateKeyFile = path5.join(tmpDir, "private_key.pem");
-      await generatePrivateKeyFile(privateKeyFile, keySize);
-      const configFile = path5.join(tmpDir, "openssl.cnf");
-      await fs7.promises.writeFile(configFile, configurationFileSimpleTemplate, "utf-8");
-      const csrFile = path5.join(tmpDir, "request.csr");
-      await createCertificateSigningRequestWithOpenSSL(csrFile, {
-        rootDir: tmpDir,
-        configFile,
-        privateKey: privateKeyFile,
-        applicationUri: options.applicationUri,
-        subject: options.subject,
-        dns: options.dns ?? [],
-        ip: options.ip ?? [],
-        purpose: CertificatePurpose.ForApplication
-      });
-      const certFile = path5.join(tmpDir, "certificate.pem");
-      const signingParams = {
-        applicationUri: options.applicationUri,
-        dns: options.dns,
-        ip: options.ip,
-        startDate
-      };
-      if (options.validityMs !== void 0) signingParams.validityMs = options.validityMs;
-      else signingParams.validity = options.validity ?? 365;
-      await this.signCertificateRequest(certFile, csrFile, signingParams);
-      const pfxFile = path5.join(tmpDir, "bundle.pfx");
-      await createPFX({
-        certificateFile: certFile,
-        privateKeyFile,
-        outputFile: pfxFile,
-        passphrase,
-        caCertificateFiles: [this.caCertificate]
-      });
-      return await fs7.promises.readFile(pfxFile);
-    } finally {
-      await fs7.promises.rm(tmpDir, {
-        recursive: true,
-        force: true
-      });
-    }
-  }
-  /**
-   * Revoke a DER-encoded certificate and regenerate the CRL.
-   *
-   * Extracts the serial number from the certificate, then
-   * uses the stored cert file at `certs/<serial>.pem` for
-   * revocation — avoiding temp-file PEM format mismatches.
-   *
-   * @param certDer - the certificate as a DER-encoded buffer
-   * @param reason - CRL reason code
-   *   (default: `"keyCompromise"`)
-   * @throws if the certificate's serial is not found in the CA
-   */
-  async revokeCertificateDER(certDer, reason) {
-    const info = exploreCertificate(certDer);
-    const serial = info.tbsCertificate.serialNumber.replace(/:/g, "").toUpperCase();
-    const storedCertFile = path5.join(this.rootDir, "certs", `${serial}.pem`);
-    if (!fs7.existsSync(storedCertFile)) {
-      throw new Error(`Cannot revoke: no stored certificate found for serial ${serial} at ${storedCertFile}`);
-    }
-    await this.revokeCertificate(storedCertFile, {
-      reason: reason ?? "keyCompromise"
-    });
+// packages/node-opcua-pki/lib/ca/backends/openssl_ca_backend.ts
+var n2 = makePath;
+function caAltName(ca) {
+  return `URI:urn:${ca.subject.commonName || "NodeOPCUA-CA"}`;
+}
+function caConfigEnvOverrides(ca, altName = caAltName(ca)) {
+  const aiaLegs = [];
+  if (ca.ocspResponderUrl) {
+    aiaLegs.push(`OCSP;URI:${ca.ocspResponderUrl}`);
   }
-  /**
-   * Initialize the CA directory structure, generate the CA
-   * private key and self-signed certificate if they do not
-   * already exist.
-   */
-  async initialize() {
-    await construct_CertificateAuthority(this);
+  if (ca.caIssuersUrl) {
+    aiaLegs.push(`caIssuers;URI:${ca.caIssuersUrl}`);
   }
+  return {
+    ALTNAME: altName,
+    CDP_URL: ca.crlDistributionUrl ?? "",
+    AIA_VALUE: aiaLegs.join(",")
+  };
+}
+var OpenSslCaBackend = class {
+  /** This backend is the `openssl` executable, so it has to be there. */
   /**
-   * Initialize the CA directory structure and generate the
-   * private key + CSR **without signing**.
-   *
-   * Use this when the CA certificate will be signed by an
-   * external (third-party) root CA.  After receiving the signed
-   * certificate, call {@link installCACertificate} to complete
-   * the setup.
-   *
-   * **Idempotent / restart-safe:**
-   * - If the CA certificate exists and is valid → `{ status: "ready" }`
-   * - If the CA certificate has expired → `{ status: "expired", csrPath, expiryDate }`
-   *   (a new CSR is generated, preserving the existing private key)
-   * - If key + CSR exist but no cert (restart before install) →
-   *   `{ status: "pending", csrPath }` without regenerating
-   * - Otherwise → generates key + CSR → `{ status: "created", csrPath }`
-   *
-   * @returns an {@link InitializeCSRResult} describing the CA state
+   * `-passin env:` argv and env for an openssl call that has to load this
+   * CA's key. Built here rather than on the CA: the passphrase is the
+   * CA's business, but expressing it as an openssl argument is this
+   * backend's, and the core has no reason to know the flag exists.
    */
-  async initializeCSR() {
-    const caRootDir = path5.resolve(this.rootDir);
-    mkdirRecursiveSync(caRootDir);
-    for (const dir of ["public", "certs", "crl", "conf"]) {
-      mkdirRecursiveSync(path5.join(caRootDir, dir));
-    }
-    ensurePrivateDirectory(path5.join(caRootDir, "private"));
-    const caCertFile = this.caCertificate;
-    const privateKeyFile = path5.join(caRootDir, "private/cakey.pem");
-    const csrFile = path5.join(caRootDir, "private/cakey.csr");
-    if (fs7.existsSync(privateKeyFile)) {
-      restrictPrivateFilePermissions(privateKeyFile, 384);
-      await this._ensurePrivateKeyProtection();
-    }
-    if (fs7.existsSync(caCertFile)) {
-      const certDer = convertPEMtoDER(readCertificatePEM(caCertFile));
-      const certInfo = exploreCertificate(certDer);
-      const notAfter = certInfo.tbsCertificate.validity.notAfter;
-      if (notAfter.getTime() < Date.now()) {
-        debugLog("CA certificate has expired \u2014 generating renewal CSR");
-        await this._generateCSR(caRootDir, privateKeyFile, csrFile);
-        return { status: "expired", csrPath: csrFile, expiryDate: notAfter };
-      }
-      debugLog("CA certificate already exists and is valid \u2014 ready");
-      return { status: "ready" };
-    }
-    if (fs7.existsSync(privateKeyFile) && fs7.existsSync(csrFile)) {
-      debugLog("CA key + CSR already exist \u2014 pending external signing");
-      return { status: "pending", csrPath: csrFile };
-    }
-    const serial = path5.join(caRootDir, "serial");
-    if (!fs7.existsSync(serial)) {
-      await fs7.promises.writeFile(serial, "1000");
-    }
-    const crlNumber = path5.join(caRootDir, "crlnumber");
-    if (!fs7.existsSync(crlNumber)) {
-      await fs7.promises.writeFile(crlNumber, "1000");
-    }
-    const indexFile = path5.join(caRootDir, "index.txt");
-    if (!fs7.existsSync(indexFile)) {
-      await fs7.promises.writeFile(indexFile, "");
-    }
-    const indexFileAttr = path5.join(caRootDir, "index.txt.attr");
-    if (!fs7.existsSync(indexFileAttr)) {
-      await fs7.promises.writeFile(indexFileAttr, "unique_subject = no");
-    }
-    const caConfigFile = this.configFile;
-    await fs7.promises.writeFile(caConfigFile, renderCaConfig(caRootDir));
-    if (!fs7.existsSync(privateKeyFile)) {
-      await generatePrivateKeyFile(privateKeyFile, this.keySize, { passphrase: await this._privateKeyPassphrase() });
-      restrictPrivateFilePermissions(privateKeyFile, 384);
-    }
-    await this._generateCSR(caRootDir, privateKeyFile, csrFile);
-    return { status: "created", csrPath: csrFile };
+  async #passin(ca) {
+    return passinArg(await ca._privateKeyPassphrase());
   }
-  /**
-   * Check whether the CA certificate needs renewal and, if so,
-   * generate a new CSR for re-signing by the external root CA.
-   *
-   * Use this while the CA is running to detect upcoming expiry
-   * **before** it actually expires. The existing private key is
-   * preserved so previously issued certs remain valid.
-   *
-   * @param thresholdDays - number of days before expiry at which
-   *   to trigger renewal (default: 30)
-   * @returns an {@link InitializeCSRResult} — `"expired"` if
-   *   renewal is needed, `"ready"` if the cert is still valid
-   */
-  async renewCSR(thresholdDays = 30) {
-    const caRootDir = path5.resolve(this.rootDir);
-    const caCertFile = this.caCertificate;
-    const privateKeyFile = path5.join(caRootDir, "private/cakey.pem");
-    const csrFile = path5.join(caRootDir, "private/cakey.csr");
-    if (!fs7.existsSync(caCertFile)) {
-      return this.initializeCSR();
-    }
-    const certDer = convertPEMtoDER(readCertificatePEM(caCertFile));
-    const certInfo = exploreCertificate(certDer);
-    const notAfter = certInfo.tbsCertificate.validity.notAfter;
-    const thresholdMs = thresholdDays * 24 * 60 * 60 * 1e3;
-    if (notAfter.getTime() - Date.now() < thresholdMs) {
-      debugLog(`CA certificate expires within ${thresholdDays} days \u2014 generating renewal CSR`);
-      await this._generateCSR(caRootDir, privateKeyFile, csrFile);
-      return { status: "expired", csrPath: csrFile, expiryDate: notAfter };
-    }
-    return { status: "ready" };
+  /** The openssl CLI loads its key from a file, so it cannot call out to an HSM. */
+  supportsExternalSigner = false;
+  async preflight() {
+    await ensure_openssl_installed();
   }
   /**
-   * Generate a CSR using the existing private key.
-   * @internal
+   * Render `conf/caconfig.cnf` once with explicit overrides, run `fn`
+   * with the rendered path, and always remove the temp file. Structural
+   * guarantee that (a) every render carries the three required env
+   * values and (b) no rendered `<name>.<pid>-<n>.tmp` file is ever left
+   * behind — each was previously a per-method discipline.
    */
-  async _generateCSR(caRootDir, privateKeyFile, csrFile) {
-    processAltNames({});
+  async #withConfig(ca, altName, fn) {
+    const caRootDir = path3.resolve(ca.rootDir);
     const options = { cwd: caRootDir };
-    const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-    const passin = await this._opensslPassin();
+    const configFile = generateStaticConfig("conf/caconfig.cnf", options, caConfigEnvOverrides(ca, altName));
+    try {
+      return await fn(configFile, options);
+    } finally {
+      await cleanupStaticConfig(configFile, options);
+    }
+  }
+  async #generateCaCsrWith(ca, configFile, options, privateKeyFile, csrFile) {
+    const passin = await this.#passin(ca);
+    displayTitle("Generate a certificate request for the CA key");
     await execute_openssl(
       [
         "req",
         "-new",
         "-sha256",
-        "-text",
         "-extensions",
         "v3_ca_req",
         "-config",
-        n4(configFile),
+        n2(configFile),
         "-key",
-        n4(privateKeyFile),
+        n2(privateKeyFile),
         "-out",
-        n4(csrFile),
+        n2(csrFile),
         "-subj",
-        this.subject.toString(),
+        ca.subject.toString(),
         ...passin.args
       ],
       { ...options, env: passin.env }
     );
   }
   /**
-   * Install an externally-signed CA certificate and generate
-   * the initial CRL.
-   *
-   * Call this after {@link initializeCSR} once the external
-   * root CA has signed the CSR.
-   *
-   * **Safety checks:**
-   * - Verifies that the certificate's public key matches the
-   *   CA private key before installing.
-   *
-   * @param signedCertFile - path to the PEM-encoded signed
-   *   CA certificate (issued by the external root CA)
-   * @returns an {@link InstallCACertificateResult} with
-   *   `status: "success"` or `status: "error"` and a `reason`
-   */
-  async installCACertificate(signedCertFile) {
-    const caRootDir = path5.resolve(this.rootDir);
-    const caCertFile = this.caCertificate;
-    const fullPem = await fs7.promises.readFile(signedCertFile, "utf8");
-    const pemBlocks = fullPem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
-    if (!pemBlocks || pemBlocks.length === 0) {
-      return {
-        status: "error",
-        reason: "no_certificate_found",
-        message: "The provided file does not contain any PEM-encoded certificate."
-      };
-    }
-    const certDer = convertPEMtoDER(pemBlocks[0]);
-    const privateKey = await this.getPrivateKey();
-    if (!certificateMatchesPrivateKey(certDer, privateKey)) {
-      return {
-        status: "error",
-        reason: "certificate_key_mismatch",
-        message: "The provided certificate does not match the CA private key. Ensure the certificate was signed from the CSR generated by initializeCSR()."
-      };
-    }
-    await fs7.promises.writeFile(caCertFile, `${pemBlocks[0]}
-`);
-    const issuerChainFile = this.issuerCertificateChain;
-    if (pemBlocks.length > 1) {
-      const issuerPem = `${pemBlocks.slice(1).join("\n")}
-`;
-      await fs7.promises.writeFile(issuerChainFile, issuerPem);
-      debugLog(`Stored ${pemBlocks.length - 1} issuer certificate(s) in issuer_chain.pem`);
-    } else {
-      if (fs7.existsSync(issuerChainFile)) {
-        await fs7.promises.unlink(issuerChainFile);
-      }
-    }
-    const options = { cwd: caRootDir };
-    const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-    await regenerateCrl(this.revocationList, ["-config", n4(configFile)], options, await this._opensslPassin());
-    return { status: "success" };
-  }
-  /**
-   * Sign a CSR with CA extensions (`v3_ca`), producing a
-   * subordinate CA certificate.
-   *
-   * Unlike {@link signCertificateRequest} which signs with
-   * end-entity extensions (SANs, etc.), this method signs
-   * with `basicConstraints = CA:TRUE` and `keyUsage =
-   * keyCertSign, cRLSign`.
-   *
-   * @param certFile - output path for the signed CA cert (PEM)
-   * @param csrFile - path to the subordinate CA's CSR
-   * @param params - signing parameters
+   * `openssl ca -gencrl` signs the CRL with the CA key it finds through the
+   * config file (`private_key = $dir/private/cakey.pem`), so it needs the
+   * CA passphrase like every other `openssl ca` invocation.
    */
-  async signCACertificateRequest(certFile, csrFile, params) {
-    const caRootDir = path5.resolve(this.rootDir);
-    const options = { cwd: caRootDir };
-    this._wireRevocationEnvVars();
-    const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-    const validity = params.validity ?? 3650;
-    const passin = await this._opensslPassin();
+  async #regenerateCrlWith(ca, configFile, options) {
+    const passin = await this.#passin(ca);
+    displaySubtitle("regenerate CRL (Certificate Revocation List)");
+    await execute_openssl(["ca", "-gencrl", "-config", n2(configFile), "-out", "crl/revocation_list.crl", ...passin.args], {
+      ...options,
+      env: passin.env
+    });
     await execute_openssl(
-      [
-        "x509",
-        "-sha256",
-        "-req",
-        "-days",
-        String(validity),
-        "-text",
-        "-extensions",
-        "v3_ca",
-        "-extfile",
-        n4(configFile),
-        "-in",
-        n4(csrFile),
-        "-CA",
-        n4(this.caCertificate),
-        "-CAkey",
-        n4(path5.join(caRootDir, "private/cakey.pem")),
-        "-CAserial",
-        n4(path5.join(caRootDir, "serial")),
-        "-out",
-        n4(certFile),
-        ...passin.args
-      ],
-      { ...options, env: passin.env }
+      ["crl", "-in", "crl/revocation_list.crl", "-out", "crl/revocation_list.der", "-outform", "der"],
+      options
+    );
+    displaySubtitle("Display (Certificate Revocation List)");
+    await execute_openssl(["crl", "-in", n2(ca.revocationList), "-text", "-noout"], options);
+  }
+  async generateCaCsr(ca, _caRootDir, privateKeyFile, csrFile) {
+    await this.#withConfig(
+      ca,
+      caAltName(ca),
+      (configFile, options) => this.#generateCaCsrWith(ca, configFile, options, privateKeyFile, csrFile)
     );
-    await this.constructCertificateChain(certFile);
   }
-  /**
-   * Rebuild the combined CA certificate + CRL file.
-   *
-   * This concatenates the CA certificate with the current
-   * revocation list so that OpenSSL can verify certificates
-   * with CRL checking enabled.
-   */
-  async constructCACertificateWithCRL() {
-    const cacertWithCRL = this.caCertificateWithCrl;
-    if (fs7.existsSync(this.revocationList)) {
-      await fs7.promises.writeFile(
-        cacertWithCRL,
-        fs7.readFileSync(this.caCertificate, "utf8") + fs7.readFileSync(this.revocationList, "utf8")
+  async bootstrap(ca) {
+    const caRootDir = path3.resolve(ca.rootDir);
+    const privateKeyFilename = path3.join(caRootDir, "private/cakey.pem");
+    const csrFilename = path3.join(caRootDir, "private/cakey.csr");
+    await this.#withConfig(ca, caAltName(ca), async (configFile, options) => {
+      await this.#generateCaCsrWith(ca, configFile, options, privateKeyFilename, csrFilename);
+      const issuerCA = ca._issuerCA;
+      if (issuerCA) {
+        displayTitle("Generate CA Certificate (signed by issuer CA)");
+        const issuerCert = path3.resolve(issuerCA.caCertificate);
+        const issuerKey = path3.resolve(issuerCA.rootDir, "private/cakey.pem");
+        const issuerSerial = path3.resolve(issuerCA.rootDir, "serial");
+        const issuerPassin = await this.#passin(issuerCA);
+        const signWithIssuer = async () => {
+          await execute_openssl(
+            [
+              "x509",
+              "-sha256",
+              "-req",
+              "-days",
+              "3650",
+              "-extensions",
+              "v3_ca",
+              "-extfile",
+              n2(configFile),
+              "-in",
+              "private/cakey.csr",
+              "-CA",
+              n2(issuerCert),
+              "-CAkey",
+              n2(issuerKey),
+              "-CAserial",
+              n2(issuerSerial),
+              "-out",
+              "public/cacert.pem",
+              ...issuerPassin.args
+            ],
+            { ...options, env: issuerPassin.env }
+          );
+        };
+        if (path3.resolve(issuerCA.rootDir) === caRootDir) {
+          await signWithIssuer();
+        } else {
+          await issuerCA._withCaDirectoryLock(signWithIssuer);
+        }
+      } else {
+        displayTitle("Generate CA Certificate (self-signed)");
+        const passin = await this.#passin(ca);
+        await execute_openssl(
+          [
+            "x509",
+            "-sha256",
+            "-req",
+            "-days",
+            "3650",
+            "-extensions",
+            "v3_ca",
+            "-extfile",
+            n2(configFile),
+            "-in",
+            "private/cakey.csr",
+            "-signkey",
+            n2(privateKeyFilename),
+            "-out",
+            "public/cacert.pem",
+            ...passin.args
+          ],
+          { ...options, env: passin.env }
+        );
+      }
+      displaySubtitle("generate initial CRL (Certificate Revocation List)");
+      await this.#regenerateCrlWith(ca, configFile, options);
+    });
+    displayTitle("Create Certificate Authority (CA) ---> DONE");
+  }
+  async regenerateCrl(ca) {
+    await this.#withConfig(ca, caAltName(ca), (configFile, options) => this.#regenerateCrlWith(ca, configFile, options));
+  }
+  async signSubordinateCsr(ca, csrFile, certFile, validityDays) {
+    await this.#withConfig(ca, caAltName(ca), async (configFile, options) => {
+      const caRootDir = options.cwd;
+      const passin = await this.#passin(ca);
+      await execute_openssl(
+        [
+          "x509",
+          "-sha256",
+          "-req",
+          "-days",
+          String(validityDays),
+          "-extensions",
+          "v3_ca",
+          "-extfile",
+          n2(configFile),
+          "-in",
+          n2(csrFile),
+          "-CA",
+          n2(ca.caCertificate),
+          "-CAkey",
+          n2(path3.join(caRootDir, "private/cakey.pem")),
+          "-CAserial",
+          n2(path3.join(caRootDir, "serial")),
+          "-out",
+          n2(certFile),
+          ...passin.args
+        ],
+        { ...options, env: passin.env }
       );
-    } else {
-      await fs7.promises.writeFile(cacertWithCRL, fs7.readFileSync(this.caCertificate));
-    }
+    });
   }
-  /**
-   * Append the CA certificate to a signed certificate file,
-   * creating a PEM certificate chain.
-   *
-   * @param certificate - path to the certificate file to extend
-   */
-  async constructCertificateChain(certificate) {
-    assert7(fs7.existsSync(certificate));
-    assert7(fs7.existsSync(this.caCertificate));
-    debugLog(chalk5.yellow("        certificate file :"), chalk5.cyan(certificate));
-    let chain = await fs7.promises.readFile(certificate, "utf8");
-    chain += await fs7.promises.readFile(this.caCertificate, "utf8");
-    if (fs7.existsSync(this.issuerCertificateChain)) {
-      chain += await fs7.promises.readFile(this.issuerCertificateChain, "utf8");
-    }
-    await fs7.promises.writeFile(certificate, chain);
+  async signEndEntityCsr(ca, certificate, csr, params1, sanOverride) {
+    await this.#withConfig(ca, buildSubjectAltNameString(sanOverride), async (configFile, options) => {
+      displaySubtitle("- then we ask the authority to sign the certificate signing request");
+      const passin = await this.#passin(ca);
+      await execute_openssl(
+        [
+          "ca",
+          "-config",
+          configFile,
+          "-startdate",
+          x509Date(params1.startDate),
+          "-enddate",
+          x509Date(params1.endDate),
+          "-batch",
+          "-out",
+          n2(certificate),
+          "-in",
+          n2(csr),
+          ...passin.args
+        ],
+        { ...options, env: passin.env }
+      );
+      displaySubtitle("- dump the certificate for a check");
+      await execute_openssl(["x509", "-in", n2(certificate), "-dates", "-fingerprint", "-purpose", "-noout"], options);
+    });
   }
-  /**
-   * Create a self-signed certificate using OpenSSL.
-   *
-   * @param certificateFile - output path for the signed certificate
-   * @param privateKey - path to the private key file
-   * @param params - certificate parameters (subject, validity, SANs)
-   */
-  async createSelfSignedCertificate(certificateFile, privateKey, params) {
-    assert7(typeof privateKey === "string");
-    assert7(fs7.existsSync(privateKey));
-    if (!certificateFileExist(certificateFile)) {
-      return;
-    }
-    adjustDate(params);
-    adjustApplicationUri(params);
-    processAltNames(params);
-    const csrFile = `${certificateFile}_csr`;
-    assert7(csrFile);
-    const configFile = generateStaticConfig(this.configFile, { cwd: this.rootDir });
-    const options = {
-      cwd: this.rootDir,
-      openssl_conf: makePath(configFile)
-    };
-    const subject = params.subject ? new Subject2(params.subject).toString() : "";
-    const subjectOptions = subject && subject.length > 1 ? ["-subj", subject] : [];
-    displaySubtitle("- the certificate signing request");
-    await execute_openssl(
-      ["req", "-new", "-sha256", "-text", ...subjectOptions, "-batch", "-key", n4(privateKey), "-out", n4(csrFile)],
-      options
-    );
-    displaySubtitle("- creating the self-signed certificate");
-    await execute_openssl(
-      [
-        "ca",
-        "-selfsign",
-        "-keyfile",
-        n4(privateKey),
-        "-startdate",
-        x509Date(params.startDate),
-        "-enddate",
-        x509Date(params.endDate),
-        "-batch",
-        "-out",
-        n4(certificateFile),
-        "-in",
-        n4(csrFile)
-      ],
-      options
-    );
-    displaySubtitle("- dump the certificate for a check");
-    await execute_openssl(["x509", "-in", n4(certificateFile), "-dates", "-fingerprint", "-purpose", "-noout"], {});
-    displaySubtitle("- verify self-signed certificate");
-    await execute_openssl_no_failure(["verify", "-verbose", "-CAfile", n4(certificateFile), n4(certificateFile)], options);
-    await fs7.promises.unlink(csrFile);
+  async revoke(ca, certificate, reason) {
+    setEnv("RANDFILE", path3.join(ca.rootDir, "random.rnd"));
+    await this.#withConfig(ca, caAltName(ca), async (configFile, options) => {
+      displaySubtitle("Revoke certificate");
+      const passin = await this.#passin(ca);
+      await execute_openssl_no_failure(
+        ["ca", "-verbose", "-config", n2(configFile), "-revoke", certificate, "-crl_reason", reason, ...passin.args],
+        { ...options, env: passin.env }
+      );
+      await this.#regenerateCrlWith(ca, configFile, options);
+      displaySubtitle("Verify that certificate is revoked");
+      await execute_openssl_no_failure(
+        [
+          "verify",
+          "-verbose",
+          "-CRLfile",
+          n2(ca.revocationList),
+          "-CAfile",
+          n2(ca.caCertificate),
+          "-crl_check",
+          n2(certificate)
+        ],
+        options
+      );
+      displaySubtitle("Produce CRL in DER form ");
+      await execute_openssl(
+        ["crl", "-in", n2(ca.revocationList), "-out", "crl/revocation_list.der", "-outform", "der"],
+        options
+      );
+      displaySubtitle("Produce CRL in PEM form ");
+      await execute_openssl(
+        ["crl", "-in", n2(ca.revocationList), "-out", "crl/revocation_list.pem", "-outform", "pem", "-text"],
+        options
+      );
+    });
   }
-  /**
-   * Revoke a certificate and regenerate the CRL.
-   *
-   * @param certificate - path to the certificate file to revoke
-   * @param params - revocation parameters
-   * @param params.reason - CRL reason code
-   *   (default `"keyCompromise"`)
-   */
-  async revokeCertificate(certificate, params) {
-    const crlReasons = [
-      "unspecified",
-      "keyCompromise",
-      "CACompromise",
-      "affiliationChanged",
-      "superseded",
-      "cessationOfOperation",
-      "certificateHold",
-      "removeFromCRL"
-    ];
-    const configFile = generateStaticConfig("conf/caconfig.cnf", { cwd: this.rootDir });
+  async createSelfSignedCertificate(ca, certificateFile, privateKeyFile, params) {
+    const envOverrides = caConfigEnvOverrides(ca, buildSubjectAltNameString(params));
+    const configFile = generateStaticConfig(ca.configFile, { cwd: ca.rootDir }, envOverrides);
     const options = {
-      cwd: this.rootDir,
+      cwd: ca.rootDir,
       openssl_conf: makePath(configFile)
     };
-    setEnv("ALTNAME", "");
-    const randomFile = path5.join(this.rootDir, "random.rnd");
-    setEnv("RANDFILE", randomFile);
-    const configOption = ["-config", n4(configFile)];
-    const reason = params.reason || "keyCompromise";
-    assert7(crlReasons.indexOf(reason) >= 0);
-    displayTitle(`Revoking certificate  ${certificate}`);
-    displaySubtitle("Revoke certificate");
-    const passin = await this._opensslPassin();
-    await execute_openssl_no_failure(
-      ["ca", "-verbose", ...configOption, "-revoke", certificate, "-crl_reason", reason, ...passin.args],
-      { ...options, env: passin.env }
-    );
-    await regenerateCrl(this.revocationList, configOption, options, passin);
-    displaySubtitle("Verify that certificate is revoked");
-    await execute_openssl_no_failure(
-      [
-        "verify",
-        "-verbose",
-        "-CRLfile",
-        n4(this.revocationList),
-        "-CAfile",
-        n4(this.caCertificate),
-        "-crl_check",
-        n4(certificate)
-      ],
-      options
-    );
-    displaySubtitle("Produce CRL in DER form ");
-    await execute_openssl(
-      ["crl", "-in", n4(this.revocationList), "-out", "crl/revocation_list.der", "-outform", "der"],
-      options
-    );
-    displaySubtitle("Produce CRL in PEM form ");
-    await execute_openssl(
-      ["crl", "-in", n4(this.revocationList), "-out", "crl/revocation_list.pem", "-outform", "pem", "-text"],
-      options
-    );
+    try {
+      const subject = params.subject ? new Subject2(params.subject).toString() : "";
+      const subjectOptions = subject && subject.length > 1 ? ["-subj", subject] : [];
+      const csrFile = `${certificateFile}_csr`;
+      const passin = await this.#passin(ca);
+      displaySubtitle("- the certificate signing request");
+      await execute_openssl(
+        [
+          "req",
+          "-new",
+          "-sha256",
+          ...subjectOptions,
+          "-batch",
+          "-key",
+          n2(privateKeyFile),
+          "-out",
+          n2(csrFile),
+          ...passin.args
+        ],
+        { ...options, env: passin.env }
+      );
+      displaySubtitle("- creating the self-signed certificate");
+      await execute_openssl(
+        [
+          "ca",
+          "-selfsign",
+          "-keyfile",
+          n2(privateKeyFile),
+          "-startdate",
+          x509Date(params.startDate),
+          "-enddate",
+          x509Date(params.endDate),
+          "-batch",
+          "-out",
+          n2(certificateFile),
+          "-in",
+          n2(csrFile),
+          ...passin.args
+        ],
+        { ...options, env: passin.env }
+      );
+      displaySubtitle("- dump the certificate for a check");
+      await execute_openssl(["x509", "-in", n2(certificateFile), "-dates", "-fingerprint", "-purpose", "-noout"], {});
+      displaySubtitle("- verify self-signed certificate");
+      await execute_openssl_no_failure(["verify", "-verbose", "-CAfile", n2(certificateFile), n2(certificateFile)], options);
+      await fs4.promises.unlink(csrFile);
+    } finally {
+      await cleanupStaticConfig(configFile, { cwd: ca.rootDir });
+    }
+  }
+};
+
+// packages/node-opcua-pki/lib/ca/certificate_authority.ts
+var CertificateAuthority = class extends CertificateAuthorityCore {
+  constructor(options) {
+    if (options.signer && options.backend === "openssl") {
+      throw new Error(
+        "CertificateAuthority: backend 'openssl' cannot be combined with 'signer' - the openssl CLI loads its key from a file and cannot call an external signer. Drop the backend option (a signer implies 'native') or drop the signer."
+      );
+    }
+    const backend = options.signer || options.backend === "native" ? new NativeCaBackend() : new OpenSslCaBackend();
+    super({ ...options, backend });
   }
   /**
-   * Sign a Certificate Signing Request (CSR) with this CA.
+   * @internal `-passin env:` argv + env for an openssl call that loads
+   * this CA's key (always emitted, empty when none).
    *
-   * The signed certificate is written to `certificate`, and the
-   * CA certificate chain plus CRL are appended to form a
-   * complete certificate chain.
-   *
-   * @param certificate - output path for the signed certificate
-   * @param certificateSigningRequestFilename - path to the CSR
-   * @param params1 - signing parameters (validity, dates, SANs)
-   * @returns the path to the signed certificate
+   * The openssl backend builds its own now; this remains so that external
+   * code calling it keeps working, and lives here rather than on the core
+   * because the flag means nothing to a backend that spawns nothing.
    */
-  async signCertificateRequest(certificate, certificateSigningRequestFilename, params1) {
-    await ensure_openssl_installed();
-    assert7(fs7.existsSync(certificateSigningRequestFilename));
-    if (!certificateFileExist(certificate)) {
-      return "";
-    }
-    adjustDate(params1);
-    adjustApplicationUri(params1);
-    processAltNames(params1);
-    const options = { cwd: this.rootDir };
-    const csr = await readCertificateSigningRequest(certificateSigningRequestFilename);
-    const csrInfo = exploreCertificateSigningRequest(csr);
-    const applicationUri = csrInfo.extensionRequest.subjectAltName.uniformResourceIdentifier ? csrInfo.extensionRequest.subjectAltName.uniformResourceIdentifier[0] : void 0;
-    if (typeof applicationUri !== "string") {
-      throw new Error("Cannot find applicationUri in CSR");
-    }
-    const dns = csrInfo.extensionRequest.subjectAltName.dNSName || [];
-    let ip = csrInfo.extensionRequest.subjectAltName.iPAddress || [];
-    ip = ip.map(octetStringToIpAddress);
-    const params = {
-      applicationUri,
-      dns,
-      ip
-    };
-    processAltNames(params);
-    this._wireRevocationEnvVars();
-    const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-    displaySubtitle("- then we ask the authority to sign the certificate signing request");
-    const passin = await this._opensslPassin();
-    await execute_openssl(
-      [
-        "ca",
-        "-config",
-        configFile,
-        "-startdate",
-        x509Date(params1.startDate),
-        "-enddate",
-        x509Date(params1.endDate),
-        "-batch",
-        "-out",
-        n4(certificate),
-        "-in",
-        n4(certificateSigningRequestFilename),
-        ...passin.args
-      ],
-      { ...options, env: passin.env }
-    );
-    displaySubtitle("- dump the certificate for a check");
-    await execute_openssl(["x509", "-in", n4(certificate), "-dates", "-fingerprint", "-purpose", "-noout"], options);
-    displaySubtitle("- construct CA certificate with CRL");
-    await this.constructCACertificateWithCRL();
-    displaySubtitle("- construct certificate chain");
-    await this.constructCertificateChain(certificate);
-    displaySubtitle("- verify certificate against the root CA");
-    await this.verifyCertificate(certificate);
-    return certificate;
+  async _opensslPassin() {
+    return passinArg(await this._privateKeyPassphrase());
   }
   /**
-   * Verify a certificate against this CA.
-   *
-   * @param certificate - path to the certificate file to verify
+   * @internal
+   * Legacy shim: publish the `CDP_URL` / `AIA_VALUE` config substitution
+   * values to the shared env registry, or unset them so the matching
+   * `{{#KEY}}...{{/KEY}}` blocks are stripped. Nothing in this package
+   * reads the registry any more - every openssl config render receives
+   * these values explicitly, from the same {@link caConfigEnvOverrides}
+   * builder this delegates to, so the two cannot drift - kept only for
+   * external code that renders openssl config templates against the
+   * registry directly.
+   *
+   * It lives on this class rather than the core because it is meaningful
+   * only to the openssl backend.
    */
-  async verifyCertificate(certificate) {
-    const isImplemented = false;
-    if (isImplemented) {
-      const options = { cwd: this.rootDir };
-      const configFile = generateStaticConfig("conf/caconfig.cnf", options);
-      setEnv("OPENSSL_CONF", makePath(configFile));
-      await execute_openssl_no_failure(
-        ["verify", "-verbose", "-CAfile", n4(this.caCertificateWithCrl), n4(certificate)],
-        options
-      );
+  _wireRevocationEnvVars() {
+    const overrides = caConfigEnvOverrides(this);
+    if (overrides.CDP_URL) {
+      setEnv("CDP_URL", overrides.CDP_URL);
+    } else {
+      unsetEnv("CDP_URL");
+    }
+    if (overrides.AIA_VALUE) {
+      setEnv("AIA_VALUE", overrides.AIA_VALUE);
+    } else {
+      unsetEnv("AIA_VALUE");
     }
   }
 };
 
 // packages/node-opcua-pki/lib/pki/certificate_manager.ts
 import { EventEmitter } from "events";
-import fs10 from "fs";
-import path6 from "path";
+import fs7 from "fs";
+import path4 from "path";
 import { drainPendingLocks, withLock } from "@ster5/global-mutex";
-import chalk6 from "chalk";
+import chalk3 from "chalk";
 import chokidar from "chokidar";
 import {
-  exploreCertificate as exploreCertificate2,
+  caSignerFromKeyOperations,
+  exploreCertificate,
   exploreCertificateInfo,
   exploreCertificateRevocationList,
-  generatePrivateKeyFile as generatePrivateKeyFile2,
+  generatePrivateKeyFile,
+  keyOperationsFromPrivateKey,
   makeSHA1Thumbprint,
+  PrivateKeyUnavailableError,
   readCertificateChain,
   readCertificateChainAsync,
   readCertificateRevocationList,
-  readPrivateKey as readPrivateKey2,
+  readPrivateKey,
   split_der,
-  toPem as toPem2,
+  toPem,
   verifyCertificateSignature,
-  writePrivateKeyFile as writePrivateKeyFile2
+  writePrivateKeyFile
 } from "node-opcua-crypto";
 
 // packages/node-opcua-pki/lib/toolbox/without_openssl/create_certificate_signing_request.ts
-import assert8 from "assert";
-import fs8 from "fs";
+import assert3 from "assert";
+import fs5 from "fs";
 import { coercePrivateKeyPem, createCertificateSigningRequest, pemToPrivateKey, Subject as Subject3 } from "node-opcua-crypto";
 async function createCertificateSigningRequestAsync(certificateSigningRequestFilename, params) {
-  assert8(params);
-  assert8(params.rootDir);
-  assert8(params.configFile);
-  assert8(params.privateKey);
+  assert3(params);
+  assert3(params.rootDir);
+  assert3(params.configFile);
+  assert3(params.privateKey);
   if (typeof params.privateKey === "string") {
-    assert8(fs8.existsSync(params.privateKey), `Private key must exist${params.privateKey}`);
+    assert3(fs5.existsSync(params.privateKey), `Private key must exist${params.privateKey}`);
   }
-  assert8(fs8.existsSync(params.rootDir), "RootDir key must exist");
-  assert8(typeof certificateSigningRequestFilename === "string");
+  assert3(fs5.existsSync(params.rootDir), "RootDir key must exist");
+  assert3(typeof certificateSigningRequestFilename === "string");
   const subject = params.subject ? new Subject3(params.subject).toString() : void 0;
   displaySubtitle("- Creating a Certificate Signing Request with subtile");
-  const privateKeyPem = typeof params.privateKey === "string" ? await fs8.promises.readFile(params.privateKey, "utf-8") : coercePrivateKeyPem(params.privateKey);
-  const privateKey = await pemToPrivateKey(privateKeyPem);
+  const privateKey = isOpaqueSigner(params.privateKey) ? params.privateKey : await pemToPrivateKey(
+    typeof params.privateKey === "string" ? await fs5.promises.readFile(params.privateKey, "utf-8") : coercePrivateKeyPem(params.privateKey)
+  );
   const { csr } = await createCertificateSigningRequest({
     privateKey,
     dns: params.dns,
@@ -2323,42 +1024,45 @@ async function createCertificateSigningRequestAsync(certificateSigningRequestFil
     applicationUri: params.applicationUri,
     purpose: params.purpose
   });
-  await fs8.promises.writeFile(certificateSigningRequestFilename, csr, "utf-8");
-  display(`- privateKey ${typeof params.privateKey === "string" ? params.privateKey : "<in-memory>"}`);
+  await fs5.promises.writeFile(certificateSigningRequestFilename, csr, "utf-8");
+  display(
+    `- privateKey ${typeof params.privateKey === "string" ? params.privateKey : isOpaqueSigner(params.privateKey) ? "<opaque-signer>" : "<in-memory>"}`
+  );
   display(`- certificateSigningRequestFilename ${certificateSigningRequestFilename}`);
 }
 
 // packages/node-opcua-pki/lib/toolbox/without_openssl/create_self_signed_certificate.ts
-import assert9 from "assert";
-import fs9 from "fs";
+import assert4 from "assert";
+import fs6 from "fs";
 import {
-  CertificatePurpose as CertificatePurpose2,
+  CertificatePurpose,
   coercePrivateKeyPem as coercePrivateKeyPem2,
   createSelfSignedCertificate as createSelfSignedCertificate1,
   pemToPrivateKey as pemToPrivateKey2,
   Subject as Subject4
 } from "node-opcua-crypto";
 async function createSelfSignedCertificateAsync(certificate, params) {
-  params.purpose = params.purpose || CertificatePurpose2.ForApplication;
-  assert9(params.purpose, "Please provide a Certificate Purpose");
-  assert9(fs9.existsSync(params.configFile));
-  assert9(fs9.existsSync(params.rootDir));
+  params.purpose = params.purpose || CertificatePurpose.ForApplication;
+  assert4(params.purpose, "Please provide a Certificate Purpose");
+  assert4(fs6.existsSync(params.configFile));
+  assert4(fs6.existsSync(params.rootDir));
   if (typeof params.privateKey === "string") {
-    assert9(fs9.existsSync(params.privateKey));
+    assert4(fs6.existsSync(params.privateKey));
   }
   if (!params.subject) {
     throw Error("Missing subject");
   }
-  assert9(typeof params.applicationUri === "string");
-  assert9(Array.isArray(params.dns));
+  assert4(typeof params.applicationUri === "string");
+  assert4(Array.isArray(params.dns));
   adjustDate(params);
-  assert9(Object.prototype.hasOwnProperty.call(params, "validity"));
+  assert4(Object.prototype.hasOwnProperty.call(params, "validity"));
   let subject = new Subject4(params.subject);
   subject = subject.toString();
   const purpose = params.purpose;
   displayTitle("Generate a certificate request");
-  const privateKeyPem = typeof params.privateKey === "string" ? await fs9.promises.readFile(params.privateKey, "utf-8") : coercePrivateKeyPem2(params.privateKey);
-  const privateKey = await pemToPrivateKey2(privateKeyPem);
+  const privateKey = isOpaqueSigner(params.privateKey) ? params.privateKey : await pemToPrivateKey2(
+    typeof params.privateKey === "string" ? await fs6.promises.readFile(params.privateKey, "utf-8") : coercePrivateKeyPem2(params.privateKey)
+  );
   const { cert } = await createSelfSignedCertificate1({
     privateKey,
     notBefore: params.startDate,
@@ -2370,18 +1074,22 @@ async function createSelfSignedCertificateAsync(certificate, params) {
     applicationUri: params.applicationUri,
     purpose
   });
-  await fs9.promises.writeFile(certificate, cert, "utf-8");
+  await fs6.promises.writeFile(certificate, cert, "utf-8");
 }
 async function createSelfSignedCertificate(certificate, params) {
   await createSelfSignedCertificateAsync(certificate, params);
 }
 
+// packages/node-opcua-pki/lib/pki/templates/simple_config_template.cnf.ts
+var config = '##################################################################################################\n## SIMPLE OPENSSL CONFIG FILE FOR SELF-SIGNED CERTIFICATE GENERATION\n################################################################################################################\n\ndistinguished_name       = req_distinguished_name\ndefault_md               = sha1\n\ndefault_md                = sha256                      # The default digest algorithm\n\n[ v3_ca ]\nsubjectKeyIdentifier        = hash\nauthorityKeyIdentifier      = keyid:always,issuer:always\n\n# authorityKeyIdentifier    = keyid\nbasicConstraints            = CA:TRUE\nkeyUsage                    = critical, cRLSign, keyCertSign\nnsComment                   = "Self-signed Certificate for CA generated by Node-OPCUA Certificate utility"\n#nsCertType                 = sslCA, emailCA\n#subjectAltName             = email:copy\n#issuerAltName              = issuer:copy\n#obj                        = DER:02:03\n# crlDistributionPoints       = @crl_info\n# [ crl_info ]\n# URI.0                     = http://localhost:8900/crl.pem\nsubjectAltName              = $ENV::ALTNAME\n\n[ req ]\ndays                      = 390\nreq_extensions            = v3_req\nx509_extensions           = v3_ca\n\n[v3_req]\nbasicConstraints       = CA:false\nkeyUsage               = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment\nsubjectAltName         = $ENV::ALTNAME\n\n[ v3_ca_signed]\nsubjectKeyIdentifier      = hash\nauthorityKeyIdentifier    = keyid,issuer\nbasicConstraints          = critical, CA:FALSE\nkeyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment\nextendedKeyUsage          = clientAuth,serverAuth \nnsComment                 = "certificate generated by Node-OPCUA Certificate utility and signed by a CA"\nsubjectAltName            = $ENV::ALTNAME\n[ v3_selfsigned]\nsubjectKeyIdentifier      = hash\nauthorityKeyIdentifier    = keyid,issuer\nbasicConstraints          = critical, CA:FALSE\nkeyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment\nextendedKeyUsage          = clientAuth,serverAuth \nnsComment                 = "Self-signed certificate generated by Node-OPCUA Certificate utility"\nsubjectAltName            = $ENV::ALTNAME\n[ req_distinguished_name ]\ncountryName             = Country Name (2 letter code)\ncountryName_default     = FR\ncountryName_min         = 2\ncountryName_max         = 2\n# stateOrProvinceName     = State or Province Name (full name)\n# stateOrProvinceName_default = Ile de France\n# localityName            = Locality Name (city, district)\n# localityName_default    = Paris\norganizationName          = Organization Name (company)\norganizationName_default  = NodeOPCUA\n# organizationalUnitName  = Organizational Unit Name (department, division)\n# organizationalUnitName_default = R&D\ncommonName                = Common Name (hostname, FQDN, IP, or your name)\ncommonName_max            = 256\ncommonName_default        = NodeOPCUA\n# emailAddress            = Email Address\n# emailAddress_max        = 40\n# emailAddress_default    = node-opcua (at) node-opcua (dot) com\nsubjectAltName            = $ENV::ALTNAME';
+var simple_config_template_cnf_default = config;
+
 // packages/node-opcua-pki/lib/pki/certificate_manager.ts
-var configurationFileSimpleTemplate2 = simple_config_template_cnf_default;
-var fsWriteFile = fs10.promises.writeFile;
+var configurationFileSimpleTemplate = simple_config_template_cnf_default;
+var fsWriteFile = fs7.promises.writeFile;
 function getOrComputeInfo(entry) {
   if (!entry.info) {
-    entry.info = exploreCertificate2(entry.certificate);
+    entry.info = exploreCertificate(entry.certificate);
   }
   return entry.info;
 }
@@ -2425,7 +1133,7 @@ function buildIdealCertificateName(certificate) {
   const chain = coerceCertificateChain(certificate);
   const fingerprint = makeFingerprint(chain);
   try {
-    const commonName = exploreCertificate2(chain[0]).tbsCertificate.subject.commonName || "";
+    const commonName = exploreCertificate(chain[0]).tbsCertificate.subject.commonName || "";
     const sanitizedCommonName = commonName.replace(forbiddenChars, "_");
     return `${sanitizedCommonName}[${fingerprint}]`;
   } catch (_err) {
@@ -2442,7 +1150,7 @@ function isSelfSigned2(info) {
   return info.tbsCertificate.extensions?.subjectKeyIdentifier === info.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier;
 }
 function isSelfSigned3(certificate) {
-  const info = exploreCertificate2(certificate);
+  const info = exploreCertificate(certificate);
   return isSelfSigned2(info);
 }
 function _isIssuerInfo(info) {
@@ -2458,7 +1166,7 @@ function _isIssuerInfo(info) {
 }
 function isIssuer(certificate) {
   try {
-    const info = exploreCertificate2(certificate);
+    const info = exploreCertificate(certificate);
     return _isIssuerInfo(info);
   } catch (_err) {
     return false;
@@ -2466,7 +1174,7 @@ function isIssuer(certificate) {
 }
 function isIntermediateIssuer(certificate) {
   try {
-    const info = exploreCertificate2(certificate);
+    const info = exploreCertificate(certificate);
     if (!_isIssuerInfo(info)) {
       return false;
     }
@@ -2477,7 +1185,7 @@ function isIntermediateIssuer(certificate) {
 }
 function isRootIssuer(certificate) {
   try {
-    const info = exploreCertificate2(certificate);
+    const info = exploreCertificate(certificate);
     if (!_isIssuerInfo(info)) {
       return false;
     }
@@ -2492,7 +1200,7 @@ function findIssuerCertificateInChain(certificate, chain) {
   if (!firstCertificate) {
     return null;
   }
-  const certInfo = exploreCertificate2(firstCertificate);
+  const certInfo = exploreCertificate(firstCertificate);
   if (isSelfSigned2(certInfo)) {
     return firstCertificate;
   }
@@ -2503,7 +1211,7 @@ function findIssuerCertificateInChain(certificate, chain) {
   }
   const coercedChain = coerceCertificateChain(chain);
   const potentialIssuers = coercedChain.filter((c) => {
-    const info = exploreCertificate2(c);
+    const info = exploreCertificate(c);
     return info.tbsCertificate.extensions && info.tbsCertificate.extensions.subjectKeyIdentifier === wantedIssuerKey;
   });
   if (potentialIssuers.length === 1) {
@@ -2538,7 +1246,31 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
   // even if the consumer forgets to call dispose().
   static #activeInstances = /* @__PURE__ */ new Set();
   static #cleanupInstalled = false;
-  static #installProcessCleanup() {
+  static #exitHandler;
+  /**
+   * Install a best-effort `exit` hook that closes any watcher
+   * still open when the process terminates.
+   *
+   * **This library never terminates the host process.** No
+   * SIGINT/SIGTERM handler is installed: deciding how (and
+   * whether) to shut down on a signal is the application's
+   * responsibility, and a listener registered here would both
+   * pre-empt the application's own graceful shutdown and
+   * silently suppress Node's default signal behaviour.
+   *
+   * Nothing here is load-bearing for process exit. The native
+   * `fs.watch` handles are `unref()`'d when the watchers are
+   * created (see `#readCertificates`), so an undisposed
+   * CertificateManager never keeps the event loop alive. This
+   * hook is only tidiness on the way out.
+   *
+   * `exit` rather than `beforeExit`: `beforeExit` fires when
+   * the loop merely drains and the loop can subsequently be
+   * resurrected, which would leave a still-in-use instance
+   * marked Disposed. `exit` is terminal, synchronous-only and
+   * cannot alter the exit code.
+   */
+  static #installExitCleanup() {
     if (_CertificateManager.#cleanupInstalled) return;
     _CertificateManager.#cleanupInstalled = true;
     const closeDanglingWatchers = () => {
@@ -2554,13 +1286,22 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
       }
       _CertificateManager.#activeInstances.clear();
     };
-    process.on("beforeExit", closeDanglingWatchers);
-    for (const signal of ["SIGINT", "SIGTERM"]) {
-      process.once(signal, () => {
-        closeDanglingWatchers();
-        process.exit();
-      });
+    _CertificateManager.#exitHandler = closeDanglingWatchers;
+    process.on("exit", closeDanglingWatchers);
+  }
+  /**
+   * Remove the `exit` hook once the last instance is disposed,
+   * so a library that is initialized and disposed repeatedly
+   * does not accumulate process listeners. A later
+   * `initialize()` re-arms it.
+   */
+  static #uninstallExitCleanupIfIdle() {
+    if (_CertificateManager.#activeInstances.size > 0) return;
+    if (_CertificateManager.#exitHandler) {
+      process.removeListener("exit", _CertificateManager.#exitHandler);
+      _CertificateManager.#exitHandler = void 0;
     }
+    _CertificateManager.#cleanupInstalled = false;
   }
   /**
    * Dispose **all** active CertificateManager instances,
@@ -2626,6 +1367,9 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
   #disableFileWatchers;
   #privateKeyPassphrase;
   #privateKeyProvider;
+  #keyOperations;
+  /** The stable lazy wrap handed out by {@link getKeyOperations} for non-opaque configurations. */
+  #lazyLocalKeyOperations;
   /**
    * The on-disk key, decrypted once and kept for the instance's lifetime,
    * so the passphrase (or its resolver function) is consulted at most
@@ -2669,14 +1413,25 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     this.#disableFileWatchers = options.disableFileWatchers ?? process.env.OPCUA_PKI_DISABLE_FILE_WATCHERS === "true";
     this.#privateKeyPassphrase = options.privateKeyPassphrase;
     this.#privateKeyProvider = options.privateKeyProvider;
+    this.#keyOperations = options.keyOperations;
+    if (this.#keyOperations && this.#privateKeyProvider) {
+      throw new Error(
+        "CertificateManager: 'keyOperations' and 'privateKeyProvider' are mutually exclusive: one hides the key, the other sources its material"
+      );
+    }
+    if (this.#keyOperations && this.#privateKeyPassphrase) {
+      throw new Error(
+        "CertificateManager: 'privateKeyPassphrase' is meaningless with 'keyOperations': there is no key material for a passphrase to protect"
+      );
+    }
     mkdirRecursiveSync(options.location);
-    if (!fs10.existsSync(this.#location)) {
+    if (!fs7.existsSync(this.#location)) {
       throw new Error(`CertificateManager cannot access location ${this.#location}`);
     }
   }
   /** Path to the OpenSSL configuration file. */
   get configFile() {
-    return path6.join(this.rootDir, "own/openssl.cnf");
+    return path4.join(this.rootDir, "own/openssl.cnf");
   }
   /** Root directory of the PKI store. */
   get rootDir() {
@@ -2692,7 +1447,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
    * be no meaningful file in that case).
    */
   get privateKey() {
-    return path6.join(this.rootDir, "own/private/private_key.pem");
+    return path4.join(this.rootDir, "own/private/private_key.pem");
   }
   /**
    * Resolve the private key: from `privateKeyProvider` if configured,
@@ -2710,6 +1465,11 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
    * authority on what the current key is.
    */
   async getPrivateKey() {
+    if (this.#keyOperations) {
+      throw new PrivateKeyUnavailableError(
+        "CertificateManager.getPrivateKey is not available when keyOperations is configured: the private key is held by the key-operations provider (HSM/KMS) and cannot be read \u2014 use getKeyOperations() instead"
+      );
+    }
     if (this.#privateKeyProvider) {
       return await this.#privateKeyProvider.getPrivateKey();
     }
@@ -2719,7 +1479,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     if (!this.#privateKeyPromise) {
       this.#privateKeyPromise = (async () => {
         const passphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
-        return readPrivateKey2(this.privateKey, passphrase);
+        return readPrivateKey(this.privateKey, passphrase);
       })().then(
         (key) => {
           this.#cachedPrivateKey = key;
@@ -2735,6 +1495,75 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
   }
   /** In-flight first read of the on-disk key, so concurrent callers share one passphrase resolution. */
   #privateKeyPromise;
+  /**
+   * True when this manager's key is opaque — configured through
+   * `keyOperations`, held by an HSM/KMS, never obtainable as material.
+   * When true, {@link getPrivateKey} throws `PrivateKeyUnavailableError`
+   * and {@link getKeyOperations} is the only way to use the key.
+   */
+  isPrivateKeyOpaque() {
+    return !!this.#keyOperations;
+  }
+  /**
+   * The key as an opaque {@link IKeyOperations} — the recommended way to
+   * *use* the private key regardless of where it lives.
+   *
+   * Returns the configured `keyOperations` object when the key is opaque.
+   * Otherwise returns a stable lazy wrap over {@link getPrivateKey}: its
+   * methods resolve the key on first use (disk read, passphrase,
+   * `privateKeyProvider` — all async), so the wrap offers no synchronous
+   * fast path; callers that need one resolve the key themselves and build
+   * a `LocalKeyOperations` over it. The wrap follows key rotation: a
+   * `privateKeyProvider` that starts returning a different key gets a
+   * fresh underlying `LocalKeyOperations`.
+   */
+  getKeyOperations() {
+    if (this.#keyOperations) {
+      return this.#keyOperations;
+    }
+    if (!this.#lazyLocalKeyOperations) {
+      let cached;
+      const resolve = async () => {
+        const key = await this.getPrivateKey();
+        if (!cached || cached.key !== key) {
+          cached = { key, ops: keyOperationsFromPrivateKey(key) };
+        }
+        return cached.ops;
+      };
+      this.#lazyLocalKeyOperations = {
+        sign: async (data, params) => (await resolve()).sign(data, params),
+        decryptBlock: async (block, params) => (await resolve()).decryptBlock(block, params),
+        getKeyMetadata: async () => (await resolve()).getKeyMetadata(),
+        getPublicKey: async () => (await resolve()).getPublicKey()
+      };
+    }
+    return this.#lazyLocalKeyOperations;
+  }
+  /**
+   * Fail closed at `initialize()` time, not on the first certificate
+   * operation, if the key cannot actually be used: wrong/missing
+   * passphrase on an encrypted key, a broken `privateKeyProvider`, or an
+   * unreachable `keyOperations` provider (probed via `getKeyMetadata`).
+   */
+  async #probePrivateKey() {
+    if (this.#keyOperations) {
+      await this.#keyOperations.getKeyMetadata();
+      return;
+    }
+    await this.getPrivateKey();
+  }
+  /**
+   * The key to hand to a certificate-issuance primitive: the raw
+   * {@link PrivateKey} for a local configuration, or a {@link CaSigner}
+   * adapted from `keyOperations` when the key is opaque — which requires
+   * the provider to implement `getPublicKey` (the adapter says so if not).
+   */
+  async #resolveSigningKey() {
+    if (this.#keyOperations) {
+      return caSignerFromKeyOperations(this.#keyOperations);
+    }
+    return await this.getPrivateKey();
+  }
   /**
    * Enable, disable, or rotate the passphrase protecting the on-disk
    * private key: decrypt with `oldPassphrase` (omit if the key is
@@ -2756,13 +1585,18 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
    * disk file for this method to rewrite).
    */
   async reencryptPrivateKey(oldPassphrase, newPassphrase) {
+    if (this.#keyOperations) {
+      throw new PrivateKeyUnavailableError(
+        "reencryptPrivateKey: not supported when keyOperations is configured \u2014 there is no key material to rewrite"
+      );
+    }
     if (this.#privateKeyProvider) {
       throw new Error("reencryptPrivateKey: not supported when a privateKeyProvider is configured");
     }
     const oldPass = await resolvePrivateKeyPassphrase(oldPassphrase);
     const newPass = await resolvePrivateKeyPassphrase(newPassphrase);
     await this.withLock2(async () => {
-      const privateKey = readPrivateKey2(this.privateKey, oldPass);
+      const privateKey = readPrivateKey(this.privateKey, oldPass);
       await this.#rewritePrivateKeyFile(privateKey, newPass);
     });
     this.#cachedPrivateKey = void 0;
@@ -2778,15 +1612,15 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
   async #rewritePrivateKeyFile(privateKey, passphrase) {
     const tmpFilename = `${this.privateKey}.${process.pid}-${Date.now()}.tmp`;
     try {
-      await writePrivateKeyFile2(tmpFilename, privateKey, { passphrase });
-      await fs10.promises.rename(tmpFilename, this.privateKey);
+      await writePrivateKeyFile(tmpFilename, privateKey, { passphrase });
+      await fs7.promises.rename(tmpFilename, this.privateKey);
     } finally {
-      await fs10.promises.rm(tmpFilename, { force: true });
+      await fs7.promises.rm(tmpFilename, { force: true });
     }
   }
   /** Path to the OpenSSL random seed file. */
   get randomFile() {
-    return path6.join(this.rootDir, "./random.rnd");
+    return path4.join(this.rootDir, "./random.rnd");
   }
   /**
    * Move a certificate to the rejected store.
@@ -2823,30 +1657,30 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
   }
   /** Path to the rejected certificates folder. */
   get rejectedFolder() {
-    return path6.join(this.rootDir, "rejected");
+    return path4.join(this.rootDir, "rejected");
   }
   /** Path to the trusted certificates folder. */
   get trustedFolder() {
-    return path6.join(this.rootDir, "trusted/certs");
+    return path4.join(this.rootDir, "trusted/certs");
   }
   /** Path to the trusted CRL folder. */
   get crlFolder() {
-    return path6.join(this.rootDir, "trusted/crl");
+    return path4.join(this.rootDir, "trusted/crl");
   }
   /** Path to the issuer (CA) certificates folder. */
   get issuersCertFolder() {
-    return path6.join(this.rootDir, "issuers/certs");
+    return path4.join(this.rootDir, "issuers/certs");
   }
   /** Path to the issuer CRL folder. */
   get issuersCrlFolder() {
-    return path6.join(this.rootDir, "issuers/crl");
+    return path4.join(this.rootDir, "issuers/crl");
   }
   /** Path to the own certificate folder. */
   get ownCertFolder() {
-    return path6.join(this.rootDir, "own/certs");
+    return path4.join(this.rootDir, "own/certs");
   }
   get ownPrivateFolder() {
-    return path6.join(this.rootDir, "own/private");
+    return path4.join(this.rootDir, "own/private");
   }
   /**
    * Check if a certificate is in the trusted store.
@@ -2881,9 +1715,9 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
         } catch (_err) {
           return "BadCertificateInvalid";
         }
-        const filename = path6.join(this.rejectedFolder, `${buildIdealCertificateName(leafCertificate)}.pem`);
+        const filename = path4.join(this.rejectedFolder, `${buildIdealCertificateName(leafCertificate)}.pem`);
         debugLog("certificate has never been seen before and is now rejected (untrusted) ", filename);
-        await fsWriteFile(filename, toPem2(chain, "CERTIFICATE"));
+        await fsWriteFile(filename, toPem(chain, "CERTIFICATE"));
         this.#thumbs.rejected.set(fingerprint, { certificate: leafCertificate, filename });
       }
       return "BadCertificateUntrusted";
@@ -2897,7 +1731,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     }
     const chain = coerceCertificateChain(certificateOrChain);
     debugLog("NB CERTIFICATE IN CHAIN = ", chain.length);
-    const info = exploreCertificate2(chain[0]);
+    const info = exploreCertificate(chain[0]);
     let hasValidIssuer = false;
     let hasTrustedIssuer = false;
     const hasIssuerKey = info.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier;
@@ -2985,23 +1819,19 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
         return "BadCertificateUntrusted" /* BadCertificateUntrusted */;
       }
     }
-    const _c2 = chain[1] ? exploreCertificateInfo(chain[1]) : "non";
-    debugLog("chain[1] info=", _c2);
-    const certificateInfo = exploreCertificateInfo(chain[0]);
+    const { validity } = exploreCertificate(chain[0]).tbsCertificate;
     const now = /* @__PURE__ */ new Date();
     let isTimeInvalid = false;
-    if (certificateInfo.notBefore.getTime() > now.getTime()) {
+    if (validity.notBefore.getTime() > now.getTime()) {
       debugLog(
-        `${chalk6.red("certificate is invalid : certificate is not active yet !")} not before date =${certificateInfo.notBefore}`
+        `${chalk3.red("certificate is invalid : certificate is not active yet !")} not before date =${validity.notBefore}`
       );
       if (!options.acceptPendingCertificate) {
         isTimeInvalid = true;
       }
     }
-    if (certificateInfo.notAfter.getTime() <= now.getTime()) {
-      debugLog(
-        `${chalk6.red("certificate is invalid : certificate has expired !")} not after date =${certificateInfo.notAfter}`
-      );
+    if (validity.notAfter.getTime() <= now.getTime()) {
+      debugLog(`${chalk3.red("certificate is invalid : certificate has expired !")} not after date =${validity.notAfter}`);
       if (!options.acceptOutdatedCertificate) {
         isTimeInvalid = true;
       }
@@ -3040,7 +1870,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     const chain = coerceCertificateChain(certificate);
     for (const element of chain) {
       try {
-        exploreCertificateInfo(element);
+        exploreCertificate(element);
       } catch (_err) {
         return "BadCertificateInvalid" /* BadCertificateInvalid */;
       }
@@ -3093,55 +1923,55 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     this.#initializingPromise = void 0;
     this.state = 2 /* Initialized */;
     _CertificateManager.#activeInstances.add(this);
-    _CertificateManager.#installProcessCleanup();
+    _CertificateManager.#installExitCleanup();
   }
   async #initialize() {
     const pkiDir = this.#location;
     mkdirRecursiveSync(pkiDir);
-    mkdirRecursiveSync(path6.join(pkiDir, "own"));
-    mkdirRecursiveSync(path6.join(pkiDir, "own/certs"));
-    ensurePrivateDirectory(path6.join(pkiDir, "own/private"));
-    mkdirRecursiveSync(path6.join(pkiDir, "rejected"));
-    mkdirRecursiveSync(path6.join(pkiDir, "trusted"));
-    mkdirRecursiveSync(path6.join(pkiDir, "trusted/certs"));
-    mkdirRecursiveSync(path6.join(pkiDir, "trusted/crl"));
-    mkdirRecursiveSync(path6.join(pkiDir, "issuers"));
-    mkdirRecursiveSync(path6.join(pkiDir, "issuers/certs"));
-    mkdirRecursiveSync(path6.join(pkiDir, "issuers/crl"));
-    const ownsDiskKey = !this.#privateKeyProvider;
-    const needsKeyGeneration = ownsDiskKey && !fs10.existsSync(this.privateKey);
+    mkdirRecursiveSync(path4.join(pkiDir, "own"));
+    mkdirRecursiveSync(path4.join(pkiDir, "own/certs"));
+    ensurePrivateDirectory(path4.join(pkiDir, "own/private"));
+    mkdirRecursiveSync(path4.join(pkiDir, "rejected"));
+    mkdirRecursiveSync(path4.join(pkiDir, "trusted"));
+    mkdirRecursiveSync(path4.join(pkiDir, "trusted/certs"));
+    mkdirRecursiveSync(path4.join(pkiDir, "trusted/crl"));
+    mkdirRecursiveSync(path4.join(pkiDir, "issuers"));
+    mkdirRecursiveSync(path4.join(pkiDir, "issuers/certs"));
+    mkdirRecursiveSync(path4.join(pkiDir, "issuers/crl"));
+    const ownsDiskKey = !this.#privateKeyProvider && !this.#keyOperations;
+    const needsKeyGeneration = ownsDiskKey && !fs7.existsSync(this.privateKey);
     const needsKeyEncryption = ownsDiskKey && !needsKeyGeneration && this.#privateKeyPassphrase !== void 0 && !isEncryptedPrivateKeyFile(this.privateKey);
-    if (!fs10.existsSync(this.configFile) || needsKeyGeneration || needsKeyEncryption) {
+    if (!fs7.existsSync(this.configFile) || needsKeyGeneration || needsKeyEncryption) {
       return await this.withLock2(async () => {
         if (this.state === 3 /* Disposing */ || this.state === 4 /* Disposed */) {
           return;
         }
-        if (!fs10.existsSync(this.configFile)) {
-          fs10.writeFileSync(this.configFile, configurationFileSimpleTemplate2);
+        if (!fs7.existsSync(this.configFile)) {
+          fs7.writeFileSync(this.configFile, configurationFileSimpleTemplate);
         }
-        if (ownsDiskKey && !fs10.existsSync(this.privateKey)) {
+        if (ownsDiskKey && !fs7.existsSync(this.privateKey)) {
           debugLog("generating private key ...");
           const passphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
-          await generatePrivateKeyFile2(this.privateKey, this.keySize, { passphrase });
-          this.#cachedPrivateKey = readPrivateKey2(this.privateKey, passphrase);
+          await generatePrivateKeyFile(this.privateKey, this.keySize, { passphrase });
+          this.#cachedPrivateKey = readPrivateKey(this.privateKey, passphrase);
         } else if (ownsDiskKey && this.#privateKeyPassphrase !== void 0 && !isEncryptedPrivateKeyFile(this.privateKey)) {
           warningLog("initialize: private key is plaintext but a passphrase is configured; encrypting it in place");
           const passphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
-          const plaintextKey = readPrivateKey2(this.privateKey);
+          const plaintextKey = readPrivateKey(this.privateKey);
           await this.#rewritePrivateKeyFile(plaintextKey, passphrase);
           this.#cachedPrivateKey = plaintextKey;
         }
         if (ownsDiskKey) {
           restrictPrivateFilePermissions(this.privateKey, 384);
         }
-        await this.getPrivateKey();
+        await this.#probePrivateKey();
         await this.#readCertificates();
       });
     } else {
       if (ownsDiskKey) {
         restrictPrivateFilePermissions(this.privateKey, 384);
       }
-      await this.getPrivateKey();
+      await this.#probePrivateKey();
       await this.#readCertificates();
     }
   }
@@ -3180,6 +2010,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
       this.#cachedPrivateKey = void 0;
       this.#privateKeyPromise = void 0;
       _CertificateManager.#activeInstances.delete(this);
+      _CertificateManager.#uninstallExitCleanupIfIdle();
     }
   }
   /**
@@ -3207,7 +2038,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     await this.#readCertificates();
   }
   async withLock2(action) {
-    const lockFileName = path6.join(this.rootDir, "mutex");
+    const lockFileName = path4.join(this.rootDir, "mutex");
     return withLock({ fileToLock: lockFileName }, async () => {
       return await action();
     });
@@ -3225,16 +2056,16 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     if (typeof params.applicationUri !== "string") {
       throw new Error("createSelfSignedCertificate: expecting applicationUri to be a string");
     }
-    if (!this.#privateKeyProvider && !fs10.existsSync(this.privateKey)) {
+    if (!this.#privateKeyProvider && !this.#keyOperations && !fs7.existsSync(this.privateKey)) {
       throw new Error(`Cannot find private key ${this.privateKey}`);
     }
-    let certificateFilename = path6.join(this.rootDir, "own/certs/self_signed_certificate.pem");
+    let certificateFilename = path4.join(this.rootDir, "own/certs/self_signed_certificate.pem");
     certificateFilename = params.outputFile || certificateFilename;
     const _params = {
       ...params,
       rootDir: this.rootDir,
       configFile: this.configFile,
-      privateKey: await this.getPrivateKey(),
+      privateKey: await this.#resolveSigningKey(),
       subject: params.subject || "CN=FIXME"
     };
     await this.withLock2(async () => {
@@ -3260,14 +2091,14 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     }
     const _params = {
       ...params,
-      rootDir: path6.resolve(this.rootDir),
-      configFile: path6.resolve(this.configFile),
-      privateKey: await this.getPrivateKey()
+      rootDir: path4.resolve(this.rootDir),
+      configFile: path4.resolve(this.configFile),
+      privateKey: await this.#resolveSigningKey()
     };
     return await this.withLock2(async () => {
       const now = /* @__PURE__ */ new Date();
       const today = `${now.toISOString().slice(0, 10)}_${now.getTime()}`;
-      const certificateSigningRequestFilename = path6.join(this.rootDir, "own/certs", `certificate_${today}.csr`);
+      const certificateSigningRequestFilename = path4.join(this.rootDir, "own/certs", `certificate_${today}.csr`);
       await createCertificateSigningRequestAsync(certificateSigningRequestFilename, _params);
       return certificateSigningRequestFilename;
     });
@@ -3287,13 +2118,13 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
         return status;
       }
     }
-    const pemCertificate = toPem2(certificate, "CERTIFICATE");
+    const pemCertificate = toPem(certificate, "CERTIFICATE");
     const fingerprint = makeFingerprint(certificate);
     if (this.#thumbs.issuers.certs.has(fingerprint)) {
       return "Good" /* Good */;
     }
-    const filename = path6.join(this.issuersCertFolder, `issuer_${buildIdealCertificateName(certificate)}.pem`);
-    await fs10.promises.writeFile(filename, pemCertificate, "ascii");
+    const filename = path4.join(this.issuersCertFolder, `issuer_${buildIdealCertificateName(certificate)}.pem`);
+    await fs7.promises.writeFile(filename, pemCertificate, "ascii");
     this.#thumbs.issuers.certs.set(fingerprint, { certificate, filename });
     if (addInTrustList) {
       await this.trustCertificate(certificate);
@@ -3332,10 +2163,10 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
         if (!index.has(key)) {
           index.set(key, { crls: [], serialNumbers: {} });
         }
-        const pemCertificate = toPem2(crl, "X509 CRL");
+        const pemCertificate = toPem(crl, "X509 CRL");
         const sanitizedKey = key.replace(/:/g, "");
-        const filename = path6.join(folder, `crl_[${sanitizedKey}].pem`);
-        await fs10.promises.writeFile(filename, pemCertificate, "ascii");
+        const filename = path4.join(folder, `crl_[${sanitizedKey}].pem`);
+        await fs7.promises.writeFile(filename, pemCertificate, "ascii");
         await this.#onCrlFileAdded(index, filename);
         await this.#waitAndCheckCRLProcessingStatus();
         return "Good" /* Good */;
@@ -3354,11 +2185,11 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
   async clearRevocationLists(target) {
     const clearFolder = async (folder, index) => {
       try {
-        const files = await fs10.promises.readdir(folder);
+        const files = await fs7.promises.readdir(folder);
         for (const file of files) {
-          const ext = path6.extname(file).toLowerCase();
+          const ext = path4.extname(file).toLowerCase();
           if (ext === ".crl" || ext === ".pem" || ext === ".der") {
-            await fs10.promises.unlink(path6.join(folder, file));
+            await fs7.promises.unlink(path4.join(folder, file));
           }
         }
       } catch (err) {
@@ -3400,7 +2231,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
       return null;
     }
     try {
-      await fs10.promises.unlink(entry.filename);
+      await fs7.promises.unlink(entry.filename);
     } catch (err) {
       if (err.code !== "ENOENT") {
         throw err;
@@ -3424,7 +2255,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
       return null;
     }
     try {
-      await fs10.promises.unlink(entry.filename);
+      await fs7.promises.unlink(entry.filename);
     } catch (err) {
       if (err.code !== "ENOENT") {
         throw err;
@@ -3440,14 +2271,14 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
    * @param target - "issuers", "trusted", or "all" (default "all")
    */
   async removeRevocationListsForIssuer(issuerCertificate, target = "all") {
-    const issuerInfo = exploreCertificate2(issuerCertificate);
+    const issuerInfo = exploreCertificate(issuerCertificate);
     const issuerFingerprint = issuerInfo.tbsCertificate.subjectFingerPrint;
     const processIndex = async (index) => {
       const crlData = index.get(issuerFingerprint);
       if (!crlData) return;
       for (const crlEntry of crlData.crls) {
         try {
-          await fs10.promises.unlink(crlEntry.filename);
+          await fs7.promises.unlink(crlEntry.filename);
         } catch (err) {
           if (err.code !== "ENOENT") {
             throw err;
@@ -3514,7 +2345,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     const opts = this.#addCertValidation;
     let leafInfo;
     try {
-      leafInfo = exploreCertificate2(leafCertificate);
+      leafInfo = exploreCertificate(leafCertificate);
     } catch (_err) {
       return "BadCertificateInvalid" /* BadCertificateInvalid */;
     }
@@ -3528,17 +2359,12 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
         return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
       }
       if (!opts.acceptExpiredCertificate) {
-        let certDetails;
-        try {
-          certDetails = exploreCertificateInfo(currentCert);
-        } catch (_err) {
-          return "BadCertificateInvalid" /* BadCertificateInvalid */;
-        }
+        const { validity } = currentInfo.tbsCertificate;
         const now = /* @__PURE__ */ new Date();
-        if (certDetails.notBefore.getTime() > now.getTime()) {
+        if (validity.notBefore.getTime() > now.getTime()) {
           return "BadCertificateTimeInvalid" /* BadCertificateTimeInvalid */;
         }
-        if (certDetails.notAfter.getTime() <= now.getTime()) {
+        if (validity.notAfter.getTime() <= now.getTime()) {
           return depth === 1 ? "BadCertificateTimeInvalid" /* BadCertificateTimeInvalid */ : "BadCertificateIssuerTimeInvalid" /* BadCertificateIssuerTimeInvalid */;
         }
       }
@@ -3582,7 +2408,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
       }
       currentCert = issuerCert;
       try {
-        currentInfo = exploreCertificate2(currentCert);
+        currentInfo = exploreCertificate(currentCert);
       } catch (_err) {
         return "BadCertificateInvalid" /* BadCertificateInvalid */;
       }
@@ -3631,7 +2457,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
    */
   async findIssuerCertificate(certificate) {
     const firstCertificate = coerceCertificateChain(certificate)[0];
-    const certInfo = exploreCertificate2(firstCertificate);
+    const certInfo = exploreCertificate(firstCertificate);
     if (isSelfSigned2(certInfo)) {
       return firstCertificate;
     }
@@ -3689,7 +2515,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     let depth = 0;
     while (depth < maxDepth) {
       const lastCert = result[result.length - 1];
-      const lastInfo = exploreCertificate2(lastCert);
+      const lastInfo = exploreCertificate(lastCert);
       if (isSelfSigned2(lastInfo)) {
         const wasExtended = result.length > chain.length;
         return {
@@ -3716,7 +2542,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
         return {
           chain: result,
           status: "AlreadyComplete" /* AlreadyComplete */,
-          message: `Chain ends at root "${exploreCertificate2(issuerCert).tbsCertificate.subject.commonName}" (already present in chain).`
+          message: `Chain ends at root "${exploreCertificate(issuerCert).tbsCertificate.subject.commonName}" (already present in chain).`
         };
       }
       result.push(issuerCert);
@@ -3755,9 +2581,9 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
       const fingerprint = makeFingerprint(certificate);
       let status = await this.#checkRejectedOrTrusted(certificate);
       if (status === "unknown") {
-        const pem = toPem2(chain, "CERTIFICATE");
-        const filename = path6.join(this.rejectedFolder, `${buildIdealCertificateName(certificate)}.pem`);
-        await fs10.promises.writeFile(filename, pem);
+        const pem = toPem(chain, "CERTIFICATE");
+        const filename = path4.join(this.rejectedFolder, `${buildIdealCertificateName(certificate)}.pem`);
+        await fs7.promises.writeFile(filename, pem);
         this.#thumbs.rejected.set(fingerprint, { certificate, filename });
         status = "rejected";
       }
@@ -3773,10 +2599,10 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
           throw new Error(`#moveCertificate: certificate ${fingerprint.substring(0, 10)} not found in ${status} index`);
         }
         const destFolder = newStatus === "trusted" ? this.trustedFolder : this.rejectedFolder;
-        const certificateDest = path6.join(destFolder, path6.basename(srcEntry.filename));
+        const certificateDest = path4.join(destFolder, path4.basename(srcEntry.filename));
         debugLog("#moveCertificate", fingerprint.substring(0, 10), "old name", srcEntry.filename);
         debugLog("#moveCertificate", fingerprint.substring(0, 10), "new name", certificateDest);
-        await fs10.promises.rename(srcEntry.filename, certificateDest);
+        await fs7.promises.rename(srcEntry.filename, certificateDest);
         indexSrc.delete(fingerprint);
         const indexDest = newStatus === "trusted" ? this.#thumbs.trusted : this.#thumbs.rejected;
         indexDest.set(fingerprint, { certificate, filename: certificateDest });
@@ -3784,7 +2610,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     });
   }
   #findAssociatedCRLs(issuerCertificate) {
-    const issuerCertificateInfo = exploreCertificate2(issuerCertificate);
+    const issuerCertificateInfo = exploreCertificate(issuerCertificate);
     const key = issuerCertificateInfo.tbsCertificate.subjectFingerPrint;
     return this.#thumbs.issuersCrl.get(key) ?? this.#thumbs.crl.get(key) ?? null;
   }
@@ -3823,7 +2649,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     if (!crls) {
       return "BadCertificateRevocationUnknown" /* BadCertificateRevocationUnknown */;
     }
-    const certInfo = exploreCertificate2(firstCertificate);
+    const certInfo = exploreCertificate(firstCertificate);
     const serialNumber = certInfo.tbsCertificate.serialNumber || certInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.serial || "";
     const key = certInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.authorityCertIssuerFingerPrint || "<unknown>";
     const crl2 = this.#thumbs.crl.get(key) ?? null;
@@ -3849,7 +2675,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
       const { index, filename } = nextCRL;
       const crl = await readCertificateRevocationList(filename);
       const crlInfo = exploreCertificateRevocationList(crl);
-      debugLog(chalk6.cyan("add CRL in folder "), filename);
+      debugLog(chalk3.cyan("add CRL in folder "), filename);
       const fingerprint = crlInfo.tbsCertList.issuerFingerprint;
       if (!index.has(fingerprint)) {
         index.set(fingerprint, { crls: [], serialNumbers: {} });
@@ -3862,7 +2688,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
           data.serialNumbers[serialNumber] = revokedCertificate.revocationDate;
         }
       }
-      debugLog(chalk6.cyan("CRL"), fingerprint, "serial numbers = ", Object.keys(data.serialNumbers));
+      debugLog(chalk3.cyan("CRL"), fingerprint, "serial numbers = ", Object.keys(data.serialNumbers));
     } catch (err) {
       debugLog("CRL filename error =");
       debugLog(err);
@@ -3888,14 +2714,15 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     const chokidarOptions = {
       usePolling,
       ...usePolling ? { interval: pollingInterval } : {},
+      depth: 0,
       persistent: false
     };
     const allCapturedHandles = [];
-    const origWatch = fs10.watch;
+    const origWatch = fs7.watch;
     let watcherReadyCount = 0;
     const totalWatchers = 5;
-    fs10.watch = ((...args) => {
-      const handle = origWatch.apply(fs10, args);
+    fs7.watch = ((...args) => {
+      const handle = origWatch.apply(fs7, args);
       handle.setMaxListeners(handle.getMaxListeners() + 1);
       handle.on("error", () => {
       });
@@ -3911,7 +2738,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
         }
         watcherReadyCount++;
         if (watcherReadyCount >= totalWatchers) {
-          fs10.watch = origWatch;
+          fs7.watch = origWatch;
         }
       };
       return { w, capturedHandles: allCapturedHandles.slice(startIdx), unreffAll };
@@ -3924,7 +2751,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
       this.#scanCrlFolder(this.issuersCrlFolder, this.#thumbs.issuersCrl)
     ]);
     if (this.#disableFileWatchers) {
-      fs10.watch = origWatch;
+      fs7.watch = origWatch;
     } else {
       this.#startWatcher(this.trustedFolder, this.#thumbs.trusted, createUnreffedWatcher, "trusted");
       this.#startWatcher(this.issuersCertFolder, this.#thumbs.issuers.certs, createUnreffedWatcher, "issuersCerts");
@@ -3939,19 +2766,19 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
    * file reads, preventing main-loop stalls with large folders.
    */
   async #scanCertFolder(folder, index) {
-    if (!fs10.existsSync(folder)) return;
-    const files = await fs10.promises.readdir(folder);
+    if (!fs7.existsSync(folder)) return;
+    const files = await fs7.promises.readdir(folder);
     for (const file of files) {
-      const filename = path6.join(folder, file);
+      const filename = path4.join(folder, file);
       try {
-        const stat = await fs10.promises.stat(filename);
+        const stat = await fs7.promises.stat(filename);
         if (!stat.isFile()) continue;
         const certs = await readCertificateChainAsync(filename);
         if (certs.length === 0) continue;
         const certificate = certs[0];
         if (certs.length > 1) {
           try {
-            await fs10.promises.writeFile(filename, toPem2(certs, "CERTIFICATE"), "ascii");
+            await fs7.promises.writeFile(filename, toPem(certs, "CERTIFICATE"), "ascii");
           } catch (writeErr) {
             debugLog(`scanCertFolder: could not rewrite legacy PEM ${filename} (read-only fs?)`, writeErr);
           }
@@ -3965,7 +2792,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
             }
           }
         }
-        const info = exploreCertificate2(certificate);
+        const info = exploreCertificate(certificate);
         const fingerprint = makeFingerprint(certificate);
         index.set(fingerprint, { certificate, filename, info });
         this.#filenameToHash.set(filename, fingerprint);
@@ -3978,12 +2805,12 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
    * Scan a CRL folder and populate the in-memory CRL index.
    */
   async #scanCrlFolder(folder, index) {
-    if (!fs10.existsSync(folder)) return;
-    const files = await fs10.promises.readdir(folder);
+    if (!fs7.existsSync(folder)) return;
+    const files = await fs7.promises.readdir(folder);
     for (const file of files) {
-      const filename = path6.join(folder, file);
+      const filename = path4.join(folder, file);
       try {
-        const stat = await fs10.promises.stat(filename);
+        const stat = await fs7.promises.stat(filename);
         if (!stat.isFile()) continue;
         this.#onCrlFileAdded(index, filename);
       } catch (err) {
@@ -4041,7 +2868,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     });
     let ready = false;
     w.on("unlink", (filename) => {
-      debugLog(chalk6.cyan(`unlink in folder ${folder}`), filename);
+      debugLog(chalk3.cyan(`unlink in folder ${folder}`), filename);
       const h = this.#filenameToHash.get(filename);
       if (h && index.has(h)) {
         index.delete(h);
@@ -4049,16 +2876,16 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
       }
     });
     w.on("add", (filename) => {
-      debugLog(chalk6.cyan(`add in folder ${folder}`), filename);
+      debugLog(chalk3.cyan(`add in folder ${folder}`), filename);
       try {
         const certificate = readCertificateChain(filename)[0];
-        const info = exploreCertificate2(certificate);
+        const info = exploreCertificate(certificate);
         const fingerprint = makeFingerprint(certificate);
         const isNew = !index.has(fingerprint);
         index.set(fingerprint, { certificate, filename, info });
         this.#filenameToHash.set(filename, fingerprint);
         debugLog(
-          chalk6.magenta("CERT"),
+          chalk3.magenta("CERT"),
           info.tbsCertificate.subjectFingerPrint,
           info.tbsCertificate.serialNumber,
           info.tbsCertificate.extensions?.authorityKeyIdentifier?.authorityCertIssuerFingerPrint
@@ -4072,7 +2899,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
       }
     });
     w.on("change", (changedPath) => {
-      debugLog(chalk6.cyan(`change in folder ${folder}`), changedPath);
+      debugLog(chalk3.cyan(`change in folder ${folder}`), changedPath);
       try {
         const certificate = readCertificateChain(changedPath)[0];
         const newFingerprint = makeFingerprint(certificate);
@@ -4080,7 +2907,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
         if (oldHash && oldHash !== newFingerprint) {
           index.delete(oldHash);
         }
-        index.set(newFingerprint, { certificate, filename: changedPath, info: exploreCertificate2(certificate) });
+        index.set(newFingerprint, { certificate, filename: changedPath, info: exploreCertificate(certificate) });
         this.#filenameToHash.set(changedPath, newFingerprint);
         this.emit("certificateChange", { store, certificate, fingerprint: newFingerprint, filename: changedPath });
       } catch (err) {
@@ -4108,12 +2935,152 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     });
   }
 };
+
+// packages/node-opcua-pki/lib/pki/toolbox_pfx.ts
+import assert5 from "assert";
+import fs8 from "fs";
+import {
+  certificateMatchesPrivateKey,
+  certificatesToPem,
+  coercePrivateKeyPem as coercePrivateKeyPem3,
+  createPfx,
+  makeSHA1Thumbprint as makeSHA1Thumbprint2,
+  Pkcs12UnsupportedAlgorithmError,
+  parsePfx,
+  readCertificateChain as readCertificateChain2,
+  readPrivateKey as readPrivateKey2,
+  toPem as toPem2,
+  x509
+} from "node-opcua-crypto";
+async function readPfxFile(options) {
+  const { pfxFile, passphrase = "" } = options;
+  assert5(fs8.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
+  try {
+    return await parsePfx(await fs8.promises.readFile(pfxFile), passphrase);
+  } catch (err) {
+    if (err instanceof Pkcs12UnsupportedAlgorithmError) {
+      const explained = new Error(
+        [
+          `${pfxFile} uses an encryption algorithm that is not supported (${err.message}).`,
+          "Bundles written by openssl 1.x default to 40-bit RC2, which openssl 3 itself",
+          "rejects unless given -legacy. Convert the file once with:",
+          "  openssl pkcs12 -legacy -in old.pfx -nodes -out tmp.pem",
+          "  openssl pkcs12 -export -in tmp.pem -out new.pfx"
+        ].join("\n")
+      );
+      explained.cause = err;
+      throw explained;
+    }
+    throw err;
+  }
+}
+async function createPFX(options) {
+  const { certificateFile, privateKeyFile, privateKeyPassphrase, outputFile, passphrase = "", caCertificateFiles } = options;
+  assert5(fs8.existsSync(certificateFile), `Certificate file does not exist: ${certificateFile}`);
+  assert5(fs8.existsSync(privateKeyFile), `Private key file does not exist: ${privateKeyFile}`);
+  const [certificate, ...bundledIssuers] = readCertificateChain2(certificateFile);
+  if (!certificate) {
+    throw new Error(`Certificate file holds no certificate: ${certificateFile}`);
+  }
+  const certificateChain = [...bundledIssuers];
+  for (const caFile of caCertificateFiles ?? []) {
+    assert5(fs8.existsSync(caFile), `CA certificate file does not exist: ${caFile}`);
+    certificateChain.push(...readCertificateChain2(caFile));
+  }
+  const privateKey = readPrivateKey2(privateKeyFile, privateKeyPassphrase);
+  if (!certificateMatchesPrivateKey(certificate, privateKey)) {
+    throw new Error(`The private key ${privateKeyFile} does not match the certificate ${certificateFile}`);
+  }
+  const pfx = await createPfx({
+    certificate,
+    certificateChain,
+    privateKey,
+    password: passphrase,
+    friendlyName: options.friendlyName
+  });
+  await fs8.promises.writeFile(outputFile, pfx);
+}
+async function extractCertificateFromPFX(options) {
+  const { certificate } = await readPfxFile(options);
+  return toPem2(certificate, "CERTIFICATE");
+}
+async function extractPrivateKeyFromPFX(options) {
+  const { privateKey } = await readPfxFile(options);
+  return coercePrivateKeyPem3(privateKey);
+}
+async function extractCACertificatesFromPFX(options) {
+  const { certificateChain } = await readPfxFile(options);
+  return certificateChain.length === 0 ? "" : certificatesToPem(certificateChain);
+}
+async function extractAllFromPFX(options) {
+  const { certificate, certificateChain, privateKey, friendlyName } = await readPfxFile(options);
+  return {
+    certificate: toPem2(certificate, "CERTIFICATE"),
+    privateKey: coercePrivateKeyPem3(privateKey),
+    caCertificates: certificateChain.length === 0 ? "" : certificatesToPem(certificateChain),
+    friendlyName
+  };
+}
+async function convertPFXtoPEM(pfxFile, pemFile, passphrase = "") {
+  const { certificate, certificateChain, privateKey } = await readPfxFile({ pfxFile, passphrase });
+  const parts = [coercePrivateKeyPem3(privateKey), toPem2(certificate, "CERTIFICATE")];
+  if (certificateChain.length > 0) {
+    parts.push(certificatesToPem(certificateChain));
+  }
+  await fs8.promises.writeFile(pemFile, `${parts.map((part) => part.trimEnd()).join("\n")}
+`, "utf-8");
+}
+function formatThumbprint(certificate) {
+  return (makeSHA1Thumbprint2(certificate).toString("hex").toUpperCase().match(/../g) ?? []).join(":");
+}
+function describePublicKey(certificate) {
+  const algorithm = certificate.publicKey.algorithm;
+  if (algorithm.modulusLength) {
+    return `${algorithm.name} ${algorithm.modulusLength} bits`;
+  }
+  if (algorithm.namedCurve) {
+    return `${algorithm.name} ${algorithm.namedCurve}`;
+  }
+  return algorithm.name;
+}
+function describeCertificate(der, indent) {
+  const certificate = new x509.X509Certificate(der);
+  return [
+    `${indent}subject          : ${certificate.subject}`,
+    `${indent}issuer           : ${certificate.issuer}`,
+    `${indent}serial number    : ${certificate.serialNumber}`,
+    `${indent}not before       : ${certificate.notBefore.toISOString()}`,
+    `${indent}not after        : ${certificate.notAfter.toISOString()}`,
+    `${indent}public key       : ${describePublicKey(certificate)}`,
+    `${indent}signature        : ${certificate.signatureAlgorithm.name}`,
+    `${indent}SHA-1 thumbprint : ${formatThumbprint(der)}`
+  ];
+}
+async function dumpPFX(pfxFile, passphrase = "") {
+  const { certificate, certificateChain, privateKey, friendlyName } = await readPfxFile({ pfxFile, passphrase });
+  const lines = [`PFX bundle : ${pfxFile}`];
+  if (friendlyName) {
+    lines.push(`friendly name : ${friendlyName}`);
+  }
+  const keyVerdict = certificateMatchesPrivateKey(certificate, privateKey) ? "matches this certificate" : "DOES NOT match this certificate";
+  lines.push("", "certificate", ...describeCertificate(certificate, "  "), `  private key      : ${keyVerdict}`);
+  lines.push("", `issuer chain : ${certificateChain.length} certificate(s)`);
+  for (const [index, issuer] of certificateChain.entries()) {
+    lines.push(`  [${index}]`, ...describeCertificate(issuer, "    "));
+  }
+  return `${lines.join("\n")}
+`;
+}
 export {
   CertificateAuthority,
+  CertificateAuthorityCore,
   CertificateManager,
   CertificateManagerState,
   ChainCompletionStatus,
+  NativeCaBackend,
+  OpenSslCaBackend,
   PrivateKeyPassphraseRequiredError,
+  PrivateKeyUnavailableError2 as PrivateKeyUnavailableError,
   Subject,
   VerificationStatus,
   adjustApplicationUri,
@@ -4130,6 +3097,7 @@ export {
   install_prerequisite,
   isIntermediateIssuer,
   isIssuer,
+  isOpaqueSigner,
   isRootIssuer,
   makeFingerprint,
   quote,