node-opcua-pki 6.22.0 → 7.0.0

package/dist/lib/ca/backends/openssl_ca_backend.js

@@ -0,0 +1,398 @@
+// ---------------------------------------------------------------------------------------------------------------------
+// node-opcua-pki
+// ---------------------------------------------------------------------------------------------------------------------
+// Copyright (c) 2014-2026 - Etienne Rossignon - etienne.rossignon (at) gadz.org
+// Copyright (c) 2022-2026 - Sterfive.com
+// ---------------------------------------------------------------------------------------------------------------------
+//
+// This  project is licensed under the terms of the MIT license.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+// ---------------------------------------------------------------------------------------------------------------------
+import fs from "node:fs";
+import path from "node:path";
+import { Subject } from "node-opcua-crypto";
+import { displaySubtitle, displayTitle, makePath } from "../../toolbox/index.js";
+import { buildSubjectAltNameString, cleanupStaticConfig, ensure_openssl_installed, execute_openssl, execute_openssl_no_failure, generateStaticConfig, passinArg, setEnv, x509Date } from "../../toolbox/with_openssl/index.js";
+const n = makePath;
+/** The ALTNAME openssl embeds as `subjectAltName` on the CA's own certificate/CSR — see `[v3_ca]` / `[v3_ca_req]`. */
+function caAltName(ca) {
+    // OPC UA validators (UaExpert, compliance tools) require every
+    // certificate — including the root/intermediate CA — to carry a
+    // SubjectAltName extension. RFC 5280 does not strictly mandate it
+    // on CA certificates but the OPC UA Profile does. Build a stable
+    // URI SAN derived from the CA CommonName so the resulting CA cert
+    // passes the spec check.
+    return `URI:urn:${ca.subject.commonName || "NodeOPCUA-CA"}`;
+}
+/**
+ * Every render of `conf/caconfig.cnf` needs `ALTNAME` / `CDP_URL` /
+ * `AIA_VALUE` resolved, **even for an `openssl` subcommand that only reads
+ * a different section** (`ca -gencrl` only needs `[crl_ext]`, `ca -revoke`
+ * only needs `[ca]`): openssl's config loader (`NCONF_load`) expands every
+ * `$ENV::NAME` reference in the file line by line as it parses it, not
+ * lazily per queried section, and every section in this template — not
+ * just the two gated behind `{{#CDP_URL}}` / `{{#AIA_VALUE}}` — references
+ * `$ENV::ALTNAME` unconditionally. Leaving any of the three unresolved
+ * makes openssl fall through to its own native `$ENV::` resolution (a real
+ * OS environment variable, which is never set) and fail with "variable has
+ * no value".
+ *
+ * Passed explicitly rather than relying on whatever `setEnv()` last wrote
+ * to the shared registry (see {@link generateStaticConfig}'s
+ * `envOverrides`) — empty string means "omit the extension" for the two
+ * gated keys (the template's `{{#KEY}}` block strips itself on an empty
+ * value), never "fall back to the registry".
+ *
+ * Exported as the single implementation of the CDP/AIA value format:
+ * `CertificateAuthority._wireRevocationEnvVars` (the legacy registry shim)
+ * delegates here so the format cannot drift between the two mechanisms.
+ */
+export function caConfigEnvOverrides(ca, altName = caAltName(ca)) {
+    const aiaLegs = [];
+    if (ca.ocspResponderUrl) {
+        aiaLegs.push(`OCSP;URI:${ca.ocspResponderUrl}`);
+    }
+    if (ca.caIssuersUrl) {
+        aiaLegs.push(`caIssuers;URI:${ca.caIssuersUrl}`);
+    }
+    return {
+        ALTNAME: altName,
+        CDP_URL: ca.crlDistributionUrl ?? "",
+        AIA_VALUE: aiaLegs.join(",")
+    };
+}
+/**
+ * The default {@link CaBackend}: shells out to the `openssl` CLI, exactly as
+ * `CertificateAuthority` always has — this is a pure code move (plus a lock
+ * around every database-mutating operation, temp-config cleanup, and
+ * explicit `envOverrides` on every config render) with no change in the
+ * openssl commands issued or the files produced.
+ */
+export class OpenSslCaBackend {
+    /** This backend is the `openssl` executable, so it has to be there. */
+    /**
+     * `-passin env:` argv and env for an openssl call that has to load this
+     * CA's key. Built here rather than on the CA: the passphrase is the
+     * CA's business, but expressing it as an openssl argument is this
+     * backend's, and the core has no reason to know the flag exists.
+     */
+    async #passin(ca) {
+        return passinArg(await ca._privateKeyPassphrase());
+    }
+    /** The openssl CLI loads its key from a file, so it cannot call out to an HSM. */
+    supportsExternalSigner = false;
+    async preflight() {
+        await ensure_openssl_installed();
+    }
+    /**
+     * Render `conf/caconfig.cnf` once with explicit overrides, run `fn`
+     * with the rendered path, and always remove the temp file. Structural
+     * guarantee that (a) every render carries the three required env
+     * values and (b) no rendered `<name>.<pid>-<n>.tmp` file is ever left
+     * behind — each was previously a per-method discipline.
+     */
+    async #withConfig(ca, altName, fn) {
+        const caRootDir = path.resolve(ca.rootDir);
+        const options = { cwd: caRootDir };
+        const configFile = generateStaticConfig("conf/caconfig.cnf", options, caConfigEnvOverrides(ca, altName));
+        try {
+            return await fn(configFile, options);
+        }
+        finally {
+            await cleanupStaticConfig(configFile, options);
+        }
+    }
+    async #generateCaCsrWith(ca, configFile, options, privateKeyFile, csrFile) {
+        const passin = await this.#passin(ca);
+        displayTitle("Generate a certificate request for the CA key");
+        await execute_openssl([
+            "req",
+            "-new",
+            "-sha256",
+            "-extensions",
+            "v3_ca_req",
+            "-config",
+            n(configFile),
+            "-key",
+            n(privateKeyFile),
+            "-out",
+            n(csrFile),
+            "-subj",
+            ca.subject.toString(),
+            ...passin.args
+        ], { ...options, env: passin.env });
+    }
+    /**
+     * `openssl ca -gencrl` signs the CRL with the CA key it finds through the
+     * config file (`private_key = $dir/private/cakey.pem`), so it needs the
+     * CA passphrase like every other `openssl ca` invocation.
+     */
+    async #regenerateCrlWith(ca, configFile, options) {
+        const passin = await this.#passin(ca);
+        // produce a CRL in PEM format
+        displaySubtitle("regenerate CRL (Certificate Revocation List)");
+        await execute_openssl(["ca", "-gencrl", "-config", n(configFile), "-out", "crl/revocation_list.crl", ...passin.args], {
+            ...options,
+            env: passin.env
+        });
+        await execute_openssl(["crl", "-in", "crl/revocation_list.crl", "-out", "crl/revocation_list.der", "-outform", "der"], options);
+        displaySubtitle("Display (Certificate Revocation List)");
+        await execute_openssl(["crl", "-in", n(ca.revocationList), "-text", "-noout"], options);
+    }
+    async generateCaCsr(ca, _caRootDir, privateKeyFile, csrFile) {
+        await this.#withConfig(ca, caAltName(ca), (configFile, options) => this.#generateCaCsrWith(ca, configFile, options, privateKeyFile, csrFile));
+    }
+    async bootstrap(ca) {
+        const caRootDir = path.resolve(ca.rootDir);
+        const privateKeyFilename = path.join(caRootDir, "private/cakey.pem");
+        const csrFilename = path.join(caRootDir, "private/cakey.csr");
+        // one render serves the CSR, the CA-certificate signature, and the
+        // initial CRL (the overrides are identical for all three)
+        await this.#withConfig(ca, caAltName(ca), async (configFile, options) => {
+            await this.#generateCaCsrWith(ca, configFile, options, privateKeyFilename, csrFilename);
+            const issuerCA = ca._issuerCA;
+            if (issuerCA) {
+                // Subordinate (intermediate) CA — signed by the parent CA
+                displayTitle("Generate CA Certificate (signed by issuer CA)");
+                const issuerCert = path.resolve(issuerCA.caCertificate);
+                const issuerKey = path.resolve(issuerCA.rootDir, "private/cakey.pem");
+                const issuerSerial = path.resolve(issuerCA.rootDir, "serial");
+                // the -CAkey is the *issuer's* key: its passphrase, not this CA's
+                const issuerPassin = await this.#passin(issuerCA);
+                const signWithIssuer = async () => {
+                    await execute_openssl([
+                        "x509",
+                        "-sha256",
+                        "-req",
+                        "-days",
+                        "3650",
+                        "-extensions",
+                        "v3_ca",
+                        "-extfile",
+                        n(configFile),
+                        "-in",
+                        "private/cakey.csr",
+                        "-CA",
+                        n(issuerCert),
+                        "-CAkey",
+                        n(issuerKey),
+                        "-CAserial",
+                        n(issuerSerial),
+                        "-out",
+                        "public/cacert.pem",
+                        ...issuerPassin.args
+                    ], { ...options, env: issuerPassin.env });
+                };
+                // `-CAserial` read-increment-writes the ISSUER's serial file,
+                // so this must hold the issuer's directory lock, not just the
+                // subordinate's (which the caller already holds). The only
+                // cross-CA lock ordering in the codebase is subordinate ->
+                // issuer, so this cannot deadlock — unless both CAs share one
+                // rootDir (a degenerate configuration), where the lock is
+                // already held and re-acquiring the non-reentrant file lock
+                // would self-deadlock: skip it there.
+                if (path.resolve(issuerCA.rootDir) === caRootDir) {
+                    await signWithIssuer();
+                }
+                else {
+                    await issuerCA._withCaDirectoryLock(signWithIssuer);
+                }
+            }
+            else {
+                // Root CA — self-signed
+                displayTitle("Generate CA Certificate (self-signed)");
+                const passin = await this.#passin(ca);
+                await execute_openssl([
+                    "x509",
+                    "-sha256",
+                    "-req",
+                    "-days",
+                    "3650",
+                    "-extensions",
+                    "v3_ca",
+                    "-extfile",
+                    n(configFile),
+                    "-in",
+                    "private/cakey.csr",
+                    "-signkey",
+                    n(privateKeyFilename),
+                    "-out",
+                    "public/cacert.pem",
+                    ...passin.args
+                ], { ...options, env: passin.env });
+            }
+            displaySubtitle("generate initial CRL (Certificate Revocation List)");
+            await this.#regenerateCrlWith(ca, configFile, options);
+        });
+        displayTitle("Create Certificate Authority (CA) ---> DONE");
+    }
+    async regenerateCrl(ca) {
+        await this.#withConfig(ca, caAltName(ca), (configFile, options) => this.#regenerateCrlWith(ca, configFile, options));
+    }
+    async signSubordinateCsr(ca, csrFile, certFile, validityDays) {
+        // `[v3_ca]`'s subjectAltName should describe the *subordinate* being
+        // certified, not `ca` (the issuer doing the signing) — but nothing
+        // here parses `csrFile`'s own subject, so this reuses the issuer's
+        // identity as a well-formed placeholder. This is a pre-existing gap,
+        // not a regression: the original code left this value to whatever a
+        // prior, unrelated operation had last set in the shared env
+        // registry (an accidental "URI:undefined" or a stale value from a
+        // different CA entirely), so this is deterministic where the
+        // original was not, even though neither describes the subordinate.
+        await this.#withConfig(ca, caAltName(ca), async (configFile, options) => {
+            const caRootDir = options.cwd;
+            const passin = await this.#passin(ca);
+            await execute_openssl([
+                "x509",
+                "-sha256",
+                "-req",
+                "-days",
+                String(validityDays),
+                "-extensions",
+                "v3_ca",
+                "-extfile",
+                n(configFile),
+                "-in",
+                n(csrFile),
+                "-CA",
+                n(ca.caCertificate),
+                "-CAkey",
+                n(path.join(caRootDir, "private/cakey.pem")),
+                "-CAserial",
+                n(path.join(caRootDir, "serial")),
+                "-out",
+                n(certFile),
+                ...passin.args
+            ], { ...options, env: passin.env });
+        });
+    }
+    async signEndEntityCsr(ca, certificate, csr, params1, sanOverride) {
+        await this.#withConfig(ca, buildSubjectAltNameString(sanOverride), async (configFile, options) => {
+            displaySubtitle("- then we ask the authority to sign the certificate signing request");
+            const passin = await this.#passin(ca);
+            await execute_openssl([
+                "ca",
+                "-config",
+                configFile,
+                "-startdate",
+                x509Date(params1.startDate),
+                "-enddate",
+                x509Date(params1.endDate),
+                "-batch",
+                "-out",
+                n(certificate),
+                "-in",
+                n(csr),
+                ...passin.args
+            ], { ...options, env: passin.env });
+            displaySubtitle("- dump the certificate for a check");
+            await execute_openssl(["x509", "-in", n(certificate), "-dates", "-fingerprint", "-purpose", "-noout"], options);
+        });
+    }
+    async revoke(ca, certificate, reason) {
+        // one render serves the revocation and the CRL regeneration
+        // openssl writes its entropy file here; the native backend has no such notion
+        setEnv("RANDFILE", path.join(ca.rootDir, "random.rnd"));
+        await this.#withConfig(ca, caAltName(ca), async (configFile, options) => {
+            displaySubtitle("Revoke certificate");
+            const passin = await this.#passin(ca);
+            await execute_openssl_no_failure(["ca", "-verbose", "-config", n(configFile), "-revoke", certificate, "-crl_reason", reason, ...passin.args], { ...options, env: passin.env });
+            // regenerate CRL (Certificate Revocation List)
+            await this.#regenerateCrlWith(ca, configFile, options);
+            displaySubtitle("Verify that certificate is revoked");
+            await execute_openssl_no_failure([
+                "verify",
+                "-verbose",
+                "-CRLfile",
+                n(ca.revocationList),
+                "-CAfile",
+                n(ca.caCertificate),
+                "-crl_check",
+                n(certificate)
+            ], options);
+            // produce CRL in DER format
+            displaySubtitle("Produce CRL in DER form ");
+            await execute_openssl(["crl", "-in", n(ca.revocationList), "-out", "crl/revocation_list.der", "-outform", "der"], options);
+            // produce CRL in PEM format with text
+            displaySubtitle("Produce CRL in PEM form ");
+            await execute_openssl(["crl", "-in", n(ca.revocationList), "-out", "crl/revocation_list.pem", "-outform", "pem", "-text"], options);
+        });
+    }
+    async createSelfSignedCertificate(ca, certificateFile, privateKeyFile, params) {
+        // Explicit overrides like every other method: `$ENV::ALTNAME` in the
+        // rendered config comes from THIS call's params, never from whatever
+        // the shared env registry happened to hold — the registry-based
+        // render made a concurrent operation's SANs (or an empty ALTNAME
+        // from a concurrent revoke) leak into this certificate. CDP/AIA now
+        // deterministically follow this CA's configured URLs as well.
+        const envOverrides = caConfigEnvOverrides(ca, buildSubjectAltNameString(params));
+        const configFile = generateStaticConfig(ca.configFile, { cwd: ca.rootDir }, envOverrides);
+        const options = {
+            cwd: ca.rootDir,
+            openssl_conf: makePath(configFile)
+        };
+        try {
+            const subject = params.subject ? new Subject(params.subject).toString() : "";
+            const subjectOptions = subject && subject.length > 1 ? ["-subj", subject] : [];
+            const csrFile = `${certificateFile}_csr`;
+            // `req -new -key` reads (and, for an encrypted key, must decrypt)
+            // privateKeyFile too: without -passin it hangs indefinitely
+            // waiting on a passphrase prompt that never comes, even with
+            // stdin redirected to /dev/null — unlike e.g. `pkcs12`/`rsa
+            // -pubout`, which fail fast instead. Reproduced directly against
+            // OpenSSL 3.5.4. Empty passin is a no-op against a plaintext key.
+            const passin = await this.#passin(ca);
+            displaySubtitle("- the certificate signing request");
+            await execute_openssl([
+                "req",
+                "-new",
+                "-sha256",
+                ...subjectOptions,
+                "-batch",
+                "-key",
+                n(privateKeyFile),
+                "-out",
+                n(csrFile),
+                ...passin.args
+            ], { ...options, env: passin.env });
+            displaySubtitle("- creating the self-signed certificate");
+            await execute_openssl([
+                "ca",
+                "-selfsign",
+                "-keyfile",
+                n(privateKeyFile),
+                "-startdate",
+                x509Date(params.startDate),
+                "-enddate",
+                x509Date(params.endDate),
+                "-batch",
+                "-out",
+                n(certificateFile),
+                "-in",
+                n(csrFile),
+                ...passin.args
+            ], { ...options, env: passin.env });
+            displaySubtitle("- dump the certificate for a check");
+            await execute_openssl(["x509", "-in", n(certificateFile), "-dates", "-fingerprint", "-purpose", "-noout"], {});
+            displaySubtitle("- verify self-signed certificate");
+            await execute_openssl_no_failure(["verify", "-verbose", "-CAfile", n(certificateFile), n(certificateFile)], options);
+            await fs.promises.unlink(csrFile);
+        }
+        finally {
+            await cleanupStaticConfig(configFile, { cwd: ca.rootDir });
+        }
+    }
+}
+//# sourceMappingURL=openssl_ca_backend.js.map

package/dist/lib/ca/backends/openssl_ca_backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openssl_ca_backend.js","sourceRoot":"","sources":["../../../../lib/ca/backends/openssl_ca_backend.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,iBAAiB;AACjB,wHAAwH;AACxH,gFAAgF;AAChF,yCAAyC;AACzC,wHAAwH;AACxH,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,+GAA+G;AAC/G,sHAAsH;AACtH,kHAAkH;AAClH,mGAAmG;AACnG,EAAE;AACF,uHAAuH;AACvH,YAAY;AACZ,EAAE;AACF,uHAAuH;AACvH,wHAAwH;AACxH,mHAAmH;AACnH,mHAAmH;AACnH,wHAAwH;AAExH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,QAAQ,EAA0C,MAAM,wBAAwB,CAAC;AACzH,OAAO,EACH,yBAAyB,EACzB,mBAAmB,EACnB,wBAAwB,EACxB,eAAe,EACf,0BAA0B,EAC1B,oBAAoB,EAEpB,SAAS,EACT,MAAM,EACN,QAAQ,EACX,MAAM,qCAAqC,CAAC;AAI7C,MAAM,CAAC,GAAG,QAAQ,CAAC;AAEnB,sHAAsH;AACtH,SAAS,SAAS,CAAC,EAA4B;IAC3C,+DAA+D;IAC/D,gEAAgE;IAChE,kEAAkE;IAClE,iEAAiE;IACjE,kEAAkE;IAClE,yBAAyB;IACzB,OAAO,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,cAAc,EAAE,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAA4B,EAAE,UAAkB,SAAS,CAAC,EAAE,CAAC;IAC9F,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,EAAE,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO;QACH,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,EAAE,CAAC,kBAAkB,IAAI,EAAE;QACpC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;KAC/B,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,gBAAgB;IACzB,uEAAuE;IACvE;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,EAA4B;QACtC,OAAO,SAAS,CAAC,MAAM,EAAE,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,kFAAkF;IAClE,sBAAsB,GAAG,KAAK,CAAC;IAExC,KAAK,CAAC,SAAS;QAClB,MAAM,wBAAwB,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CACb,EAA4B,EAC5B,OAAe,EACf,EAAgE;QAEhE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,oBAAoB,CAAC,mBAAmB,EAAE,OAAO,EAAE,oBAAoB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC;YACD,OAAO,MAAM,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;gBAAS,CAAC;YACP,MAAM,mBAAmB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;IACL,CAAC;IAED,KAAK,CAAC,kBAAkB,CACpB,EAA4B,EAC5B,UAAkB,EAClB,OAAwB,EACxB,cAAsB,EACtB,OAAe;QAEf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,YAAY,CAAC,+CAA+C,CAAC,CAAC;QAC9D,MAAM,eAAe,CACjB;YACI,KAAK;YACL,MAAM;YACN,SAAS;YACT,aAAa;YACb,WAAW;YACX,SAAS;YACT,CAAC,CAAC,UAAU,CAAC;YACb,MAAM;YACN,CAAC,CAAC,cAAc,CAAC;YACjB,MAAM;YACN,CAAC,CAAC,OAAO,CAAC;YACV,OAAO;YACP,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE;YACrB,GAAG,MAAM,CAAC,IAAI;SACjB,EACD,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAClC,CAAC;IACN,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,EAA4B,EAAE,UAAkB,EAAE,OAAwB;QAC/F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,8BAA8B;QAC9B,eAAe,CAAC,8CAA8C,CAAC,CAAC;QAChE,MAAM,eAAe,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE;YAClH,GAAG,OAAO;YACV,GAAG,EAAE,MAAM,CAAC,GAAG;SAClB,CAAC,CAAC;QACH,MAAM,eAAe,CACjB,CAAC,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,MAAM,EAAE,yBAAyB,EAAE,UAAU,EAAE,KAAK,CAAC,EAC/F,OAAO,CACV,CAAC;QAEF,eAAe,CAAC,uCAAuC,CAAC,CAAC;QACzD,MAAM,eAAe,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5F,CAAC;IAEM,KAAK,CAAC,aAAa,CACtB,EAA4B,EAC5B,UAAkB,EAClB,cAAsB,EACtB,OAAe;QAEf,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAC9D,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,CAC5E,CAAC;IACN,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,EAA4B;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QAE9D,mEAAmE;QACnE,0DAA0D;QAC1D,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE;YACpE,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;YAExF,MAAM,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC;YAC9B,IAAI,QAAQ,EAAE,CAAC;gBACX,0DAA0D;gBAC1D,YAAY,CAAC,+CAA+C,CAAC,CAAC;gBAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;gBACxD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;gBACtE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC9D,kEAAkE;gBAClE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAClD,MAAM,cAAc,GAAG,KAAK,IAAI,EAAE;oBAC9B,MAAM,eAAe,CACjB;wBACI,MAAM;wBACN,SAAS;wBACT,MAAM;wBACN,OAAO;wBACP,MAAM;wBACN,aAAa;wBACb,OAAO;wBACP,UAAU;wBACV,CAAC,CAAC,UAAU,CAAC;wBACb,KAAK;wBACL,mBAAmB;wBACnB,KAAK;wBACL,CAAC,CAAC,UAAU,CAAC;wBACb,QAAQ;wBACR,CAAC,CAAC,SAAS,CAAC;wBACZ,WAAW;wBACX,CAAC,CAAC,YAAY,CAAC;wBACf,MAAM;wBACN,mBAAmB;wBACnB,GAAG,YAAY,CAAC,IAAI;qBACvB,EACD,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE,CACxC,CAAC;gBACN,CAAC,CAAC;gBACF,8DAA8D;gBAC9D,8DAA8D;gBAC9D,2DAA2D;gBAC3D,2DAA2D;gBAC3D,8DAA8D;gBAC9D,0DAA0D;gBAC1D,4DAA4D;gBAC5D,sCAAsC;gBACtC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC/C,MAAM,cAAc,EAAE,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACJ,MAAM,QAAQ,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;gBACxD,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,wBAAwB;gBACxB,YAAY,CAAC,uCAAuC,CAAC,CAAC;gBACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACtC,MAAM,eAAe,CACjB;oBACI,MAAM;oBACN,SAAS;oBACT,MAAM;oBACN,OAAO;oBACP,MAAM;oBACN,aAAa;oBACb,OAAO;oBACP,UAAU;oBACV,CAAC,CAAC,UAAU,CAAC;oBACb,KAAK;oBACL,mBAAmB;oBACnB,UAAU;oBACV,CAAC,CAAC,kBAAkB,CAAC;oBACrB,MAAM;oBACN,mBAAmB;oBACnB,GAAG,MAAM,CAAC,IAAI;iBACjB,EACD,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAClC,CAAC;YACN,CAAC;YAED,eAAe,CAAC,oDAAoD,CAAC,CAAC;YACtE,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QACH,YAAY,CAAC,6CAA6C,CAAC,CAAC;IAChE,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,EAA4B;QACnD,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IACzH,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC3B,EAA4B,EAC5B,OAAe,EACf,QAAgB,EAChB,YAAoB;QAEpB,qEAAqE;QACrE,mEAAmE;QACnE,mEAAmE;QACnE,qEAAqE;QACrE,oEAAoE;QACpE,4DAA4D;QAC5D,kEAAkE;QAClE,6DAA6D;QAC7D,mEAAmE;QACnE,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE;YACpE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACtC,MAAM,eAAe,CACjB;gBACI,MAAM;gBACN,SAAS;gBACT,MAAM;gBACN,OAAO;gBACP,MAAM,CAAC,YAAY,CAAC;gBACpB,aAAa;gBACb,OAAO;gBACP,UAAU;gBACV,CAAC,CAAC,UAAU,CAAC;gBACb,KAAK;gBACL,CAAC,CAAC,OAAO,CAAC;gBACV,KAAK;gBACL,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC;gBACnB,QAAQ;gBACR,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;gBAC5C,WAAW;gBACX,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBACjC,MAAM;gBACN,CAAC,CAAC,QAAQ,CAAC;gBACX,GAAG,MAAM,CAAC,IAAI;aACjB,EACD,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAClC,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC;IAEM,KAAK,CAAC,gBAAgB,CACzB,EAA4B,EAC5B,WAAmB,EACnB,GAAW,EACX,OAAe,EACf,WAA2C;QAE3C,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,yBAAyB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE;YAC7F,eAAe,CAAC,qEAAqE,CAAC,CAAC;YACvF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACtC,MAAM,eAAe,CACjB;gBACI,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;gBAC3B,UAAU;gBACV,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;gBACzB,QAAQ;gBACR,MAAM;gBACN,CAAC,CAAC,WAAW,CAAC;gBACd,KAAK;gBACL,CAAC,CAAC,GAAG,CAAC;gBACN,GAAG,MAAM,CAAC,IAAI;aACjB,EACD,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAClC,CAAC;YAEF,eAAe,CAAC,oCAAoC,CAAC,CAAC;YACtD,MAAM,eAAe,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QACpH,CAAC,CAAC,CAAC;IACP,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,EAA4B,EAAE,WAAmB,EAAE,MAAc;QACjF,4DAA4D;QAC5D,8EAA8E;QAC9E,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE;YACpE,eAAe,CAAC,oBAAoB,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACtC,MAAM,0BAA0B,CAC5B,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAC3G,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAClC,CAAC;YAEF,+CAA+C;YAC/C,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAEvD,eAAe,CAAC,oCAAoC,CAAC,CAAC;YACtD,MAAM,0BAA0B,CAC5B;gBACI,QAAQ;gBACR,UAAU;gBACV,UAAU;gBACV,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC;gBACpB,SAAS;gBACT,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC;gBACnB,YAAY;gBACZ,CAAC,CAAC,WAAW,CAAC;aACjB,EACD,OAAO,CACV,CAAC;YAEF,4BAA4B;YAC5B,eAAe,CAAC,0BAA0B,CAAC,CAAC;YAC5C,MAAM,eAAe,CACjB,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,UAAU,EAAE,KAAK,CAAC,EAC1F,OAAO,CACV,CAAC;YACF,sCAAsC;YACtC,eAAe,CAAC,0BAA0B,CAAC,CAAC;YAC5C,MAAM,eAAe,CACjB,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,EACnG,OAAO,CACV,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC;IAEM,KAAK,CAAC,2BAA2B,CACpC,EAA4B,EAC5B,eAAuB,EACvB,cAAsB,EACtB,MAAc;QAEd,qEAAqE;QACrE,qEAAqE;QACrE,gEAAgE;QAChE,iEAAiE;QACjE,oEAAoE;QACpE,8DAA8D;QAC9D,MAAM,YAAY,GAAG,oBAAoB,CAAC,EAAE,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;QACjF,MAAM,UAAU,GAAG,oBAAoB,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;QAC1F,MAAM,OAAO,GAAG;YACZ,GAAG,EAAE,EAAE,CAAC,OAAO;YACf,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC;SACrC,CAAC;QAEF,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,MAAM,cAAc,GAAG,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,OAAO,GAAG,GAAG,eAAe,MAAM,CAAC;YAEzC,kEAAkE;YAClE,4DAA4D;YAC5D,6DAA6D;YAC7D,4DAA4D;YAC5D,iEAAiE;YACjE,kEAAkE;YAClE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAEtC,eAAe,CAAC,mCAAmC,CAAC,CAAC;YACrD,MAAM,eAAe,CACjB;gBACI,KAAK;gBACL,MAAM;gBACN,SAAS;gBACT,GAAG,cAAc;gBACjB,QAAQ;gBACR,MAAM;gBACN,CAAC,CAAC,cAAc,CAAC;gBACjB,MAAM;gBACN,CAAC,CAAC,OAAO,CAAC;gBACV,GAAG,MAAM,CAAC,IAAI;aACjB,EACD,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAClC,CAAC;YAEF,eAAe,CAAC,wCAAwC,CAAC,CAAC;YAC1D,MAAM,eAAe,CACjB;gBACI,IAAI;gBACJ,WAAW;gBACX,UAAU;gBACV,CAAC,CAAC,cAAc,CAAC;gBACjB,YAAY;gBACZ,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;gBAC1B,UAAU;gBACV,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;gBACxB,QAAQ;gBACR,MAAM;gBACN,CAAC,CAAC,eAAe,CAAC;gBAClB,KAAK;gBACL,CAAC,CAAC,OAAO,CAAC;gBACV,GAAG,MAAM,CAAC,IAAI;aACjB,EACD,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAClC,CAAC;YAEF,eAAe,CAAC,oCAAoC,CAAC,CAAC;YACtD,MAAM,eAAe,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YAE/G,eAAe,CAAC,kCAAkC,CAAC,CAAC;YACpD,MAAM,0BAA0B,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAErH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;gBAAS,CAAC;YACP,MAAM,mBAAmB,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;IACL,CAAC;CACJ"}

package/dist/lib/ca/certificate_authority.d.ts

@@ -0,0 +1,62 @@
+import { type OpensslPassArg } from "../toolbox/with_openssl/index.js";
+import { CertificateAuthorityCore, type CertificateAuthorityCoreOptions } from "./core/certificate_authority_core.js";
+export * from "./core/certificate_authority_core.js";
+/**
+ * Options for {@link CertificateAuthority}: the core's, except that the
+ * backend is named rather than supplied.
+ */
+export interface CertificateAuthorityOptions extends Omit<CertificateAuthorityCoreOptions, "backend"> {
+    /**
+     * Signing backend to use.
+     *
+     * - `"openssl"` (default): shells out to the `openssl` CLI, as this
+     *   class always has.
+     * - `"native"`: signs in pure JS via `node-opcua-crypto`, writing the
+     *   same on-disk database format, and needs no `openssl` executable.
+     *
+     * Setting `signer` implies `"native"`, since the openssl CLI can only
+     * load a key from a file.
+     *
+     * To supply a backend instance directly - including one of your own -
+     * use {@link CertificateAuthorityCore}, which is also the class to
+     * build against when you do not want the openssl backend in your
+     * bundle at all.
+     */
+    backend?: "openssl" | "native";
+}
+/**
+ * A Certificate Authority with a backend chosen for you.
+ *
+ * This is {@link CertificateAuthorityCore} plus the convenience that made
+ * it the historical API: name a backend, or name nothing and get openssl.
+ * Because it resolves the name, it necessarily references both backends,
+ * which is why the core exists separately - a program that never imports
+ * this class never pulls the openssl backend into its bundle.
+ */
+export declare class CertificateAuthority extends CertificateAuthorityCore {
+    constructor(options: CertificateAuthorityOptions);
+    /**
+     * @internal `-passin env:` argv + env for an openssl call that loads
+     * this CA's key (always emitted, empty when none).
+     *
+     * The openssl backend builds its own now; this remains so that external
+     * code calling it keeps working, and lives here rather than on the core
+     * because the flag means nothing to a backend that spawns nothing.
+     */
+    _opensslPassin(): Promise<OpensslPassArg>;
+    /**
+     * @internal
+     * Legacy shim: publish the `CDP_URL` / `AIA_VALUE` config substitution
+     * values to the shared env registry, or unset them so the matching
+     * `{{#KEY}}...{{/KEY}}` blocks are stripped. Nothing in this package
+     * reads the registry any more - every openssl config render receives
+     * these values explicitly, from the same {@link caConfigEnvOverrides}
+     * builder this delegates to, so the two cannot drift - kept only for
+     * external code that renders openssl config templates against the
+     * registry directly.
+     *
+     * It lives on this class rather than the core because it is meaningful
+     * only to the openssl backend.
+     */
+    _wireRevocationEnvVars(): void;
+}

package/dist/lib/ca/certificate_authority.js

@@ -0,0 +1,91 @@
+// ---------------------------------------------------------------------------------------------------------------------
+// node-opcua-pki
+// ---------------------------------------------------------------------------------------------------------------------
+// Copyright (c) 2014-2026 - Etienne Rossignon - etienne.rossignon (at) gadz.org
+// Copyright (c) 2022-2026 - Sterfive.com
+// ---------------------------------------------------------------------------------------------------------------------
+//
+// This  project is licensed under the terms of the MIT license.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+// ---------------------------------------------------------------------------------------------------------------------
+import { passinArg, setEnv, unsetEnv } from "../toolbox/with_openssl/index.js";
+import { NativeCaBackend } from "./backends/native_ca_backend.js";
+import { caConfigEnvOverrides, OpenSslCaBackend } from "./backends/openssl_ca_backend.js";
+import { CertificateAuthorityCore } from "./core/certificate_authority_core.js";
+// Everything the CA exposes lives in the core module; re-exported here so
+// that `import { ... } from "./ca/certificate_authority"` keeps resolving
+// exactly as it did before the split.
+export * from "./core/certificate_authority_core.js";
+/**
+ * A Certificate Authority with a backend chosen for you.
+ *
+ * This is {@link CertificateAuthorityCore} plus the convenience that made
+ * it the historical API: name a backend, or name nothing and get openssl.
+ * Because it resolves the name, it necessarily references both backends,
+ * which is why the core exists separately - a program that never imports
+ * this class never pulls the openssl backend into its bundle.
+ */
+export class CertificateAuthority extends CertificateAuthorityCore {
+    constructor(options) {
+        if (options.signer && options.backend === "openssl") {
+            throw new Error("CertificateAuthority: backend 'openssl' cannot be combined with 'signer' - " +
+                "the openssl CLI loads its key from a file and cannot call an external signer. " +
+                "Drop the backend option (a signer implies 'native') or drop the signer.");
+        }
+        const backend = options.signer || options.backend === "native" ? new NativeCaBackend() : new OpenSslCaBackend();
+        super({ ...options, backend });
+    }
+    /**
+     * @internal `-passin env:` argv + env for an openssl call that loads
+     * this CA's key (always emitted, empty when none).
+     *
+     * The openssl backend builds its own now; this remains so that external
+     * code calling it keeps working, and lives here rather than on the core
+     * because the flag means nothing to a backend that spawns nothing.
+     */
+    async _opensslPassin() {
+        return passinArg(await this._privateKeyPassphrase());
+    }
+    /**
+     * @internal
+     * Legacy shim: publish the `CDP_URL` / `AIA_VALUE` config substitution
+     * values to the shared env registry, or unset them so the matching
+     * `{{#KEY}}...{{/KEY}}` blocks are stripped. Nothing in this package
+     * reads the registry any more - every openssl config render receives
+     * these values explicitly, from the same {@link caConfigEnvOverrides}
+     * builder this delegates to, so the two cannot drift - kept only for
+     * external code that renders openssl config templates against the
+     * registry directly.
+     *
+     * It lives on this class rather than the core because it is meaningful
+     * only to the openssl backend.
+     */
+    _wireRevocationEnvVars() {
+        const overrides = caConfigEnvOverrides(this);
+        if (overrides.CDP_URL) {
+            setEnv("CDP_URL", overrides.CDP_URL);
+        }
+        else {
+            unsetEnv("CDP_URL");
+        }
+        if (overrides.AIA_VALUE) {
+            setEnv("AIA_VALUE", overrides.AIA_VALUE);
+        }
+        else {
+            unsetEnv("AIA_VALUE");
+        }
+    }
+}
+//# sourceMappingURL=certificate_authority.js.map

package/dist/lib/ca/certificate_authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate_authority.js","sourceRoot":"","sources":["../../../lib/ca/certificate_authority.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,iBAAiB;AACjB,wHAAwH;AACxH,gFAAgF;AAChF,yCAAyC;AACzC,wHAAwH;AACxH,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,+GAA+G;AAC/G,sHAAsH;AACtH,kHAAkH;AAClH,mGAAmG;AACnG,EAAE;AACF,uHAAuH;AACvH,YAAY;AACZ,EAAE;AACF,uHAAuH;AACvH,wHAAwH;AACxH,mHAAmH;AACnH,mHAAmH;AACnH,wHAAwH;AAExH,OAAO,EAAuB,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACpG,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAAwC,MAAM,sCAAsC,CAAC;AAEtH,0EAA0E;AAC1E,0EAA0E;AAC1E,sCAAsC;AACtC,cAAc,sCAAsC,CAAC;AA0BrD;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAqB,SAAQ,wBAAwB;IAC9D,YAAY,OAAoC;QAC5C,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACX,6EAA6E;gBACzE,gFAAgF;gBAChF,yEAAyE,CAChF,CAAC;QACN,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,gBAAgB,EAAE,CAAC;QAChH,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,cAAc;QACvB,OAAO,SAAS,CAAC,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,sBAAsB;QACzB,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACJ,QAAQ,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACJ,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC1B,CAAC;IACL,CAAC;CACJ"}