node-opcua-pki 6.22.0 → 7.0.0

package/dist/lib/toolbox/with_openssl/_env.d.ts

@@ -0,0 +1,58 @@
+import type { ProcessAltNamesParam } from "../common.js";
+/**
+ * Environment variables passed through to every openssl child process,
+ * beyond whatever a specific call explicitly needs (e.g. a passphrase via
+ * `ExecuteOptions.env`).
+ *
+ * This app's own config-templating (ALTNAME, CDP_URL, AIA_VALUE — see
+ * `generateStaticConfig`) substitutes values directly into the config file
+ * content; it never relies on the openssl child actually seeing those as
+ * real OS environment variables. Only `OPENSSL_CONF` and `RANDFILE` are
+ * genuinely required at the OS level, alongside whatever the shell, the
+ * dynamic loader, and the openssl binary themselves need to start up on
+ * each platform.
+ *
+ * Rather than handing the child the full parent process environment —
+ * which, in a hosting application, may hold unrelated secrets (API keys,
+ * database credentials, tokens) that have no business being visible to a
+ * spawned openssl process — only this curated, minimal set is passed
+ * through. The same set is used to *discover* the openssl binary
+ * (`install_prerequisite`) and to *run* it, so a binary that is found is
+ * also one that can start.
+ */
+export declare const SAFE_ENV_PASSTHROUGH: ReadonlySet<string>;
+/**
+ * Build the environment for an openssl child process: the allowlisted
+ * subset of `process.env` (see {@link SAFE_ENV_PASSTHROUGH}), overlaid with
+ * `extra` (per-invocation values such as a passphrase for `-passin env:`).
+ * Never writes to `process.env`.
+ */
+export declare function buildChildEnv(extra?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * A copy of `options` safe to hand to a logger: the values of any
+ * per-invocation `env` are replaced by their variable names, so a passphrase
+ * passed for `-passin env:NAME` can never end up in debug output.
+ */
+export declare function redactEnvForLog<T extends {
+    env?: NodeJS.ProcessEnv;
+}>(options: T): Omit<T, "env"> & {
+    env?: string[];
+};
+export declare const exportedEnvVars: Record<string, string>;
+export declare function setEnv(varName: string, value: string): void;
+export declare function hasEnv(varName: string): boolean;
+export declare function getEnv(varName: string): string;
+export declare function unsetEnv(varName: string): void;
+export declare function getEnvironmentVarNames(): {
+    key: string;
+    pattern: string;
+}[];
+/**
+ * Build the openssl `subjectAltName` value string (`URI:..., DNS:..., IP:...`)
+ * from SAN parameters. The single implementation of this format — used both
+ * by {@link processAltNames} (which publishes it to the shared env registry)
+ * and by callers that pass it as an explicit per-render override — so a
+ * format fix cannot land in one copy only.
+ */
+export declare function buildSubjectAltNameString(params: ProcessAltNamesParam): string;
+export declare function processAltNames(params: ProcessAltNamesParam): void;

package/dist/lib/toolbox/with_openssl/_env.js

@@ -0,0 +1,126 @@
+import { g_config } from "../config.js";
+import { warningLog } from "../debug.js";
+/**
+ * Environment variables passed through to every openssl child process,
+ * beyond whatever a specific call explicitly needs (e.g. a passphrase via
+ * `ExecuteOptions.env`).
+ *
+ * This app's own config-templating (ALTNAME, CDP_URL, AIA_VALUE — see
+ * `generateStaticConfig`) substitutes values directly into the config file
+ * content; it never relies on the openssl child actually seeing those as
+ * real OS environment variables. Only `OPENSSL_CONF` and `RANDFILE` are
+ * genuinely required at the OS level, alongside whatever the shell, the
+ * dynamic loader, and the openssl binary themselves need to start up on
+ * each platform.
+ *
+ * Rather than handing the child the full parent process environment —
+ * which, in a hosting application, may hold unrelated secrets (API keys,
+ * database credentials, tokens) that have no business being visible to a
+ * spawned openssl process — only this curated, minimal set is passed
+ * through. The same set is used to *discover* the openssl binary
+ * (`install_prerequisite`) and to *run* it, so a binary that is found is
+ * also one that can start.
+ */
+export const SAFE_ENV_PASSTHROUGH = new Set([
+    // POSIX/Windows shell and process essentials
+    "path",
+    "home",
+    "userprofile",
+    "temp",
+    "tmp",
+    "tmpdir",
+    "systemroot",
+    "windir",
+    "comspec",
+    "pathext",
+    "appdata",
+    "localappdata",
+    // dynamic loader: a custom-built or relocated openssl (e.g. under /opt,
+    // or Homebrew on macOS) may need these to find its own libcrypto/libssl
+    "ld_library_path",
+    "dyld_library_path",
+    "dyld_fallback_library_path",
+    // locale, so openssl's textual output stays parseable
+    "lang",
+    "lc_all",
+    "lc_ctype",
+    // openssl configuration this app, or the host OS/user, may rely on
+    "openssl_conf",
+    "randfile",
+    "openssl_modules",
+    "openssl_engines",
+    "ssl_cert_file",
+    "ssl_cert_dir"
+]);
+/**
+ * Build the environment for an openssl child process: the allowlisted
+ * subset of `process.env` (see {@link SAFE_ENV_PASSTHROUGH}), overlaid with
+ * `extra` (per-invocation values such as a passphrase for `-passin env:`).
+ * Never writes to `process.env`.
+ */
+export function buildChildEnv(extra) {
+    const env = {};
+    for (const key of Object.keys(process.env)) {
+        if (SAFE_ENV_PASSTHROUGH.has(key.toLowerCase())) {
+            env[key] = process.env[key];
+        }
+    }
+    return { ...env, ...extra };
+}
+/**
+ * A copy of `options` safe to hand to a logger: the values of any
+ * per-invocation `env` are replaced by their variable names, so a passphrase
+ * passed for `-passin env:NAME` can never end up in debug output.
+ */
+export function redactEnvForLog(options) {
+    const { env, ...rest } = options;
+    return env ? { ...rest, env: Object.keys(env) } : rest;
+}
+export const exportedEnvVars = {};
+export function setEnv(varName, value) {
+    // istanbul ignore next
+    if (!g_config.silent) {
+        warningLog(`          set ${varName}=${value}`);
+    }
+    exportedEnvVars[varName] = value;
+    if (["OPENSSL_CONF"].indexOf(varName) >= 0) {
+        process.env[varName] = value;
+    }
+    if (["RANDFILE"].indexOf(varName) >= 0) {
+        process.env[varName] = value;
+    }
+}
+export function hasEnv(varName) {
+    return Object.prototype.hasOwnProperty.call(exportedEnvVars, varName);
+}
+export function getEnv(varName) {
+    return exportedEnvVars[varName];
+}
+export function unsetEnv(varName) {
+    delete exportedEnvVars[varName];
+}
+export function getEnvironmentVarNames() {
+    return Object.keys(exportedEnvVars).map((varName) => {
+        return { key: varName, pattern: `\\$ENV\\:\\:${varName}` };
+    });
+}
+/**
+ * Build the openssl `subjectAltName` value string (`URI:..., DNS:..., IP:...`)
+ * from SAN parameters. The single implementation of this format — used both
+ * by {@link processAltNames} (which publishes it to the shared env registry)
+ * and by callers that pass it as an explicit per-render override — so a
+ * format fix cannot land in one copy only.
+ */
+export function buildSubjectAltNameString(params) {
+    return [
+        `URI:${params.applicationUri}`,
+        ...(params.dns ?? []).map((d) => `DNS:${d}`),
+        ...(params.ip ?? []).map((d) => `IP:${d}`)
+    ].join(", ");
+}
+export function processAltNames(params) {
+    params.dns = params.dns || [];
+    params.ip = params.ip || [];
+    setEnv("ALTNAME", buildSubjectAltNameString(params));
+}
+//# sourceMappingURL=_env.js.map

package/dist/lib/toolbox/with_openssl/_env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_env.js","sourceRoot":"","sources":["../../../../lib/toolbox/with_openssl/_env.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IAC7D,6CAA6C;IAC7C,MAAM;IACN,MAAM;IACN,aAAa;IACb,MAAM;IACN,KAAK;IACL,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,SAAS;IACT,SAAS;IACT,cAAc;IACd,wEAAwE;IACxE,wEAAwE;IACxE,iBAAiB;IACjB,mBAAmB;IACnB,4BAA4B;IAC5B,sDAAsD;IACtD,MAAM;IACN,QAAQ;IACR,UAAU;IACV,mEAAmE;IACnE,cAAc;IACd,UAAU;IACV,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,cAAc;CACjB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAyB;IACnD,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAwC,OAAU;IAC7E,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACjC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAA2B,EAAE,CAAC;AAE1D,MAAM,UAAU,MAAM,CAAC,OAAe,EAAE,KAAa;IACjD,uBAAuB;IACvB,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,iBAAiB,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,eAAe,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;IAEjC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;IACjC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,OAAe;IAClC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;AAC1E,CAAC;AACD,MAAM,UAAU,MAAM,CAAC,OAAe;IAClC,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe;IACpC,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,sBAAsB;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,OAAe,EAAE,EAAE;QACxD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,OAAO,EAAE,EAAE,CAAC;IAC/D,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAA4B;IAClE,OAAO;QACH,OAAO,MAAM,CAAC,cAAc,EAAE;QAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;KACrD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAA4B;IACxD,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5B,MAAM,CAAC,SAAS,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/lib/toolbox/with_openssl/create_certificate_signing_request.d.ts

@@ -0,0 +1,5 @@
+import type { CreateCertificateSigningRequestWithConfigOptions } from "../common.js";
+/**
+ * create a certificate signing request
+ */
+export declare function createCertificateSigningRequestWithOpenSSL(certificateSigningRequestFilename: string, params: CreateCertificateSigningRequestWithConfigOptions): Promise<void>;

package/dist/lib/toolbox/with_openssl/create_certificate_signing_request.js

@@ -0,0 +1,72 @@
+// ---------------------------------------------------------------------------------------------------------------------
+// node-opcua-pki
+// ---------------------------------------------------------------------------------------------------------------------
+// Copyright (c) 2014-2026 - Etienne Rossignon - etienne.rossignon (at) gadz.org
+// Copyright (c) 2022-2026 - Sterfive.com
+// ---------------------------------------------------------------------------------------------------------------------
+//
+// This  project is licensed under the terms of the MIT license.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+// ---------------------------------------------------------------------------------------------------------------------
+import assert from "node:assert";
+import fs from "node:fs";
+import path from "node:path";
+import { Subject } from "../../misc/subject.js";
+import { makePath } from "../common2.js";
+import { displaySubtitle } from "../display.js";
+import { processAltNames } from "./_env.js";
+import { execute_openssl } from "./execute_openssl.js";
+import { cleanupStaticConfig, generateStaticConfig } from "./toolbox.js";
+const n = makePath;
+/**
+ * create a certificate signing request
+ */
+export async function createCertificateSigningRequestWithOpenSSL(certificateSigningRequestFilename, params) {
+    assert(params);
+    assert(params.rootDir);
+    assert(params.configFile);
+    assert(params.privateKey);
+    assert(typeof params.privateKey === "string");
+    assert(fs.existsSync(params.configFile), `config file must exist ${params.configFile}`);
+    assert(fs.existsSync(params.privateKey), `Private key must exist${params.privateKey}`);
+    assert(fs.existsSync(params.rootDir), "RootDir key must exist");
+    assert(typeof certificateSigningRequestFilename === "string");
+    // note : this openssl command requires a config file
+    processAltNames(params);
+    const configFile = generateStaticConfig(params.configFile, { cwd: params.rootDir });
+    try {
+        const options = { cwd: params.rootDir, openssl_conf: path.relative(params.rootDir, configFile) };
+        const subject = params.subject ? new Subject(params.subject).toString() : undefined;
+        displaySubtitle("- Creating a Certificate Signing Request with openssl");
+        await execute_openssl([
+            "req",
+            "-new",
+            "-sha256",
+            "-batch",
+            "-text",
+            "-config",
+            n(configFile),
+            "-key",
+            n(params.privateKey),
+            ...(subject ? ["-subj", subject] : []),
+            "-out",
+            n(certificateSigningRequestFilename)
+        ], options);
+    }
+    finally {
+        await cleanupStaticConfig(configFile, { cwd: params.rootDir });
+    }
+}
+//# sourceMappingURL=create_certificate_signing_request.js.map

package/dist/lib/toolbox/with_openssl/create_certificate_signing_request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create_certificate_signing_request.js","sourceRoot":"","sources":["../../../../lib/toolbox/with_openssl/create_certificate_signing_request.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,iBAAiB;AACjB,wHAAwH;AACxH,gFAAgF;AAChF,yCAAyC;AACzC,wHAAwH;AACxH,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,+GAA+G;AAC/G,sHAAsH;AACtH,kHAAkH;AAClH,mGAAmG;AACnG,EAAE;AACF,uHAAuH;AACvH,YAAY;AACZ,EAAE;AACF,uHAAuH;AACvH,wHAAwH;AACxH,mHAAmH;AACnH,mHAAmH;AACnH,wHAAwH;AAExH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEhD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzE,MAAM,CAAC,GAAG,QAAQ,CAAC;AAEnB;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,0CAA0C,CAC5D,iCAAyC,EACzC,MAAwD;IAExD,MAAM,CAAC,MAAM,CAAC,CAAC;IACf,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1B,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1B,MAAM,CAAC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC;IAC9C,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,0BAA0B,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACxF,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,yBAAyB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACvF,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAChE,MAAM,CAAC,OAAO,iCAAiC,KAAK,QAAQ,CAAC,CAAC;IAE9D,qDAAqD;IACrD,eAAe,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACpF,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QAEjG,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpF,eAAe,CAAC,uDAAuD,CAAC,CAAC;QACzE,MAAM,eAAe,CACjB;YACI,KAAK;YACL,MAAM;YACN,SAAS;YACT,QAAQ;YACR,OAAO;YACP,SAAS;YACT,CAAC,CAAC,UAAU,CAAC;YACb,MAAM;YACN,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;YACpB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,MAAM;YACN,CAAC,CAAC,iCAAiC,CAAC;SACvC,EACD,OAAO,CACV,CAAC;IACN,CAAC;YAAS,CAAC;QACP,MAAM,mBAAmB,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;AACL,CAAC"}

package/dist/lib/toolbox/with_openssl/create_private_key.d.ts

@@ -0,0 +1,5 @@
+import type { KeyLength } from "../common.js";
+/**
+ * create a RSA PRIVATE KEY
+ *
+ */ export declare function createPrivateKeyOld(privateKeyFilename: string, keyLength: KeyLength): Promise<void>;

package/dist/lib/toolbox/with_openssl/create_private_key.js

@@ -0,0 +1,92 @@
+// ---------------------------------------------------------------------------------------------------------------------
+// node-opcua-pki
+// ---------------------------------------------------------------------------------------------------------------------
+// Copyright (c) 2014-2026 - Etienne Rossignon - etienne.rossignon (at) gadz.org
+// Copyright (c) 2022-2026 - Sterfive.com
+// ---------------------------------------------------------------------------------------------------------------------
+//
+// This  project is licensed under the terms of the MIT license.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+// ---------------------------------------------------------------------------------------------------------------------
+import assert from "node:assert";
+import { makePath } from "../common2.js";
+import { createRandomFileIfNotExist, useRandFile } from "./_create_random_file.js";
+import { getEnv, hasEnv } from "./_env.js";
+import { execute_openssl } from "./execute_openssl.js";
+const n = makePath;
+/**
+ * create a RSA PRIVATE KEY
+ *
+ */ export async function createPrivateKeyOld(privateKeyFilename, keyLength) {
+    // istanbul ignore next
+    if (useRandFile()) {
+        assert(hasEnv("RANDFILE"));
+    }
+    assert([1024, 2048, 3072, 4096].indexOf(keyLength) >= 0);
+    const randomFile = hasEnv("RANDFILE") ? n(getEnv("RANDFILE")) : "random.rnd";
+    await createRandomFileIfNotExist(randomFile, {});
+    // Note   OpenSSL1 generates a -----BEGIN RSA PRIVATE KEY---- whereas
+    //        OpenSSL3 generates a -----BEGIN PRIVATE KEY----- unless the new -traditional option is used
+    //
+    // a BEGIN PRIVATE KEY structure is
+    //
+    // SEQUENCE (3 elem)
+    //   INTEGER 0
+    //   SEQUENCE (2 elem)
+    //     OBJECT IDENTIFIER 1.2.840.113549.1.1.1 rsaEncryption (PKCS #1)
+    //     NULL
+    //   OCTET STRING (609 byte) 3082025D02010002818100C5B53231183906122A5E3778736B05C095C75F1BB80D48B
+    //      SEQUENCE (9 elem)
+    //
+    // a BEGIN RSA PRIVATE KEY structure is just
+    //   SEQUENCE (9 elem)
+    //
+    // ------------
+    // SEQUENCE (3 elem)
+    //   INTEGER 0
+    //   SEQUENCE (2 elem)
+    //     OBJECT IDENTIFIER 1.2.840.113549.1.1.1 rsaEncryption (PKCS #1)
+    //     NULL
+    //   OCTET STRING (610 byte) 3082025E02010002818100B2AA439E27C3BA098C2702AA3198EB84A7DCBD5EE89C960…
+    //     SEQUENCE (9 elem)
+    //       INTEGER 0
+    //       INTEGER (1024 bit) 125462895859728341123584977638642589270771742121547332287445289226366…
+    //       INTEGER 65537
+    //       INTEGER (1023 bit) 774731515410736871832760190435666409081718972781314217974674368631736…
+    //       INTEGER (512 bit) 1180764843612672431114081004978719388013129627283808550504107596576487…
+    //       INTEGER (512 bit) 1062556160427859677755725246352892525259232894278841408942283814742302…
+    //       INTEGER (512 bit) 8949288388532991287104785339472809167552401673320618630794823159001369…
+    //       INTEGER (512 bit) 7748065421164683482653822084922773530923521184169484732585074266859925…
+    //       INTEGER (512 bit) 1095294121686521689461230080512147243032904766384703204256065545245002…
+    // SEQUENCE (3 elem)
+    //   INTEGER 0
+    //   SEQUENCE (2 elem)
+    //     OBJECT IDENTIFIER 1.2.840.113549.1.1.1 rsaEncryption (PKCS #1)
+    //     NULL
+    //   OCTET STRING (1190 byte) 308204A202010002820101008D57525CF578A09A540144C58BC1E0A22014261C2756…
+    //     SEQUENCE (9 elem)
+    //       INTEGER 0
+    //       INTEGER (2048 bit) 178426609506070188409882662408448396194020805872625675714062746989511…
+    //       INTEGER 65537
+    //       INTEGER (2046 bit) 479410740008299120757682500320485803222685257276205124379958025502892…
+    //       INTEGER (1024 bit) 137695219737286994055132178347232356287024706246418361355523203552368…
+    //       INTEGER (1024 bit) 129580830653740837008469816238439062404066917510657577819175199112208…
+    //       INTEGER (1023 bit) 609718979626175834639964572018353446060920850095527846336769056729744…
+    //       INTEGER (1022 bit) 376719039084139366697037613682496827133479863181189073376679596057938…
+    //       INTEGER (1021 bit) 162921471472202227976749871246879611058257361785053516568268141902018…
+    // */
+    await execute_openssl(["genrsa", "-out", n(privateKeyFilename), ...(useRandFile() ? ["-rand", randomFile] : []), String(keyLength)], {});
+}
+//# sourceMappingURL=create_private_key.js.map

package/dist/lib/toolbox/with_openssl/create_private_key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create_private_key.js","sourceRoot":"","sources":["../../../../lib/toolbox/with_openssl/create_private_key.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,iBAAiB;AACjB,wHAAwH;AACxH,gFAAgF;AAChF,yCAAyC;AACzC,wHAAwH;AACxH,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,+GAA+G;AAC/G,sHAAsH;AACtH,kHAAkH;AAClH,mGAAmG;AACnG,EAAE;AACF,uHAAuH;AACvH,YAAY;AACZ,EAAE;AACF,uHAAuH;AACvH,wHAAwH;AACxH,mHAAmH;AACnH,mHAAmH;AACnH,wHAAwH;AACxH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,MAAM,CAAC,GAAG,QAAQ,CAAC;AAEnB;;;GAGG,CAAC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,kBAA0B,EAAE,SAAoB;IAC1F,uBAAuB;IACvB,IAAI,WAAW,EAAE,EAAE,CAAC;QAChB,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7E,MAAM,0BAA0B,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjD,qEAAqE;IACrE,qGAAqG;IACrG,EAAE;IACF,mCAAmC;IACnC,EAAE;IACF,oBAAoB;IACpB,cAAc;IACd,sBAAsB;IACtB,qEAAqE;IACrE,WAAW;IACX,kGAAkG;IAClG,yBAAyB;IACzB,EAAE;IACF,4CAA4C;IAC5C,sBAAsB;IACtB,EAAE;IACF,eAAe;IACf,oBAAoB;IACpB,cAAc;IACd,sBAAsB;IACtB,qEAAqE;IACrE,WAAW;IACX,mGAAmG;IACnG,wBAAwB;IACxB,kBAAkB;IAClB,kGAAkG;IAClG,sBAAsB;IACtB,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAElG,oBAAoB;IACpB,cAAc;IACd,sBAAsB;IACtB,qEAAqE;IACrE,WAAW;IACX,mGAAmG;IACnG,wBAAwB;IACxB,kBAAkB;IAClB,kGAAkG;IAClG,sBAAsB;IACtB,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,KAAK;IACL,MAAM,eAAe,CACjB,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,kBAAkB,CAAC,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAC7G,EAAE,CACL,CAAC;AACN,CAAC"}

package/dist/lib/toolbox/with_openssl/create_self_signed_certificate.d.ts

@@ -0,0 +1,5 @@
+import { type CreateSelfSignCertificateWithConfigParam } from "../common.js";
+/**
+ * @param certificate: the filename of the certificate to create
+ */
+export declare function createSelfSignedCertificate(certificate: string, params: CreateSelfSignCertificateWithConfigParam): Promise<void>;

package/dist/lib/toolbox/with_openssl/create_self_signed_certificate.js

@@ -0,0 +1,135 @@
+// ---------------------------------------------------------------------------------------------------------------------
+// node-opcua-pki
+// ---------------------------------------------------------------------------------------------------------------------
+// Copyright (c) 2014-2026 - Etienne Rossignon - etienne.rossignon (at) gadz.org
+// Copyright (c) 2022-2026 - Sterfive.com
+// ---------------------------------------------------------------------------------------------------------------------
+//
+// This  project is licensed under the terms of the MIT license.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+// ---------------------------------------------------------------------------------------------------------------------
+import assert from "node:assert";
+import fs from "node:fs";
+import { CertificatePurpose } from "node-opcua-crypto";
+import { Subject } from "../../misc/subject.js";
+import { adjustDate } from "../common.js";
+import { makePath } from "../common2.js";
+import { displayTitle } from "../display.js";
+import { processAltNames } from "./_env.js";
+import { ensure_openssl_installed, execute_openssl } from "./execute_openssl.js";
+import { cleanupStaticConfig, generateStaticConfig } from "./toolbox.js";
+const n = makePath;
+/**
+ * @param certificate: the filename of the certificate to create
+ */
+export async function createSelfSignedCertificate(certificate, params) {
+    await ensure_openssl_installed();
+    params.purpose = params.purpose || CertificatePurpose.ForApplication;
+    assert(params.purpose, "Please provide a Certificate Purpose");
+    /**
+     * note: due to a limitation of openssl ,
+     *       it is not possible to control the startDate of the certificate validity
+     *       to achieve this the certificateAuthority tool shall be used.
+     */
+    assert(fs.existsSync(params.configFile));
+    assert(fs.existsSync(params.rootDir));
+    if (typeof params.privateKey !== "string") {
+        // This openssl-CLI-based path can only pass a private key to
+        // openssl as a file path (`-key <path>`); it has no way to hand it
+        // an in-memory key without writing the decrypted key back out to
+        // disk, defeating the purpose of a passphrase-protected key. Use
+        // CertificateManager's own createSelfSignedCertificate (the
+        // WebCrypto-based, without_openssl path) instead, which does
+        // support an in-memory PrivateKey.
+        throw new Error("createSelfSignedCertificate (openssl-CLI path): an in-memory PrivateKey is not supported here; provide a filename.");
+    }
+    const privateKeyFilename = params.privateKey;
+    assert(fs.existsSync(privateKeyFilename));
+    if (!params.subject) {
+        throw new Error("Missing subject");
+    }
+    assert(typeof params.applicationUri === "string");
+    assert(Array.isArray(params.dns));
+    // xx no key size in self-signed assert(params.keySize == 2048 || params.keySize == 4096);
+    processAltNames(params);
+    adjustDate(params);
+    assert(Object.prototype.hasOwnProperty.call(params, "validity"));
+    let subject = new Subject(params.subject);
+    subject = subject.toString();
+    const certificateRequestFilename = `${certificate}.csr`;
+    const configFile = generateStaticConfig(params.configFile);
+    try {
+        const configOption = ["-config", n(configFile)];
+        let extension;
+        switch (params.purpose) {
+            case CertificatePurpose.ForApplication:
+                extension = "v3_selfsigned";
+                break;
+            case CertificatePurpose.ForCertificateAuthority:
+                extension = "v3_ca";
+                break;
+            default:
+                extension = "v3_selfsigned";
+        }
+        displayTitle("Generate a certificate request");
+        // Once the private key is generated a Certificate Signing Request can be generated.
+        // The CSR is then used in one of two ways. Ideally, the CSR will be sent to a Certificate Authority, such as
+        // Thawte or Verisign who will verify the identity of the requestor and issue a signed certificate.
+        // The second option is to self-sign the CSR, which will be demonstrated in the next section
+        await execute_openssl([
+            "req",
+            "-new",
+            "-sha256",
+            "-text",
+            "-extensions",
+            extension,
+            ...configOption,
+            "-key",
+            n(privateKeyFilename),
+            "-out",
+            n(certificateRequestFilename),
+            "-subj",
+            subject
+        ], {});
+        // Xx // Step 3: Remove Passphrase from Key
+        // Xx execute("cp private/cakey.pem private/cakey.pem.org");
+        // Xx execute(openssl_path + " rsa -in private/cakey.pem.org
+        // Xx -out private/cakey.pem -passin pass:"+paraphrase);
+        displayTitle("Generate Certificate (self-signed)");
+        await execute_openssl([
+            "x509",
+            "-req",
+            "-days",
+            String(params.validity),
+            "-extensions",
+            extension,
+            "-extfile",
+            n(configFile),
+            "-in",
+            n(certificateRequestFilename),
+            "-signkey",
+            n(privateKeyFilename),
+            "-text",
+            "-out",
+            certificate
+        ], {});
+        // remove unnecessary certificate request file
+        await fs.promises.unlink(certificateRequestFilename);
+    }
+    finally {
+        await cleanupStaticConfig(configFile);
+    }
+}
+//# sourceMappingURL=create_self_signed_certificate.js.map

package/dist/lib/toolbox/with_openssl/create_self_signed_certificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create_self_signed_certificate.js","sourceRoot":"","sources":["../../../../lib/toolbox/with_openssl/create_self_signed_certificate.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,iBAAiB;AACjB,wHAAwH;AACxH,gFAAgF;AAChF,yCAAyC;AACzC,wHAAwH;AACxH,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,+GAA+G;AAC/G,sHAAsH;AACtH,kHAAkH;AAClH,mGAAmG;AACnG,EAAE;AACF,uHAAuH;AACvH,YAAY;AACZ,EAAE;AACF,uHAAuH;AACvH,wHAAwH;AACxH,mHAAmH;AACnH,mHAAmH;AACnH,wHAAwH;AAExH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAiD,MAAM,cAAc,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzE,MAAM,CAAC,GAAG,QAAQ,CAAC;AAEnB;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,WAAmB,EAAE,MAAgD;IACnH,MAAM,wBAAwB,EAAE,CAAC;IAEjC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,kBAAkB,CAAC,cAAc,CAAC;IACrE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,sCAAsC,CAAC,CAAC;IAC/D;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACxC,6DAA6D;QAC7D,mEAAmE;QACnE,iEAAiE;QACjE,iEAAiE;QACjE,4DAA4D;QAC5D,6DAA6D;QAC7D,mCAAmC;QACnC,MAAM,IAAI,KAAK,CACX,oHAAoH,CACvH,CAAC;IACN,CAAC;IACD,MAAM,kBAAkB,GAAW,MAAM,CAAC,UAAU,CAAC;IACrD,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,CAAC,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAElC,0FAA0F;IAE1F,eAAe,CAAC,MAAM,CAAC,CAAC;IAExB,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAEjE,IAAI,OAAO,GAAqB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAE7B,MAAM,0BAA0B,GAAG,GAAG,WAAW,MAAM,CAAC;IAExD,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,CAAC;QACD,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAEhD,IAAI,SAAiB,CAAC;QACtB,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,KAAK,kBAAkB,CAAC,cAAc;gBAClC,SAAS,GAAG,eAAe,CAAC;gBAC5B,MAAM;YACV,KAAK,kBAAkB,CAAC,uBAAuB;gBAC3C,SAAS,GAAG,OAAO,CAAC;gBACpB,MAAM;YACV;gBACI,SAAS,GAAG,eAAe,CAAC;QACpC,CAAC;QAED,YAAY,CAAC,gCAAgC,CAAC,CAAC;QAE/C,oFAAoF;QACpF,6GAA6G;QAC7G,mGAAmG;QACnG,4FAA4F;QAC5F,MAAM,eAAe,CACjB;YACI,KAAK;YACL,MAAM;YACN,SAAS;YACT,OAAO;YACP,aAAa;YACb,SAAS;YACT,GAAG,YAAY;YACf,MAAM;YACN,CAAC,CAAC,kBAAkB,CAAC;YACrB,MAAM;YACN,CAAC,CAAC,0BAA0B,CAAC;YAC7B,OAAO;YACP,OAAO;SACV,EACD,EAAE,CACL,CAAC;QAEF,2CAA2C;QAC3C,4DAA4D;QAC5D,4DAA4D;QAC5D,wDAAwD;QAExD,YAAY,CAAC,oCAAoC,CAAC,CAAC;QACnD,MAAM,eAAe,CACjB;YACI,MAAM;YACN,MAAM;YACN,OAAO;YACP,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YACvB,aAAa;YACb,SAAS;YACT,UAAU;YACV,CAAC,CAAC,UAAU,CAAC;YACb,KAAK;YACL,CAAC,CAAC,0BAA0B,CAAC;YAC7B,UAAU;YACV,CAAC,CAAC,kBAAkB,CAAC;YACrB,OAAO;YACP,MAAM;YACN,WAAW;SACd,EACD,EAAE,CACL,CAAC;QACF,8CAA8C;QAE9C,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACzD,CAAC;YAAS,CAAC;QACP,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;AACL,CAAC"}

package/dist/lib/toolbox/with_openssl/execute_openssl.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Arguments for one openssl invocation, one array element per argv entry,
+ * e.g. `["x509", "-in", certificateFile, "-noout"]`. Values are handed to
+ * the openssl process as-is: no shell is involved, so no quoting or escaping
+ * is needed and no value can be interpreted as a shell metacharacter.
+ */
+export type OpensslArgs = readonly string[];
+export interface ExecuteOptions {
+    cwd?: string;
+    hideErrorMessage?: boolean;
+    /**
+     * Extra environment variables for this invocation only. Merged with a
+     * curated, minimal passthrough of the current process environment (see
+     * `SAFE_ENV_PASSTHROUGH` in `_env.ts`) for the spawned child — never the
+     * full parent environment, and never written to `process.env`, so
+     * concurrent invocations cannot see or clobber each other's values and
+     * unrelated secrets sitting in the host application's environment are
+     * never handed to the openssl child.
+     *
+     * Use this together with openssl's `-passin env:NAME` / `-passout
+     * env:NAME` syntax to pass a secret without ever placing it in argv: an
+     * argv value is visible to other processes via the process list. See
+     * {@link passinArg} / {@link passoutArg}.
+     */
+    env?: NodeJS.ProcessEnv;
+}
+/** openssl argv entries plus the env they need; merge `env` into `ExecuteOptions.env`. */
+export interface OpensslPassArg {
+    args: string[];
+    env: NodeJS.ProcessEnv;
+}
+/**
+ * `-passin env:...` for a source passphrase (an input key or PFX bundle).
+ *
+ * Always emit this — with `""` when there is no passphrase — for any command
+ * that reads a private key which *might* be encrypted: without a `-passin`,
+ * openssl prompts on the controlling terminal for an encrypted key. An empty
+ * `-passin` on a plaintext key is a no-op; on an encrypted key it fails fast
+ * with `bad decrypt` instead.
+ */
+export declare function passinArg(passphrase?: string): OpensslPassArg;
+/** `-passout env:...` for an output passphrase (a PFX bundle being written). */
+export declare function passoutArg(passphrase?: string): OpensslPassArg;
+/**
+ * Run `file` with `args` directly (no shell): each element of `args` reaches
+ * the child as one argv entry, so a value can never be reinterpreted as a
+ * shell metacharacter, a redirection, or a second command. stdin is
+ * `/dev/null`: OpenSSL's app UI opens the console before honouring
+ * `-passin` and calls tcgetattr on stdin when there is no controlling TTY;
+ * a socket (Node's default child stdin) yields ENOTTY on Linux but
+ * EOPNOTSUPP on macOS, which OpenSSL rejects and the key load fails even
+ * with the right passphrase; /dev/null yields ENOTTY everywhere. It also
+ * removes any way for openssl to block reading a password from stdin.
+ */
+export declare function execute(file: string, args: OpensslArgs, options: ExecuteOptions): Promise<string>;
+export declare function find_openssl(): Promise<string>;
+export declare function ensure_openssl_installed(): Promise<void>;
+export declare function executeOpensslAsync(args: OpensslArgs, options: ExecuteOpenSSLOptions): Promise<string>;
+export declare function execute_openssl_no_failure(args: OpensslArgs, options: ExecuteOpenSSLOptions): Promise<string | undefined>;
+export interface ExecuteOpenSSLOptions extends ExecuteOptions {
+    openssl_conf?: string;
+}
+/**
+ * Run `openssl` with `args` (see {@link OpensslArgs}): no shell, one argv
+ * entry per element, curated environment, /dev/null stdin.
+ */
+export declare function execute_openssl(args: OpensslArgs, options: ExecuteOpenSSLOptions): Promise<string>;