node-opcua-pki 6.3.0 → 6.5.0

package/dist/bin/pki.mjs

@@ -1,15 +1,3437 @@
 #!/usr/bin/env node
 import {
   __commonJS,
+  __dirname,
+  __esm,
+  __filename,
   init_esm_shims
-} from "../chunk-VXGTT7QM.mjs";
+} from "../chunk-GCHH54PS.mjs";
+
+// packages/node-opcua-pki/lib/misc/applicationurn.ts
+import assert from "assert";
+import { createHash } from "crypto";
+function makeApplicationUrn(hostname, suffix) {
+  let hostnameHash = hostname;
+  if (hostnameHash.length + 7 + suffix.length >= 64) {
+    hostnameHash = createHash("md5").update(hostname).digest("hex").substring(0, 16);
+  }
+  const applicationUrn = `urn:${hostnameHash}:${suffix}`;
+  assert(applicationUrn.length <= 64);
+  return applicationUrn;
+}
+var init_applicationurn = __esm({
+  "packages/node-opcua-pki/lib/misc/applicationurn.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
+// packages/node-opcua-pki/lib/misc/hostname.ts
+import dns from "dns";
+import os from "os";
+import { promisify } from "util";
+function trim(str, length) {
+  if (!length) {
+    return str;
+  }
+  return str.substring(0, Math.min(str.length, length));
+}
+function fqdn(callback) {
+  const uqdn = os.hostname();
+  dns.lookup(uqdn, { hints: dns.ADDRCONFIG }, (err1, ip) => {
+    if (err1) {
+      return callback(err1);
+    }
+    dns.lookupService(ip, 0, (err2, _fqdn) => {
+      if (err2) {
+        return callback(err2);
+      }
+      _fqdn = _fqdn.replace(".localdomain", "");
+      callback(null, _fqdn);
+    });
+  });
+}
+async function extractFullyQualifiedDomainName() {
+  if (_fullyQualifiedDomainNameInCache) {
+    return _fullyQualifiedDomainNameInCache;
+  }
+  if (process.platform === "win32") {
+    const env = process.env;
+    _fullyQualifiedDomainNameInCache = env.COMPUTERNAME + (env.USERDNSDOMAIN && env.USERDNSDOMAIN?.length > 0 ? `.${env.USERDNSDOMAIN}` : "");
+  } else {
+    try {
+      _fullyQualifiedDomainNameInCache = await promisify(fqdn)();
+      if (_fullyQualifiedDomainNameInCache === "localhost") {
+        throw new Error("localhost not expected");
+      }
+      if (/sethostname/.test(_fullyQualifiedDomainNameInCache)) {
+        throw new Error("Detecting fqdn  on windows !!!");
+      }
+    } catch (_err) {
+      _fullyQualifiedDomainNameInCache = os.hostname();
+    }
+  }
+  return _fullyQualifiedDomainNameInCache;
+}
+async function prepareFQDN() {
+  _fullyQualifiedDomainNameInCache = await extractFullyQualifiedDomainName();
+}
+function getFullyQualifiedDomainName(optional_max_length) {
+  if (!_fullyQualifiedDomainNameInCache) {
+    throw new Error("FullyQualifiedDomainName computation is not completed yet");
+  }
+  return _fullyQualifiedDomainNameInCache ? trim(_fullyQualifiedDomainNameInCache, optional_max_length) : "%FQDN%";
+}
+var _fullyQualifiedDomainNameInCache;
+var init_hostname = __esm({
+  "packages/node-opcua-pki/lib/misc/hostname.ts"() {
+    "use strict";
+    init_esm_shims();
+    prepareFQDN();
+  }
+});
+
+// packages/node-opcua-pki/lib/toolbox/config.ts
+var g_config;
+var init_config = __esm({
+  "packages/node-opcua-pki/lib/toolbox/config.ts"() {
+    "use strict";
+    init_esm_shims();
+    g_config = {
+      opensslVersion: "unset",
+      silent: process.env.VERBOSE ? !process.env.VERBOSE : true,
+      force: false
+    };
+  }
+});
+
+// packages/node-opcua-pki/lib/toolbox/debug.ts
+function debugLog(...args) {
+  if (displayDebug) {
+    console.log.apply(null, args);
+  }
+}
+function warningLog(...args) {
+  console.log.apply(null, args);
+}
+var doDebug, displayError, displayDebug;
+var init_debug = __esm({
+  "packages/node-opcua-pki/lib/toolbox/debug.ts"() {
+    "use strict";
+    init_esm_shims();
+    doDebug = process.env.NODEOPCUAPKIDEBUG || false;
+    displayError = true;
+    displayDebug = !!process.env.NODEOPCUAPKIDEBUG || false;
+  }
+});
+
+// packages/node-opcua-pki/lib/toolbox/common2.ts
+import assert2 from "assert";
+import fs from "fs";
+import path from "path";
+import chalk from "chalk";
+function certificateFileExist(certificateFile) {
+  if (fs.existsSync(certificateFile) && !g_config.force) {
+    warningLog(
+      chalk.yellow("        certificate ") + chalk.cyan(certificateFile) + chalk.yellow(" already exists => do not overwrite")
+    );
+    return false;
+  }
+  return true;
+}
+function mkdirRecursiveSync(folder) {
+  if (!fs.existsSync(folder)) {
+    debugLog(chalk.white(" .. constructing "), folder);
+    fs.mkdirSync(folder, { recursive: true });
+  }
+}
+function makePath(folderName, filename) {
+  let s;
+  if (filename) {
+    s = path.join(path.normalize(folderName), filename);
+  } else {
+    assert2(folderName);
+    s = folderName;
+  }
+  s = s.replace(/\\/g, "/");
+  return s;
+}
+var init_common2 = __esm({
+  "packages/node-opcua-pki/lib/toolbox/common2.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_config();
+    init_debug();
+  }
+});
+
+// packages/node-opcua-pki/lib/toolbox/display.ts
+import chalk2 from "chalk";
+function displayChapter(str) {
+  const l = "                                                                                               ";
+  warningLog(`${chalk2.bgWhite(l)} `);
+  str = `        ${str}${l}`.substring(0, l.length);
+  warningLog(chalk2.bgWhite.cyan(str));
+  warningLog(`${chalk2.bgWhite(l)} `);
+}
+function displayTitle(str) {
+  if (!g_config.silent) {
+    warningLog("");
+    warningLog(chalk2.yellowBright(str));
+    warningLog(chalk2.yellow(new Array(str.length + 1).join("=")), "\n");
+  }
+}
+function displaySubtitle(str) {
+  if (!g_config.silent) {
+    warningLog("");
+    warningLog(`    ${chalk2.yellowBright(str)}`);
+    warningLog(`    ${chalk2.white(new Array(str.length + 1).join("-"))}`, "\n");
+  }
+}
+function display(str) {
+  if (!g_config.silent) {
+    warningLog(`       ${str}`);
+  }
+}
+var init_display = __esm({
+  "packages/node-opcua-pki/lib/toolbox/display.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_config();
+    init_debug();
+  }
+});
+
+// packages/node-opcua-pki/lib/toolbox/without_openssl/create_certificate_signing_request.ts
+import assert3 from "assert";
+import fs2 from "fs";
+import { createCertificateSigningRequest, pemToPrivateKey, Subject } from "node-opcua-crypto";
+async function createCertificateSigningRequestAsync(certificateSigningRequestFilename, params) {
+  assert3(params);
+  assert3(params.rootDir);
+  assert3(params.configFile);
+  assert3(params.privateKey);
+  assert3(typeof params.privateKey === "string");
+  assert3(fs2.existsSync(params.privateKey), `Private key must exist${params.privateKey}`);
+  assert3(fs2.existsSync(params.rootDir), "RootDir key must exist");
+  assert3(typeof certificateSigningRequestFilename === "string");
+  const subject = params.subject ? new Subject(params.subject).toString() : void 0;
+  displaySubtitle("- Creating a Certificate Signing Request with subtile");
+  const privateKeyPem = await fs2.promises.readFile(params.privateKey, "utf-8");
+  const privateKey = await pemToPrivateKey(privateKeyPem);
+  const { csr } = await createCertificateSigningRequest({
+    privateKey,
+    dns: params.dns,
+    ip: params.ip,
+    subject,
+    applicationUri: params.applicationUri,
+    purpose: params.purpose
+  });
+  await fs2.promises.writeFile(certificateSigningRequestFilename, csr, "utf-8");
+  display(`- privateKey ${params.privateKey}`);
+  display(`- certificateSigningRequestFilename ${certificateSigningRequestFilename}`);
+}
+var init_create_certificate_signing_request = __esm({
+  "packages/node-opcua-pki/lib/toolbox/without_openssl/create_certificate_signing_request.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_display();
+  }
+});
+
+// packages/node-opcua-pki/lib/toolbox/common.ts
+import assert4 from "assert";
+function quote(str) {
+  return `"${str || ""}"`;
+}
+function adjustDate(params) {
+  assert4(params instanceof Object);
+  params.startDate = params.startDate || /* @__PURE__ */ new Date();
+  assert4(params.startDate instanceof Date);
+  params.validity = params.validity || 365;
+  params.endDate = new Date(params.startDate.getTime());
+  params.endDate.setDate(params.startDate.getDate() + params.validity);
+  assert4(params.endDate instanceof Date);
+  assert4(params.startDate instanceof Date);
+}
+function adjustApplicationUri(params) {
+  const applicationUri = params.applicationUri || "";
+  if (applicationUri.length > 200) {
+    throw new Error(`Openssl doesn't support urn with length greater than 200${applicationUri}`);
+  }
+}
+var init_common = __esm({
+  "packages/node-opcua-pki/lib/toolbox/common.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
+// packages/node-opcua-pki/lib/toolbox/without_openssl/create_self_signed_certificate.ts
+import assert5 from "assert";
+import fs3 from "fs";
+import {
+  CertificatePurpose,
+  createSelfSignedCertificate as createSelfSignedCertificate1,
+  pemToPrivateKey as pemToPrivateKey2,
+  Subject as Subject2
+} from "node-opcua-crypto";
+async function createSelfSignedCertificateAsync(certificate, params) {
+  params.purpose = params.purpose || CertificatePurpose.ForApplication;
+  assert5(params.purpose, "Please provide a Certificate Purpose");
+  assert5(fs3.existsSync(params.configFile));
+  assert5(fs3.existsSync(params.rootDir));
+  assert5(fs3.existsSync(params.privateKey));
+  if (!params.subject) {
+    throw Error("Missing subject");
+  }
+  assert5(typeof params.applicationUri === "string");
+  assert5(Array.isArray(params.dns));
+  adjustDate(params);
+  assert5(Object.prototype.hasOwnProperty.call(params, "validity"));
+  let subject = new Subject2(params.subject);
+  subject = subject.toString();
+  const purpose = params.purpose;
+  displayTitle("Generate a certificate request");
+  const privateKeyPem = await fs3.promises.readFile(params.privateKey, "utf-8");
+  const privateKey = await pemToPrivateKey2(privateKeyPem);
+  const { cert } = await createSelfSignedCertificate1({
+    privateKey,
+    notBefore: params.startDate,
+    notAfter: params.endDate,
+    validity: params.validity,
+    dns: params.dns,
+    ip: params.ip,
+    subject,
+    applicationUri: params.applicationUri,
+    purpose
+  });
+  await fs3.promises.writeFile(certificate, cert, "utf-8");
+}
+async function createSelfSignedCertificate(certificate, params) {
+  await createSelfSignedCertificateAsync(certificate, params);
+}
+var init_create_self_signed_certificate = __esm({
+  "packages/node-opcua-pki/lib/toolbox/without_openssl/create_self_signed_certificate.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_common();
+    init_display();
+  }
+});
+
+// packages/node-opcua-pki/lib/toolbox/without_openssl/index.ts
+var init_without_openssl = __esm({
+  "packages/node-opcua-pki/lib/toolbox/without_openssl/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_create_certificate_signing_request();
+    init_create_self_signed_certificate();
+  }
+});
+
+// packages/node-opcua-pki/lib/pki/templates/simple_config_template.cnf.ts
+var config, simple_config_template_cnf_default;
+var init_simple_config_template_cnf = __esm({
+  "packages/node-opcua-pki/lib/pki/templates/simple_config_template.cnf.ts"() {
+    "use strict";
+    init_esm_shims();
+    config = '##################################################################################################\n## SIMPLE OPENSSL CONFIG FILE FOR SELF-SIGNED CERTIFICATE GENERATION\n################################################################################################################\n\ndistinguished_name       = req_distinguished_name\ndefault_md               = sha1\n\ndefault_md                = sha256                      # The default digest algorithm\n\n[ v3_ca ]\nsubjectKeyIdentifier        = hash\nauthorityKeyIdentifier      = keyid:always,issuer:always\n\n# authorityKeyIdentifier    = keyid\nbasicConstraints            = CA:TRUE\nkeyUsage                    = critical, cRLSign, keyCertSign\nnsComment                   = "Self-signed Certificate for CA generated by Node-OPCUA Certificate utility"\n#nsCertType                 = sslCA, emailCA\n#subjectAltName             = email:copy\n#issuerAltName              = issuer:copy\n#obj                        = DER:02:03\n# crlDistributionPoints       = @crl_info\n# [ crl_info ]\n# URI.0                     = http://localhost:8900/crl.pem\nsubjectAltName              = $ENV::ALTNAME\n\n[ req ]\ndays                      = 390\nreq_extensions            = v3_req\nx509_extensions           = v3_ca\n\n[v3_req]\nbasicConstraints       = CA:false\nkeyUsage               = critical, cRLSign, keyCertSign\nsubjectAltName         = $ENV::ALTNAME\n\n[ v3_ca_signed]\nsubjectKeyIdentifier      = hash\nauthorityKeyIdentifier    = keyid,issuer\nbasicConstraints          = critical, CA:FALSE\nkeyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign\nextendedKeyUsage          = clientAuth,serverAuth \nnsComment                 = "certificate generated by Node-OPCUA Certificate utility and signed by a CA"\nsubjectAltName            = $ENV::ALTNAME\n[ v3_selfsigned]\nsubjectKeyIdentifier      = hash\nauthorityKeyIdentifier    = keyid,issuer\nbasicConstraints          = critical, CA:FALSE\nkeyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign\nextendedKeyUsage          = clientAuth,serverAuth \nnsComment                 = "Self-signed certificate generated by Node-OPCUA Certificate utility"\nsubjectAltName            = $ENV::ALTNAME\n[ req_distinguished_name ]\ncountryName             = Country Name (2 letter code)\ncountryName_default     = FR\ncountryName_min         = 2\ncountryName_max         = 2\n# stateOrProvinceName     = State or Province Name (full name)\n# stateOrProvinceName_default = Ile de France\n# localityName            = Locality Name (city, district)\n# localityName_default    = Paris\norganizationName          = Organization Name (company)\norganizationName_default  = NodeOPCUA\n# organizationalUnitName  = Organizational Unit Name (department, division)\n# organizationalUnitName_default = R&D\ncommonName                = Common Name (hostname, FQDN, IP, or your name)\ncommonName_max            = 256\ncommonName_default        = NodeOPCUA\n# emailAddress            = Email Address\n# emailAddress_max        = 40\n# emailAddress_default    = node-opcua (at) node-opcua (dot) com\nsubjectAltName            = $ENV::ALTNAME';
+    simple_config_template_cnf_default = config;
+  }
+});
+
+// packages/node-opcua-pki/lib/pki/certificate_manager.ts
+import fs4 from "fs";
+import path2 from "path";
+import { withLock } from "@ster5/global-mutex";
+import chalk3 from "chalk";
+import chokidar from "chokidar";
+import {
+  exploreCertificate,
+  exploreCertificateInfo,
+  exploreCertificateRevocationList,
+  generatePrivateKeyFile,
+  makeSHA1Thumbprint,
+  readCertificate,
+  readCertificateRevocationList,
+  split_der,
+  toPem,
+  verifyCertificateChain,
+  verifyCertificateSignature
+} from "node-opcua-crypto";
+function getOrComputeInfo(entry) {
+  if (!entry.info) {
+    entry.info = exploreCertificate(entry.certificate);
+  }
+  return entry.info;
+}
+function makeFingerprint(certificate) {
+  const chain = split_der(certificate);
+  return makeSHA1Thumbprint(chain[0]).toString("hex");
+}
+function short(stringToShorten) {
+  return stringToShorten.substring(0, 10);
+}
+function buildIdealCertificateName(certificate) {
+  const fingerprint2 = makeFingerprint(certificate);
+  try {
+    const commonName = exploreCertificate(certificate).tbsCertificate.subject.commonName || "";
+    const sanitizedCommonName = commonName.replace(forbiddenChars, "_");
+    return `${sanitizedCommonName}[${fingerprint2}]`;
+  } catch (_err) {
+    return `invalid_certificate_[${fingerprint2}]`;
+  }
+}
+function findMatchingIssuerKey(entries, wantedIssuerKey) {
+  return entries.filter((entry) => {
+    const info = getOrComputeInfo(entry);
+    return info.tbsCertificate.extensions && info.tbsCertificate.extensions.subjectKeyIdentifier === wantedIssuerKey;
+  });
+}
+function isSelfSigned2(info) {
+  return info.tbsCertificate.extensions?.subjectKeyIdentifier === info.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier;
+}
+function isSelfSigned3(certificate) {
+  const info = exploreCertificate(certificate);
+  return isSelfSigned2(info);
+}
+function findIssuerCertificateInChain(certificate, chain) {
+  if (!certificate) {
+    return null;
+  }
+  const certInfo = exploreCertificate(certificate);
+  if (isSelfSigned2(certInfo)) {
+    return certificate;
+  }
+  const wantedIssuerKey = certInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier;
+  if (!wantedIssuerKey) {
+    debugLog("Certificate has no extension 3");
+    return null;
+  }
+  const potentialIssuers = chain.filter((c) => {
+    const info = exploreCertificate(c);
+    return info.tbsCertificate.extensions && info.tbsCertificate.extensions.subjectKeyIdentifier === wantedIssuerKey;
+  });
+  if (potentialIssuers.length === 1) {
+    return potentialIssuers[0];
+  }
+  if (potentialIssuers.length > 1) {
+    debugLog("findIssuerCertificateInChain: certificate is not self-signed but has several issuers");
+    return potentialIssuers[0];
+  }
+  return null;
+}
+var configurationFileSimpleTemplate, fsWriteFile, forbiddenChars, CertificateManager;
+var init_certificate_manager = __esm({
+  "packages/node-opcua-pki/lib/pki/certificate_manager.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_common2();
+    init_debug();
+    init_without_openssl();
+    init_simple_config_template_cnf();
+    configurationFileSimpleTemplate = simple_config_template_cnf_default;
+    fsWriteFile = fs4.promises.writeFile;
+    forbiddenChars = /[\x00-\x1F<>:"/\\|?*]/g;
+    CertificateManager = class _CertificateManager {
+      // ── Global instance registry ─────────────────────────────────
+      // Tracks all initialized CertificateManager instances so their
+      // file watchers can be closed automatically on process exit,
+      // even if the consumer forgets to call dispose().
+      static #activeInstances = /* @__PURE__ */ new Set();
+      static #cleanupInstalled = false;
+      static #installProcessCleanup() {
+        if (_CertificateManager.#cleanupInstalled) return;
+        _CertificateManager.#cleanupInstalled = true;
+        const closeDanglingWatchers = () => {
+          for (const cm of _CertificateManager.#activeInstances) {
+            for (const w of cm.#watchers) {
+              try {
+                w.close();
+              } catch {
+              }
+            }
+            cm.#watchers.splice(0);
+            cm.state = 4 /* Disposed */;
+          }
+          _CertificateManager.#activeInstances.clear();
+        };
+        process.on("beforeExit", closeDanglingWatchers);
+        for (const signal of ["SIGINT", "SIGTERM"]) {
+          process.once(signal, () => {
+            closeDanglingWatchers();
+            process.exit();
+          });
+        }
+      }
+      /**
+       * Dispose **all** active CertificateManager instances,
+       * closing their file watchers and freeing resources.
+       *
+       * This is mainly useful in test tear-down to ensure the
+       * Node.js process can exit cleanly.
+       */
+      static async disposeAll() {
+        const instances = [..._CertificateManager.#activeInstances];
+        await Promise.all(instances.map((cm) => cm.dispose()));
+      }
+      /**
+       * Assert that all CertificateManager instances have been
+       * properly disposed. Throws an Error listing the locations
+       * of any leaked instances.
+       *
+       * Intended for use in test `afterAll()` / `afterEach()`
+       * hooks to catch missing `dispose()` calls early.
+       *
+       * @example
+       * ```ts
+       * after(() => {
+       *     CertificateManager.checkAllDisposed();
+       * });
+       * ```
+       */
+      static checkAllDisposed() {
+        if (_CertificateManager.#activeInstances.size === 0) return;
+        const locations = [..._CertificateManager.#activeInstances].map((cm) => cm.rootDir);
+        throw new Error(
+          `${_CertificateManager.#activeInstances.size} CertificateManager instance(s) not disposed:
+  - ${locations.join("\n  - ")}`
+        );
+      }
+      // ─────────────────────────────────────────────────────────────
+      /**
+       * When `true` (the default), any certificate that is not
+       * already in the trusted or rejected store is automatically
+       * written to the rejected folder the first time it is seen.
+       */
+      untrustUnknownCertificate = true;
+      /** Current lifecycle state of this instance. */
+      state = 0 /* Uninitialized */;
+      /** @deprecated Use {@link folderPollingInterval} instead (typo fix). */
+      folderPoolingInterval = 5e3;
+      /** Interval in milliseconds for file-system polling (when enabled). */
+      get folderPollingInterval() {
+        return this.folderPoolingInterval;
+      }
+      set folderPollingInterval(value) {
+        this.folderPoolingInterval = value;
+      }
+      /** RSA key size used when generating the private key. */
+      keySize;
+      #location;
+      #watchers = [];
+      #readCertificatesCalled = false;
+      #filenameToHash = /* @__PURE__ */ new Map();
+      #initializingPromise;
+      #thumbs = {
+        rejected: /* @__PURE__ */ new Map(),
+        trusted: /* @__PURE__ */ new Map(),
+        issuers: {
+          certs: /* @__PURE__ */ new Map()
+        },
+        crl: /* @__PURE__ */ new Map(),
+        issuersCrl: /* @__PURE__ */ new Map()
+      };
+      /**
+       * Create a new CertificateManager.
+       *
+       * The constructor creates the root directory if it does not
+       * exist but does **not** initialise the PKI store — call
+       * {@link initialize} before using any other method.
+       *
+       * @param options - configuration options
+       */
+      constructor(options) {
+        options.keySize = options.keySize || 2048;
+        if (!options.location) {
+          throw new Error("CertificateManager: missing 'location' option");
+        }
+        this.#location = makePath(options.location, "");
+        this.keySize = options.keySize;
+        mkdirRecursiveSync(options.location);
+        if (!fs4.existsSync(this.#location)) {
+          throw new Error(`CertificateManager cannot access location ${this.#location}`);
+        }
+      }
+      /** Path to the OpenSSL configuration file. */
+      get configFile() {
+        return path2.join(this.rootDir, "own/openssl.cnf");
+      }
+      /** Root directory of the PKI store. */
+      get rootDir() {
+        return this.#location;
+      }
+      /** Path to the private key file (`own/private/private_key.pem`). */
+      get privateKey() {
+        return path2.join(this.rootDir, "own/private/private_key.pem");
+      }
+      /** Path to the OpenSSL random seed file. */
+      get randomFile() {
+        return path2.join(this.rootDir, "./random.rnd");
+      }
+      /**
+       * Move a certificate to the rejected store.
+       * If the certificate was previously trusted, it will be removed from the trusted folder.
+       * @param certificate - the DER-encoded certificate
+       */
+      async rejectCertificate(certificate) {
+        await this.#moveCertificate(certificate, "rejected");
+      }
+      /**
+       * Move a certificate to the trusted store.
+       * If the certificate was previously rejected, it will be removed from the rejected folder.
+       * @param certificate - the DER-encoded certificate
+       */
+      async trustCertificate(certificate) {
+        await this.#moveCertificate(certificate, "trusted");
+      }
+      /** Path to the rejected certificates folder. */
+      get rejectedFolder() {
+        return path2.join(this.rootDir, "rejected");
+      }
+      /** Path to the trusted certificates folder. */
+      get trustedFolder() {
+        return path2.join(this.rootDir, "trusted/certs");
+      }
+      /** Path to the trusted CRL folder. */
+      get crlFolder() {
+        return path2.join(this.rootDir, "trusted/crl");
+      }
+      /** Path to the issuer (CA) certificates folder. */
+      get issuersCertFolder() {
+        return path2.join(this.rootDir, "issuers/certs");
+      }
+      /** Path to the issuer CRL folder. */
+      get issuersCrlFolder() {
+        return path2.join(this.rootDir, "issuers/crl");
+      }
+      /** Path to the own certificate folder. */
+      get ownCertFolder() {
+        return path2.join(this.rootDir, "own/certs");
+      }
+      get ownPrivateFolder() {
+        return path2.join(this.rootDir, "own/private");
+      }
+      /**
+       * Check if a certificate is in the trusted store.
+       * If the certificate is unknown and `untrustUnknownCertificate` is set,
+       * it will be written to the rejected folder.
+       * @param certificate - the DER-encoded certificate
+       * @returns `"Good"` if trusted, `"BadCertificateUntrusted"` if rejected/unknown,
+       *   or `"BadCertificateInvalid"` if the certificate cannot be parsed.
+       */
+      async isCertificateTrusted(certificate) {
+        const fingerprint2 = makeFingerprint(certificate);
+        if (this.#thumbs.trusted.has(fingerprint2)) {
+          return "Good";
+        }
+        if (!this.#thumbs.rejected.has(fingerprint2)) {
+          if (!this.untrustUnknownCertificate) {
+            return "Good";
+          }
+          try {
+            exploreCertificateInfo(certificate);
+          } catch (_err) {
+            return "BadCertificateInvalid";
+          }
+          const filename = path2.join(this.rejectedFolder, `${buildIdealCertificateName(certificate)}.pem`);
+          debugLog("certificate has never been seen before and is now rejected (untrusted) ", filename);
+          await fsWriteFile(filename, toPem(certificate, "CERTIFICATE"));
+          this.#thumbs.rejected.set(fingerprint2, { certificate, filename });
+        }
+        return "BadCertificateUntrusted";
+      }
+      async #innerVerifyCertificateAsync(certificate, _isIssuer, level, options) {
+        if (level >= 5) {
+          return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
+        }
+        const chain = split_der(certificate);
+        debugLog("NB CERTIFICATE IN CHAIN = ", chain.length);
+        const info = exploreCertificate(chain[0]);
+        let hasValidIssuer = false;
+        let hasTrustedIssuer = false;
+        const hasIssuerKey = info.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier;
+        debugLog("Certificate as an Issuer Key", hasIssuerKey);
+        if (hasIssuerKey) {
+          const isSelfSigned = isSelfSigned2(info);
+          debugLog("Is the Certificate self-signed  ?", isSelfSigned);
+          if (!isSelfSigned) {
+            debugLog(
+              "Is issuer found in the list of know issuers ?",
+              "\n subjectKeyIdentifier   = ",
+              info.tbsCertificate.extensions?.subjectKeyIdentifier,
+              "\n authorityKeyIdentifier = ",
+              info.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier
+            );
+            let issuerCertificate = await this.findIssuerCertificate(chain[0]);
+            if (!issuerCertificate) {
+              issuerCertificate = findIssuerCertificateInChain(chain[0], chain);
+              if (!issuerCertificate) {
+                debugLog(
+                  " the issuer has not been found in the chain itself nor in the issuer.cert list => the chain is incomplete!"
+                );
+                return "BadCertificateChainIncomplete" /* BadCertificateChainIncomplete */;
+              }
+              debugLog(" the issuer certificate has been found in the chain itself ! the chain is complete !");
+            } else {
+              debugLog(" the issuer certificate has been found in the issuer.cert folder !");
+            }
+            const issuerStatus = await this.#innerVerifyCertificateAsync(issuerCertificate, true, level + 1, options);
+            if (issuerStatus === "BadCertificateRevocationUnknown" /* BadCertificateRevocationUnknown */) {
+              return "BadCertificateIssuerRevocationUnknown" /* BadCertificateIssuerRevocationUnknown */;
+            }
+            if (issuerStatus === "BadCertificateIssuerRevocationUnknown" /* BadCertificateIssuerRevocationUnknown */) {
+              return "BadCertificateIssuerRevocationUnknown" /* BadCertificateIssuerRevocationUnknown */;
+            }
+            if (issuerStatus === "BadCertificateTimeInvalid" /* BadCertificateTimeInvalid */) {
+              if (!options || !options.acceptOutDatedIssuerCertificate) {
+                return "BadCertificateIssuerTimeInvalid" /* BadCertificateIssuerTimeInvalid */;
+              }
+            }
+            if (issuerStatus === "BadCertificateUntrusted" /* BadCertificateUntrusted */) {
+              debugLog("warning issuerStatus = ", issuerStatus.toString(), "the issuer certificate is not trusted");
+            }
+            if (issuerStatus !== "Good" /* Good */ && issuerStatus !== "BadCertificateUntrusted" /* BadCertificateUntrusted */) {
+              return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
+            }
+            const isCertificateSignatureOK = verifyCertificateSignature(certificate, issuerCertificate);
+            if (!isCertificateSignatureOK) {
+              debugLog(" the certificate was not signed by the issuer as it claim to be ! Danger");
+              return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
+            }
+            hasValidIssuer = true;
+            let revokedStatus = await this.isCertificateRevoked(certificate);
+            if (revokedStatus === "BadCertificateRevocationUnknown" /* BadCertificateRevocationUnknown */) {
+              if (options?.ignoreMissingRevocationList) {
+                revokedStatus = "Good" /* Good */;
+              }
+            }
+            if (revokedStatus !== "Good" /* Good */) {
+              debugLog("revokedStatus", revokedStatus);
+              return revokedStatus;
+            }
+            const issuerTrustedStatus = await this.#checkRejectedOrTrusted(issuerCertificate);
+            debugLog("issuerTrustedStatus", issuerTrustedStatus);
+            if (issuerTrustedStatus === "unknown") {
+              hasTrustedIssuer = false;
+            } else if (issuerTrustedStatus === "trusted") {
+              hasTrustedIssuer = true;
+            } else if (issuerTrustedStatus === "rejected") {
+              return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
+            }
+          } else {
+            const isCertificateSignatureOK = verifyCertificateSignature(certificate, certificate);
+            if (!isCertificateSignatureOK) {
+              debugLog("Self-signed Certificate signature is not valid");
+              return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
+            }
+            const revokedStatus = await this.isCertificateRevoked(certificate);
+            debugLog("revokedStatus of self signed certificate:", revokedStatus);
+          }
+        }
+        const status = await this.#checkRejectedOrTrusted(certificate);
+        if (status === "rejected") {
+          if (!(options.acceptCertificateWithValidIssuerChain && hasValidIssuer && hasTrustedIssuer)) {
+            return "BadCertificateUntrusted" /* BadCertificateUntrusted */;
+          }
+        }
+        const _c2 = chain[1] ? exploreCertificateInfo(chain[1]) : "non";
+        debugLog("chain[1] info=", _c2);
+        const certificateInfo = exploreCertificateInfo(certificate);
+        const now = /* @__PURE__ */ new Date();
+        let isTimeInvalid = false;
+        if (certificateInfo.notBefore.getTime() > now.getTime()) {
+          debugLog(
+            chalk3.red("certificate is invalid : certificate is not active yet !") + "  not before date =" + certificateInfo.notBefore
+          );
+          if (!options.acceptPendingCertificate) {
+            isTimeInvalid = true;
+          }
+        }
+        if (certificateInfo.notAfter.getTime() <= now.getTime()) {
+          debugLog(
+            `${chalk3.red("certificate is invalid : certificate has expired !")} not after date =${certificateInfo.notAfter}`
+          );
+          if (!options.acceptOutdatedCertificate) {
+            isTimeInvalid = true;
+          }
+        }
+        if (status === "trusted") {
+          return isTimeInvalid ? "BadCertificateTimeInvalid" /* BadCertificateTimeInvalid */ : "Good" /* Good */;
+        }
+        if (hasIssuerKey) {
+          if (!hasTrustedIssuer) {
+            return "BadCertificateUntrusted" /* BadCertificateUntrusted */;
+          }
+          if (!hasValidIssuer) {
+            return "BadCertificateUntrusted" /* BadCertificateUntrusted */;
+          }
+          if (!options.acceptCertificateWithValidIssuerChain) {
+            return "BadCertificateUntrusted" /* BadCertificateUntrusted */;
+          }
+          return isTimeInvalid ? "BadCertificateTimeInvalid" /* BadCertificateTimeInvalid */ : "Good" /* Good */;
+        } else {
+          return "BadCertificateUntrusted" /* BadCertificateUntrusted */;
+        }
+      }
+      /**
+       * Internal verification hook called by {@link verifyCertificate}.
+       *
+       * Subclasses can override this to inject additional validation
+       * logic (e.g. application-level policy checks) while still
+       * delegating to the default chain/CRL/trust verification.
+       *
+       * @param certificate - the DER-encoded certificate to verify
+       * @param options - verification options forwarded from the
+       *   public API
+       * @returns the verification status code
+       */
+      async verifyCertificateAsync(certificate, options) {
+        const status1 = await this.#innerVerifyCertificateAsync(certificate, false, 0, options);
+        return status1;
+      }
+      /**
+       * Verify a certificate against the PKI trust store.
+       *
+       * This performs a full validation including trust status,
+       * issuer chain, CRL revocation checks, and time validity.
+       *
+       * @param certificate - the DER-encoded certificate to verify
+       * @param options - optional flags to relax validation rules
+       * @returns the verification status code
+       */
+      async verifyCertificate(certificate, options) {
+        if (!certificate) {
+          return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
+        }
+        try {
+          const status = await this.verifyCertificateAsync(certificate, options || {});
+          return status;
+        } catch (error) {
+          warningLog(`verifyCertificate error: ${error.message}`);
+          return "BadCertificateInvalid" /* BadCertificateInvalid */;
+        }
+      }
+      /**
+       * Initialize the PKI directory structure, generate the
+       * private key (if missing), and start file-system watchers.
+       *
+       * This method is idempotent — subsequent calls are no-ops.
+       * It must be called before any certificate operations.
+       */
+      async initialize() {
+        if (this.state !== 0 /* Uninitialized */) {
+          return;
+        }
+        this.state = 1 /* Initializing */;
+        this.#initializingPromise = this.#initialize();
+        await this.#initializingPromise;
+        this.#initializingPromise = void 0;
+        this.state = 2 /* Initialized */;
+        _CertificateManager.#activeInstances.add(this);
+        _CertificateManager.#installProcessCleanup();
+      }
+      async #initialize() {
+        this.state = 1 /* Initializing */;
+        const pkiDir = this.#location;
+        mkdirRecursiveSync(pkiDir);
+        mkdirRecursiveSync(path2.join(pkiDir, "own"));
+        mkdirRecursiveSync(path2.join(pkiDir, "own/certs"));
+        mkdirRecursiveSync(path2.join(pkiDir, "own/private"));
+        mkdirRecursiveSync(path2.join(pkiDir, "rejected"));
+        mkdirRecursiveSync(path2.join(pkiDir, "trusted"));
+        mkdirRecursiveSync(path2.join(pkiDir, "trusted/certs"));
+        mkdirRecursiveSync(path2.join(pkiDir, "trusted/crl"));
+        mkdirRecursiveSync(path2.join(pkiDir, "issuers"));
+        mkdirRecursiveSync(path2.join(pkiDir, "issuers/certs"));
+        mkdirRecursiveSync(path2.join(pkiDir, "issuers/crl"));
+        if (!fs4.existsSync(this.configFile) || !fs4.existsSync(this.privateKey)) {
+          return await this.withLock2(async () => {
+            if (this.state === 3 /* Disposing */ || this.state === 4 /* Disposed */) {
+              return;
+            }
+            if (!fs4.existsSync(this.configFile)) {
+              fs4.writeFileSync(this.configFile, configurationFileSimpleTemplate);
+            }
+            if (!fs4.existsSync(this.privateKey)) {
+              debugLog("generating private key ...");
+              await generatePrivateKeyFile(this.privateKey, this.keySize);
+              await this.#readCertificates();
+            } else {
+              await this.#readCertificates();
+            }
+          });
+        } else {
+          await this.#readCertificates();
+        }
+      }
+      /**
+       * Dispose of the CertificateManager, releasing file watchers
+       * and other resources. The instance should not be used after
+       * calling this method.
+       */
+      async dispose() {
+        if (this.state === 3 /* Disposing */) {
+          throw new Error("Already disposing");
+        }
+        if (this.state === 0 /* Uninitialized */) {
+          this.state = 4 /* Disposed */;
+          return;
+        }
+        if (this.state === 1 /* Initializing */) {
+          if (this.#initializingPromise) {
+            await this.#initializingPromise;
+          }
+        }
+        try {
+          this.state = 3 /* Disposing */;
+          await Promise.all(this.#watchers.map((w) => w.close()));
+          this.#watchers.forEach((w) => {
+            w.removeAllListeners();
+          });
+          this.#watchers.splice(0);
+        } finally {
+          this.state = 4 /* Disposed */;
+          _CertificateManager.#activeInstances.delete(this);
+        }
+      }
+      /**
+       * Force a full re-scan of all PKI folders, rebuilding
+       * the in-memory `_thumbs` index from scratch.
+       *
+       * Call this after external processes have modified the
+       * PKI folders (e.g. via `writeTrustList` or CLI tools)
+       * to ensure the CertificateManager sees the latest
+       * state without waiting for file-system events.
+       */
+      async reloadCertificates() {
+        await Promise.all(this.#watchers.map((w) => w.close()));
+        for (const w of this.#watchers) {
+          w.removeAllListeners();
+        }
+        this.#watchers.splice(0);
+        this.#thumbs.rejected.clear();
+        this.#thumbs.trusted.clear();
+        this.#thumbs.issuers.certs.clear();
+        this.#thumbs.crl.clear();
+        this.#thumbs.issuersCrl.clear();
+        this.#filenameToHash.clear();
+        this.#readCertificatesCalled = false;
+        await this.#readCertificates();
+      }
+      async withLock2(action) {
+        const lockFileName = path2.join(this.rootDir, "mutex.lock");
+        return withLock({ fileToLock: lockFileName }, async () => {
+          return await action();
+        });
+      }
+      /**
+       * Create a self-signed certificate for this PKI's private key.
+       *
+       * The certificate is written to `params.outputFile` or
+       * `own/certs/self_signed_certificate.pem` by default.
+       *
+       * @param params - certificate parameters (subject, SANs,
+       *   validity, etc.)
+       */
+      async createSelfSignedCertificate(params) {
+        if (typeof params.applicationUri !== "string") {
+          throw new Error("createSelfSignedCertificate: expecting applicationUri to be a string");
+        }
+        if (!fs4.existsSync(this.privateKey)) {
+          throw new Error(`Cannot find private key ${this.privateKey}`);
+        }
+        let certificateFilename = path2.join(this.rootDir, "own/certs/self_signed_certificate.pem");
+        certificateFilename = params.outputFile || certificateFilename;
+        const _params = params;
+        _params.rootDir = this.rootDir;
+        _params.configFile = this.configFile;
+        _params.privateKey = this.privateKey;
+        _params.subject = params.subject || "CN=FIXME";
+        await this.withLock2(async () => {
+          await createSelfSignedCertificate(certificateFilename, _params);
+        });
+      }
+      /**
+       * Create a Certificate Signing Request (CSR) using this
+       * PKI's private key and configuration.
+       *
+       * The CSR file is written to `own/certs/` with a timestamped
+       * filename.
+       *
+       * @param params - CSR parameters (subject, SANs)
+       * @returns the filesystem path to the generated CSR file
+       */
+      async createCertificateRequest(params) {
+        if (!params) {
+          throw new Error("params is required");
+        }
+        const _params = params;
+        if (Object.prototype.hasOwnProperty.call(_params, "rootDir")) {
+          throw new Error("rootDir should not be specified ");
+        }
+        _params.rootDir = path2.resolve(this.rootDir);
+        _params.configFile = path2.resolve(this.configFile);
+        _params.privateKey = path2.resolve(this.privateKey);
+        return await this.withLock2(async () => {
+          const now = /* @__PURE__ */ new Date();
+          const today2 = `${now.toISOString().slice(0, 10)}_${now.getTime()}`;
+          const certificateSigningRequestFilename = path2.join(this.rootDir, "own/certs", `certificate_${today2}.csr`);
+          await createCertificateSigningRequestAsync(certificateSigningRequestFilename, _params);
+          return certificateSigningRequestFilename;
+        });
+      }
+      /**
+       * Add a CA (issuer) certificate to the issuers store.
+       * If the certificate is already present, this is a no-op.
+       * @param certificate - the DER-encoded CA certificate
+       * @param validate - if `true`, verify the certificate before adding
+       * @param addInTrustList - if `true`, also add to the trusted store
+       * @returns `VerificationStatus.Good` on success
+       */
+      async addIssuer(certificate, validate = false, addInTrustList = false) {
+        if (validate) {
+          const status = await this.verifyCertificate(certificate);
+          if (status !== "Good" /* Good */ && status !== "BadCertificateUntrusted" /* BadCertificateUntrusted */) {
+            return status;
+          }
+        }
+        const pemCertificate = toPem(certificate, "CERTIFICATE");
+        const fingerprint2 = makeFingerprint(certificate);
+        if (this.#thumbs.issuers.certs.has(fingerprint2)) {
+          return "Good" /* Good */;
+        }
+        const filename = path2.join(this.issuersCertFolder, `issuer_${buildIdealCertificateName(certificate)}.pem`);
+        await fs4.promises.writeFile(filename, pemCertificate, "ascii");
+        this.#thumbs.issuers.certs.set(fingerprint2, { certificate, filename });
+        if (addInTrustList) {
+          await this.trustCertificate(certificate);
+        }
+        return "Good" /* Good */;
+      }
+      /**
+       * Add a CRL to the certificate manager.
+       * @param crl - the CRL to add
+       * @param target - "issuers" (default) writes to issuers/crl, "trusted" writes to trusted/crl
+       */
+      async addRevocationList(crl, target = "issuers") {
+        return await this.withLock2(async () => {
+          try {
+            const index = target === "trusted" ? this.#thumbs.crl : this.#thumbs.issuersCrl;
+            const folder = target === "trusted" ? this.crlFolder : this.issuersCrlFolder;
+            const crlInfo = exploreCertificateRevocationList(crl);
+            const key = crlInfo.tbsCertList.issuerFingerprint;
+            if (!index.has(key)) {
+              index.set(key, { crls: [], serialNumbers: {} });
+            }
+            const pemCertificate = toPem(crl, "X509 CRL");
+            const filename = path2.join(folder, `crl_${buildIdealCertificateName(crl)}.pem`);
+            await fs4.promises.writeFile(filename, pemCertificate, "ascii");
+            await this.#onCrlFileAdded(index, filename);
+            await this.#waitAndCheckCRLProcessingStatus();
+            return "Good" /* Good */;
+          } catch (err) {
+            debugLog(err);
+            return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
+          }
+        });
+      }
+      /**
+       * Remove all CRL files from the specified folder(s) and clear the
+       * corresponding in-memory index.
+       * @param target - "issuers" clears issuers/crl, "trusted" clears
+       *   trusted/crl, "all" clears both.
+       */
+      async clearRevocationLists(target) {
+        const clearFolder = async (folder, index) => {
+          try {
+            const files = await fs4.promises.readdir(folder);
+            for (const file of files) {
+              const ext = path2.extname(file).toLowerCase();
+              if (ext === ".crl" || ext === ".pem" || ext === ".der") {
+                await fs4.promises.unlink(path2.join(folder, file));
+              }
+            }
+          } catch (err) {
+            if (err.code !== "ENOENT") {
+              throw err;
+            }
+          }
+          index.clear();
+        };
+        if (target === "issuers" || target === "all") {
+          await clearFolder(this.issuersCrlFolder, this.#thumbs.issuersCrl);
+        }
+        if (target === "trusted" || target === "all") {
+          await clearFolder(this.crlFolder, this.#thumbs.crl);
+        }
+      }
+      /**
+       * Check whether an issuer certificate with the given thumbprint
+       * is already registered.
+       * @param thumbprint - hex-encoded SHA-1 thumbprint (lowercase)
+       */
+      async hasIssuer(thumbprint) {
+        await this.#readCertificates();
+        const normalized = thumbprint.toLowerCase();
+        return this.#thumbs.issuers.certs.has(normalized);
+      }
+      /**
+       * Remove a trusted certificate identified by its SHA-1 thumbprint.
+       * Deletes the file on disk and removes the entry from the
+       * in-memory index.
+       * @param thumbprint - hex-encoded SHA-1 thumbprint (lowercase)
+       * @returns the removed certificate buffer, or `null` if not found
+       */
+      async removeTrustedCertificate(thumbprint) {
+        await this.#readCertificates();
+        const normalized = thumbprint.toLowerCase();
+        const entry = this.#thumbs.trusted.get(normalized);
+        if (!entry) {
+          return null;
+        }
+        try {
+          await fs4.promises.unlink(entry.filename);
+        } catch (err) {
+          if (err.code !== "ENOENT") {
+            throw err;
+          }
+        }
+        this.#thumbs.trusted.delete(normalized);
+        return entry.certificate;
+      }
+      /**
+       * Remove an issuer certificate identified by its SHA-1 thumbprint.
+       * Deletes the file on disk and removes the entry from the
+       * in-memory index.
+       * @param thumbprint - hex-encoded SHA-1 thumbprint (lowercase)
+       * @returns the removed certificate buffer, or `null` if not found
+       */
+      async removeIssuer(thumbprint) {
+        await this.#readCertificates();
+        const normalized = thumbprint.toLowerCase();
+        const entry = this.#thumbs.issuers.certs.get(normalized);
+        if (!entry) {
+          return null;
+        }
+        try {
+          await fs4.promises.unlink(entry.filename);
+        } catch (err) {
+          if (err.code !== "ENOENT") {
+            throw err;
+          }
+        }
+        this.#thumbs.issuers.certs.delete(normalized);
+        return entry.certificate;
+      }
+      /**
+       * Remove all CRL files that were issued by the given CA certificate
+       * from the specified folder (or both).
+       * @param issuerCertificate - the CA certificate whose CRLs to remove
+       * @param target - "issuers", "trusted", or "all" (default "all")
+       */
+      async removeRevocationListsForIssuer(issuerCertificate, target = "all") {
+        const issuerInfo = exploreCertificate(issuerCertificate);
+        const issuerFingerprint = issuerInfo.tbsCertificate.subjectFingerPrint;
+        const processIndex = async (index) => {
+          const crlData = index.get(issuerFingerprint);
+          if (!crlData) return;
+          for (const crlEntry of crlData.crls) {
+            try {
+              await fs4.promises.unlink(crlEntry.filename);
+            } catch (err) {
+              if (err.code !== "ENOENT") {
+                throw err;
+              }
+            }
+          }
+          index.delete(issuerFingerprint);
+        };
+        if (target === "issuers" || target === "all") {
+          await processIndex(this.#thumbs.issuersCrl);
+        }
+        if (target === "trusted" || target === "all") {
+          await processIndex(this.#thumbs.crl);
+        }
+      }
+      /**
+       * Validate a certificate (optionally with its chain) and add
+       * the leaf certificate to the trusted store.
+       *
+       * The certificate buffer may contain a single certificate or a
+       * full chain (leaf + issuer certificates concatenated in DER).
+       * Only the leaf certificate is added to the trusted store.
+       *
+       * When the chain contains issuer certificates, this method
+       * verifies that each issuer is already registered via
+       * {@link addIssuer} before trusting the leaf.
+       *
+       * @param certificateChain - DER-encoded certificate or chain
+       * @returns `VerificationStatus.Good` on success, or an error
+       *  status indicating why the certificate was rejected.
+       */
+      async addTrustedCertificateFromChain(certificateChain) {
+        const certificates = split_der(certificateChain);
+        const leafCertificate = certificates[0];
+        try {
+          exploreCertificate(leafCertificate);
+        } catch (_err) {
+          return "BadCertificateInvalid" /* BadCertificateInvalid */;
+        }
+        const result = await verifyCertificateChain([leafCertificate]);
+        if (result.status !== "Good") {
+          return "BadCertificateInvalid" /* BadCertificateInvalid */;
+        }
+        if (certificates.length > 1) {
+          const issuerFolder = this.issuersCertFolder;
+          const issuerThumbprints = /* @__PURE__ */ new Set();
+          const files = await fs4.promises.readdir(issuerFolder);
+          for (const file of files) {
+            const ext = path2.extname(file).toLowerCase();
+            if (ext === ".pem" || ext === ".der") {
+              try {
+                const issuerCert = readCertificate(path2.join(issuerFolder, file));
+                const fp = makeFingerprint(issuerCert);
+                issuerThumbprints.add(fp);
+              } catch (_err) {
+              }
+            }
+          }
+          for (const issuerCert of certificates.slice(1)) {
+            const thumbprint = makeFingerprint(issuerCert);
+            if (!issuerThumbprints.has(thumbprint)) {
+              return "BadCertificateChainIncomplete" /* BadCertificateChainIncomplete */;
+            }
+          }
+        }
+        await this.trustCertificate(leafCertificate);
+        return "Good" /* Good */;
+      }
+      /**
+       * Check whether an issuer certificate is still needed by any
+       * certificate in the trusted store.
+       *
+       * This is used before removing an issuer to ensure that
+       * doing so would not break the chain of any trusted
+       * certificate.
+       *
+       * @param issuerCertificate - the CA certificate to check
+       * @returns `true` if at least one trusted certificate was
+       *   signed by this issuer.
+       */
+      async isIssuerInUseByTrustedCertificate(issuerCertificate) {
+        await this.#readCertificates();
+        for (const entry of this.#thumbs.trusted.values()) {
+          if (!entry.certificate) continue;
+          try {
+            if (verifyCertificateSignature(entry.certificate, issuerCertificate)) {
+              return true;
+            }
+          } catch (_err) {
+          }
+        }
+        return false;
+      }
+      /**
+       *  find the issuer certificate among the trusted  issuer certificates.
+       *
+       *  The findIssuerCertificate method is an asynchronous method that attempts to find
+       *  the issuer certificate for a given certificate from the list of issuer certificate declared in the PKI
+       *
+       *  - If the certificate is self-signed, it returns the certificate itself.
+       *
+       *  - If the certificate has no extension 3, it is assumed to be generated by an old system, and a null value is returned.
+       *
+       *  - the method checks both issuer and trusted certificates and returns the appropriate issuercertificate,
+       *    if found. If multiple matching certificates are found, a warning is logged to the console.
+       *
+       */
+      async findIssuerCertificate(certificate) {
+        const certInfo = exploreCertificate(certificate);
+        if (isSelfSigned2(certInfo)) {
+          return certificate;
+        }
+        const wantedIssuerKey = certInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier;
+        if (!wantedIssuerKey) {
+          debugLog("Certificate has no extension 3");
+          return null;
+        }
+        const issuerCertificates = [...this.#thumbs.issuers.certs.values()];
+        const selectedIssuerCertificates = findMatchingIssuerKey(issuerCertificates, wantedIssuerKey);
+        if (selectedIssuerCertificates.length > 0) {
+          if (selectedIssuerCertificates.length > 1) {
+            warningLog("Warning more than one issuer certificate exists with subjectKeyIdentifier ", wantedIssuerKey);
+          }
+          return selectedIssuerCertificates[0].certificate || null;
+        }
+        const trustedCertificates = [...this.#thumbs.trusted.values()];
+        const selectedTrustedCertificates = findMatchingIssuerKey(trustedCertificates, wantedIssuerKey);
+        if (selectedTrustedCertificates.length > 1) {
+          warningLog(
+            "Warning more than one certificate exists with subjectKeyIdentifier in trusted certificate list ",
+            wantedIssuerKey,
+            selectedTrustedCertificates.length
+          );
+        }
+        return selectedTrustedCertificates.length > 0 ? selectedTrustedCertificates[0].certificate : null;
+      }
+      /**
+       *
+       * check if the certificate explicitly appear in the trust list, the reject list or none.
+       * In case of being in the reject and trusted list at the same time is consider: rejected.
+       * @internal
+       * @private
+       */
+      async #checkRejectedOrTrusted(certificate) {
+        const fingerprint2 = makeFingerprint(certificate);
+        debugLog("#checkRejectedOrTrusted fingerprint ", short(fingerprint2));
+        await this.#readCertificates();
+        if (this.#thumbs.rejected.has(fingerprint2)) {
+          return "rejected";
+        }
+        if (this.#thumbs.trusted.has(fingerprint2)) {
+          return "trusted";
+        }
+        return "unknown";
+      }
+      async #moveCertificate(certificate, newStatus) {
+        await this.withLock2(async () => {
+          const fingerprint2 = makeFingerprint(certificate);
+          let status = await this.#checkRejectedOrTrusted(certificate);
+          if (status === "unknown") {
+            const pem = toPem(certificate, "CERTIFICATE");
+            const filename = path2.join(this.rejectedFolder, `${buildIdealCertificateName(certificate)}.pem`);
+            await fs4.promises.writeFile(filename, pem);
+            this.#thumbs.rejected.set(fingerprint2, { certificate, filename });
+            status = "rejected";
+          }
+          debugLog("#moveCertificate", fingerprint2.substring(0, 10), "from", status, "to", newStatus);
+          if (status !== "rejected" && status !== "trusted") {
+            throw new Error(`#moveCertificate: unexpected status '${status}' for certificate ${fingerprint2.substring(0, 10)}`);
+          }
+          if (status !== newStatus) {
+            const indexSrc = status === "rejected" ? this.#thumbs.rejected : this.#thumbs.trusted;
+            const srcEntry = indexSrc.get(fingerprint2);
+            if (!srcEntry) {
+              debugLog(" cannot find certificate ", fingerprint2.substring(0, 10), " in", status);
+              throw new Error(`#moveCertificate: certificate ${fingerprint2.substring(0, 10)} not found in ${status} index`);
+            }
+            const destFolder = newStatus === "trusted" ? this.trustedFolder : this.rejectedFolder;
+            const certificateDest = path2.join(destFolder, path2.basename(srcEntry.filename));
+            debugLog("#moveCertificate", fingerprint2.substring(0, 10), "old name", srcEntry.filename);
+            debugLog("#moveCertificate", fingerprint2.substring(0, 10), "new name", certificateDest);
+            await fs4.promises.rename(srcEntry.filename, certificateDest);
+            indexSrc.delete(fingerprint2);
+            const indexDest = newStatus === "trusted" ? this.#thumbs.trusted : this.#thumbs.rejected;
+            indexDest.set(fingerprint2, { certificate, filename: certificateDest });
+          }
+        });
+      }
+      #findAssociatedCRLs(issuerCertificate) {
+        const issuerCertificateInfo = exploreCertificate(issuerCertificate);
+        const key = issuerCertificateInfo.tbsCertificate.subjectFingerPrint;
+        return this.#thumbs.issuersCrl.get(key) ?? this.#thumbs.crl.get(key) ?? null;
+      }
+      /**
+       * Check whether a certificate has been revoked by its issuer's CRL.
+       *
+       * - Self-signed certificates are never considered revoked.
+       * - If no `issuerCertificate` is provided, the method attempts
+       *   to find it via {@link findIssuerCertificate}.
+       *
+       * @param certificate - the DER-encoded certificate to check
+       * @param issuerCertificate - optional issuer certificate; looked
+       *   up automatically when omitted
+       * @returns `Good` if not revoked, `BadCertificateRevoked` if the
+       *   serial number appears in a CRL,
+       *   `BadCertificateRevocationUnknown` if no CRL is available,
+       *   or `BadCertificateChainIncomplete` if the issuer cannot be
+       *   found.
+       */
+      async isCertificateRevoked(certificate, issuerCertificate) {
+        if (isSelfSigned3(certificate)) {
+          return "Good" /* Good */;
+        }
+        if (!issuerCertificate) {
+          issuerCertificate = await this.findIssuerCertificate(certificate);
+        }
+        if (!issuerCertificate) {
+          return "BadCertificateChainIncomplete" /* BadCertificateChainIncomplete */;
+        }
+        const crls = this.#findAssociatedCRLs(issuerCertificate);
+        if (!crls) {
+          return "BadCertificateRevocationUnknown" /* BadCertificateRevocationUnknown */;
+        }
+        const certInfo = exploreCertificate(certificate);
+        const serialNumber = certInfo.tbsCertificate.serialNumber || certInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.serial || "";
+        const key = certInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.authorityCertIssuerFingerPrint || "<unknown>";
+        const crl2 = this.#thumbs.crl.get(key) ?? null;
+        if (crls.serialNumbers[serialNumber] || crl2?.serialNumbers[serialNumber]) {
+          return "BadCertificateRevoked" /* BadCertificateRevoked */;
+        }
+        return "Good" /* Good */;
+      }
+      #pendingCrlToProcess = 0;
+      #onCrlProcess;
+      #queue = [];
+      #onCrlFileAdded(index, filename) {
+        this.#queue.push({ index, filename });
+        this.#pendingCrlToProcess += 1;
+        if (this.#pendingCrlToProcess === 1) {
+          this.#processNextCrl();
+        }
+      }
+      async #processNextCrl() {
+        try {
+          const nextCRL = this.#queue.shift();
+          if (!nextCRL) return;
+          const { index, filename } = nextCRL;
+          const crl = await readCertificateRevocationList(filename);
+          const crlInfo = exploreCertificateRevocationList(crl);
+          debugLog(chalk3.cyan("add CRL in folder "), filename);
+          const fingerprint2 = crlInfo.tbsCertList.issuerFingerprint;
+          if (!index.has(fingerprint2)) {
+            index.set(fingerprint2, { crls: [], serialNumbers: {} });
+          }
+          const data = index.get(fingerprint2) || { crls: [], serialNumbers: {} };
+          data.crls.push({ crlInfo, filename });
+          for (const revokedCertificate of crlInfo.tbsCertList.revokedCertificates) {
+            const serialNumber = revokedCertificate.userCertificate;
+            if (!data.serialNumbers[serialNumber]) {
+              data.serialNumbers[serialNumber] = revokedCertificate.revocationDate;
+            }
+          }
+          debugLog(chalk3.cyan("CRL"), fingerprint2, "serial numbers = ", Object.keys(data.serialNumbers));
+        } catch (err) {
+          debugLog("CRL filename error =");
+          debugLog(err);
+        }
+        this.#pendingCrlToProcess -= 1;
+        if (this.#pendingCrlToProcess === 0) {
+          if (this.#onCrlProcess) {
+            this.#onCrlProcess();
+            this.#onCrlProcess = void 0;
+          }
+        } else {
+          this.#processNextCrl();
+        }
+      }
+      async #readCertificates() {
+        if (this.#readCertificatesCalled) {
+          return;
+        }
+        this.#readCertificatesCalled = true;
+        const usePolling = process.env.OPCUA_PKI_USE_POLLING === "true";
+        const chokidarOptions = {
+          usePolling,
+          ...usePolling ? { interval: Math.min(10 * 60 * 1e3, Math.max(100, this.folderPoolingInterval)) } : {},
+          persistent: false
+        };
+        const createUnreffedWatcher = (folder) => {
+          const capturedHandles = [];
+          const origWatch = fs4.watch;
+          fs4.watch = ((...args) => {
+            const handle = origWatch.apply(fs4, args);
+            capturedHandles.push(handle);
+            return handle;
+          });
+          const w = chokidar.watch(folder, chokidarOptions);
+          const unreffAll = () => {
+            fs4.watch = origWatch;
+            for (const h of capturedHandles) {
+              h.unref();
+            }
+          };
+          return { w, capturedHandles, unreffAll };
+        };
+        const promises = [
+          this.#walkAllFiles(this.trustedFolder, this.#thumbs.trusted, createUnreffedWatcher),
+          this.#walkAllFiles(this.issuersCertFolder, this.#thumbs.issuers.certs, createUnreffedWatcher),
+          this.#walkAllFiles(this.rejectedFolder, this.#thumbs.rejected, createUnreffedWatcher),
+          this.#walkCRLFiles(this.crlFolder, this.#thumbs.crl, createUnreffedWatcher),
+          this.#walkCRLFiles(this.issuersCrlFolder, this.#thumbs.issuersCrl, createUnreffedWatcher)
+        ];
+        await Promise.all(promises);
+        await this.#waitAndCheckCRLProcessingStatus();
+      }
+      async #walkCRLFiles(folder, index, createUnreffedWatcher) {
+        await new Promise((resolve, _reject) => {
+          const { w, unreffAll } = createUnreffedWatcher(folder);
+          w.on("unlink", (filename) => {
+            for (const [key, data] of index.entries()) {
+              data.crls = data.crls.filter((c) => c.filename !== filename);
+              if (data.crls.length === 0) {
+                index.delete(key);
+              }
+            }
+          });
+          w.on("add", (filename) => {
+            this.#onCrlFileAdded(index, filename);
+          });
+          w.on("change", (changedPath) => {
+            debugLog("change in folder ", folder, changedPath);
+          });
+          this.#watchers.push(w);
+          w.on("ready", () => {
+            unreffAll();
+            resolve();
+          });
+        });
+      }
+      async #walkAllFiles(folder, index, createUnreffedWatcher) {
+        const { w, unreffAll } = createUnreffedWatcher(folder);
+        w.on("unlink", (filename) => {
+          debugLog(chalk3.cyan(`unlink in folder ${folder}`), filename);
+          const h = this.#filenameToHash.get(filename);
+          if (h && index.has(h)) {
+            index.delete(h);
+          }
+        });
+        w.on("add", (filename) => {
+          debugLog(chalk3.cyan(`add in folder ${folder}`), filename);
+          try {
+            const certificate = readCertificate(filename);
+            const info = exploreCertificate(certificate);
+            const fingerprint2 = makeFingerprint(certificate);
+            index.set(fingerprint2, { certificate, filename, info });
+            this.#filenameToHash.set(filename, fingerprint2);
+            debugLog(
+              chalk3.magenta("CERT"),
+              info.tbsCertificate.subjectFingerPrint,
+              info.tbsCertificate.serialNumber,
+              info.tbsCertificate.extensions?.authorityKeyIdentifier?.authorityCertIssuerFingerPrint
+            );
+          } catch (err) {
+            debugLog(`Walk files in folder ${folder} with file ${filename}`);
+            debugLog(err);
+          }
+        });
+        w.on("change", (changedPath) => {
+          debugLog(chalk3.cyan(`change in folder ${folder}`), changedPath);
+          try {
+            const certificate = readCertificate(changedPath);
+            const newFingerprint = makeFingerprint(certificate);
+            const oldHash = this.#filenameToHash.get(changedPath);
+            if (oldHash && oldHash !== newFingerprint) {
+              index.delete(oldHash);
+            }
+            index.set(newFingerprint, { certificate, filename: changedPath, info: exploreCertificate(certificate) });
+            this.#filenameToHash.set(changedPath, newFingerprint);
+          } catch (err) {
+            debugLog(`change event: failed to re-read ${changedPath}`, err);
+          }
+        });
+        this.#watchers.push(w);
+        await new Promise((resolve, _reject) => {
+          w.on("ready", () => {
+            unreffAll();
+            debugLog("ready");
+            debugLog([...index.keys()].map((k) => k.substring(0, 10)));
+            resolve();
+          });
+        });
+      }
+      // make sure that all crls have been processed.
+      async #waitAndCheckCRLProcessingStatus() {
+        return new Promise((resolve, reject) => {
+          if (this.#pendingCrlToProcess === 0) {
+            setImmediate(resolve);
+            return;
+          }
+          if (this.#onCrlProcess) {
+            return reject(new Error("Internal Error"));
+          }
+          this.#onCrlProcess = resolve;
+        });
+      }
+    };
+  }
+});
+
+// packages/node-opcua-pki/lib/toolbox/index.ts
+var init_toolbox = __esm({
+  "packages/node-opcua-pki/lib/toolbox/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_common();
+    init_common2();
+    init_config();
+    init_debug();
+    init_display();
+  }
+});
+
+// packages/node-opcua-pki/lib/toolbox/with_openssl/_env.ts
+function setEnv(varName, value) {
+  if (!g_config.silent) {
+    warningLog(`          set ${varName}=${value}`);
+  }
+  exportedEnvVars[varName] = value;
+  if (["OPENSSL_CONF"].indexOf(varName) >= 0) {
+    process.env[varName] = value;
+  }
+  if (["RANDFILE"].indexOf(varName) >= 0) {
+    process.env[varName] = value;
+  }
+}
+function getEnv(varName) {
+  return exportedEnvVars[varName];
+}
+function getEnvironmentVarNames() {
+  return Object.keys(exportedEnvVars).map((varName) => {
+    return { key: varName, pattern: `\\$ENV\\:\\:${varName}` };
+  });
+}
+function processAltNames(params) {
+  params.dns = params.dns || [];
+  params.ip = params.ip || [];
+  let subjectAltName = [];
+  subjectAltName.push(`URI:${params.applicationUri}`);
+  subjectAltName = [].concat(
+    subjectAltName,
+    params.dns.map((d) => `DNS:${d}`)
+  );
+  subjectAltName = [].concat(
+    subjectAltName,
+    params.ip.map((d) => `IP:${d}`)
+  );
+  const subjectAltNameString = subjectAltName.join(", ");
+  setEnv("ALTNAME", subjectAltNameString);
+}
+var exportedEnvVars;
+var init_env = __esm({
+  "packages/node-opcua-pki/lib/toolbox/with_openssl/_env.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_config();
+    init_debug();
+    exportedEnvVars = {};
+  }
+});
+
+// packages/node-opcua-pki/lib/misc/subject.ts
+import { Subject as Subject3 } from "node-opcua-crypto";
+var init_subject = __esm({
+  "packages/node-opcua-pki/lib/misc/subject.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
+// packages/node-opcua-pki/lib/toolbox/with_openssl/install_prerequisite.ts
+import child_process from "child_process";
+import fs5 from "fs";
+import os2 from "os";
+import path3 from "path";
+import url from "url";
+import byline from "byline";
+import chalk4 from "chalk";
+import ProgressBar from "progress";
+import wget from "wget-improved-2";
+import yauzl from "yauzl";
+function makeOptions() {
+  const proxy = process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || void 0;
+  if (proxy) {
+    const a = new url.URL(proxy);
+    const auth = a.username ? `${a.username}:${a.password}` : void 0;
+    const options = {
+      proxy: {
+        port: a.port ? parseInt(a.port, 10) : 80,
+        protocol: a.protocol.replace(":", ""),
+        host: a.hostname ?? "",
+        proxyAuth: auth
+      }
+    };
+    warningLog(chalk4.green("- using proxy "), proxy);
+    warningLog(options);
+    return options;
+  }
+  return {};
+}
+async function execute(cmd, cwd) {
+  let output = "";
+  const options = {
+    cwd,
+    windowsHide: true
+  };
+  return await new Promise((resolve, reject) => {
+    const child = child_process.exec(
+      cmd,
+      options,
+      (err) => {
+        const exitCode = err === null ? 0 : err.code || 1;
+        if (err) reject(err);
+        else {
+          resolve({ exitCode, output });
+        }
+      }
+    );
+    const stream1 = byline(child.stdout);
+    stream1.on("data", (line) => {
+      output += `${line}
+`;
+      if (doDebug2) {
+        process.stdout.write(`        stdout ${chalk4.yellow(line)}
+`);
+      }
+    });
+  });
+}
+function quote2(str) {
+  return `"${str.replace(/\\/g, "/")}"`;
+}
+function is_expected_openssl_version(strVersion) {
+  return !!strVersion.match(/OpenSSL 1|3/);
+}
+async function getopensslExecPath() {
+  let result1;
+  try {
+    result1 = await execute("which openssl");
+  } catch (err) {
+    warningLog("warning: ", err.message);
+    throw new Error("Cannot find openssl");
+  }
+  const exitCode = result1?.exitCode;
+  const output = result1?.output;
+  if (exitCode !== 0) {
+    warningLog(chalk4.yellow(" it seems that ") + chalk4.cyan("openssl") + chalk4.yellow(" is not installed on your computer "));
+    warningLog(chalk4.yellow("Please install it before running this programs"));
+    throw new Error("Cannot find openssl");
+  }
+  const opensslExecPath = output.replace(/\n\r/g, "").trim();
+  return opensslExecPath;
+}
+async function check_system_openssl_version() {
+  const opensslExecPath = await getopensslExecPath();
+  const q_opensslExecPath = quote2(opensslExecPath);
+  if (doDebug2) {
+    warningLog(`              OpenSSL found in : ${chalk4.yellow(opensslExecPath)}`);
+  }
+  const result = await execute(`${q_opensslExecPath} version`);
+  const exitCode = result?.exitCode;
+  const output = result?.output;
+  const version = output.trim();
+  const versionOK = exitCode === 0 && is_expected_openssl_version(version);
+  if (!versionOK) {
+    let message = chalk4.whiteBright("Warning !!!!!!!!!!!! ") + "\nyour version of openssl is " + version + ". It doesn't match the expected version";
+    if (process.platform === "darwin") {
+      message += chalk4.cyan("\nplease refer to :") + chalk4.yellow(" https://github.com/node-opcua/node-opcua/wiki/installing-node-opcua-or-node-red-on-MacOS");
+    }
+    console.log(message);
+  }
+  return output;
+}
+async function install_and_check_win32_openssl_version() {
+  const downloadFolder = path3.join(os2.tmpdir(), ".");
+  function get_openssl_folder_win32() {
+    if (process.env.LOCALAPPDATA) {
+      const userProgramFolder = path3.join(process.env.LOCALAPPDATA, "Programs");
+      if (fs5.existsSync(userProgramFolder)) {
+        return path3.join(userProgramFolder, "openssl");
+      }
+    }
+    return path3.join(process.cwd(), "openssl");
+  }
+  function get_openssl_exec_path_win32() {
+    const opensslFolder2 = get_openssl_folder_win32();
+    return path3.join(opensslFolder2, "openssl.exe");
+  }
+  async function check_openssl_win32() {
+    const opensslExecPath2 = get_openssl_exec_path_win32();
+    const exists = fs5.existsSync(opensslExecPath2);
+    if (!exists) {
+      warningLog("checking presence of ", opensslExecPath2);
+      warningLog(chalk4.red(" cannot find file ") + opensslExecPath2);
+      return {
+        opensslOk: false,
+        version: `cannot find file ${opensslExecPath2}`
+      };
+    } else {
+      const q_openssl_exe_path = quote2(opensslExecPath2);
+      const cwd = ".";
+      const { exitCode, output } = await execute(`${q_openssl_exe_path} version`, cwd);
+      const version = output.trim();
+      if (doDebug2) {
+        warningLog(" Version = ", version);
+      }
+      return {
+        opensslOk: exitCode === 0 && is_expected_openssl_version(version),
+        version
+      };
+    }
+  }
+  function win32or64() {
+    if (process.env.PROCESSOR_ARCHITECTURE === "x86" && process.env.PROCESSOR_ARCHITEW6432) {
+      return 64;
+    }
+    if (process.env.PROCESSOR_ARCHITECTURE === "AMD64") {
+      return 64;
+    }
+    if (process.env.CURRENT_CPU === "x64") {
+      return 64;
+    }
+    return 32;
+  }
+  async function download_openssl() {
+    const url2 = win32or64() === 64 ? "https://github.com/node-opcua/node-opcua-pki/releases/download/2.14.2/openssl-1.0.2u-x64_86-win64.zip" : "https://github.com/node-opcua/node-opcua-pki/releases/download/2.14.2/openssl-1.0.2u-i386-win32.zip";
+    const outputFilename = path3.join(downloadFolder, path3.basename(url2));
+    warningLog(`downloading ${chalk4.yellow(url2)} to ${outputFilename}`);
+    if (fs5.existsSync(outputFilename)) {
+      return { downloadedFile: outputFilename };
+    }
+    const options = makeOptions();
+    const bar = new ProgressBar(chalk4.cyan("[:bar]") + chalk4.cyan(" :percent ") + chalk4.white(":etas"), {
+      complete: "=",
+      incomplete: " ",
+      total: 100,
+      width: 100
+    });
+    return await new Promise((resolve, reject) => {
+      const download = wget.download(url2, outputFilename, options);
+      download.on("error", (err) => {
+        warningLog(err);
+        setImmediate(() => {
+          reject(err);
+        });
+      });
+      download.on("end", (output) => {
+        if (doDebug2) {
+          warningLog(output);
+        }
+        resolve({ downloadedFile: outputFilename });
+      });
+      download.on("progress", (progress) => {
+        bar.update(progress);
+      });
+    });
+  }
+  async function unzip_openssl(zipFilename) {
+    const opensslFolder2 = get_openssl_folder_win32();
+    const zipFile = await new Promise((resolve, reject) => {
+      yauzl.open(zipFilename, { lazyEntries: true }, (err, zipfile) => {
+        if (err) {
+          reject(err);
+        } else {
+          if (!zipfile) {
+            reject(new Error("zipfile is null"));
+          } else {
+            resolve(zipfile);
+          }
+        }
+      });
+    });
+    zipFile.readEntry();
+    await new Promise((resolve, reject) => {
+      zipFile.on("end", (err) => {
+        setImmediate(() => {
+          if (doDebug2) {
+            warningLog("unzip done");
+          }
+          if (err) {
+            reject(err);
+          } else {
+            resolve();
+          }
+        });
+      });
+      zipFile.on("entry", (entry) => {
+        zipFile.openReadStream(entry, (err, readStream) => {
+          if (err) {
+            return reject(err);
+          }
+          const file = path3.join(opensslFolder2, entry.fileName);
+          if (doDebug2) {
+            warningLog(" unzipping :", file);
+          }
+          const writeStream = fs5.createWriteStream(file, "binary");
+          readStream?.pipe(writeStream);
+          writeStream.on("close", () => {
+            zipFile.readEntry();
+          });
+        });
+      });
+    });
+  }
+  const opensslFolder = get_openssl_folder_win32();
+  const opensslExecPath = get_openssl_exec_path_win32();
+  if (!fs5.existsSync(opensslFolder)) {
+    if (doDebug2) {
+      warningLog("creating openssl_folder", opensslFolder);
+    }
+    fs5.mkdirSync(opensslFolder);
+  }
+  const { opensslOk, version: _version } = await check_openssl_win32();
+  if (!opensslOk) {
+    warningLog(chalk4.yellow("openssl seems to be missing and need to be installed"));
+    const { downloadedFile } = await download_openssl();
+    if (doDebug2) {
+      warningLog("deflating ", chalk4.yellow(downloadedFile));
+    }
+    await unzip_openssl(downloadedFile);
+    const opensslExists = !!fs5.existsSync(opensslExecPath);
+    if (doDebug2) {
+      warningLog("verifying ", opensslExists, opensslExists ? chalk4.green("OK ") : chalk4.red(" Error"), opensslExecPath);
+    }
+    const _opensslExecPath2 = await check_openssl_win32();
+    return opensslExecPath;
+  } else {
+    if (doDebug2) {
+      warningLog(chalk4.green("openssl is already installed and have the expected version."));
+    }
+    return opensslExecPath;
+  }
+}
+async function install_prerequisite() {
+  if (process.platform !== "win32") {
+    return await check_system_openssl_version();
+  } else {
+    return await install_and_check_win32_openssl_version();
+  }
+}
+async function get_openssl_exec_path() {
+  if (process.platform === "win32") {
+    const opensslExecPath = await install_prerequisite();
+    if (!fs5.existsSync(opensslExecPath)) {
+      throw new Error(`internal error cannot find ${opensslExecPath}`);
+    }
+    return opensslExecPath;
+  } else {
+    return "openssl";
+  }
+}
+var doDebug2;
+var init_install_prerequisite = __esm({
+  "packages/node-opcua-pki/lib/toolbox/with_openssl/install_prerequisite.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_debug();
+    doDebug2 = process.env.NODEOPCUAPKIDEBUG || false;
+  }
+});
+
+// packages/node-opcua-pki/lib/toolbox/with_openssl/execute_openssl.ts
+import assert6 from "assert";
+import child_process2 from "child_process";
+import fs6 from "fs";
+import os3 from "os";
+import byline2 from "byline";
+import chalk5 from "chalk";
+async function execute2(cmd, options) {
+  const from = new Error();
+  options.cwd = options.cwd || process.cwd();
+  if (!g_config.silent) {
+    warningLog(chalk5.cyan("                  CWD         "), options.cwd);
+  }
+  const outputs = [];
+  return await new Promise((resolve, reject) => {
+    const child = child_process2.exec(
+      cmd,
+      {
+        cwd: options.cwd,
+        windowsHide: true
+      },
+      (err) => {
+        if (err) {
+          if (!options.hideErrorMessage) {
+            const fence = "###########################################";
+            console.error(chalk5.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
+            console.error(chalk5.bgWhiteBright.redBright(`CWD = ${options.cwd}`));
+            console.error(chalk5.bgWhiteBright.redBright(err.message));
+            console.error(chalk5.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
+            console.error(from.stack);
+          }
+          reject(new Error(err.message));
+          return;
+        }
+        resolve(outputs.join(""));
+      }
+    );
+    if (child.stdout) {
+      const stream2 = byline2(child.stdout);
+      stream2.on("data", (line) => {
+        outputs.push(`${line}
+`);
+      });
+      if (!g_config.silent) {
+        stream2.on("data", (line) => {
+          line = line.toString();
+          if (doDebug) {
+            process.stdout.write(`${chalk5.white("        stdout ") + chalk5.whiteBright(line)}
+`);
+          }
+        });
+      }
+    }
+    if (!g_config.silent) {
+      if (child.stderr) {
+        const stream1 = byline2(child.stderr);
+        stream1.on("data", (line) => {
+          line = line.toString();
+          if (displayError) {
+            process.stdout.write(`${chalk5.white("        stderr ") + chalk5.red(line)}
+`);
+          }
+        });
+      }
+    }
+  });
+}
+async function find_openssl() {
+  return await get_openssl_exec_path();
+}
+async function ensure_openssl_installed() {
+  if (!opensslPath) {
+    opensslPath = await find_openssl();
+    const outputs = await execute_openssl("version", { cwd: "." });
+    g_config.opensslVersion = outputs.trim();
+    if (doDebug) {
+      warningLog("OpenSSL version : ", g_config.opensslVersion);
+    }
+  }
+}
+async function execute_openssl_no_failure(cmd, options) {
+  options = options || {};
+  options.hideErrorMessage = true;
+  try {
+    return await execute_openssl(cmd, options);
+  } catch (err) {
+    debugLog(" (ignored error =  ERROR : )", err.message);
+  }
+}
+function getTempFolder() {
+  return os3.tmpdir();
+}
+async function execute_openssl(cmd, options) {
+  debugLog("execute_openssl", cmd, options);
+  const empty_config_file = n(getTempFolder(), "empty_config.cnf");
+  if (!fs6.existsSync(empty_config_file)) {
+    await fs6.promises.writeFile(empty_config_file, "# empty config file");
+  }
+  options = options || {};
+  options.openssl_conf = options.openssl_conf || empty_config_file;
+  assert6(options.openssl_conf);
+  setEnv("OPENSSL_CONF", options.openssl_conf);
+  if (!g_config.silent) {
+    warningLog(chalk5.cyan("                  OPENSSL_CONF"), process.env.OPENSSL_CONF);
+    warningLog(chalk5.cyan("                  RANDFILE    "), process.env.RANDFILE);
+    warningLog(chalk5.cyan("                  CMD         openssl "), chalk5.cyanBright(cmd));
+  }
+  await ensure_openssl_installed();
+  return await execute2(`${quote(opensslPath)} ${cmd}`, options);
+}
+var opensslPath, n;
+var init_execute_openssl = __esm({
+  "packages/node-opcua-pki/lib/toolbox/with_openssl/execute_openssl.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_common();
+    init_common2();
+    init_config();
+    init_debug();
+    init_env();
+    init_install_prerequisite();
+    n = makePath;
+  }
+});
+
+// packages/node-opcua-pki/lib/toolbox/with_openssl/toolbox.ts
+import assert7 from "assert";
+import fs7 from "fs";
+import path4 from "path";
+function openssl_require2DigitYearInDate() {
+  if (!g_config.opensslVersion) {
+    throw new Error(
+      "openssl_require2DigitYearInDate : openssl version is not known:  please call ensure_openssl_installed()"
+    );
+  }
+  return g_config.opensslVersion.match(/OpenSSL 0\.9/);
+}
+function generateStaticConfig(configPath, options) {
+  const prePath = options?.cwd || "";
+  const originalFilename = !path4.isAbsolute(configPath) ? path4.join(prePath, configPath) : configPath;
+  let staticConfig = fs7.readFileSync(originalFilename, { encoding: "utf8" });
+  for (const envVar of getEnvironmentVarNames()) {
+    staticConfig = staticConfig.replace(new RegExp(envVar.pattern, "gi"), getEnv(envVar.key));
+  }
+  const staticConfigPath = `${configPath}.${process.pid}-${_counter++}.tmp`;
+  const temporaryConfigPath = !path4.isAbsolute(configPath) ? path4.join(prePath, staticConfigPath) : staticConfigPath;
+  fs7.writeFileSync(temporaryConfigPath, staticConfig);
+  if (options?.cwd) {
+    return path4.relative(options.cwd, temporaryConfigPath);
+  } else {
+    return temporaryConfigPath;
+  }
+}
+async function getPublicKeyFromPrivateKey(privateKeyFilename, publicKeyFilename) {
+  assert7(fs7.existsSync(privateKeyFilename));
+  await execute_openssl(`rsa -pubout -in ${q(n2(privateKeyFilename))} -out ${q(n2(publicKeyFilename))}`, {});
+}
+function x509Date(date) {
+  date = date || /* @__PURE__ */ new Date();
+  const Y = date.getUTCFullYear();
+  const M = date.getUTCMonth() + 1;
+  const D = date.getUTCDate();
+  const h = date.getUTCHours();
+  const m = date.getUTCMinutes();
+  const s = date.getUTCSeconds();
+  function w(s2, l) {
+    return `${s2}`.padStart(l, "0");
+  }
+  if (openssl_require2DigitYearInDate()) {
+    return `${w(Y, 2) + w(M, 2) + w(D, 2) + w(h, 2) + w(m, 2) + w(s, 2)}Z`;
+  } else {
+    return `${w(Y, 4) + w(M, 2) + w(D, 2) + w(h, 2) + w(m, 2) + w(s, 2)}Z`;
+  }
+}
+async function dumpCertificate(certificate) {
+  assert7(fs7.existsSync(certificate));
+  return await execute_openssl(`x509  -in ${q(n2(certificate))} -text  -noout`, {});
+}
+async function toDer(certificatePem) {
+  assert7(fs7.existsSync(certificatePem));
+  const certificateDer = certificatePem.replace(".pem", ".der");
+  return await execute_openssl(`x509   -outform der  -in ${certificatePem} -out ${certificateDer}`, {});
+}
+async function fingerprint(certificatePem) {
+  assert7(fs7.existsSync(certificatePem));
+  return await execute_openssl(`x509   -fingerprint  -noout  -in ${certificatePem}`, {});
+}
+var _counter, q, n2;
+var init_toolbox2 = __esm({
+  "packages/node-opcua-pki/lib/toolbox/with_openssl/toolbox.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_common();
+    init_common2();
+    init_config();
+    init_env();
+    init_execute_openssl();
+    g_config.opensslVersion = "";
+    _counter = 0;
+    q = quote;
+    n2 = makePath;
+  }
+});
+
+// packages/node-opcua-pki/lib/toolbox/with_openssl/create_certificate_signing_request.ts
+import assert8 from "assert";
+import fs8 from "fs";
+import path5 from "path";
+async function createCertificateSigningRequestWithOpenSSL(certificateSigningRequestFilename, params) {
+  assert8(params);
+  assert8(params.rootDir);
+  assert8(params.configFile);
+  assert8(params.privateKey);
+  assert8(typeof params.privateKey === "string");
+  assert8(fs8.existsSync(params.configFile), `config file must exist ${params.configFile}`);
+  assert8(fs8.existsSync(params.privateKey), `Private key must exist${params.privateKey}`);
+  assert8(fs8.existsSync(params.rootDir), "RootDir key must exist");
+  assert8(typeof certificateSigningRequestFilename === "string");
+  processAltNames(params);
+  const configFile = generateStaticConfig(params.configFile, { cwd: params.rootDir });
+  const options = { cwd: params.rootDir, openssl_conf: path5.relative(params.rootDir, configFile) };
+  const configOption = ` -config ${q2(n3(configFile))}`;
+  const subject = params.subject ? new Subject3(params.subject).toString() : void 0;
+  const subjectOptions = subject ? ` -subj "${subject}"` : "";
+  displaySubtitle("- Creating a Certificate Signing Request with openssl");
+  await execute_openssl(
+    "req -new  -sha256  -batch  -text " + configOption + " -key " + q2(n3(params.privateKey)) + subjectOptions + " -out " + q2(n3(certificateSigningRequestFilename)),
+    options
+  );
+}
+var q2, n3;
+var init_create_certificate_signing_request2 = __esm({
+  "packages/node-opcua-pki/lib/toolbox/with_openssl/create_certificate_signing_request.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_subject();
+    init_common();
+    init_common2();
+    init_display();
+    init_env();
+    init_execute_openssl();
+    init_toolbox2();
+    q2 = quote;
+    n3 = makePath;
+  }
+});
+
+// packages/node-opcua-pki/lib/toolbox/with_openssl/index.ts
+import exp from "constants";
+var init_with_openssl = __esm({
+  "packages/node-opcua-pki/lib/toolbox/with_openssl/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_env();
+    init_create_certificate_signing_request2();
+    init_execute_openssl();
+    init_install_prerequisite();
+    init_toolbox2();
+  }
+});
+
+// packages/node-opcua-pki/lib/ca/templates/ca_config_template.cnf.ts
+var config2, ca_config_template_cnf_default;
+var init_ca_config_template_cnf = __esm({
+  "packages/node-opcua-pki/lib/ca/templates/ca_config_template.cnf.ts"() {
+    "use strict";
+    init_esm_shims();
+    config2 = `#.........DO NOT MODIFY BY HAND .........................
+[ ca ]
+default_ca               = CA_default
+[ CA_default ]
+dir                      = %%ROOT_FOLDER%%            # the main CA folder
+certs                    = $dir/certs                 # where to store certificates
+new_certs_dir            = $dir/certs                 #
+database                 = $dir/index.txt             # the certificate database
+serial                   = $dir/serial                # the serial number counter
+certificate              = $dir/public/cacert.pem     # The root CA certificate
+private_key              = $dir/private/cakey.pem     # the CA private key
+x509_extensions          = usr_cert                   #
+default_days             = 3650                       # default validity : 10 years
+
+# default_md               = sha1
+
+default_md                = sha256                      # The default digest algorithm
+
+preserve                 = no
+policy                   = policy_match
+# randfile                 = $dir/random.rnd
+# default_startdate        = YYMMDDHHMMSSZ
+# default_enddate          = YYMMDDHHMMSSZ
+crl_dir                  = $dir/crl
+crl_extensions           = crl_ext
+crl                      = $dir/revocation_list.crl # the Revocation list
+crlnumber                = $dir/crlnumber           # CRL number file
+default_crl_days         = 30
+default_crl_hours        = 24
+#msie_hack
+
+[ policy_match ]
+countryName              = optional
+stateOrProvinceName      = optional
+localityName             = optional
+organizationName         = optional
+organizationalUnitName   = optional
+commonName               = optional
+emailAddress             = optional
+
+[ req ]
+default_bits             = 4096                     # Size of keys
+default_keyfile          = key.pem                  # name of generated keys
+distinguished_name       = req_distinguished_name
+attributes               = req_attributes
+x509_extensions          = v3_ca
+#input_password
+#output_password
+string_mask              = nombstr                  # permitted characters
+req_extensions           = v3_req
+
+[ req_distinguished_name ]
+
+#0 countryName             = Country Name (2 letter code)
+# countryName_default     = FR
+# countryName_min         = 2
+# countryName_max         = 2
+# stateOrProvinceName     = State or Province Name (full name)
+# stateOrProvinceName_default = Ile de France
+# localityName            = Locality Name (city, district)
+# localityName_default    = Paris
+organizationName          = Organization Name (company)
+organizationName_default  = NodeOPCUA
+# organizationalUnitName  = Organizational Unit Name (department, division)
+# organizationalUnitName_default = R&D
+commonName                = Common Name (hostname, FQDN, IP, or your name)
+commonName_max            = 256
+commonName_default        = NodeOPCUA
+# emailAddress            = Email Address
+# emailAddress_max        = 40
+# emailAddress_default    = node-opcua (at) node-opcua (dot) com
+
+[ req_attributes ]
+#challengePassword        = A challenge password
+#challengePassword_min    = 4
+#challengePassword_max    = 20
+#unstructuredName         = An optional company name
+[ usr_cert ]
+basicConstraints          = critical, CA:FALSE
+subjectKeyIdentifier      = hash
+authorityKeyIdentifier    = keyid,issuer:always
+#authorityKeyIdentifier    = keyid
+subjectAltName            = $ENV::ALTNAME
+# issuerAltName            = issuer:copy
+nsComment                 = ''OpenSSL Generated Certificate''
+#nsCertType               = client, email, objsign for ''everything including object signing''
+#nsCaRevocationUrl        = http://www.domain.dom/ca-crl.pem
+#nsBaseUrl                =
+#nsRenewalUrl             =
+#nsCaPolicyUrl            =
+#nsSslServerName          =
+keyUsage                  = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign
+extendedKeyUsage          = critical,serverAuth ,clientAuth
+
+[ v3_req ]
+basicConstraints          = critical, CA:FALSE
+keyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyAgreement
+extendedKeyUsage          = critical,serverAuth ,clientAuth
+subjectAltName            = $ENV::ALTNAME
+nsComment                 = "CA Generated by Node-OPCUA Certificate utility using openssl"
+[ v3_ca ]
+subjectKeyIdentifier      = hash
+authorityKeyIdentifier    = keyid:always,issuer:always
+# authorityKeyIdentifier    = keyid
+basicConstraints          = CA:TRUE
+keyUsage                  = critical, cRLSign, keyCertSign
+nsComment                 = "CA Certificate generated by Node-OPCUA Certificate utility using openssl"
+#nsCertType                 = sslCA, emailCA
+#subjectAltName             = email:copy
+#issuerAltName              = issuer:copy
+#obj                        = DER:02:03
+crlDistributionPoints     = @crl_info
+[ crl_info ]
+URI.0                     = http://localhost:8900/crl.pem
+[ v3_selfsigned]
+basicConstraints          = critical, CA:FALSE
+keyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyAgreement
+extendedKeyUsage          = critical,serverAuth ,clientAuth
+nsComment                 = "Self-signed certificate, generated by NodeOPCUA"
+subjectAltName            = $ENV::ALTNAME
+
+[ crl_ext ]
+#issuerAltName            = issuer:copy
+authorityKeyIdentifier    = keyid:always,issuer:always
+#authorityInfoAccess       = @issuer_info`;
+    ca_config_template_cnf_default = config2;
+  }
+});
+
+// packages/node-opcua-pki/lib/ca/certificate_authority.ts
+import assert9 from "assert";
+import fs9 from "fs";
+import path6 from "path";
+import chalk6 from "chalk";
+import {
+  exploreCertificateSigningRequest,
+  generatePrivateKeyFile as generatePrivateKeyFile2,
+  readCertificateSigningRequest,
+  Subject as Subject4
+} from "node-opcua-crypto";
+function octetStringToIpAddress(a) {
+  return parseInt(a.substring(0, 2), 16).toString() + "." + parseInt(a.substring(2, 4), 16).toString() + "." + parseInt(a.substring(4, 6), 16).toString() + "." + parseInt(a.substring(6, 8), 16).toString();
+}
+async function construct_CertificateAuthority(certificateAuthority) {
+  const subject = certificateAuthority.subject;
+  const caRootDir = path6.resolve(certificateAuthority.rootDir);
+  async function make_folders() {
+    mkdirRecursiveSync(caRootDir);
+    mkdirRecursiveSync(path6.join(caRootDir, "private"));
+    mkdirRecursiveSync(path6.join(caRootDir, "public"));
+    mkdirRecursiveSync(path6.join(caRootDir, "certs"));
+    mkdirRecursiveSync(path6.join(caRootDir, "crl"));
+    mkdirRecursiveSync(path6.join(caRootDir, "conf"));
+  }
+  await make_folders();
+  async function construct_default_files() {
+    const serial = path6.join(caRootDir, "serial");
+    if (!fs9.existsSync(serial)) {
+      await fs9.promises.writeFile(serial, "1000");
+    }
+    const crlNumber = path6.join(caRootDir, "crlnumber");
+    if (!fs9.existsSync(crlNumber)) {
+      await fs9.promises.writeFile(crlNumber, "1000");
+    }
+    const indexFile = path6.join(caRootDir, "index.txt");
+    if (!fs9.existsSync(indexFile)) {
+      await fs9.promises.writeFile(indexFile, "");
+    }
+  }
+  await construct_default_files();
+  if (fs9.existsSync(path6.join(caRootDir, "private/cakey.pem")) && !config3.forceCA) {
+    debugLog("CA private key already exists ... skipping");
+    return;
+  }
+  displayTitle("Create Certificate Authority (CA)");
+  const indexFileAttr = path6.join(caRootDir, "index.txt.attr");
+  if (!fs9.existsSync(indexFileAttr)) {
+    await fs9.promises.writeFile(indexFileAttr, "unique_subject = no");
+  }
+  const caConfigFile = certificateAuthority.configFile;
+  if (1) {
+    let data = configurationFileTemplate;
+    data = makePath(data.replace(/%%ROOT_FOLDER%%/, caRootDir));
+    await fs9.promises.writeFile(caConfigFile, data);
+  }
+  const subjectOpt = ` -subj "${subject.toString()}" `;
+  processAltNames({});
+  const options = { cwd: caRootDir };
+  const configFile = generateStaticConfig("conf/caconfig.cnf", options);
+  const configOption = ` -config ${q3(n4(configFile))}`;
+  const keySize = certificateAuthority.keySize;
+  const privateKeyFilename = path6.join(caRootDir, "private/cakey.pem");
+  const csrFilename = path6.join(caRootDir, "private/cakey.csr");
+  displayTitle(`Generate the CA private Key - ${keySize}`);
+  await generatePrivateKeyFile2(privateKeyFilename, keySize);
+  displayTitle("Generate a certificate request for the CA key");
+  await execute_openssl(
+    "req -new -sha256  -text  -extensions v3_ca" + configOption + " -key " + q3(n4(privateKeyFilename)) + " -out " + q3(n4(csrFilename)) + " " + subjectOpt,
+    options
+  );
+  displayTitle("Generate CA Certificate (self-signed)");
+  await execute_openssl(
+    " x509 -sha256 -req -days 3650  -text  -extensions v3_ca -extfile " + q3(n4(configFile)) + " -in private/cakey.csr  -signkey " + q3(n4(privateKeyFilename)) + " -out public/cacert.pem",
+    options
+  );
+  displaySubtitle("generate initial CRL (Certificate Revocation List)");
+  await regenerateCrl(certificateAuthority.revocationList, configOption, options);
+  displayTitle("Create Certificate Authority (CA) ---> DONE");
+}
+async function regenerateCrl(revocationList, configOption, options) {
+  displaySubtitle("regenerate CRL (Certificate Revocation List)");
+  await execute_openssl(`ca -gencrl ${configOption} -out crl/revocation_list.crl`, options);
+  await execute_openssl("crl  -in  crl/revocation_list.crl -out  crl/revocation_list.der  -outform der", options);
+  displaySubtitle("Display (Certificate Revocation List)");
+  await execute_openssl(`crl  -in ${q3(n4(revocationList))} -text  -noout`, options);
+}
+var defaultSubject, configurationFileTemplate, config3, n4, q3, CertificateAuthority;
+var init_certificate_authority = __esm({
+  "packages/node-opcua-pki/lib/ca/certificate_authority.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_toolbox();
+    init_with_openssl();
+    init_ca_config_template_cnf();
+    defaultSubject = "/C=FR/ST=IDF/L=Paris/O=Local NODE-OPCUA Certificate Authority/CN=NodeOPCUA-CA";
+    configurationFileTemplate = ca_config_template_cnf_default;
+    config3 = {
+      certificateDir: "INVALID",
+      forceCA: false,
+      pkiDir: "INVALID"
+    };
+    n4 = makePath;
+    q3 = quote;
+    assert9(octetStringToIpAddress("c07b9179") === "192.123.145.121");
+    CertificateAuthority = class {
+      /** RSA key size used when generating the CA private key. */
+      keySize;
+      /** Root filesystem path of the CA directory structure. */
+      location;
+      /** X.500 subject of the CA certificate. */
+      subject;
+      constructor(options) {
+        assert9(Object.prototype.hasOwnProperty.call(options, "location"));
+        assert9(Object.prototype.hasOwnProperty.call(options, "keySize"));
+        this.location = options.location;
+        this.keySize = options.keySize || 2048;
+        this.subject = new Subject4(options.subject || defaultSubject);
+      }
+      /** Absolute path to the CA root directory (alias for {@link location}). */
+      get rootDir() {
+        return this.location;
+      }
+      /** Path to the OpenSSL configuration file (`conf/caconfig.cnf`). */
+      get configFile() {
+        return path6.normalize(path6.join(this.rootDir, "./conf/caconfig.cnf"));
+      }
+      /** Path to the CA certificate in PEM format (`public/cacert.pem`). */
+      get caCertificate() {
+        return makePath(this.rootDir, "./public/cacert.pem");
+      }
+      /**
+       * Path to the current Certificate Revocation List in DER format.
+       * (`crl/revocation_list.der`)
+       */
+      get revocationListDER() {
+        return makePath(this.rootDir, "./crl/revocation_list.der");
+      }
+      /**
+       * Path to the current Certificate Revocation List in PEM format.
+       * (`crl/revocation_list.crl`)
+       */
+      get revocationList() {
+        return makePath(this.rootDir, "./crl/revocation_list.crl");
+      }
+      /**
+       * Path to the concatenated CA certificate + CRL file.
+       * Used by OpenSSL for CRL-based verification.
+       */
+      get caCertificateWithCrl() {
+        return makePath(this.rootDir, "./public/cacertificate_with_crl.pem");
+      }
+      /**
+       * Initialize the CA directory structure, generate the CA
+       * private key and self-signed certificate if they do not
+       * already exist.
+       */
+      async initialize() {
+        await construct_CertificateAuthority(this);
+      }
+      /**
+       * Rebuild the combined CA certificate + CRL file.
+       *
+       * This concatenates the CA certificate with the current
+       * revocation list so that OpenSSL can verify certificates
+       * with CRL checking enabled.
+       */
+      async constructCACertificateWithCRL() {
+        const cacertWithCRL = this.caCertificateWithCrl;
+        if (fs9.existsSync(this.revocationList)) {
+          await fs9.promises.writeFile(
+            cacertWithCRL,
+            fs9.readFileSync(this.caCertificate, "utf8") + fs9.readFileSync(this.revocationList, "utf8")
+          );
+        } else {
+          await fs9.promises.writeFile(cacertWithCRL, fs9.readFileSync(this.caCertificate));
+        }
+      }
+      /**
+       * Append the CA certificate to a signed certificate file,
+       * creating a PEM certificate chain.
+       *
+       * @param certificate - path to the certificate file to extend
+       */
+      async constructCertificateChain(certificate) {
+        assert9(fs9.existsSync(certificate));
+        assert9(fs9.existsSync(this.caCertificate));
+        debugLog(chalk6.yellow("        certificate file :"), chalk6.cyan(certificate));
+        await fs9.promises.writeFile(
+          certificate,
+          await fs9.promises.readFile(certificate, "utf8") + await fs9.promises.readFile(this.caCertificate, "utf8")
+          //   + fs.readFileSync(this.revocationList)
+        );
+      }
+      /**
+       * Create a self-signed certificate using OpenSSL.
+       *
+       * @param certificateFile - output path for the signed certificate
+       * @param privateKey - path to the private key file
+       * @param params - certificate parameters (subject, validity, SANs)
+       */
+      async createSelfSignedCertificate(certificateFile, privateKey, params) {
+        assert9(typeof privateKey === "string");
+        assert9(fs9.existsSync(privateKey));
+        if (!certificateFileExist(certificateFile)) {
+          return;
+        }
+        adjustDate(params);
+        adjustApplicationUri(params);
+        processAltNames(params);
+        const csrFile = `${certificateFile}_csr`;
+        assert9(csrFile);
+        const configFile = generateStaticConfig(this.configFile, { cwd: this.rootDir });
+        const options = {
+          cwd: this.rootDir,
+          openssl_conf: makePath(configFile)
+        };
+        const configOption = "";
+        const subject = params.subject ? new Subject4(params.subject).toString() : "";
+        const subjectOptions = subject && subject.length > 1 ? ` -subj ${subject} ` : "";
+        displaySubtitle("- the certificate signing request");
+        await execute_openssl(
+          "req  -new -sha256 -text " + configOption + subjectOptions + " -batch -key " + q3(n4(privateKey)) + " -out " + q3(n4(csrFile)),
+          options
+        );
+        displaySubtitle("- creating the self-signed certificate");
+        await execute_openssl(
+          "ca  -selfsign  -keyfile " + q3(n4(privateKey)) + " -startdate " + x509Date(params.startDate) + " -enddate " + x509Date(params.endDate) + " -batch -out " + q3(n4(certificateFile)) + " -in " + q3(n4(csrFile)),
+          options
+        );
+        displaySubtitle("- dump the certificate for a check");
+        await execute_openssl(`x509 -in ${q3(n4(certificateFile))}  -dates -fingerprint -purpose -noout`, {});
+        displaySubtitle("- verify self-signed certificate");
+        await execute_openssl_no_failure(`verify -verbose -CAfile ${q3(n4(certificateFile))} ${q3(n4(certificateFile))}`, options);
+        await fs9.promises.unlink(csrFile);
+      }
+      /**
+       * Revoke a certificate and regenerate the CRL.
+       *
+       * @param certificate - path to the certificate file to revoke
+       * @param params - revocation parameters
+       * @param params.reason - CRL reason code
+       *   (default `"keyCompromise"`)
+       */
+      async revokeCertificate(certificate, params) {
+        const crlReasons = [
+          "unspecified",
+          "keyCompromise",
+          "CACompromise",
+          "affiliationChanged",
+          "superseded",
+          "cessationOfOperation",
+          "certificateHold",
+          "removeFromCRL"
+        ];
+        const configFile = generateStaticConfig("conf/caconfig.cnf", { cwd: this.rootDir });
+        const options = {
+          cwd: this.rootDir,
+          openssl_conf: makePath(configFile)
+        };
+        setEnv("ALTNAME", "");
+        const randomFile = path6.join(this.rootDir, "random.rnd");
+        setEnv("RANDFILE", randomFile);
+        const configOption = ` -config ${q3(n4(configFile))}`;
+        const reason = params.reason || "keyCompromise";
+        assert9(crlReasons.indexOf(reason) >= 0);
+        displayTitle(`Revoking certificate  ${certificate}`);
+        displaySubtitle("Revoke certificate");
+        await execute_openssl_no_failure(`ca -verbose ${configOption} -revoke ${q3(certificate)} -crl_reason ${reason}`, options);
+        await regenerateCrl(this.revocationList, configOption, options);
+        displaySubtitle("Verify that certificate is revoked");
+        await execute_openssl_no_failure(
+          "verify -verbose -CRLfile " + q3(n4(this.revocationList)) + " -CAfile " + q3(n4(this.caCertificate)) + " -crl_check " + q3(n4(certificate)),
+          options
+        );
+        displaySubtitle("Produce CRL in DER form ");
+        await execute_openssl(`crl  -in ${q3(n4(this.revocationList))} -out crl/revocation_list.der  -outform der`, options);
+        displaySubtitle("Produce CRL in PEM form ");
+        await execute_openssl(`crl  -in ${q3(n4(this.revocationList))} -out crl/revocation_list.pem  -outform pem -text `, options);
+      }
+      /**
+       * Sign a Certificate Signing Request (CSR) with this CA.
+       *
+       * The signed certificate is written to `certificate`, and the
+       * CA certificate chain plus CRL are appended to form a
+       * complete certificate chain.
+       *
+       * @param certificate - output path for the signed certificate
+       * @param certificateSigningRequestFilename - path to the CSR
+       * @param params1 - signing parameters (validity, dates, SANs)
+       * @returns the path to the signed certificate
+       */
+      async signCertificateRequest(certificate, certificateSigningRequestFilename, params1) {
+        await ensure_openssl_installed();
+        assert9(fs9.existsSync(certificateSigningRequestFilename));
+        if (!certificateFileExist(certificate)) {
+          return "";
+        }
+        adjustDate(params1);
+        adjustApplicationUri(params1);
+        processAltNames(params1);
+        const options = { cwd: this.rootDir };
+        const csr = await readCertificateSigningRequest(certificateSigningRequestFilename);
+        const csrInfo = exploreCertificateSigningRequest(csr);
+        const applicationUri = csrInfo.extensionRequest.subjectAltName.uniformResourceIdentifier ? csrInfo.extensionRequest.subjectAltName.uniformResourceIdentifier[0] : void 0;
+        if (typeof applicationUri !== "string") {
+          throw new Error("Cannot find applicationUri in CSR");
+        }
+        const dns2 = csrInfo.extensionRequest.subjectAltName.dNSName || [];
+        let ip = csrInfo.extensionRequest.subjectAltName.iPAddress || [];
+        ip = ip.map(octetStringToIpAddress);
+        const params = {
+          applicationUri,
+          dns: dns2,
+          ip
+        };
+        processAltNames(params);
+        const configFile = generateStaticConfig("conf/caconfig.cnf", options);
+        displaySubtitle("- then we ask the authority to sign the certificate signing request");
+        const configOption = ` -config ${configFile}`;
+        await execute_openssl(
+          "ca " + configOption + " -startdate " + x509Date(params1.startDate) + " -enddate " + x509Date(params1.endDate) + " -batch -out " + q3(n4(certificate)) + " -in " + q3(n4(certificateSigningRequestFilename)),
+          options
+        );
+        displaySubtitle("- dump the certificate for a check");
+        await execute_openssl(`x509 -in ${q3(n4(certificate))}  -dates -fingerprint -purpose -noout`, options);
+        displaySubtitle("- construct CA certificate with CRL");
+        await this.constructCACertificateWithCRL();
+        displaySubtitle("- construct certificate chain");
+        await this.constructCertificateChain(certificate);
+        displaySubtitle("- verify certificate against the root CA");
+        await this.verifyCertificate(certificate);
+        return certificate;
+      }
+      /**
+       * Verify a certificate against this CA.
+       *
+       * @param certificate - path to the certificate file to verify
+       */
+      async verifyCertificate(certificate) {
+        const isImplemented = false;
+        if (isImplemented) {
+          const options = { cwd: this.rootDir };
+          const configFile = generateStaticConfig("conf/caconfig.cnf", options);
+          setEnv("OPENSSL_CONF", makePath(configFile));
+          const _configOption = ` -config ${configFile}`;
+          _configOption;
+          await execute_openssl_no_failure(
+            `verify -verbose  -CAfile ${q3(n4(this.caCertificateWithCrl))} ${q3(n4(certificate))}`,
+            options
+          );
+        }
+      }
+    };
+  }
+});
+
+// packages/node-opcua-pki/lib/ca/crypto_create_CA.ts
+import assert10 from "assert";
+import fs10 from "fs";
+import { createRequire } from "module";
+import os4 from "os";
+import path7 from "path";
+import chalk7 from "chalk";
+import { CertificatePurpose as CertificatePurpose2, generatePrivateKeyFile as generatePrivateKeyFile3, Subject as Subject5 } from "node-opcua-crypto";
+import commandLineArgs from "command-line-args";
+import commandLineUsage from "command-line-usage";
+function get_offset_date(date, nbDays) {
+  const d = new Date(date.getTime());
+  d.setDate(d.getDate() + nbDays);
+  return d;
+}
+async function construct_CertificateAuthority2(subject) {
+  assert10(typeof gLocalConfig.CAFolder === "string", "expecting a CAFolder in config");
+  assert10(typeof gLocalConfig.keySize === "number", "expecting a keySize in config");
+  if (!g_certificateAuthority) {
+    g_certificateAuthority = new CertificateAuthority({
+      keySize: gLocalConfig.keySize,
+      location: gLocalConfig.CAFolder,
+      subject
+    });
+    await g_certificateAuthority.initialize();
+  }
+}
+async function construct_CertificateManager() {
+  assert10(typeof gLocalConfig.PKIFolder === "string", "expecting a PKIFolder in config");
+  if (!certificateManager) {
+    certificateManager = new CertificateManager({
+      keySize: gLocalConfig.keySize,
+      location: gLocalConfig.PKIFolder
+    });
+    await certificateManager.initialize();
+  }
+}
+function default_template_content() {
+  if (process.pkg?.entrypoint) {
+    const a = fs10.readFileSync(path7.join(__dirname, "../../bin/pki_config.example.js"), "utf8");
+    return a;
+  }
+  function find_default_config_template() {
+    const rootFolder = find_module_root_folder();
+    const configName = "pki_config.example.js";
+    let default_config_template2 = path7.join(rootFolder, "bin", configName);
+    if (!fs10.existsSync(default_config_template2)) {
+      default_config_template2 = path7.join(__dirname, "..", configName);
+      if (!fs10.existsSync(default_config_template2)) {
+        default_config_template2 = path7.join(__dirname, `../bin/${configName}`);
+      }
+    }
+    return default_config_template2;
+  }
+  const default_config_template = find_default_config_template();
+  assert10(fs10.existsSync(default_config_template));
+  const default_config_template_content = fs10.readFileSync(default_config_template, "utf8");
+  return default_config_template_content;
+}
+function find_module_root_folder() {
+  let rootFolder = path7.join(__dirname);
+  for (let i = 0; i < 4; i++) {
+    if (fs10.existsSync(path7.join(rootFolder, "package.json"))) {
+      return rootFolder;
+    }
+    rootFolder = path7.join(rootFolder, "..");
+  }
+  assert10(fs10.existsSync(path7.join(rootFolder, "package.json")), "root folder must have a package.json file");
+  return rootFolder;
+}
+async function readConfiguration(argv) {
+  if (argv.silent) {
+    g_config.silent = true;
+  } else {
+    g_config.silent = false;
+  }
+  const fqdn2 = await extractFullyQualifiedDomainName();
+  const hostname = os4.hostname();
+  let certificateDir;
+  function performSubstitution(str) {
+    str = str.replace("{CWD}", process.cwd());
+    if (certificateDir) {
+      str = str.replace("{root}", certificateDir);
+    }
+    if (gLocalConfig?.PKIFolder) {
+      str = str.replace("{PKIFolder}", gLocalConfig.PKIFolder);
+    }
+    str = str.replace("{hostname}", hostname);
+    str = str.replace("%FQDN%", fqdn2);
+    return str;
+  }
+  function prepare(file) {
+    const tmp = path7.resolve(performSubstitution(file));
+    return makePath(tmp);
+  }
+  certificateDir = argv.root;
+  assert10(typeof certificateDir === "string");
+  certificateDir = prepare(certificateDir);
+  mkdirRecursiveSync(certificateDir);
+  assert10(fs10.existsSync(certificateDir));
+  const default_config = path7.join(certificateDir, "config.js");
+  if (!fs10.existsSync(default_config)) {
+    debugLog(chalk7.yellow(" Creating default g_config file "), chalk7.cyan(default_config));
+    const default_config_template_content = default_template_content();
+    fs10.writeFileSync(default_config, default_config_template_content);
+  } else {
+    debugLog(chalk7.yellow(" using  g_config file "), chalk7.cyan(default_config));
+  }
+  if (!fs10.existsSync(default_config)) {
+    debugLog(chalk7.redBright(" cannot find config file ", default_config));
+  }
+  const defaultRandomFile = path7.join(path7.dirname(default_config), "random.rnd");
+  setEnv("RANDFILE", defaultRandomFile);
+  const _require = createRequire(__filename);
+  gLocalConfig = _require(default_config);
+  gLocalConfig.subject = new Subject5(gLocalConfig.subject || "");
+  if (argv.subject) {
+    gLocalConfig.subject = new Subject5(argv.subject);
+  }
+  if (!gLocalConfig.subject.commonName) {
+    throw new Error("subject must have a Common Name");
+  }
+  gLocalConfig.certificateDir = certificateDir;
+  let CAFolder = argv.CAFolder || path7.join(certificateDir, "CA");
+  CAFolder = prepare(CAFolder);
+  gLocalConfig.CAFolder = CAFolder;
+  gLocalConfig.PKIFolder = path7.join(gLocalConfig.certificateDir, "PKI");
+  if (argv.PKIFolder) {
+    gLocalConfig.PKIFolder = prepare(argv.PKIFolder);
+  }
+  gLocalConfig.PKIFolder = prepare(gLocalConfig.PKIFolder);
+  if (argv.privateKey) {
+    gLocalConfig.privateKey = prepare(argv.privateKey);
+  }
+  if (argv.applicationUri) {
+    gLocalConfig.applicationUri = performSubstitution(argv.applicationUri);
+  }
+  if (argv.output) {
+    gLocalConfig.outputFile = argv.output;
+  }
+  gLocalConfig.altNames = [];
+  if (argv.altNames) {
+    gLocalConfig.altNames = argv.altNames.split(";");
+  }
+  gLocalConfig.dns = [getFullyQualifiedDomainName()];
+  if (argv.dns) {
+    gLocalConfig.dns = argv.dns.split(",").map(performSubstitution);
+  }
+  gLocalConfig.ip = [];
+  if (argv.ip) {
+    gLocalConfig.ip = argv.ip.split(",");
+  }
+  if (argv.keySize) {
+    const v = argv.keySize;
+    if (v !== 1024 && v !== 2048 && v !== 3072 && v !== 4096) {
+      throw new Error(`invalid keysize specified ${v} should be 1024,2048,3072 or 4096`);
+    }
+    gLocalConfig.keySize = argv.keySize;
+  }
+  if (argv.validity) {
+    gLocalConfig.validity = argv.validity;
+  }
+}
+async function createDefaultCertificate(base_name, prefix, key_length, applicationUri, dev) {
+  assert10(key_length === 1024 || key_length === 2048 || key_length === 3072 || key_length === 4096);
+  const private_key_file = makePath(base_name, `${prefix}key_${key_length}.pem`);
+  const public_key_file = makePath(base_name, `${prefix}public_key_${key_length}.pub`);
+  const certificate_file = makePath(base_name, `${prefix}cert_${key_length}.pem`);
+  const certificate_file_outofdate = makePath(base_name, `${prefix}cert_${key_length}_outofdate.pem`);
+  const certificate_file_not_active_yet = makePath(base_name, `${prefix}cert_${key_length}_not_active_yet.pem`);
+  const certificate_revoked = makePath(base_name, `${prefix}cert_${key_length}_revoked.pem`);
+  const self_signed_certificate_file = makePath(base_name, `${prefix}selfsigned_cert_${key_length}.pem`);
+  const fqdn2 = getFullyQualifiedDomainName();
+  const hostname = os4.hostname();
+  const dns2 = [
+    // for conformance reason, localhost shall not be present in the DNS field of COP
+    // ***FORBIDEN** "localhost",
+    getFullyQualifiedDomainName()
+  ];
+  if (hostname !== fqdn2) {
+    dns2.push(hostname);
+  }
+  const ip = [];
+  async function createCertificateIfNotExist(certificate, private_key, applicationUri2, startDate, validity) {
+    if (fs10.existsSync(certificate)) {
+      warningLog(chalk7.yellow("         certificate"), chalk7.cyan(certificate), chalk7.yellow(" already exists => skipping"));
+      return "";
+    } else {
+      return await createCertificate(certificate, private_key, applicationUri2, startDate, validity);
+    }
+  }
+  async function createCertificate(certificate, privateKey, applicationUri2, startDate, validity) {
+    const certificateSigningRequestFile = `${certificate}.csr`;
+    const configFile = makePath(base_name, "../certificates/PKI/own/openssl.cnf");
+    const dns3 = [os4.hostname()];
+    const ip2 = ["127.0.0.1"];
+    const params = {
+      applicationUri: applicationUri2,
+      privateKey,
+      rootDir: ".",
+      configFile,
+      dns: dns3,
+      ip: ip2,
+      purpose: CertificatePurpose2.ForApplication
+    };
+    await createCertificateSigningRequestWithOpenSSL(certificateSigningRequestFile, params);
+    return await g_certificateAuthority.signCertificateRequest(certificate, certificateSigningRequestFile, {
+      applicationUri: applicationUri2,
+      dns: dns3,
+      ip: ip2,
+      startDate,
+      validity
+    });
+  }
+  async function createSelfSignedCertificate2(certificate, private_key, applicationUri2, startDate, validity) {
+    await g_certificateAuthority.createSelfSignedCertificate(certificate, private_key, {
+      applicationUri: applicationUri2,
+      dns: dns2,
+      ip,
+      startDate,
+      validity
+    });
+  }
+  async function revoke_certificate(certificate) {
+    await g_certificateAuthority.revokeCertificate(certificate, {});
+  }
+  async function createPrivateKeyIfNotExist(privateKey, keyLength) {
+    if (fs10.existsSync(privateKey)) {
+      warningLog(chalk7.yellow("         privateKey"), chalk7.cyan(privateKey), chalk7.yellow(" already exists => skipping"));
+      return;
+    } else {
+      await generatePrivateKeyFile3(privateKey, keyLength);
+    }
+  }
+  displaySubtitle(` create private key :${private_key_file}`);
+  await createPrivateKeyIfNotExist(private_key_file, key_length);
+  displaySubtitle(` extract public key ${public_key_file} from private key `);
+  await getPublicKeyFromPrivateKey(private_key_file, public_key_file);
+  displaySubtitle(` create Certificate ${certificate_file}`);
+  await createCertificateIfNotExist(certificate_file, private_key_file, applicationUri, yesterday, 365);
+  displaySubtitle(` create self signed Certificate ${self_signed_certificate_file}`);
+  if (fs10.existsSync(self_signed_certificate_file)) {
+    return;
+  }
+  await createSelfSignedCertificate2(self_signed_certificate_file, private_key_file, applicationUri, yesterday, 365);
+  if (dev) {
+    await createCertificateIfNotExist(certificate_file_outofdate, private_key_file, applicationUri, two_years_ago, 365);
+    await createCertificateIfNotExist(certificate_file_not_active_yet, private_key_file, applicationUri, next_year, 365);
+    if (!fs10.existsSync(certificate_revoked)) {
+      const certificate = await createCertificateIfNotExist(
+        certificate_revoked,
+        private_key_file,
+        `${applicationUri}Revoked`,
+        // make sure we used a uniq URI here
+        yesterday,
+        365
+      );
+      warningLog(" certificate to revoke => ", certificate);
+      revoke_certificate(certificate_revoked);
+    }
+  }
+}
+async function wrap(func) {
+  try {
+    await func();
+  } catch (err) {
+    console.log(err.message);
+  }
+}
+async function create_default_certificates(dev) {
+  assert10(gLocalConfig);
+  const base_name = gLocalConfig.certificateDir || "";
+  assert10(fs10.existsSync(base_name));
+  let clientURN;
+  let serverURN;
+  let discoveryServerURN;
+  wrap(async () => {
+    await extractFullyQualifiedDomainName();
+    const hostname = os4.hostname();
+    const fqdn2 = getFullyQualifiedDomainName();
+    warningLog(chalk7.yellow("     hostname = "), chalk7.cyan(hostname));
+    warningLog(chalk7.yellow("     fqdn     = "), chalk7.cyan(fqdn2));
+    clientURN = makeApplicationUrn(hostname, "NodeOPCUA-Client");
+    serverURN = makeApplicationUrn(hostname, "NodeOPCUA-Server");
+    discoveryServerURN = makeApplicationUrn(hostname, "NodeOPCUA-DiscoveryServer");
+    displayTitle("Create  Application Certificate for Server & its private key");
+    await createDefaultCertificate(base_name, "client_", 1024, clientURN, dev);
+    await createDefaultCertificate(base_name, "client_", 2048, clientURN, dev);
+    await createDefaultCertificate(base_name, "client_", 3072, clientURN, dev);
+    await createDefaultCertificate(base_name, "client_", 4096, clientURN, dev);
+    displayTitle("Create  Application Certificate for Client & its private key");
+    await createDefaultCertificate(base_name, "server_", 1024, serverURN, dev);
+    await createDefaultCertificate(base_name, "server_", 2048, serverURN, dev);
+    await createDefaultCertificate(base_name, "server_", 3072, serverURN, dev);
+    await createDefaultCertificate(base_name, "server_", 4096, serverURN, dev);
+    displayTitle("Create  Application Certificate for DiscoveryServer & its private key");
+    await createDefaultCertificate(base_name, "discoveryServer_", 1024, discoveryServerURN, dev);
+    await createDefaultCertificate(base_name, "discoveryServer_", 2048, discoveryServerURN, dev);
+    await createDefaultCertificate(base_name, "discoveryServer_", 3072, discoveryServerURN, dev);
+    await createDefaultCertificate(base_name, "discoveryServer_", 4096, discoveryServerURN, dev);
+  });
+}
+async function createDefaultCertificates(dev) {
+  await construct_CertificateAuthority2("");
+  await construct_CertificateManager();
+  await create_default_certificates(dev);
+}
+function getOptions(names) {
+  return commonOptions.filter((o) => names.includes(o.name) || o.name === "help" || o.name === "silent");
+}
+function showHelp(command, description, options, usage) {
+  const sections = [
+    {
+      header: `Command: ${command}`,
+      content: description
+    },
+    {
+      header: "Usage",
+      content: usage || `$0 ${command} [options]`
+    },
+    {
+      header: "Options",
+      optionList: options
+    }
+  ];
+  console.log(commandLineUsage(sections));
+}
+async function main(argumentsList) {
+  const mainDefinitions = [{ name: "command", defaultOption: true }];
+  let mainOptions;
+  try {
+    mainOptions = commandLineArgs(mainDefinitions, { argv: argumentsList, stopAtFirstUnknown: true });
+  } catch (err) {
+    console.log(err.message);
+    return;
+  }
+  const argv = mainOptions._unknown || [];
+  const command = mainOptions.command;
+  if (!command || command === "help") {
+    console.log(
+      commandLineUsage([
+        {
+          header: "node-opcua-pki",
+          content: `PKI management for node-opcua
+
+${epilog}`
+        },
+        {
+          header: "Commands",
+          content: [
+            { name: "demo", summary: "create default certificate for node-opcua demos" },
+            { name: "createCA", summary: "create a Certificate Authority" },
+            { name: "createPKI", summary: "create a Public Key Infrastructure" },
+            { name: "certificate", summary: "create a new certificate" },
+            { name: "revoke <certificateFile>", summary: "revoke a existing certificate" },
+            { name: "csr", summary: "create a certificate signing request" },
+            { name: "sign", summary: "validate a certificate signing request and generate a certificate" },
+            { name: "dump <certificateFile>", summary: "display a certificate" },
+            { name: "toder <pemCertificate>", summary: "convert a certificate to a DER format with finger print" },
+            { name: "fingerprint <certificateFile>", summary: "print the certificate fingerprint" },
+            { name: "version", summary: "display the version number" }
+          ]
+        }
+      ])
+    );
+    return;
+  }
+  if (command === "version") {
+    const rootFolder = find_module_root_folder();
+    const pkg = JSON.parse(fs10.readFileSync(path7.join(rootFolder, "package.json"), "utf-8"));
+    console.log(pkg.version);
+    return;
+  }
+  if (command === "demo") {
+    const optionsDef = [
+      ...getOptions(["root", "silent"]),
+      { name: "dev", type: Boolean, description: "create all sort of fancy certificates for dev testing purposes" },
+      { name: "clean", type: Boolean, description: "Purge existing directory [use with care!]" }
+    ];
+    const local_argv = commandLineArgs(optionsDef, { argv });
+    if (local_argv.help)
+      return showHelp(
+        "demo",
+        "create default certificate for node-opcua demos",
+        optionsDef,
+        "$0 demo [--dev] [--silent] [--clean]"
+      );
+    await wrap(async () => {
+      await ensure_openssl_installed();
+      displayChapter("Create Demo certificates");
+      displayTitle("reading configuration");
+      await readConfiguration(local_argv);
+      if (local_argv.clean) {
+        displayTitle("Cleaning old certificates");
+        assert10(gLocalConfig);
+        const certificateDir = gLocalConfig.certificateDir || "";
+        const files = await fs10.promises.readdir(certificateDir);
+        for (const file of files) {
+          if (file.includes(".pem") || file.includes(".pub")) {
+            await fs10.promises.unlink(path7.join(certificateDir, file));
+          }
+        }
+        mkdirRecursiveSync(certificateDir);
+      }
+      displayTitle("create certificates");
+      await createDefaultCertificates(local_argv.dev);
+      displayChapter("Demo certificates  CREATED");
+    });
+    return;
+  }
+  if (command === "createCA") {
+    const optionsDef = [
+      ...getOptions(["root", "CAFolder", "keySize", "silent"]),
+      { name: "subject", type: String, defaultValue: defaultSubject, description: "the CA certificate subject" }
+    ];
+    const local_argv = commandLineArgs(optionsDef, { argv });
+    if (local_argv.help) return showHelp("createCA", "create a Certificate Authority", optionsDef);
+    await wrap(async () => {
+      await ensure_openssl_installed();
+      await readConfiguration(local_argv);
+      await construct_CertificateAuthority2(local_argv.subject);
+    });
+    return;
+  }
+  if (command === "createPKI") {
+    const optionsDef = getOptions(["root", "PKIFolder", "keySize", "silent"]);
+    const local_argv = commandLineArgs(optionsDef, { argv });
+    if (local_argv.help) return showHelp("createPKI", "create a Public Key Infrastructure", optionsDef);
+    await wrap(async () => {
+      await readConfiguration(local_argv);
+      await construct_CertificateManager();
+    });
+    return;
+  }
+  if (command === "certificate") {
+    const optionsDef = [
+      ...getOptions(["root", "CAFolder", "PKIFolder", "privateKey", "silent"]),
+      {
+        name: "applicationUri",
+        alias: "a",
+        type: String,
+        defaultValue: "urn:{hostname}:Node-OPCUA-Server",
+        description: "the application URI"
+      },
+      {
+        name: "output",
+        alias: "o",
+        type: String,
+        defaultValue: "my_certificate.pem",
+        description: "the name of the generated certificate =>"
+      },
+      {
+        name: "selfSigned",
+        alias: "s",
+        type: Boolean,
+        defaultValue: false,
+        description: "if true, certificate will be self-signed"
+      },
+      { name: "validity", alias: "v", type: Number, description: "the certificate validity in days" },
+      {
+        name: "dns",
+        type: String,
+        defaultValue: "{hostname}",
+        description: "the list of valid domain name (comma separated)"
+      },
+      { name: "ip", type: String, defaultValue: "", description: "the list of valid IPs (comma separated)" },
+      {
+        name: "subject",
+        type: String,
+        defaultValue: "",
+        description: "the certificate subject ( for instance C=FR/ST=Centre/L=Orleans/O=SomeOrganization/CN=Hello )"
+      }
+    ];
+    const local_argv = commandLineArgs(optionsDef, { argv });
+    if (local_argv.help || !local_argv.applicationUri || !local_argv.output)
+      return showHelp("certificate", "create a new certificate", optionsDef);
+    async function command_certificate(local_argv2) {
+      const selfSigned = !!local_argv2.selfSigned;
+      if (!selfSigned) {
+        await command_full_certificate(local_argv2);
+      } else {
+        await command_selfsigned_certificate(local_argv2);
+      }
+    }
+    async function command_selfsigned_certificate(local_argv2) {
+      const _fqdn = await extractFullyQualifiedDomainName();
+      await readConfiguration(local_argv2);
+      await construct_CertificateManager();
+      displaySubtitle(` create self signed Certificate ${gLocalConfig.outputFile}`);
+      let subject = local_argv2.subject && local_argv2.subject.length > 1 ? new Subject5(local_argv2.subject) : gLocalConfig.subject || "";
+      subject = JSON.parse(JSON.stringify(subject));
+      const params = {
+        applicationUri: gLocalConfig.applicationUri || "",
+        dns: gLocalConfig.dns || [],
+        ip: gLocalConfig.ip || [],
+        outputFile: gLocalConfig.outputFile || "self_signed_certificate.pem",
+        startDate: gLocalConfig.startDate || /* @__PURE__ */ new Date(),
+        subject,
+        validity: gLocalConfig.validity || 365
+      };
+      await certificateManager.createSelfSignedCertificate(params);
+    }
+    async function command_full_certificate(local_argv2) {
+      await readConfiguration(local_argv2);
+      await construct_CertificateManager();
+      await construct_CertificateAuthority2("");
+      assert10(fs10.existsSync(gLocalConfig.CAFolder || ""), " CA folder must exist");
+      gLocalConfig.privateKey = void 0;
+      gLocalConfig.subject = local_argv2.subject && local_argv2.subject.length > 1 ? local_argv2.subject : gLocalConfig.subject;
+      const csr_file = await certificateManager.createCertificateRequest(
+        gLocalConfig
+      );
+      if (!csr_file) {
+        return;
+      }
+      warningLog(" csr_file = ", csr_file);
+      const certificate = csr_file.replace(".csr", ".pem");
+      if (fs10.existsSync(certificate)) {
+        throw new Error(` File ${certificate} already exist`);
+      }
+      await g_certificateAuthority.signCertificateRequest(
+        certificate,
+        csr_file,
+        gLocalConfig
+      );
+      assert10(typeof gLocalConfig.outputFile === "string");
+      fs10.writeFileSync(gLocalConfig.outputFile || "", fs10.readFileSync(certificate, "ascii"));
+    }
+    await wrap(async () => await command_certificate(local_argv));
+    return;
+  }
+  if (command === "revoke") {
+    const optionsDef = [{ name: "certificateFile", type: String, defaultOption: true }, ...getOptions(["root", "CAFolder"])];
+    const local_argv = commandLineArgs(optionsDef, { argv });
+    if (local_argv.help || !local_argv.certificateFile)
+      return showHelp(
+        "revoke <certificateFile>",
+        "revoke a existing certificate",
+        optionsDef,
+        "$0 revoke my_certificate.pem"
+      );
+    async function revoke_certificate(certificate) {
+      await g_certificateAuthority.revokeCertificate(certificate, {});
+    }
+    await wrap(async () => {
+      const certificate = path7.resolve(local_argv.certificateFile);
+      warningLog(chalk7.yellow(" Certificate to revoke : "), chalk7.cyan(certificate));
+      if (!fs10.existsSync(certificate)) {
+        throw new Error(`cannot find certificate to revoke ${certificate}`);
+      }
+      await readConfiguration(local_argv);
+      await construct_CertificateAuthority2("");
+      await revoke_certificate(certificate);
+      warningLog("done ... ");
+      warningLog("  crl = ", g_certificateAuthority.revocationList);
+      warningLog("\nyou should now publish the new Certificate Revocation List");
+    });
+    return;
+  }
+  if (command === "csr") {
+    const optionsDef = [
+      ...getOptions(["root", "PKIFolder", "privateKey", "silent"]),
+      {
+        name: "applicationUri",
+        alias: "a",
+        type: String,
+        defaultValue: "urn:{hostname}:Node-OPCUA-Server",
+        description: "the application URI"
+      },
+      {
+        name: "output",
+        alias: "o",
+        type: String,
+        defaultValue: "my_certificate_signing_request.csr",
+        description: "the name of the generated signing_request"
+      },
+      {
+        name: "dns",
+        type: String,
+        defaultValue: "{hostname}",
+        description: "the list of valid domain name (comma separated)"
+      },
+      { name: "ip", type: String, defaultValue: "", description: "the list of valid IPs (comma separated)" },
+      {
+        name: "subject",
+        type: String,
+        defaultValue: "/CN=Certificate",
+        description: "the certificate subject ( for instance /C=FR/ST=Centre/L=Orleans/O=SomeOrganization/CN=Hello )"
+      }
+    ];
+    const local_argv = commandLineArgs(optionsDef, { argv });
+    if (local_argv.help) return showHelp("csr", "create a certificate signing request", optionsDef);
+    await wrap(async () => {
+      await readConfiguration(local_argv);
+      if (!fs10.existsSync(gLocalConfig.PKIFolder || "")) {
+        warningLog("PKI folder must exist");
+      }
+      await construct_CertificateManager();
+      if (!gLocalConfig.outputFile || fs10.existsSync(gLocalConfig.outputFile)) {
+        throw new Error(` File ${gLocalConfig.outputFile} already exist`);
+      }
+      gLocalConfig.privateKey = void 0;
+      gLocalConfig.subject = local_argv.subject && local_argv.subject.length > 1 ? local_argv.subject : gLocalConfig.subject;
+      const internal_csr_file = await certificateManager.createCertificateRequest(
+        gLocalConfig
+      );
+      if (!internal_csr_file) {
+        return;
+      }
+      if (!gLocalConfig.outputFile) {
+        warningLog("please specify a output file");
+        return;
+      }
+      const csr = await fs10.promises.readFile(internal_csr_file, "utf-8");
+      fs10.writeFileSync(gLocalConfig.outputFile || "", csr, "utf-8");
+      warningLog("Subject        = ", gLocalConfig.subject);
+      warningLog("applicationUri = ", gLocalConfig.applicationUri);
+      warningLog("altNames       = ", gLocalConfig.altNames);
+      warningLog("dns            = ", gLocalConfig.dns);
+      warningLog("ip             = ", gLocalConfig.ip);
+      warningLog("CSR file = ", gLocalConfig.outputFile);
+    });
+    return;
+  }
+  if (command === "sign") {
+    const optionsDef = [
+      ...getOptions(["root", "CAFolder", "silent"]),
+      { name: "csr", alias: "i", type: String, defaultValue: "my_certificate_signing_request.csr", description: "the csr" },
+      {
+        name: "output",
+        alias: "o",
+        type: String,
+        defaultValue: "my_certificate.pem",
+        description: "the name of the generated certificate"
+      },
+      { name: "validity", alias: "v", type: Number, defaultValue: 365, description: "the certificate validity in days" }
+    ];
+    const local_argv = commandLineArgs(optionsDef, { argv });
+    if (local_argv.help || !local_argv.csr || !local_argv.output)
+      return showHelp("sign", "validate a certificate signing request and generate a certificate", optionsDef);
+    await wrap(async () => {
+      await readConfiguration(local_argv);
+      if (!fs10.existsSync(gLocalConfig.CAFolder || "")) {
+        throw new Error(`CA folder must exist:${gLocalConfig.CAFolder}`);
+      }
+      await construct_CertificateAuthority2("");
+      const csr_file = path7.resolve(local_argv.csr || "");
+      if (!fs10.existsSync(csr_file)) {
+        throw new Error(`Certificate signing request doesn't exist: ${csr_file}`);
+      }
+      const certificate = path7.resolve(local_argv.output || csr_file.replace(".csr", ".pem"));
+      if (fs10.existsSync(certificate)) {
+        throw new Error(` File ${certificate} already exist`);
+      }
+      await g_certificateAuthority.signCertificateRequest(
+        certificate,
+        csr_file,
+        gLocalConfig
+      );
+      assert10(typeof gLocalConfig.outputFile === "string");
+      fs10.writeFileSync(gLocalConfig.outputFile || "", fs10.readFileSync(certificate, "ascii"));
+    });
+    return;
+  }
+  if (command === "dump") {
+    const optionsDef = [
+      { name: "certificateFile", type: String, defaultOption: true },
+      { name: "help", alias: "h", type: Boolean }
+    ];
+    const local_argv = commandLineArgs(optionsDef, { argv });
+    if (local_argv.help || !local_argv.certificateFile)
+      return showHelp("dump <certificateFile>", "display a certificate", optionsDef);
+    await wrap(async () => {
+      const data = await dumpCertificate(local_argv.certificateFile);
+      warningLog(data);
+    });
+    return;
+  }
+  if (command === "toder") {
+    const optionsDef = [
+      { name: "pemCertificate", type: String, defaultOption: true },
+      { name: "help", alias: "h", type: Boolean }
+    ];
+    const local_argv = commandLineArgs(optionsDef, { argv });
+    if (local_argv.help || !local_argv.pemCertificate)
+      return showHelp("toder <pemCertificate>", "convert a certificate to a DER format with finger print", optionsDef);
+    await wrap(async () => {
+      await toDer(local_argv.pemCertificate);
+    });
+    return;
+  }
+  if (command === "fingerprint") {
+    const optionsDef = [
+      { name: "certificateFile", type: String, defaultOption: true },
+      { name: "help", alias: "h", type: Boolean }
+    ];
+    const local_argv = commandLineArgs(optionsDef, { argv });
+    if (local_argv.help || !local_argv.certificateFile)
+      return showHelp("fingerprint <certificateFile>", "print the certificate fingerprint", optionsDef);
+    await wrap(async () => {
+      const certificate = local_argv.certificateFile;
+      const data = await fingerprint(certificate);
+      if (!data) return;
+      const s = data.split("=")[1].split(":").join("").trim();
+      warningLog(s);
+    });
+    return;
+  }
+  console.log(`Unknown command: ${command}`);
+}
+var epilog, today, yesterday, two_years_ago, next_year, gLocalConfig, g_certificateAuthority, certificateManager, commonOptions;
+var init_crypto_create_CA = __esm({
+  "packages/node-opcua-pki/lib/ca/crypto_create_CA.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_applicationurn();
+    init_hostname();
+    init_certificate_manager();
+    init_toolbox();
+    init_with_openssl();
+    init_certificate_authority();
+    epilog = "Copyright (c) sterfive - node-opcua - 2017-2026";
+    today = /* @__PURE__ */ new Date();
+    yesterday = get_offset_date(today, -1);
+    two_years_ago = get_offset_date(today, -2 * 365);
+    next_year = get_offset_date(today, 365);
+    gLocalConfig = {};
+    commonOptions = [
+      {
+        name: "root",
+        alias: "r",
+        type: String,
+        defaultValue: "{CWD}/certificates",
+        description: "the location of the Certificate folder"
+      },
+      {
+        name: "CAFolder",
+        alias: "c",
+        type: String,
+        defaultValue: "{root}/CA",
+        description: "the location of the Certificate Authority folder"
+      },
+      { name: "PKIFolder", type: String, defaultValue: "{root}/PKI", description: "the location of the Public Key Infrastructure" },
+      { name: "silent", type: Boolean, defaultValue: false, description: "minimize output" },
+      {
+        name: "privateKey",
+        alias: "p",
+        type: String,
+        defaultValue: "{PKIFolder}/own/private_key.pem",
+        description: "the private key to use to generate certificate"
+      },
+      {
+        name: "keySize",
+        alias: "k",
+        type: Number,
+        defaultValue: 2048,
+        description: "the private key size in bits (1024|2048|3072|4096)"
+      },
+      { name: "help", alias: "h", type: Boolean, description: "display this help" }
+    ];
+  }
+});
 
 // packages/node-opcua-pki/bin/pki.ts
-import { pki_main } from "node-opcua-pki";
 var require_pki = __commonJS({
   "packages/node-opcua-pki/bin/pki.ts"() {
     init_esm_shims();
-    pki_main(process.argv.splice(2));
+    init_crypto_create_CA();
+    main(process.argv.splice(2));
   }
 });
 export default require_pki();