node-opcua-pki 6.22.1 → 7.0.0

package/dist/chunk-EQ4DGI4M.mjs

@@ -1,1917 +0,0 @@
-// packages/node-opcua-pki/lib/toolbox/common.ts
-import assert from "assert";
-function quote(str) {
-  return `"${str || ""}"`;
-}
-function isOpaqueSigner(privateKey) {
-  return typeof privateKey !== "string" && typeof privateKey.sign === "function";
-}
-async function resolvePrivateKeyPassphrase(passphrase) {
-  if (passphrase === void 0) {
-    return void 0;
-  }
-  return typeof passphrase === "function" ? await passphrase() : passphrase;
-}
-function adjustDate(params) {
-  assert(params instanceof Object);
-  params.startDate = params.startDate || /* @__PURE__ */ new Date();
-  assert(params.startDate instanceof Date);
-  if (params.validityMs !== void 0) {
-    if (params.validityMs <= 0) {
-      throw new RangeError(`validityMs must be > 0 (got ${params.validityMs})`);
-    }
-    params.endDate = new Date(params.startDate.getTime() + params.validityMs);
-    params.validity = Math.ceil(params.validityMs / 864e5);
-  } else {
-    params.validity = params.validity || 365;
-    params.endDate = new Date(params.startDate.getTime());
-    params.endDate.setDate(params.startDate.getDate() + params.validity);
-  }
-  assert(params.endDate instanceof Date);
-  assert(params.startDate instanceof Date);
-}
-function adjustApplicationUri(params) {
-  const applicationUri = params.applicationUri || "";
-  if (applicationUri.length > 200) {
-    throw new Error(`Openssl doesn't support urn with length greater than 200${applicationUri}`);
-  }
-}
-
-// packages/node-opcua-pki/lib/ca/core/ca_database.ts
-import fs from "fs";
-import path from "path";
-import { convertPEMtoDER, readCertificatePEM } from "node-opcua-crypto";
-function parseOpenSSLDate(dateStr) {
-  const raw = dateStr?.split(",")[0] ?? "";
-  if (raw.length < 12) return "";
-  const yy = parseInt(raw.substring(0, 2), 10);
-  const year = yy >= 70 ? 1900 + yy : 2e3 + yy;
-  const month = raw.substring(2, 4);
-  const day = raw.substring(4, 6);
-  const hour = raw.substring(6, 8);
-  const min = raw.substring(8, 10);
-  const sec = raw.substring(10, 12);
-  return `${year}-${month}-${day}T${hour}:${min}:${sec}Z`;
-}
-function formatOpenSSLDate(date) {
-  const yy = String(date.getUTCFullYear() % 100).padStart(2, "0");
-  const mm = String(date.getUTCMonth() + 1).padStart(2, "0");
-  const dd = String(date.getUTCDate()).padStart(2, "0");
-  const hh = String(date.getUTCHours()).padStart(2, "0");
-  const mi = String(date.getUTCMinutes()).padStart(2, "0");
-  const ss = String(date.getUTCSeconds()).padStart(2, "0");
-  return `${yy}${mm}${dd}${hh}${mi}${ss}Z`;
-}
-function parseRevocationReason(dateStr) {
-  const parts = dateStr?.split(",");
-  return parts && parts.length > 1 ? parts[1] : void 0;
-}
-function evenLengthHex(value) {
-  const hex = value.toString(16).toUpperCase();
-  return hex.length % 2 === 0 ? hex : `0${hex}`;
-}
-function escapeIndexField(value) {
-  return value.replace(/[\x00-\x1f\x7f\\]/g, (c) => `\\x${c.charCodeAt(0).toString(16).toUpperCase().padStart(2, "0")}`);
-}
-function assertHexSerial(serial) {
-  if (!/^[0-9A-Fa-f]+$/.test(serial)) {
-    throw new Error(`Invalid certificate serial number: ${JSON.stringify(serial)}`);
-  }
-  return serial.toUpperCase();
-}
-var CaDatabase = class {
-  #rootDir;
-  constructor(rootDir) {
-    this.#rootDir = rootDir;
-  }
-  /** Path to the OpenSSL certificate database file (`index.txt`). */
-  get indexFile() {
-    return path.join(this.#rootDir, "index.txt");
-  }
-  /**
-   * Parse the OpenSSL `index.txt` certificate database.
-   *
-   * Each line has tab-separated fields:
-   * ```
-   * status  expiry  [revocationDate]  serial  unknown  subject
-   * ```
-   *
-   * - status: `V` (valid), `R` (revoked), `E` (expired)
-   * - expiry: `YYMMDDHHmmssZ`
-   * - revocationDate: present only for revoked certs
-   * - serial: hex string
-   * - unknown: always `"unknown"`
-   * - subject: X.500 slash-delimited string
-   */
-  readIndex() {
-    const indexPath = this.indexFile;
-    if (!fs.existsSync(indexPath)) {
-      return [];
-    }
-    const content = fs.readFileSync(indexPath, "utf-8");
-    const lines = content.split("\n").filter((l) => l.trim().length > 0);
-    const records = [];
-    for (const line of lines) {
-      const fields = line.split("	");
-      if (fields.length < 4) continue;
-      const statusChar = fields[0];
-      const expiryStr = fields[1];
-      let serial;
-      let subject;
-      let revocationDate;
-      if (statusChar === "R") {
-        revocationDate = fields[2];
-        serial = fields[3];
-        subject = fields.length >= 6 ? fields[5] : "";
-      } else {
-        serial = fields[3];
-        subject = fields.length >= 6 ? fields[5] : "";
-      }
-      let status;
-      switch (statusChar) {
-        case "V":
-          status = "valid";
-          break;
-        case "R":
-          status = "revoked";
-          break;
-        case "E":
-          status = "expired";
-          break;
-        default:
-          continue;
-      }
-      records.push({
-        serial,
-        status,
-        subject,
-        expiryDate: parseOpenSSLDate(expiryStr),
-        revocationDate: revocationDate ? parseOpenSSLDate(revocationDate) : void 0,
-        reason: revocationDate ? parseRevocationReason(revocationDate) : void 0
-      });
-    }
-    return records;
-  }
-  /** Look up one record by serial number (case-insensitive). */
-  findBySerial(serial) {
-    const upper = serial.toUpperCase();
-    return this.readIndex().find((r) => r.serial.toUpperCase() === upper);
-  }
-  /**
-   * Read a specific issued certificate by serial number.
-   *
-   * OpenSSL stores signed certificates in the `certs/` directory using
-   * the naming convention `<SERIAL>.pem`.
-   *
-   * @param serial - hex-encoded serial number (e.g. `"1000"`)
-   * @returns the DER buffer, or `undefined` if not found
-   */
-  getCertificateBySerial(serial) {
-    const upper = serial.toUpperCase();
-    const certFile = path.join(this.#rootDir, "certs", `${upper}.pem`);
-    if (!fs.existsSync(certFile)) {
-      return void 0;
-    }
-    const pem = readCertificatePEM(certFile);
-    return convertPEMtoDER(pem);
-  }
-  /**
-   * Read-increment-write a hex counter file (`serial`/`crlnumber`),
-   * returning the value to hand out — matching `openssl ca`'s own
-   * behavior: the file holds the *next* value to assign, and is bumped
-   * to the following one immediately after being read. A `.old` backup
-   * of the pre-bump content is kept, as `openssl` itself does.
-   */
-  #nextHexCounter(fileName) {
-    const counterFile = path.join(this.#rootDir, fileName);
-    const current = BigInt(`0x${fs.readFileSync(counterFile, "utf-8").trim()}`);
-    fs.copyFileSync(counterFile, `${counterFile}.old`);
-    fs.writeFileSync(counterFile, evenLengthHex(current + 1n));
-    return evenLengthHex(current);
-  }
-  /** Hand out the next certificate serial number, bumping the `serial` file. */
-  nextSerial() {
-    return this.#nextHexCounter("serial");
-  }
-  /** Hand out the next CRL number, bumping the `crlnumber` file. */
-  nextCrlNumber() {
-    return this.#nextHexCounter("crlnumber");
-  }
-  /** Append a newly-issued certificate's `V` (valid) row to `index.txt`. */
-  appendIssued(record) {
-    const serial = assertHexSerial(record.serial);
-    const subject = escapeIndexField(record.subject);
-    const line = `V	${formatOpenSSLDate(record.expiryDate)}		${serial}	unknown	${subject}
-`;
-    fs.appendFileSync(this.indexFile, line);
-  }
-  /**
-   * Rewrite a certificate's `index.txt` row from `V` to `R` (revoked).
-   * Throws if the serial is not found, or is already revoked — the same
-   * "already revoked" case `openssl ca -revoke` itself rejects.
-   */
-  markRevoked(serial, revocationDate, reason) {
-    const upper = assertHexSerial(serial);
-    if (!/^[A-Za-z]+$/.test(reason)) {
-      throw new Error(`Invalid CRL reason: ${JSON.stringify(reason)}`);
-    }
-    const lines = fs.readFileSync(this.indexFile, "utf-8").split("\n").filter((l) => l.trim().length > 0);
-    let found = false;
-    const rewritten = lines.map((line) => {
-      const fields = line.split("	");
-      if (fields.length < 4 || fields[3]?.toUpperCase() !== upper) {
-        return line;
-      }
-      if (fields[0] === "R") {
-        throw new Error(`Certificate ${upper} is already revoked`);
-      }
-      found = true;
-      const subject = fields.length >= 6 ? fields[5] : "";
-      return `R	${fields[1]}	${formatOpenSSLDate(revocationDate)},${reason}	${upper}	unknown	${subject}`;
-    });
-    if (!found) {
-      throw new Error(`Certificate ${upper} not found in the certificate database`);
-    }
-    fs.writeFileSync(this.indexFile, `${rewritten.join("\n")}
-`);
-  }
-  /** Store a signed certificate's PEM under `certs/<SERIAL>.pem`, as `openssl ca` does. */
-  storeCertificate(serial, pem) {
-    const certFile = path.join(this.#rootDir, "certs", `${assertHexSerial(serial)}.pem`);
-    fs.writeFileSync(certFile, pem);
-  }
-};
-
-// packages/node-opcua-pki/lib/ca/backends/native_ca_backend.ts
-import fs3 from "fs";
-import path3 from "path";
-import {
-  CertificatePurpose,
-  createCertificateFromCsr,
-  createCertificateSigningRequest,
-  createCrl,
-  isCaSigner,
-  privateKeyToCryptoKey,
-  readPrivateKey,
-  Subject,
-  x509
-} from "node-opcua-crypto";
-
-// packages/node-opcua-pki/lib/toolbox/common2.ts
-import assert2 from "assert";
-import fs2 from "fs";
-import path2 from "path";
-import chalk from "chalk";
-
-// packages/node-opcua-pki/lib/toolbox/config.ts
-var g_config = {
-  opensslVersion: "unset",
-  silent: process.env.VERBOSE ? !process.env.VERBOSE : true,
-  force: false
-};
-
-// packages/node-opcua-pki/lib/toolbox/debug.ts
-var doDebug = process.env.NODEOPCUAPKIDEBUG || false;
-var displayError = true;
-var displayDebug = !!process.env.NODEOPCUAPKIDEBUG || false;
-function debugLog(...args) {
-  if (displayDebug) {
-    console.log.apply(null, args);
-  }
-}
-function warningLog(...args) {
-  console.log.apply(null, args);
-}
-
-// packages/node-opcua-pki/lib/toolbox/common2.ts
-function certificateFileExist(certificateFile) {
-  if (fs2.existsSync(certificateFile) && !g_config.force) {
-    warningLog(
-      chalk.yellow("        certificate ") + chalk.cyan(certificateFile) + chalk.yellow(" already exists => do not overwrite")
-    );
-    return false;
-  }
-  return true;
-}
-function mkdirRecursiveSync(folder) {
-  if (!fs2.existsSync(folder)) {
-    debugLog(chalk.white(" .. constructing "), folder);
-    fs2.mkdirSync(folder, { recursive: true });
-  }
-}
-function restrictPrivateFilePermissions(target, mode) {
-  if (process.platform === "win32") {
-    return;
-  }
-  try {
-    fs2.chmodSync(target, mode);
-  } catch (err) {
-    warningLog(chalk.yellow("        could not restrict permissions on "), target, err.message);
-  }
-}
-function ensurePrivateDirectory(dir) {
-  if (!fs2.existsSync(dir)) {
-    fs2.mkdirSync(dir, { recursive: true, mode: 448 });
-  }
-  restrictPrivateFilePermissions(dir, 448);
-}
-function isEncryptedPrivateKeyFile(filename) {
-  return fs2.readFileSync(filename, "utf-8").includes("-----BEGIN ENCRYPTED PRIVATE KEY-----");
-}
-function makePath(folderName, filename) {
-  let s;
-  if (filename) {
-    s = path2.join(path2.normalize(folderName), filename);
-  } else {
-    assert2(folderName);
-    s = folderName;
-  }
-  s = s.replace(/\\/g, "/");
-  return s;
-}
-
-// packages/node-opcua-pki/lib/toolbox/display.ts
-import chalk2 from "chalk";
-function displayTitle(str) {
-  if (!g_config.silent) {
-    warningLog("");
-    warningLog(chalk2.yellowBright(str));
-    warningLog(chalk2.yellow(new Array(str.length + 1).join("=")), "\n");
-  }
-}
-function displaySubtitle(str) {
-  if (!g_config.silent) {
-    warningLog("");
-    warningLog(`    ${chalk2.yellowBright(str)}`);
-    warningLog(`    ${chalk2.white(new Array(str.length + 1).join("-"))}`, "\n");
-  }
-}
-function display(str) {
-  if (!g_config.silent) {
-    warningLog(`       ${str}`);
-  }
-}
-
-// packages/node-opcua-pki/lib/ca/backends/native_ca_backend.ts
-var CA_CERT_VALIDITY_DAYS = 3650;
-var RSA_SHA256 = { name: "RSASSA-PKCS1-v1_5", hash: { name: "SHA-256" } };
-function signingAlgorithmOf(key) {
-  return isCaSigner(key) ? key.algorithm : RSA_SHA256;
-}
-function daysFromNow(notBefore, days) {
-  return new Date(notBefore.getTime() + days * 24 * 60 * 60 * 1e3);
-}
-function caSanUri(ca) {
-  return `urn:${ca.subject.commonName || "NodeOPCUA-CA"}`;
-}
-function sanFromCsr(csrPem) {
-  const request = new x509.Pkcs10CertificateRequest(csrPem);
-  const extension = request.getExtension("2.5.29.17");
-  const dns = [];
-  const ip = [];
-  let applicationUri;
-  for (const name of extension?.names.toJSON() ?? []) {
-    if (name.type === "dns") {
-      dns.push(name.value);
-    } else if (name.type === "ip") {
-      ip.push(name.value);
-    } else if (name.type === "url" && applicationUri === void 0) {
-      applicationUri = name.value;
-    }
-  }
-  return { dns, ip, applicationUri };
-}
-var REASON_TO_X509_CRL_REASON = {
-  unspecified: x509.X509CrlReason.unspecified,
-  keyCompromise: x509.X509CrlReason.keyCompromise,
-  CACompromise: x509.X509CrlReason.cACompromise,
-  affiliationChanged: x509.X509CrlReason.affiliationChanged,
-  superseded: x509.X509CrlReason.superseded,
-  cessationOfOperation: x509.X509CrlReason.cessationOfOperation,
-  certificateHold: x509.X509CrlReason.certificateHold,
-  removeFromCRL: x509.X509CrlReason.removeFromCRL
-};
-function toOpenSslSubjectString(subjectName) {
-  const parts = [];
-  for (const rdn of subjectName.toJSON()) {
-    for (const [type, values] of Object.entries(rdn)) {
-      for (const value of values) {
-        parts.push(`${type}=${value}`);
-      }
-    }
-  }
-  return `/${parts.join("/")}`;
-}
-var NativeCaBackend = class {
-  /** Nothing to check: this backend spawns no process and needs no tool on PATH. */
-  /** Signing goes through `ca._getSigningKey()`, which may be an external signer. */
-  supportsExternalSigner = true;
-  async preflight() {
-  }
-  /**
-   * Write a CSR for the CA's own key, the `[v3_ca_req]` equivalent. The
-   * key comes from the CA rather than from `privateKeyFile`: on a
-   * signer-backed CA that file does not exist.
-   */
-  async generateCaCsr(ca, _caRootDir, _privateKeyFile, csrFile) {
-    displayTitle("Generate a certificate request for the CA key");
-    const signingKey = await ca._getSigningKey();
-    const { csr } = await createCertificateSigningRequest({
-      privateKey: signingKey,
-      subject: ca.subject.toString(),
-      applicationUri: caSanUri(ca),
-      purpose: CertificatePurpose.ForCertificateAuthority
-    });
-    await fs3.promises.writeFile(csrFile, csr);
-  }
-  async bootstrap(ca) {
-    const caRootDir = path3.resolve(ca.rootDir);
-    const csrFile = path3.join(caRootDir, "private/cakey.csr");
-    await this.generateCaCsr(ca, caRootDir, path3.join(caRootDir, "private/cakey.pem"), csrFile);
-    const issuerCA = ca._issuerCA;
-    if (issuerCA) {
-      displayTitle("Generate CA Certificate (signed by issuer CA)");
-      const signWithIssuer = () => this.signSubordinateCsr(issuerCA, csrFile, ca.caCertificate, CA_CERT_VALIDITY_DAYS);
-      if (path3.resolve(issuerCA.rootDir) === caRootDir) {
-        await signWithIssuer();
-      } else {
-        await issuerCA._withCaDirectoryLock(signWithIssuer);
-      }
-    } else {
-      displayTitle("Generate CA Certificate (self-signed)");
-      const csrPem = await fs3.promises.readFile(csrFile, "utf-8");
-      const signingKey = await ca._getSigningKey();
-      const request = new x509.Pkcs10CertificateRequest(csrPem);
-      const notBefore = /* @__PURE__ */ new Date();
-      const { cert } = await createCertificateFromCsr({
-        csr: csrPem,
-        // the CSR's own parsed subject, so issuer and subject are
-        // byte-identical on a self-signed root: re-encoding a string
-        // form could differ and break chain building
-        issuerName: request.subjectName,
-        issuerPublicKey: request.publicKey,
-        signingKey,
-        signingAlgorithm: signingAlgorithmOf(signingKey),
-        notBefore,
-        notAfter: daysFromNow(notBefore, CA_CERT_VALIDITY_DAYS),
-        purpose: CertificatePurpose.ForCertificateAuthority,
-        applicationUri: caSanUri(ca),
-        revocation: {
-          crlDistributionUrl: ca.crlDistributionUrl,
-          ocspResponderUrl: ca.ocspResponderUrl,
-          caIssuersUrl: ca.caIssuersUrl
-        }
-      });
-      await fs3.promises.writeFile(ca.caCertificate, cert);
-    }
-    displaySubtitle("generate initial CRL (Certificate Revocation List)");
-    await this.#regenerateCrlLocked(ca, new CaDatabase(ca.rootDir));
-    displayTitle("Create Certificate Authority (CA) ---> DONE");
-  }
-  /** Sign a subordinate CA's request with this CA's key, the `[v3_ca]` equivalent. */
-  async signSubordinateCsr(ca, csrFile, certFile, validityDays) {
-    const { signingKey, signingAlgorithm, issuerPublicKey, issuerName } = await this.#issuerContext(ca);
-    const csrPem = await fs3.promises.readFile(csrFile, "utf-8");
-    const db = new CaDatabase(ca.rootDir);
-    const serialNumber = db.nextSerial();
-    const notBefore = /* @__PURE__ */ new Date();
-    const notAfter = daysFromNow(notBefore, validityDays);
-    const { cert } = await createCertificateFromCsr({
-      csr: csrPem,
-      issuerName,
-      issuerPublicKey,
-      signingKey,
-      signingAlgorithm,
-      serialNumber,
-      notBefore,
-      notAfter,
-      purpose: CertificatePurpose.ForCertificateAuthority,
-      // the subordinate's own SAN, not the issuer's
-      ...sanFromCsr(csrPem),
-      revocation: {
-        crlDistributionUrl: ca.crlDistributionUrl,
-        ocspResponderUrl: ca.ocspResponderUrl,
-        caIssuersUrl: ca.caIssuersUrl
-      }
-    });
-    await fs3.promises.writeFile(certFile, cert);
-    this.#record(db, serialNumber, cert, notAfter);
-  }
-  /**
-   * Self-sign a certificate with a caller-supplied key file and record it
-   * in this CA's database: the native equivalent of `openssl req -new`
-   * followed by `openssl ca -selfsign`, which likewise applies the
-   * end-entity profile and updates `index.txt`.
-   */
-  async createSelfSignedCertificate(ca, certificateFile, privateKeyFile, params) {
-    displaySubtitle("- the certificate signing request");
-    const key = await privateKeyToCryptoKey(readPrivateKey(privateKeyFile, await ca._privateKeyPassphrase()));
-    const { csr } = await createCertificateSigningRequest({
-      privateKey: key,
-      subject: params.subject ? new Subject(params.subject).toString() : ca.subject.toString(),
-      dns: params.dns,
-      ip: params.ip,
-      applicationUri: params.applicationUri,
-      purpose: CertificatePurpose.ForApplication
-    });
-    displaySubtitle("- creating the self-signed certificate");
-    const request = new x509.Pkcs10CertificateRequest(csr);
-    const db = new CaDatabase(ca.rootDir);
-    const serialNumber = db.nextSerial();
-    const notBefore = params.startDate ?? /* @__PURE__ */ new Date();
-    const notAfter = params.endDate ?? daysFromNow(notBefore, params.validity ?? 365);
-    const { cert } = await createCertificateFromCsr({
-      csr,
-      issuerName: request.subjectName,
-      issuerPublicKey: request.publicKey,
-      signingKey: key,
-      signingAlgorithm: RSA_SHA256,
-      serialNumber,
-      notBefore,
-      notAfter,
-      purpose: CertificatePurpose.ForApplication,
-      ...sanFromCsr(csr)
-    });
-    await fs3.promises.writeFile(certificateFile, cert);
-    this.#record(db, serialNumber, cert, notAfter);
-  }
-  /** `certs/<SERIAL>.pem` plus the `V` row, exactly as `openssl ca` writes them. */
-  #record(db, serialNumber, certPem, notAfter) {
-    db.storeCertificate(serialNumber, certPem);
-    db.appendIssued({
-      serial: serialNumber,
-      expiryDate: notAfter,
-      subject: toOpenSslSubjectString(new x509.X509Certificate(certPem).subjectName)
-    });
-  }
-  /**
-   * The CA's signing key and issuer identity, resolved fresh on every
-   * call and never cached across operations. The identity is read back
-   * from the CA certificate on disk so that the issuer field of anything
-   * this CA signs is byte-identical to that certificate's subject.
-   */
-  async #issuerContext(ca) {
-    const signingKey = await ca._getSigningKey();
-    const caCertPem = await fs3.promises.readFile(ca.caCertificate, "utf-8");
-    const caCert = new x509.X509Certificate(caCertPem);
-    return {
-      signingKey,
-      signingAlgorithm: signingAlgorithmOf(signingKey),
-      issuerPublicKey: caCert.publicKey,
-      issuerName: caCert.subjectName
-    };
-  }
-  async signEndEntityCsr(ca, certificate, csr, params, sanOverride) {
-    const { signingKey, signingAlgorithm, issuerPublicKey, issuerName } = await this.#issuerContext(ca);
-    const db = new CaDatabase(ca.rootDir);
-    const serialNumber = db.nextSerial();
-    const csrPem = await fs3.promises.readFile(csr, "utf-8");
-    const notBefore = params.startDate ?? /* @__PURE__ */ new Date();
-    const notAfter = params.endDate ?? new Date(notBefore.getTime() + (params.validity ?? 365) * 24 * 60 * 60 * 1e3);
-    const { cert } = await createCertificateFromCsr({
-      csr: csrPem,
-      issuerName,
-      issuerPublicKey,
-      signingKey,
-      signingAlgorithm,
-      serialNumber,
-      notBefore,
-      notAfter,
-      purpose: CertificatePurpose.ForApplication,
-      dns: sanOverride.dns,
-      ip: sanOverride.ip,
-      applicationUri: sanOverride.applicationUri,
-      revocation: {
-        crlDistributionUrl: ca.crlDistributionUrl,
-        ocspResponderUrl: ca.ocspResponderUrl,
-        caIssuersUrl: ca.caIssuersUrl
-      }
-    });
-    await fs3.promises.writeFile(certificate, cert);
-    this.#record(db, serialNumber, cert, notAfter);
-  }
-  async #regenerateCrlLocked(ca, db) {
-    const { signingKey, signingAlgorithm, issuerPublicKey, issuerName } = await this.#issuerContext(ca);
-    const crlNumber = db.nextCrlNumber();
-    const entries = db.readIndex().filter((r) => r.status === "revoked").map((r) => ({
-      serialNumber: r.serial,
-      revocationDate: r.revocationDate ? new Date(r.revocationDate) : /* @__PURE__ */ new Date(),
-      reason: r.reason ? REASON_TO_X509_CRL_REASON[r.reason] : void 0
-    }));
-    const { crl } = await createCrl({
-      issuerName,
-      issuerPublicKey,
-      signingKey,
-      signingAlgorithm,
-      crlNumber: BigInt(`0x${crlNumber}`),
-      entries
-    });
-    await fs3.promises.writeFile(ca.revocationList, crl);
-    const der = new x509.X509Crl(crl).rawData;
-    await fs3.promises.writeFile(ca.revocationListDER, Buffer.from(der));
-  }
-  async regenerateCrl(ca) {
-    const db = new CaDatabase(ca.rootDir);
-    await this.#regenerateCrlLocked(ca, db);
-  }
-  async revoke(ca, certificate, reason) {
-    const certPem = await fs3.promises.readFile(certificate, "utf-8");
-    const cert = new x509.X509Certificate(certPem);
-    const db = new CaDatabase(ca.rootDir);
-    db.markRevoked(cert.serialNumber, /* @__PURE__ */ new Date(), reason);
-    await this.#regenerateCrlLocked(ca, db);
-  }
-};
-
-// packages/node-opcua-pki/lib/misc/subject.ts
-import { Subject as Subject2 } from "node-opcua-crypto";
-
-// packages/node-opcua-pki/lib/ca/core/certificate_authority_core.ts
-import assert3 from "assert";
-import fs4 from "fs";
-import os from "os";
-import path4 from "path";
-import { withLock } from "@ster5/global-mutex";
-import chalk3 from "chalk";
-import {
-  CertificatePurpose as CertificatePurpose2,
-  certificateMatchesPrivateKey,
-  convertPEMtoDER as convertPEMtoDER2,
-  createCertificateSigningRequest as createCertificateSigningRequest2,
-  createPfx,
-  exploreCertificate,
-  exploreCertificateSigningRequest,
-  generatePrivateKeyFile,
-  privateKeyToCryptoKey as privateKeyToCryptoKey2,
-  readCertificatePEM as readCertificatePEM2,
-  readCertificateSigningRequest,
-  readPrivateKey as readPrivateKey2,
-  Subject as Subject3,
-  toPem,
-  verifyCertificateSignature,
-  writePrivateKeyFile,
-  x509 as x5092
-} from "node-opcua-crypto";
-
-// packages/node-opcua-pki/lib/ca/templates/ca_config_template.cnf.ts
-var config = `#.........DO NOT MODIFY BY HAND .........................
-[ ca ]
-default_ca               = CA_default
-[ CA_default ]
-dir                      = "%%ROOT_FOLDER%%"        # the main CA folder (quoted: see renderCaConfig)
-certs                    = $dir/certs                 # where to store certificates
-new_certs_dir            = $dir/certs                 #
-database                 = $dir/index.txt             # the certificate database
-serial                   = $dir/serial                # the serial number counter
-certificate              = $dir/public/cacert.pem     # The root CA certificate
-private_key              = $dir/private/cakey.pem     # the CA private key
-x509_extensions          = usr_cert                   #
-default_days             = 3650                       # default validity : 10 years
-
-# default_md               = sha1
-
-default_md                = sha256                      # The default digest algorithm
-
-preserve                 = no
-policy                   = policy_match
-# randfile                 = $dir/random.rnd
-# default_startdate        = YYMMDDHHMMSSZ
-# default_enddate          = YYMMDDHHMMSSZ
-crl_dir                  = $dir/crl
-crl_extensions           = crl_ext
-crl                      = $dir/crl/revocation_list.crl # the Revocation list
-crlnumber                = $dir/crlnumber           # CRL number file
-default_crl_days         = 30
-default_crl_hours        = 24
-#msie_hack
-
-[ policy_match ]
-countryName              = optional
-stateOrProvinceName      = optional
-localityName             = optional
-organizationName         = optional
-organizationalUnitName   = optional
-commonName               = optional
-emailAddress             = optional
-
-[ req ]
-default_bits             = 4096                     # Size of keys
-default_keyfile          = key.pem                  # name of generated keys
-distinguished_name       = req_distinguished_name
-attributes               = req_attributes
-x509_extensions          = v3_ca
-#input_password
-#output_password
-string_mask              = nombstr                  # permitted characters
-req_extensions           = v3_req
-
-[ req_distinguished_name ]
-
-#0 countryName             = Country Name (2 letter code)
-# countryName_default     = FR
-# countryName_min         = 2
-# countryName_max         = 2
-# stateOrProvinceName     = State or Province Name (full name)
-# stateOrProvinceName_default = Ile de France
-# localityName            = Locality Name (city, district)
-# localityName_default    = Paris
-organizationName          = Organization Name (company)
-organizationName_default  = NodeOPCUA
-# organizationalUnitName  = Organizational Unit Name (department, division)
-# organizationalUnitName_default = R&D
-commonName                = Common Name (hostname, FQDN, IP, or your name)
-commonName_max            = 256
-commonName_default        = NodeOPCUA
-# emailAddress            = Email Address
-# emailAddress_max        = 40
-# emailAddress_default    = node-opcua (at) node-opcua (dot) com
-
-[ req_attributes ]
-#challengePassword        = A challenge password
-#challengePassword_min    = 4
-#challengePassword_max    = 20
-#unstructuredName         = An optional company name
-[ usr_cert ]
-basicConstraints          = critical, CA:FALSE
-subjectKeyIdentifier      = hash
-authorityKeyIdentifier    = keyid,issuer:always
-#authorityKeyIdentifier    = keyid
-subjectAltName            = $ENV::ALTNAME
-# issuerAltName            = issuer:copy
-nsComment                 = ''OpenSSL Generated Certificate''
-#nsCertType               = client, email, objsign for ''everything including object signing''
-#nsCaRevocationUrl        = http://www.domain.dom/ca-crl.pem
-#nsBaseUrl                =
-#nsRenewalUrl             =
-#nsCaPolicyUrl            =
-#nsSslServerName          =
-keyUsage                  = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement
-extendedKeyUsage          = critical,serverAuth ,clientAuth
-{{#CDP_URL}}crlDistributionPoints     = URI:$ENV::CDP_URL
-{{/CDP_URL}}{{#AIA_VALUE}}authorityInfoAccess       = $ENV::AIA_VALUE
-{{/AIA_VALUE}}
-[ v3_req ]
-basicConstraints          = critical, CA:FALSE
-keyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyAgreement
-extendedKeyUsage          = critical,serverAuth ,clientAuth
-subjectAltName            = $ENV::ALTNAME
-nsComment                 = "CA Generated by Node-OPCUA Certificate utility using openssl"
-[ v3_ca_req ]
-subjectKeyIdentifier      = hash
-basicConstraints          = CA:TRUE
-keyUsage                  = critical, cRLSign, keyCertSign
-subjectAltName            = $ENV::ALTNAME
-nsComment                 = "CA CSR generated by Node-OPCUA Certificate utility using openssl"
-[ v3_ca ]
-subjectKeyIdentifier      = hash
-authorityKeyIdentifier    = keyid:always,issuer:always
-basicConstraints          = CA:TRUE
-keyUsage                  = critical, cRLSign, keyCertSign
-subjectAltName            = $ENV::ALTNAME
-nsComment                 = "CA Certificate generated by Node-OPCUA Certificate utility using openssl"
-#nsCertType                 = sslCA, emailCA
-#issuerAltName              = issuer:copy
-#obj                        = DER:02:03
-{{#CDP_URL}}crlDistributionPoints     = URI:$ENV::CDP_URL
-{{/CDP_URL}}{{#AIA_VALUE}}authorityInfoAccess       = $ENV::AIA_VALUE
-{{/AIA_VALUE}}[ v3_selfsigned]
-basicConstraints          = critical, CA:FALSE
-keyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyAgreement
-extendedKeyUsage          = critical,serverAuth ,clientAuth
-nsComment                 = "Self-signed certificate, generated by NodeOPCUA"
-subjectAltName            = $ENV::ALTNAME
-
-[ crl_ext ]
-#issuerAltName            = issuer:copy
-authorityKeyIdentifier    = keyid:always,issuer:always
-#authorityInfoAccess       = @issuer_info`;
-var ca_config_template_cnf_default = config;
-
-// packages/node-opcua-pki/lib/ca/core/certificate_authority_core.ts
-var defaultSubject = "/C=FR/ST=IDF/L=Paris/O=Local NODE-OPCUA Certificate Authority/CN=NodeOPCUA-CA";
-var configurationFileTemplate = ca_config_template_cnf_default;
-function escapeOpensslConfDoubleQuoted(value) {
-  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-}
-function renderCaConfig(caRootDir) {
-  return configurationFileTemplate.replace(/%%ROOT_FOLDER%%/, escapeOpensslConfDoubleQuoted(makePath(caRootDir)));
-}
-var config2 = {
-  certificateDir: "INVALID",
-  forceCA: false,
-  pkiDir: "INVALID"
-};
-var CA_LOCK_MAX_WAIT_MS = 5 * 6e4;
-var CA_LOCK_RETRY = { minTimeout: 20, maxTimeout: 250 };
-function octetStringToIpAddress(a) {
-  return parseInt(a.substring(0, 2), 16).toString() + "." + parseInt(a.substring(2, 4), 16).toString() + "." + parseInt(a.substring(4, 6), 16).toString() + "." + parseInt(a.substring(6, 8), 16).toString();
-}
-assert3(octetStringToIpAddress("c07b9179") === "192.123.145.121");
-function validateRevocationUrl(url, fieldName) {
-  if (url === void 0) {
-    return void 0;
-  }
-  if (url === "") {
-    throw new Error(`${fieldName} must not be empty \u2014 pass undefined to disable the extension`);
-  }
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new Error(`${fieldName} is not a valid URL: ${url}`);
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error(`${fieldName} must use http: or https: (got ${parsed.protocol} in ${url})`);
-  }
-  if (!parsed.pathname || parsed.pathname === "/") {
-    throw new Error(`${fieldName} must include a path component (got ${url})`);
-  }
-  const isLoopback = parsed.hostname === "localhost" || parsed.hostname === "::1" || parsed.hostname.startsWith("127.");
-  if (isLoopback) {
-    console.warn(
-      `[node-opcua-pki] ${fieldName} points at loopback (${url}) \u2014 certificates issued with this URL will be unreachable from any other host.`
-    );
-  }
-  return url;
-}
-var CertificateAuthorityCore = class {
-  /** RSA key size used when generating the CA private key. */
-  keySize;
-  /** Root filesystem path of the CA directory structure. */
-  location;
-  /** X.500 subject of the CA certificate. */
-  subject;
-  /** @internal Parent CA (undefined for root CAs). */
-  _issuerCA;
-  /** @internal Configured CDP / AIA URLs (US-202). */
-  _crlDistributionUrl;
-  _ocspResponderUrl;
-  _caIssuersUrl;
-  #privateKeyPassphrase;
-  /** resolved once (see `privateKeyPassphrase`); `#passphraseResolved` distinguishes "none" from "not yet" */
-  #resolvedPassphrase;
-  #passphraseResolved = false;
-  /** Signing backend: `openssl` shells out to the CLI, `native` signs in-process. */
-  #backend;
-  /** External signing key (HSM/KMS), when one was supplied instead of a key file. */
-  #signer;
-  /** Read access to `index.txt` / `certs/<SERIAL>.pem`. */
-  #db;
-  constructor(options) {
-    assert3(Object.prototype.hasOwnProperty.call(options, "location"));
-    assert3(Object.prototype.hasOwnProperty.call(options, "keySize"));
-    this.location = options.location;
-    this.keySize = options.keySize || 2048;
-    this.subject = new Subject3(options.subject || defaultSubject);
-    this._issuerCA = options.issuerCA;
-    this.#privateKeyPassphrase = options.privateKeyPassphrase;
-    this.#signer = options.signer;
-    if (options.signer) {
-      const algorithm = options.signer.algorithm;
-      if (algorithm.name !== "RSASSA-PKCS1-v1_5" && algorithm.name !== "ECDSA") {
-        throw new Error(
-          `CertificateAuthority: signer algorithm ${algorithm.name} is not supported - use RSASSA-PKCS1-v1_5 or ECDSA.`
-        );
-      }
-      if (algorithm.name === "ECDSA" && !algorithm.namedCurve) {
-        throw new Error(
-          "CertificateAuthority: an ECDSA signer must declare its namedCurve (P-256, P-384 or P-521) - importing the signer's public key needs the curve, and an SPKI import cannot infer it."
-        );
-      }
-    }
-    if (options.signer && !options.backend.supportsExternalSigner) {
-      throw new Error(
-        "CertificateAuthority: this backend cannot sign with an external signer - it loads its key from a file. Use a backend that supports one, such as NativeCaBackend."
-      );
-    }
-    this.#backend = options.backend;
-    this.#db = new CaDatabase(this.location);
-    if (options.crlDistributionUrl !== void 0) {
-      this.setCrlDistributionUrl(options.crlDistributionUrl);
-    }
-    if (options.ocspResponderUrl !== void 0) {
-      this.setOcspResponderUrl(options.ocspResponderUrl);
-    }
-    if (options.caIssuersUrl !== void 0) {
-      this.setCaIssuersUrl(options.caIssuersUrl);
-    }
-  }
-  /**
-   * Public URL where the CRL produced by this CA is reachable, or
-   * `undefined` if no CDP extension should be emitted on issued certs.
-   */
-  get crlDistributionUrl() {
-    return this._crlDistributionUrl;
-  }
-  /**
-   * Public URL of the OCSP responder, or `undefined` if no AIA OCSP
-   * leg should be emitted on issued certs.
-   */
-  get ocspResponderUrl() {
-    return this._ocspResponderUrl;
-  }
-  /**
-   * Public URL where the issuer's certificate can be fetched, or
-   * `undefined` if no AIA caIssuers leg should be emitted.
-   */
-  get caIssuersUrl() {
-    return this._caIssuersUrl;
-  }
-  /**
-   * Configure the URL embedded as `crlDistributionPoints` in every
-   * subsequently-issued certificate. Pass `undefined` to disable
-   * the extension entirely. Validated synchronously — throws on
-   * empty string, non-http(s) protocol, missing path. Warns (does
-   * not throw) when the URL points at loopback.
-   *
-   * @see US-202
-   */
-  setCrlDistributionUrl(url) {
-    this._crlDistributionUrl = validateRevocationUrl(url, "crlDistributionUrl");
-  }
-  /**
-   * Configure the OCSP responder URL embedded as the `OCSP` leg of
-   * the `authorityInfoAccess` extension on every subsequently-issued
-   * certificate. Pass `undefined` to disable.
-   *
-   * @see US-202
-   */
-  setOcspResponderUrl(url) {
-    this._ocspResponderUrl = validateRevocationUrl(url, "ocspResponderUrl");
-  }
-  /**
-   * Configure the caIssuers URL embedded as the `caIssuers` leg of
-   * the `authorityInfoAccess` extension on every subsequently-issued
-   * certificate. Pass `undefined` to disable.
-   *
-   * @see US-202
-   */
-  setCaIssuersUrl(url) {
-    this._caIssuersUrl = validateRevocationUrl(url, "caIssuersUrl");
-  }
-  /** Absolute path to the CA root directory (alias for {@link location}). */
-  get rootDir() {
-    return this.location;
-  }
-  /** Path to the OpenSSL configuration file (`conf/caconfig.cnf`). */
-  get configFile() {
-    return path4.normalize(path4.join(this.rootDir, "./conf/caconfig.cnf"));
-  }
-  /** Path to the CA private key (`private/cakey.pem`); may be passphrase-encrypted, see {@link getPrivateKey}. */
-  get privateKey() {
-    return path4.join(path4.resolve(this.rootDir), "private/cakey.pem");
-  }
-  /**
-   * The CA private key, decrypted with the configured `privateKeyPassphrase`
-   * if it is encrypted. Fails closed (`PrivateKeyPassphraseRequiredError`)
-   * on an encrypted key with no or the wrong passphrase.
-   */
-  async getPrivateKey() {
-    this.#assertKeyIsOnDisk("getPrivateKey");
-    return readPrivateKey2(this.privateKey, await this._privateKeyPassphrase());
-  }
-  /**
-   * True when this CA signs with an external {@link CaSigner} (HSM/KMS)
-   * rather than with `private/cakey.pem`. There is then no private key
-   * file on disk, and never was one.
-   */
-  get hasExternalSigner() {
-    return this.#signer !== void 0;
-  }
-  /**
-   * Does `cert` certify the key this CA signs with? With the key on disk
-   * that is a private-key match; with a signer there is no private key to
-   * match, so compare the certified public key against the signer's own -
-   * the same question, asked the only way an HSM allows.
-   */
-  async #certificateMatchesOurKey(certPem, certDer) {
-    if (this.#signer) {
-      const ours = Buffer.from(await this.#signer.getPublicKey());
-      const certified = Buffer.from(new x5092.X509Certificate(certPem).publicKey.rawData);
-      return ours.equals(certified);
-    }
-    return certificateMatchesPrivateKey(certDer, await this.getPrivateKey());
-  }
-  /** Reject the key-file-only operations up front, rather than failing on a missing file later. */
-  #assertKeyIsOnDisk(what) {
-    if (this.#signer) {
-      throw new Error(
-        `CertificateAuthority.${what} is not available on a signer-backed CA: the private key lives in the signer (HSM/KMS) and is never written to disk.`
-      );
-    }
-  }
-  /**
-   * @internal The key every signing operation goes through. An injected
-   * {@link CaSigner} is returned as-is; otherwise the on-disk key is read
-   * (and decrypted) and handed over as a plain `CryptoKey`. Both are
-   * accepted by the `node-opcua-crypto` signing primitives, so callers
-   * never branch on which one they got.
-   */
-  async _getSigningKey() {
-    if (this.#signer) {
-      return this.#signer;
-    }
-    return privateKeyToCryptoKey2(await this.getPrivateKey());
-  }
-  /**
-   * Enable, disable, or rotate the passphrase protecting `private/cakey.pem`
-   * (temp file + atomic rename, temp file removed on failure). Only
-   * rewrites the file: construct a new `CertificateAuthority` with the new
-   * passphrase to continue using it.
-   */
-  async reencryptPrivateKey(oldPassphrase, newPassphrase) {
-    this.#assertKeyIsOnDisk("reencryptPrivateKey");
-    const oldPass = await resolvePrivateKeyPassphrase(oldPassphrase);
-    const newPass = await resolvePrivateKeyPassphrase(newPassphrase);
-    const key = readPrivateKey2(this.privateKey, oldPass);
-    await this.#rewritePrivateKeyFile(key, newPass);
-  }
-  async #rewritePrivateKeyFile(privateKey, passphrase) {
-    const tmpFilename = `${this.privateKey}.${process.pid}-${Date.now()}.tmp`;
-    try {
-      await writePrivateKeyFile(tmpFilename, privateKey, { passphrase });
-      await fs4.promises.rename(tmpFilename, this.privateKey);
-    } finally {
-      await fs4.promises.rm(tmpFilename, { force: true });
-    }
-  }
-  /** @internal resolve the configured passphrase, at most once per instance */
-  async _privateKeyPassphrase() {
-    if (!this.#passphraseResolved) {
-      this.#resolvedPassphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
-      this.#passphraseResolved = true;
-    }
-    return this.#resolvedPassphrase;
-  }
-  /**
-   * @internal On an existing key: encrypt it in place if a passphrase is
-   * configured and it is still plaintext (secure by default: the option
-   * means "protect this key", not "ignore me"), then read it back so a
-   * wrong or missing passphrase fails initialize() closed rather than the
-   * first signing operation.
-   */
-  async _ensurePrivateKeyProtection() {
-    if (this.#signer || !fs4.existsSync(this.privateKey)) {
-      return;
-    }
-    if (this.#privateKeyPassphrase !== void 0 && !isEncryptedPrivateKeyFile(this.privateKey)) {
-      warningLog("CertificateAuthority: private key is plaintext but a passphrase is configured; encrypting it in place");
-      const plaintextKey = readPrivateKey2(this.privateKey);
-      await this.#rewritePrivateKeyFile(plaintextKey, await this._privateKeyPassphrase());
-    }
-    await this.getPrivateKey();
-  }
-  /**
-   * Acquire a file-based lock on this CA's directory for the duration of
-   * `action` — serializes every operation that mutates the certificate
-   * database (`index.txt`, `serial`, `crlnumber`, `certs/`,
-   * `crl/revocation_list.*`) or the CA's own key/certificate, so
-   * concurrent calls on one `CertificateAuthority` (or two instances
-   * pointed at the same directory, in this or another process) cannot
-   * interleave. Mirrors `CertificateManager.withLock2`.
-   *
-   * Only ever call this from a top-level public operation — nested calls
-   * on the same instance would deadlock, since the underlying file lock
-   * is not reentrant.
-   *
-   * The wait is bounded: a waiter gives up (throws) after
-   * `CA_LOCK_MAX_WAIT_MS`. Without a bound, a holder whose openssl child
-   * hangs would block every CA operation in every process forever and
-   * silently — the lock library's keepalive keeps refreshing the lock
-   * file's mtime as long as the holder process is alive, so stale-lock
-   * recovery never fires for a live-but-stuck holder. A dead holder's
-   * lock goes stale (default 2 minutes) and is taken over well within
-   * this bound.
-   */
-  async #withCaLock(action) {
-    const lockFileName = path4.join(this.rootDir, ".ca.lock");
-    return withLock(
-      {
-        fileToLock: lockFileName,
-        retries: { forever: true, maxRetryTime: CA_LOCK_MAX_WAIT_MS, ...CA_LOCK_RETRY }
-      },
-      action
-    );
-  }
-  /**
-   * @internal Run `action` under this CA's directory lock. For the one
-   * legitimate cross-instance use: a subordinate CA's bootstrap signs its
-   * certificate with `openssl x509 -CAserial`, which read-increment-writes
-   * THIS issuer's `serial` file, and must therefore hold this issuer's
-   * lock (ordering is always subordinate -> issuer, so no cycle).
-   */
-  async _withCaDirectoryLock(action) {
-    return this.#withCaLock(action);
-  }
-  /** Path to the CA certificate in PEM format (`public/cacert.pem`). */
-  get caCertificate() {
-    return makePath(this.rootDir, "./public/cacert.pem");
-  }
-  /**
-   * Path to the issuer certificate chain (`public/issuer_chain.pem`).
-   *
-   * This file is created by {@link installCACertificate} when the
-   * provided cert file contains additional issuer certificates
-   * (e.g. intermediate + root). It is appended to signed certs
-   * by {@link constructCertificateChain} to produce a full chain
-   * per OPC UA Part 6 §6.2.6.
-   */
-  get issuerCertificateChain() {
-    return makePath(this.rootDir, "./public/issuer_chain.pem");
-  }
-  /**
-   * Path to the current Certificate Revocation List in DER format.
-   * (`crl/revocation_list.der`)
-   */
-  get revocationListDER() {
-    return makePath(this.rootDir, "./crl/revocation_list.der");
-  }
-  /**
-   * Path to the current Certificate Revocation List in PEM format.
-   * (`crl/revocation_list.crl`)
-   */
-  get revocationList() {
-    return makePath(this.rootDir, "./crl/revocation_list.crl");
-  }
-  /**
-   * Path to the concatenated CA certificate + CRL file.
-   * Used by OpenSSL for CRL-based verification.
-   */
-  get caCertificateWithCrl() {
-    return makePath(this.rootDir, "./public/cacertificate_with_crl.pem");
-  }
-  // ---------------------------------------------------------------
-  // Buffer-based accessors (US-059)
-  // ---------------------------------------------------------------
-  /**
-   * Return the CA certificate as a DER-encoded buffer.
-   *
-   * @throws if the CA certificate file does not exist
-   *   (call {@link initialize} first).
-   */
-  getCACertificateDER() {
-    const pem = readCertificatePEM2(this.caCertificate);
-    return convertPEMtoDER2(pem);
-  }
-  /**
-   * Return the CA certificate as a PEM-encoded string.
-   *
-   * @throws if the CA certificate file does not exist
-   *   (call {@link initialize} first).
-   */
-  getCACertificatePEM() {
-    const raw = readCertificatePEM2(this.caCertificate);
-    const beginMarker = "-----BEGIN CERTIFICATE-----";
-    const idx = raw.indexOf(beginMarker);
-    if (idx > 0) {
-      return raw.substring(idx);
-    }
-    return raw;
-  }
-  /**
-   * Return the current Certificate Revocation List as a
-   * DER-encoded buffer.
-   *
-   * Returns an empty buffer if no CRL has been generated yet.
-   */
-  getCRLDER() {
-    const crlPath = this.revocationListDER;
-    if (!fs4.existsSync(crlPath)) {
-      return Buffer.alloc(0);
-    }
-    return fs4.readFileSync(crlPath);
-  }
-  /**
-   * Return the current Certificate Revocation List as a
-   * PEM-encoded string.
-   *
-   * Returns an empty string if no CRL has been generated yet.
-   */
-  getCRLPEM() {
-    const crlPath = this.revocationList;
-    if (!fs4.existsSync(crlPath)) {
-      return "";
-    }
-    const raw = fs4.readFileSync(crlPath, "utf-8");
-    const beginMarker = "-----BEGIN X509 CRL-----";
-    const idx = raw.indexOf(beginMarker);
-    if (idx > 0) {
-      return raw.substring(idx);
-    }
-    return raw;
-  }
-  // ---------------------------------------------------------------
-  // Certificate database API (US-057)
-  // ---------------------------------------------------------------
-  /**
-   * Return a list of all issued certificates recorded in the
-   * OpenSSL `index.txt` database.
-   *
-   * Each entry includes the serial number, subject, status,
-   * expiry date, and (for revoked certs) the revocation date.
-   */
-  getIssuedCertificates() {
-    return this.#db.readIndex();
-  }
-  /**
-   * Return the total number of certificates recorded in
-   * `index.txt`.
-   */
-  getIssuedCertificateCount() {
-    return this.#db.readIndex().length;
-  }
-  /**
-   * Return the status of a certificate by its serial number.
-   *
-   * @param serial - hex-encoded serial number (e.g. `"1000"`)
-   * @returns `"valid"`, `"revoked"`, `"expired"`, or
-   *   `undefined` if not found
-   */
-  getCertificateStatus(serial) {
-    return this.#db.findBySerial(serial)?.status;
-  }
-  /**
-   * Read a specific issued certificate by serial number and
-   * return its content as a DER-encoded buffer.
-   *
-   * OpenSSL stores signed certificates in the `certs/`
-   * directory using the naming convention `<SERIAL>.pem`.
-   *
-   * @param serial - hex-encoded serial number (e.g. `"1000"`)
-   * @returns the DER buffer, or `undefined` if not found
-   */
-  getCertificateBySerial(serial) {
-    return this.#db.getCertificateBySerial(serial);
-  }
-  /**
-   * Path to the OpenSSL certificate database file.
-   */
-  get indexFile() {
-    return this.#db.indexFile;
-  }
-  // ---------------------------------------------------------------
-  // Buffer-based CA operations (US-058)
-  // ---------------------------------------------------------------
-  /**
-   * Sign a DER-encoded Certificate Signing Request and return
-   * the signed certificate as a DER buffer.
-   *
-   * This method handles temp-file creation and cleanup
-   * internally so that callers can work with in-memory
-   * buffers only.
-   *
-   * The CA can override fields from the CSR by passing
-   * `options.dns`, `options.ip`, `options.applicationUri`,
-   * `options.startDate`, or `options.subject`.
-   *
-   * @param csrDer - the CSR as a DER-encoded buffer
-   * @param options - signing options and CA overrides
-   * @returns the signed certificate as a DER-encoded buffer
-   */
-  async signCertificateRequestFromDER(csrDer, options) {
-    const tmpDir = await fs4.promises.mkdtemp(path4.join(os.tmpdir(), "pki-sign-"));
-    try {
-      const csrFile = path4.join(tmpDir, "request.csr");
-      const certFile = path4.join(tmpDir, "certificate.pem");
-      const csrPem = toPem(csrDer, "CERTIFICATE REQUEST");
-      await fs4.promises.writeFile(csrFile, csrPem, "utf-8");
-      const signingParams = {};
-      if (options?.validityMs !== void 0) signingParams.validityMs = options.validityMs;
-      else signingParams.validity = options?.validity ?? 365;
-      if (options?.startDate) signingParams.startDate = options.startDate;
-      if (options?.dns) signingParams.dns = options.dns;
-      if (options?.ip) signingParams.ip = options.ip;
-      if (options?.applicationUri) signingParams.applicationUri = options.applicationUri;
-      if (options?.subject) signingParams.subject = options.subject;
-      await this.signCertificateRequest(certFile, csrFile, signingParams);
-      const certPem = readCertificatePEM2(certFile);
-      return convertPEMtoDER2(certPem);
-    } finally {
-      await fs4.promises.rm(tmpDir, {
-        recursive: true,
-        force: true
-      });
-    }
-  }
-  /**
-   * Advertise the validity limits this CA can honor.
-   *
-   * Consumers (notably the GDS server in [`cert_auth.ts`](https://github.com/sterfive/node-opcua-gds))
-   * clamp a requested validity against these bounds before calling
-   * {@link signCertificateRequestFromDER}, so a misconfigured
-   * `defaultCertValidity` cannot ask the CA for something it cannot
-   * produce.
-   *
-   * Defaults match the OpenSSL-backed implementation:
-   * - `minValidityMs = 60_000` (1 minute) — practical floor; the
-   *   X.509 spec floor is 1 second but very short certs are rarely
-   *   useful and pathological for any real deployment.
-   * - `maxValidityMs = 10 * 365 * 86_400_000` (≈ 10 years) — long
-   *   enough for root CAs.
-   * - `validityGranularityMs = 1_000` (1 second) — RFC 5280 §4.1.2.5
-   *   floor on `notBefore` / `notAfter`.
-   * - `nativeUnit = "second"` — what `x509Date()` actually encodes.
-   *
-   * @see US-208 — the consumer-side capability story.
-   */
-  getCapabilities() {
-    return {
-      minValidityMs: 6e4,
-      maxValidityMs: 10 * 365 * 864e5,
-      validityGranularityMs: 1e3,
-      nativeUnit: "second"
-    };
-  }
-  /**
-   * Generate a new RSA key pair, create an internal CSR, sign it
-   * with this CA, and return both the certificate and private key
-   * as DER-encoded buffers.
-   *
-   * The private key is **never stored** by the CA — it exists only
-   * in a temporary directory that is cleaned up after the operation.
-   *
-   * This is used by `StartNewKeyPairRequest` (OPC UA Part 12) for
-   * constrained devices that cannot generate their own keys.
-   *
-   * @param options - key generation and certificate parameters
-   * @returns `{ certificateDer, privateKey }` — certificate as DER,
-   *   private key as a branded `PrivateKey` buffer
-   */
-  /**
-   * An ephemeral key and a CSR for it, written into `tmpDir`. Both
-   * `generateKeyPairAndSign*` methods need exactly this, and neither
-   * needs a subprocess for it: the key comes from node's crypto and the
-   * request is built and self-signed in process, so no `openssl.cnf` has
-   * to be rendered either.
-   */
-  async #createEphemeralKeyAndCsr(tmpDir, keySize, options) {
-    const privateKeyFile = path4.join(tmpDir, "private_key.pem");
-    await generatePrivateKeyFile(privateKeyFile, keySize);
-    const { csr } = await createCertificateSigningRequest2({
-      privateKey: await privateKeyToCryptoKey2(readPrivateKey2(privateKeyFile)),
-      subject: options.subject ? new Subject3(options.subject).toString() : void 0,
-      applicationUri: options.applicationUri,
-      dns: options.dns ?? [],
-      ip: options.ip ?? [],
-      purpose: CertificatePurpose2.ForApplication
-    });
-    const csrFile = path4.join(tmpDir, "request.csr");
-    await fs4.promises.writeFile(csrFile, csr);
-    return { privateKeyFile, csrFile };
-  }
-  async generateKeyPairAndSignDER(options) {
-    const keySize = options.keySize ?? 2048;
-    const startDate = options.startDate ?? /* @__PURE__ */ new Date();
-    const tmpDir = await fs4.promises.mkdtemp(path4.join(os.tmpdir(), "pki-keygen-"));
-    try {
-      const { privateKeyFile, csrFile } = await this.#createEphemeralKeyAndCsr(tmpDir, keySize, options);
-      const certFile = path4.join(tmpDir, "certificate.pem");
-      const signingParams = {
-        applicationUri: options.applicationUri,
-        dns: options.dns,
-        ip: options.ip,
-        startDate
-      };
-      if (options.validityMs !== void 0) signingParams.validityMs = options.validityMs;
-      else signingParams.validity = options.validity ?? 365;
-      await this.signCertificateRequest(certFile, csrFile, signingParams);
-      const certPem = readCertificatePEM2(certFile);
-      const certificateDer = convertPEMtoDER2(certPem);
-      const privateKey = readPrivateKey2(privateKeyFile);
-      return { certificateDer, privateKey };
-    } finally {
-      await fs4.promises.rm(tmpDir, {
-        recursive: true,
-        force: true
-      });
-    }
-  }
-  /**
-   * Generate a new RSA key pair, create an internal CSR, sign it
-   * with this CA, and return the result as a PKCS#12 (PFX)
-   * buffer bundling the certificate, private key, and CA chain.
-   *
-   * The private key is **never stored** by the CA — it exists only
-   * in a temporary directory that is cleaned up after the operation.
-   *
-   * @param options - key generation, certificate, and PFX options
-   * @returns the PFX as a `Buffer`
-   */
-  async generateKeyPairAndSignPFX(options) {
-    const keySize = options.keySize ?? 2048;
-    const startDate = options.startDate ?? /* @__PURE__ */ new Date();
-    const passphrase = options.passphrase ?? "";
-    const tmpDir = await fs4.promises.mkdtemp(path4.join(os.tmpdir(), "pki-keygen-pfx-"));
-    try {
-      const { privateKeyFile, csrFile } = await this.#createEphemeralKeyAndCsr(tmpDir, keySize, options);
-      const certFile = path4.join(tmpDir, "certificate.pem");
-      const signingParams = {
-        applicationUri: options.applicationUri,
-        dns: options.dns,
-        ip: options.ip,
-        startDate
-      };
-      if (options.validityMs !== void 0) signingParams.validityMs = options.validityMs;
-      else signingParams.validity = options.validity ?? 365;
-      await this.signCertificateRequest(certFile, csrFile, signingParams);
-      const blocks = (await fs4.promises.readFile(certFile, "utf-8")).match(
-        /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g
-      );
-      if (!blocks || blocks.length === 0) {
-        throw new Error(`generateKeyPairAndSignPFX: no certificate was produced in ${certFile}`);
-      }
-      return await createPfx({
-        certificate: convertPEMtoDER2(blocks[0]),
-        certificateChain: blocks.slice(1).map(convertPEMtoDER2),
-        privateKey: readPrivateKey2(privateKeyFile),
-        password: passphrase
-      });
-    } finally {
-      await fs4.promises.rm(tmpDir, {
-        recursive: true,
-        force: true
-      });
-    }
-  }
-  /**
-   * Revoke a DER-encoded certificate and regenerate the CRL.
-   *
-   * Extracts the serial number from the certificate, then
-   * uses the stored cert file at `certs/<serial>.pem` for
-   * revocation — avoiding temp-file PEM format mismatches.
-   *
-   * @param certDer - the certificate as a DER-encoded buffer
-   * @param reason - CRL reason code
-   *   (default: `"keyCompromise"`)
-   * @throws if the certificate's serial is not found in the CA
-   */
-  async revokeCertificateDER(certDer, reason) {
-    const info = exploreCertificate(certDer);
-    const serial = info.tbsCertificate.serialNumber.replace(/:/g, "").toUpperCase();
-    const storedCertFile = path4.join(this.rootDir, "certs", `${serial}.pem`);
-    if (!fs4.existsSync(storedCertFile)) {
-      throw new Error(`Cannot revoke: no stored certificate found for serial ${serial} at ${storedCertFile}`);
-    }
-    await this.revokeCertificate(storedCertFile, {
-      reason: reason ?? "keyCompromise"
-    });
-  }
-  /**
-   * Initialize the CA directory structure, generate the CA
-   * private key and self-signed certificate if they do not
-   * already exist.
-   */
-  async initialize() {
-    mkdirRecursiveSync(path4.resolve(this.rootDir));
-    await this.#withCaLock(() => this.#bootstrap());
-  }
-  /**
-   * @internal Shared (backend-agnostic) part of `initialize()`: directory
-   * layout, default database files, the "already initialized" / "partial
-   * init" checks, and the openssl config file — then delegates CSR
-   * generation, CA-certificate signing, and the initial CRL to
-   * {@link CaBackend.bootstrap}. Must be called under {@link #withCaLock}.
-   */
-  async #bootstrap() {
-    const caRootDir = path4.resolve(this.rootDir);
-    mkdirRecursiveSync(caRootDir);
-    ensurePrivateDirectory(path4.join(caRootDir, "private"));
-    mkdirRecursiveSync(path4.join(caRootDir, "public"));
-    mkdirRecursiveSync(path4.join(caRootDir, "certs"));
-    mkdirRecursiveSync(path4.join(caRootDir, "crl"));
-    mkdirRecursiveSync(path4.join(caRootDir, "conf"));
-    const serial = path4.join(caRootDir, "serial");
-    if (!fs4.existsSync(serial)) {
-      await fs4.promises.writeFile(serial, "1000");
-    }
-    const crlNumber = path4.join(caRootDir, "crlnumber");
-    if (!fs4.existsSync(crlNumber)) {
-      await fs4.promises.writeFile(crlNumber, "1000");
-    }
-    const indexFile = path4.join(caRootDir, "index.txt");
-    if (!fs4.existsSync(indexFile)) {
-      await fs4.promises.writeFile(indexFile, "");
-    }
-    const signerBacked = this.hasExternalSigner;
-    const caKeyExists = signerBacked || fs4.existsSync(path4.join(caRootDir, "private/cakey.pem"));
-    const caCertExists = fs4.existsSync(path4.join(caRootDir, "public/cacert.pem"));
-    if (caKeyExists && caCertExists && !config2.forceCA) {
-      if (!signerBacked) {
-        restrictPrivateFilePermissions(path4.join(caRootDir, "private/cakey.pem"), 384);
-        await this._ensurePrivateKeyProtection();
-      }
-      debugLog("CA private key and certificate already exist ... skipping");
-      return;
-    }
-    if (!signerBacked && caKeyExists && !caCertExists) {
-      debugLog("CA private key exists but cacert.pem is missing \u2014 rebuilding CA");
-      fs4.unlinkSync(path4.join(caRootDir, "private/cakey.pem"));
-      const staleCsr = path4.join(caRootDir, "private/cakey.csr");
-      if (fs4.existsSync(staleCsr)) {
-        fs4.unlinkSync(staleCsr);
-      }
-    }
-    displayTitle("Create Certificate Authority (CA)");
-    const indexFileAttr = path4.join(caRootDir, "index.txt.attr");
-    if (!fs4.existsSync(indexFileAttr)) {
-      await fs4.promises.writeFile(indexFileAttr, "unique_subject = no");
-    }
-    const caConfigFile = this.configFile;
-    await fs4.promises.writeFile(caConfigFile, renderCaConfig(caRootDir));
-    if (!signerBacked) {
-      const privateKeyFilename = path4.join(caRootDir, "private/cakey.pem");
-      displayTitle(`Generate the CA private Key - ${this.keySize}`);
-      await generatePrivateKeyFile(privateKeyFilename, this.keySize, { passphrase: await this._privateKeyPassphrase() });
-      restrictPrivateFilePermissions(privateKeyFilename, 384);
-    }
-    await this.#backend.bootstrap(this);
-  }
-  /**
-   * Initialize the CA directory structure and generate the
-   * private key + CSR **without signing**.
-   *
-   * Use this when the CA certificate will be signed by an
-   * external (third-party) root CA.  After receiving the signed
-   * certificate, call {@link installCACertificate} to complete
-   * the setup.
-   *
-   * **Idempotent / restart-safe:**
-   * - If the CA certificate exists and is valid → `{ status: "ready" }`
-   * - If the CA certificate has expired → `{ status: "expired", csrPath, expiryDate }`
-   *   (a new CSR is generated, preserving the existing private key)
-   * - If key + CSR exist but no cert (restart before install) →
-   *   `{ status: "pending", csrPath }` without regenerating
-   * - Otherwise → generates key + CSR → `{ status: "created", csrPath }`
-   *
-   * @returns an {@link InitializeCSRResult} describing the CA state
-   */
-  async initializeCSR() {
-    const caRootDir = path4.resolve(this.rootDir);
-    mkdirRecursiveSync(caRootDir);
-    return this.#withCaLock(() => this.#initializeCSRLocked(caRootDir));
-  }
-  async #initializeCSRLocked(caRootDir) {
-    for (const dir of ["public", "certs", "crl", "conf"]) {
-      mkdirRecursiveSync(path4.join(caRootDir, dir));
-    }
-    ensurePrivateDirectory(path4.join(caRootDir, "private"));
-    const caCertFile = this.caCertificate;
-    const privateKeyFile = path4.join(caRootDir, "private/cakey.pem");
-    const csrFile = path4.join(caRootDir, "private/cakey.csr");
-    const keyAvailable = this.hasExternalSigner || fs4.existsSync(privateKeyFile);
-    if (!this.hasExternalSigner && fs4.existsSync(privateKeyFile)) {
-      restrictPrivateFilePermissions(privateKeyFile, 384);
-      await this._ensurePrivateKeyProtection();
-    }
-    if (fs4.existsSync(caCertFile)) {
-      const certDer = convertPEMtoDER2(readCertificatePEM2(caCertFile));
-      const certInfo = exploreCertificate(certDer);
-      const notAfter = certInfo.tbsCertificate.validity.notAfter;
-      if (notAfter.getTime() < Date.now()) {
-        debugLog("CA certificate has expired \u2014 generating renewal CSR");
-        await this._generateCSR(caRootDir, privateKeyFile, csrFile);
-        return { status: "expired", csrPath: csrFile, expiryDate: notAfter };
-      }
-      debugLog("CA certificate already exists and is valid \u2014 ready");
-      return { status: "ready" };
-    }
-    if (keyAvailable && fs4.existsSync(csrFile)) {
-      debugLog("CA key + CSR already exist \u2014 pending external signing");
-      return { status: "pending", csrPath: csrFile };
-    }
-    const serial = path4.join(caRootDir, "serial");
-    if (!fs4.existsSync(serial)) {
-      await fs4.promises.writeFile(serial, "1000");
-    }
-    const crlNumber = path4.join(caRootDir, "crlnumber");
-    if (!fs4.existsSync(crlNumber)) {
-      await fs4.promises.writeFile(crlNumber, "1000");
-    }
-    const indexFile = path4.join(caRootDir, "index.txt");
-    if (!fs4.existsSync(indexFile)) {
-      await fs4.promises.writeFile(indexFile, "");
-    }
-    const indexFileAttr = path4.join(caRootDir, "index.txt.attr");
-    if (!fs4.existsSync(indexFileAttr)) {
-      await fs4.promises.writeFile(indexFileAttr, "unique_subject = no");
-    }
-    const caConfigFile = this.configFile;
-    await fs4.promises.writeFile(caConfigFile, renderCaConfig(caRootDir));
-    if (!keyAvailable) {
-      await generatePrivateKeyFile(privateKeyFile, this.keySize, { passphrase: await this._privateKeyPassphrase() });
-      restrictPrivateFilePermissions(privateKeyFile, 384);
-    }
-    await this._generateCSR(caRootDir, privateKeyFile, csrFile);
-    return { status: "created", csrPath: csrFile };
-  }
-  /**
-   * Check whether the CA certificate needs renewal and, if so,
-   * generate a new CSR for re-signing by the external root CA.
-   *
-   * Use this while the CA is running to detect upcoming expiry
-   * **before** it actually expires. The existing private key is
-   * preserved so previously issued certs remain valid.
-   *
-   * @param thresholdDays - number of days before expiry at which
-   *   to trigger renewal (default: 30)
-   * @returns an {@link InitializeCSRResult} — `"expired"` if
-   *   renewal is needed, `"ready"` if the cert is still valid
-   */
-  async renewCSR(thresholdDays = 30) {
-    const caRootDir = path4.resolve(this.rootDir);
-    const caCertFile = this.caCertificate;
-    const privateKeyFile = path4.join(caRootDir, "private/cakey.pem");
-    const csrFile = path4.join(caRootDir, "private/cakey.csr");
-    if (!fs4.existsSync(caCertFile)) {
-      return this.initializeCSR();
-    }
-    const certDer = convertPEMtoDER2(readCertificatePEM2(caCertFile));
-    const certInfo = exploreCertificate(certDer);
-    const notAfter = certInfo.tbsCertificate.validity.notAfter;
-    const thresholdMs = thresholdDays * 24 * 60 * 60 * 1e3;
-    if (notAfter.getTime() - Date.now() < thresholdMs) {
-      debugLog(`CA certificate expires within ${thresholdDays} days \u2014 generating renewal CSR`);
-      await this.#withCaLock(() => this._generateCSR(caRootDir, privateKeyFile, csrFile));
-      return { status: "expired", csrPath: csrFile, expiryDate: notAfter };
-    }
-    return { status: "ready" };
-  }
-  /**
-   * Generate a CSR using the existing private key.
-   * Must be called under {@link #withCaLock} — the lock is taken by the
-   * public callers (`initializeCSR`, `renewCSR`), not here, so that
-   * `initializeCSR` can hold one lock across key generation AND CSR
-   * generation without the non-reentrant file lock deadlocking.
-   * @internal
-   */
-  async _generateCSR(caRootDir, privateKeyFile, csrFile) {
-    await this.#backend.generateCaCsr(this, caRootDir, privateKeyFile, csrFile);
-  }
-  /**
-   * Install an externally-signed CA certificate and generate
-   * the initial CRL.
-   *
-   * Call this after {@link initializeCSR} once the external
-   * root CA has signed the CSR.
-   *
-   * **Safety checks:**
-   * - Verifies that the certificate's public key matches the
-   *   CA private key before installing.
-   *
-   * @param signedCertFile - path to the PEM-encoded signed
-   *   CA certificate (issued by the external root CA)
-   * @returns an {@link InstallCACertificateResult} with
-   *   `status: "success"` or `status: "error"` and a `reason`
-   */
-  async installCACertificate(signedCertFile) {
-    return this.#withCaLock(async () => {
-      const caCertFile = this.caCertificate;
-      const fullPem = await fs4.promises.readFile(signedCertFile, "utf8");
-      const pemBlocks = fullPem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
-      if (!pemBlocks || pemBlocks.length === 0) {
-        return {
-          status: "error",
-          reason: "no_certificate_found",
-          message: "The provided file does not contain any PEM-encoded certificate."
-        };
-      }
-      const certDer = convertPEMtoDER2(pemBlocks[0]);
-      if (!await this.#certificateMatchesOurKey(pemBlocks[0], certDer)) {
-        return {
-          status: "error",
-          reason: "certificate_key_mismatch",
-          message: "The provided certificate does not match the CA private key. Ensure the certificate was signed from the CSR generated by initializeCSR()."
-        };
-      }
-      await fs4.promises.writeFile(caCertFile, `${pemBlocks[0]}
-`);
-      const issuerChainFile = this.issuerCertificateChain;
-      if (pemBlocks.length > 1) {
-        const issuerPem = `${pemBlocks.slice(1).join("\n")}
-`;
-        await fs4.promises.writeFile(issuerChainFile, issuerPem);
-        debugLog(`Stored ${pemBlocks.length - 1} issuer certificate(s) in issuer_chain.pem`);
-      } else {
-        if (fs4.existsSync(issuerChainFile)) {
-          await fs4.promises.unlink(issuerChainFile);
-        }
-      }
-      await this.#backend.regenerateCrl(this);
-      return { status: "success" };
-    });
-  }
-  /**
-   * Sign a CSR with CA extensions (`v3_ca`), producing a
-   * subordinate CA certificate.
-   *
-   * Unlike {@link signCertificateRequest} which signs with
-   * end-entity extensions (SANs, etc.), this method signs
-   * with `basicConstraints = CA:TRUE` and `keyUsage =
-   * keyCertSign, cRLSign`.
-   *
-   * @param certFile - output path for the signed CA cert (PEM)
-   * @param csrFile - path to the subordinate CA's CSR
-   * @param params - signing parameters
-   */
-  async signCACertificateRequest(certFile, csrFile, params) {
-    await this.#withCaLock(async () => {
-      const validity = params.validity ?? 3650;
-      await this.#backend.signSubordinateCsr(this, csrFile, certFile, validity);
-      await this.constructCertificateChain(certFile);
-    });
-  }
-  /**
-   * Rebuild the combined CA certificate + CRL file.
-   *
-   * This concatenates the CA certificate with the current
-   * revocation list so that OpenSSL can verify certificates
-   * with CRL checking enabled.
-   */
-  async constructCACertificateWithCRL() {
-    const cacertWithCRL = this.caCertificateWithCrl;
-    if (fs4.existsSync(this.revocationList)) {
-      await fs4.promises.writeFile(
-        cacertWithCRL,
-        fs4.readFileSync(this.caCertificate, "utf8") + fs4.readFileSync(this.revocationList, "utf8")
-      );
-    } else {
-      await fs4.promises.writeFile(cacertWithCRL, fs4.readFileSync(this.caCertificate));
-    }
-  }
-  /**
-   * Append the CA certificate to a signed certificate file,
-   * creating a PEM certificate chain.
-   *
-   * @param certificate - path to the certificate file to extend
-   */
-  async constructCertificateChain(certificate) {
-    assert3(fs4.existsSync(certificate));
-    assert3(fs4.existsSync(this.caCertificate));
-    debugLog(chalk3.yellow("        certificate file :"), chalk3.cyan(certificate));
-    let chain = await fs4.promises.readFile(certificate, "utf8");
-    chain += await fs4.promises.readFile(this.caCertificate, "utf8");
-    if (fs4.existsSync(this.issuerCertificateChain)) {
-      chain += await fs4.promises.readFile(this.issuerCertificateChain, "utf8");
-    }
-    await fs4.promises.writeFile(certificate, chain);
-  }
-  /**
-   * Create a self-signed certificate using OpenSSL.
-   *
-   * @param certificateFile - output path for the signed certificate
-   * @param privateKey - path to the private key file
-   * @param params - certificate parameters (subject, validity, SANs)
-   */
-  async createSelfSignedCertificate(certificateFile, privateKey, params) {
-    assert3(typeof privateKey === "string");
-    assert3(fs4.existsSync(privateKey));
-    if (!certificateFileExist(certificateFile)) {
-      return;
-    }
-    adjustDate(params);
-    adjustApplicationUri(params);
-    params.dns = params.dns || [];
-    params.ip = params.ip || [];
-    await this.#withCaLock(async () => {
-      await this.#backend.createSelfSignedCertificate(this, certificateFile, privateKey, params);
-    });
-  }
-  /**
-   * Regenerate `crl/revocation_list.{crl,der}` from the current database
-   * state, without changing any certificate's status. Normally
-   * unnecessary — `revokeCertificate` already regenerates the CRL as
-   * part of revoking — but useful to force a refresh (e.g. after
-   * switching a CA's `backend` between `"openssl"` and `"native"`).
-   */
-  async regenerateCrl() {
-    await this.#withCaLock(async () => {
-      await this.#backend.regenerateCrl(this);
-    });
-  }
-  /**
-   * Revoke a certificate and regenerate the CRL.
-   *
-   * @param certificate - path to the certificate file to revoke
-   * @param params - revocation parameters
-   * @param params.reason - CRL reason code
-   *   (default `"keyCompromise"`)
-   */
-  async revokeCertificate(certificate, params) {
-    const crlReasons = [
-      "unspecified",
-      "keyCompromise",
-      "CACompromise",
-      "affiliationChanged",
-      "superseded",
-      "cessationOfOperation",
-      "certificateHold",
-      "removeFromCRL"
-    ];
-    const reason = params.reason || "keyCompromise";
-    assert3(crlReasons.indexOf(reason) >= 0);
-    displayTitle(`Revoking certificate  ${certificate}`);
-    await this.#withCaLock(async () => {
-      await this.#backend.revoke(this, certificate, reason);
-    });
-  }
-  /**
-   * Sign a Certificate Signing Request (CSR) with this CA.
-   *
-   * The signed certificate is written to `certificate`, and the
-   * CA certificate chain plus CRL are appended to form a
-   * complete certificate chain.
-   *
-   * @param certificate - output path for the signed certificate
-   * @param certificateSigningRequestFilename - path to the CSR
-   * @param params1 - signing parameters (validity, dates, SANs)
-   * @returns the path to the signed certificate
-   */
-  async signCertificateRequest(certificate, certificateSigningRequestFilename, params1) {
-    await this.#backend.preflight();
-    assert3(fs4.existsSync(certificateSigningRequestFilename));
-    if (!certificateFileExist(certificate)) {
-      return "";
-    }
-    adjustDate(params1);
-    adjustApplicationUri(params1);
-    const csr = await readCertificateSigningRequest(certificateSigningRequestFilename);
-    const csrInfo = exploreCertificateSigningRequest(csr);
-    const applicationUri = csrInfo.extensionRequest.subjectAltName.uniformResourceIdentifier ? csrInfo.extensionRequest.subjectAltName.uniformResourceIdentifier[0] : void 0;
-    if (typeof applicationUri !== "string") {
-      throw new Error("Cannot find applicationUri in CSR");
-    }
-    const dns = csrInfo.extensionRequest.subjectAltName.dNSName || [];
-    let ip = csrInfo.extensionRequest.subjectAltName.iPAddress || [];
-    ip = ip.map(octetStringToIpAddress);
-    const sanOverride = { applicationUri, dns, ip };
-    return this.#withCaLock(async () => {
-      await this.#backend.signEndEntityCsr(this, certificate, certificateSigningRequestFilename, params1, sanOverride);
-      displaySubtitle("- construct CA certificate with CRL");
-      await this.constructCACertificateWithCRL();
-      displaySubtitle("- construct certificate chain");
-      await this.constructCertificateChain(certificate);
-      displaySubtitle("- verify certificate against the root CA");
-      await this.verifyCertificate(certificate);
-      return certificate;
-    });
-  }
-  /**
-   * Check that `certificate` really was signed by this CA, and throw if it
-   * was not.
-   *
-   * This used to do nothing: `openssl verify` crashes on Windows, so the
-   * check was left as a placeholder. It no longer needs a subprocess -
-   * `verifyCertificateSignature` does it in pure JS, the same way
-   * {@link CertificateManager} already validates a chain - so the check
-   * that `signCertificateRequest` always claimed to perform now actually
-   * happens on every issuance, whichever backend did the signing.
-   *
-   * Only the leading certificate is examined: the file may be a chain,
-   * and the rest of it is this CA's own certificate and its issuers.
-   *
-   * @param certificate - path to the certificate (or chain) to verify
-   */
-  async verifyCertificate(certificate) {
-    const pem = await fs4.promises.readFile(certificate, "utf-8");
-    const blocks = pem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
-    if (!blocks || blocks.length === 0) {
-      throw new Error(`verifyCertificate: ${certificate} contains no PEM-encoded certificate`);
-    }
-    const caCertificateDer = convertPEMtoDER2(readCertificatePEM2(this.caCertificate));
-    if (!verifyCertificateSignature(convertPEMtoDER2(blocks[0]), caCertificateDer)) {
-      throw new Error(
-        `verifyCertificate: ${certificate} was not signed by this certificate authority (${this.caCertificate})`
-      );
-    }
-  }
-};
-
-export {
-  quote,
-  isOpaqueSigner,
-  resolvePrivateKeyPassphrase,
-  adjustDate,
-  adjustApplicationUri,
-  g_config,
-  doDebug,
-  displayError,
-  debugLog,
-  warningLog,
-  mkdirRecursiveSync,
-  restrictPrivateFilePermissions,
-  ensurePrivateDirectory,
-  isEncryptedPrivateKeyFile,
-  makePath,
-  displayTitle,
-  displaySubtitle,
-  display,
-  CaDatabase,
-  NativeCaBackend,
-  Subject2 as Subject,
-  defaultSubject,
-  configurationFileTemplate,
-  escapeOpensslConfDoubleQuoted,
-  renderCaConfig,
-  CertificateAuthorityCore
-};
-//# sourceMappingURL=chunk-EQ4DGI4M.mjs.map