node-opcua-server-configuration 2.166.0 → 2.168.0

package/source/server/trust_list_server.ts

@@ -2,13 +2,18 @@ import fs from "node:fs";
 import path from "node:path";
 import { BinaryStream } from "node-opcua-binary-stream";
 import type { OPCUACertificateManager } from "node-opcua-certificate-manager";
-import { readCertificate, readCertificateRevocationList } from "node-opcua-crypto";
+import { readCertificateChainAsync, readCertificateRevocationList } from "node-opcua-crypto";
 import { make_errorLog } from "node-opcua-debug";
 import type { AbstractFs } from "node-opcua-file-transfer";
 import { TrustListDataType } from "node-opcua-types";
 
 const errorLog = make_errorLog("TrustListServer");
 
+/**
+ * Read all certificate (chains) and CRLs in a folder
+ * @param folder
+ * @returns
+ */
 async function readAll(folder: string): Promise<Buffer[]> {
     const results: Buffer[] = [];
     const files = await fs.promises.readdir(folder);
@@ -16,8 +21,9 @@ async function readAll(folder: string): Promise<Buffer[]> {
         const file = path.join(folder, f);
         const ext = path.extname(file);
         if (ext === ".der" || ext === ".pem") {
-            const buf = await readCertificate(file);
-            results.push(buf);
+            const chain = await readCertificateChainAsync(file);
+            const concatenated = Buffer.concat(chain);
+            results.push(concatenated);
         } else if (ext === ".crl") {
             // Strict validation: only accept valid CRL files
             const buf = await readCertificateRevocationList(file);

package/dist/server/install_push_certitifate_management.js

@@ -1,178 +0,0 @@
-/**
- * @module node-opcua-server-configuration-server
- */
-import fs from "node:fs";
-import path from "node:path";
-import chalk from "chalk";
-import { assert } from "node-opcua-assert";
-import { readPrivateKey } from "node-opcua-crypto";
-import { convertPEMtoDER, split_der } from "node-opcua-crypto/web";
-import { checkDebugFlag, make_debugLog, make_errorLog } from "node-opcua-debug";
-import { getFullyQualifiedDomainName, getIpAddresses } from "node-opcua-hostname";
-import { installPushCertificateManagement } from "./push_certificate_manager_helpers.js";
-// node 14 onward : import {  readFile } from "fs/promises";
-const { readFile } = fs.promises;
-const debugLog = make_debugLog("ServerConfiguration");
-const errorLog = make_errorLog("ServerConfiguration");
-const doDebug = checkDebugFlag("ServerConfiguration");
-function getCertificate() {
-    if (!this.$$certificate) {
-        const certificateChain = getCertificateChain.call(this);
-        this.$$certificate = split_der(certificateChain)[0];
-    }
-    return this.$$certificate;
-}
-function getCertificateChain() {
-    if (!this.$$certificateChain) {
-        throw new Error("internal Error. cannot find $$certificateChain");
-    }
-    return this.$$certificateChain;
-}
-function getPrivateKey() {
-    // c8 ignore next
-    if (!this.$$privateKey) {
-        throw new Error("internal Error. cannot find $$privateKey");
-    }
-    return this.$$privateKey;
-}
-/**
- *
- */
-async function install() {
-    doDebug && debugLog("install push certificate management", this.serverCertificateManager.rootDir);
-    Object.defineProperty(this, "privateKeyFile", {
-        get: () => this.serverCertificateManager.privateKey,
-        configurable: true
-    });
-    Object.defineProperty(this, "certificateFile", {
-        get: () => path.join(this.serverCertificateManager.rootDir, "own/certs/certificate.pem"),
-        configurable: true
-    });
-    if (!this.$$privateKey) {
-        this.$$privateKey = readPrivateKey(this.serverCertificateManager.privateKey);
-    }
-    if (!this.$$certificateChain) {
-        const certificateFile = this.certificateFile;
-        if (!fs.existsSync(certificateFile)) {
-            // this is the first time server is launch
-            // let's create a default self signed certificate with limited validity
-            const fqdn = await getFullyQualifiedDomainName();
-            const ipAddresses = await getIpAddresses();
-            const applicationUri = (this.serverInfo ? this.serverInfo.applicationUri : null) || "uri:MISSING";
-            const options = {
-                applicationUri,
-                dns: [fqdn],
-                ip: ipAddresses,
-                subject: `/CN=${applicationUri};/L=Paris`,
-                startDate: new Date(),
-                validity: 365 * 5, // five year
-                /* */
-                outputFile: certificateFile
-            };
-            doDebug && debugLog("creating self signed certificate", options);
-            await this.serverCertificateManager.createSelfSignedCertificate(options);
-        }
-        const certificatePEM = await readFile(certificateFile, "utf8");
-        this.$$certificateChain = convertPEMtoDER(certificatePEM);
-        //  await this.serverCertificateManager.trustCertificate( this.$$certificateChain);
-    }
-}
-function getCertificateChainEP() {
-    const certificateFile = path.join(this.certificateManager.rootDir, "own/certs/certificate.pem");
-    const certificatePEM = fs.readFileSync(certificateFile, "utf8");
-    const $$certificateChain = convertPEMtoDER(certificatePEM);
-    return $$certificateChain;
-}
-function getPrivateKeyEP() {
-    const privateKey = readPrivateKey(this.certificateManager.privateKey);
-    return privateKey;
-}
-async function onCertificateAboutToChange(server) {
-    doDebug && debugLog(chalk.yellow(" onCertificateAboutToChange => Suspending End points"));
-    await server.suspendEndPoints();
-    doDebug && debugLog(chalk.yellow(" onCertificateAboutToChange => End points suspended"));
-}
-/**
- * onCertificateChange is called when the serverConfiguration notifies
- * that the server certificate and/or private key has changed.
- *
- * this function suspends all endpoint listeners and stop all existing channels
- * then start all endpoint listener
- *
- * @param server
- */
-async function onCertificateChange(server) {
-    doDebug && debugLog("on CertificateChanged");
-    const _server = server;
-    _server.$$privateKey = readPrivateKey(server.serverCertificateManager.privateKey);
-    const certificateFile = path.join(server.serverCertificateManager.rootDir, "own/certs/certificate.pem");
-    const certificatePEM = fs.readFileSync(certificateFile, "utf8");
-    const privateKeyFile = server.serverCertificateManager.privateKey;
-    const privateKey = readPrivateKey(privateKeyFile);
-    // also reread the private key
-    _server.$$certificateChain = convertPEMtoDER(certificatePEM);
-    _server.$$privateKey = privateKey;
-    // note : $$certificate will be reconstructed on demand
-    _server.$$certificate = split_der(_server.$$certificateChain)[0];
-    setTimeout(async () => {
-        try {
-            doDebug && debugLog(chalk.yellow(" onCertificateChange => shutting down channels"));
-            await server.shutdownChannels();
-            doDebug && debugLog(chalk.yellow(" onCertificateChange => channels shut down"));
-            doDebug && debugLog(chalk.yellow(" onCertificateChange => resuming end points"));
-            await server.resumeEndPoints();
-            doDebug && debugLog(chalk.yellow(" onCertificateChange => end points resumed"));
-            debugLog(chalk.yellow("channels have been closed -> client should reconnect "));
-        }
-        catch (err) {
-            errorLog("Error in CertificateChanged handler ", err.message);
-            debugLog("err = ", err);
-        }
-    }, 2000);
-}
-export async function installPushCertificateManagementOnServer(server) {
-    if (!server.engine || !server.engine.addressSpace) {
-        throw new Error("Server must have a valid address space." +
-            "you need to call installPushCertificateManagementOnServer after server has been initialized");
-    }
-    await install.call(server);
-    server.getCertificate = getCertificate;
-    server.getCertificateChain = getCertificateChain;
-    server.getPrivateKey = getPrivateKey;
-    for (const endpoint of server.endpoints) {
-        const endpointPriv = endpoint;
-        endpointPriv._certificateChain = null;
-        endpointPriv._privateKey = null;
-        endpoint.getCertificateChain = getCertificateChainEP;
-        endpoint.getPrivateKey = getPrivateKeyEP;
-        for (const e of endpoint.endpointDescriptions()) {
-            Object.defineProperty(e, "serverCertificate", {
-                get: () => endpoint.getCertificate(),
-                configurable: true
-            });
-        }
-    }
-    await installPushCertificateManagement(server.engine.addressSpace, {
-        applicationGroup: server.serverCertificateManager,
-        userTokenGroup: server.userCertificateManager,
-        applicationUri: server.serverInfo.applicationUri || "InvalidURI"
-    });
-    const serverConfiguration = server.engine.addressSpace.rootFolder.objects.server.getChildByName("ServerConfiguration");
-    const serverConfigurationPriv = serverConfiguration;
-    assert(serverConfigurationPriv.$pushCertificateManager);
-    serverConfigurationPriv.$pushCertificateManager.on("CertificateAboutToChange", (actionQueue) => {
-        actionQueue.push(async () => {
-            doDebug && debugLog("CertificateAboutToChange Event received");
-            await onCertificateAboutToChange(server);
-            doDebug && debugLog("CertificateAboutToChange Event processed");
-        });
-    });
-    serverConfigurationPriv.$pushCertificateManager.on("CertificateChanged", (actionQueue) => {
-        actionQueue.push(async () => {
-            doDebug && debugLog("CertificateChanged Event received");
-            await onCertificateChange(server);
-            doDebug && debugLog("CertificateChanged Event processed");
-        });
-    });
-}
-//# sourceMappingURL=install_push_certitifate_management.js.map

package/dist/server/install_push_certitifate_management.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"install_push_certitifate_management.js","sourceRoot":"","sources":["../../source/server/install_push_certitifate_management.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAG3C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAoB,eAAe,EAAmB,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAIlF,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AAGzF,4DAA4D;AAC5D,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC;AAEjC,MAAM,QAAQ,GAAG,aAAa,CAAC,qBAAqB,CAAC,CAAC;AACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,qBAAqB,CAAC,CAAC;AACtD,MAAM,OAAO,GAAG,cAAc,CAAC,qBAAqB,CAAC,CAAC;AAatD,SAAS,cAAc;IACnB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACtB,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC,aAAa,CAAC;AAC9B,CAAC;AAED,SAAS,mBAAmB;IACxB,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,CAAC,kBAAkB,CAAC;AACnC,CAAC;AAED,SAAS,aAAa;IAClB,iBAAiB;IACjB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC,YAAY,CAAC;AAC7B,CAAC;AAID;;GAEG;AACH,KAAK,UAAU,OAAO;IAClB,OAAO,IAAI,QAAQ,CAAC,qCAAqC,EAAE,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAElG,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,EAAE;QAC1C,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,UAAU;QACnD,YAAY,EAAE,IAAI;KACrB,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,iBAAiB,EAAE;QAC3C,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,2BAA2B,CAAC;QACxF,YAAY,EAAE,IAAI;KACrB,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACrB,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC3B,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAE7C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAClC,0CAA0C;YAC1C,uEAAuE;YAEvE,MAAM,IAAI,GAAG,MAAM,2BAA2B,EAAE,CAAC;YACjD,MAAM,WAAW,GAAG,MAAM,cAAc,EAAE,CAAC;YAE3C,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC;YAElG,MAAM,OAAO,GAAG;gBACZ,cAAc;gBAEd,GAAG,EAAE,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,WAAW;gBAEf,OAAO,EAAE,OAAO,cAAc,WAAW;gBAEzC,SAAS,EAAE,IAAI,IAAI,EAAE;gBAErB,QAAQ,EAAE,GAAG,GAAG,CAAC,EAAE,YAAY;gBAE/B,KAAK;gBACL,UAAU,EAAE,eAAe;aAC9B,CAAC;YAEF,OAAO,IAAI,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC,CAAC;YACjE,MAAM,IAAI,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAE/D,IAAI,CAAC,kBAAkB,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;QAE1D,mFAAmF;IACvF,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB;IAC1B,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;IAChG,MAAM,cAAc,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,kBAAkB,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;IAC3D,OAAO,kBAAkB,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe;IACpB,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACtE,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,MAAmB;IACzD,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC,CAAC;IAC1F,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;IAChC,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,qDAAqD,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,mBAAmB,CAAC,MAAmB;IAClD,OAAO,IAAI,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,MAAuC,CAAC;IAExD,OAAO,CAAC,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC;IAClF,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;IACxG,MAAM,cAAc,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAEhE,MAAM,cAAc,GAAG,MAAM,CAAC,wBAAwB,CAAC,UAAU,CAAC;IAClE,MAAM,UAAU,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;IAClD,8BAA8B;IAE9B,OAAO,CAAC,kBAAkB,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;IAC7D,OAAO,CAAC,YAAY,GAAG,UAAU,CAAC;IAClC,uDAAuD;IACvD,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjE,UAAU,CAAC,KAAK,IAAI,EAAE;QAClB,IAAI,CAAC;YACD,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,gDAAgD,CAAC,CAAC,CAAC;YACpF,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAChC,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,4CAA4C,CAAC,CAAC,CAAC;YAEhF,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC,CAAC;YACjF,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;YAC/B,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,4CAA4C,CAAC,CAAC,CAAC;YAEhF,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,uDAAuD,CAAC,CAAC,CAAC;QACpF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,QAAQ,CAAC,sCAAsC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YACzE,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;IACL,CAAC,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,MAAmB;IAC9E,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACX,yCAAyC;YACrC,6FAA6F,CACpG,CAAC;IACN,CAAC;IACD,MAAM,OAAO,CAAC,IAAI,CAAC,MAAuC,CAAC,CAAC;IAE5D,MAAM,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,MAAM,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IACjD,MAAM,CAAC,aAAa,GAAG,aAAa,CAAC;IAErC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,YAAY,GAA0B,QAA4C,CAAC;QACzF,YAAY,CAAC,iBAAiB,GAAG,IAAI,CAAC;QACtC,YAAY,CAAC,WAAW,GAAG,IAAI,CAAC;QAEhC,QAAQ,CAAC,mBAAmB,GAAG,qBAAqB,CAAC;QACrD,QAAQ,CAAC,aAAa,GAAG,eAAe,CAAC;QAEzC,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC9C,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,mBAAmB,EAAE;gBAC1C,GAAG,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE;gBACpC,YAAY,EAAE,IAAI;aACrB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,MAAM,gCAAgC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE;QAC/D,gBAAgB,EAAE,MAAM,CAAC,wBAAwB;QACjD,cAAc,EAAE,MAAM,CAAC,sBAAsB;QAE7C,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc,IAAI,YAAY;KACnE,CAAC,CAAC;IAEH,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC;IACvH,MAAM,uBAAuB,GAAG,mBAA8C,CAAC;IAC/E,MAAM,CAAC,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;IAExD,uBAAuB,CAAC,uBAAuB,CAAC,EAAE,CAAC,0BAA0B,EAAE,CAAC,WAAwB,EAAE,EAAE;QACxG,WAAW,CAAC,IAAI,CAAC,KAAK,IAAmB,EAAE;YACvC,OAAO,IAAI,QAAQ,CAAC,yCAAyC,CAAC,CAAC;YAC/D,MAAM,0BAA0B,CAAC,MAAM,CAAC,CAAC;YACzC,OAAO,IAAI,QAAQ,CAAC,0CAA0C,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IACH,uBAAuB,CAAC,uBAAuB,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,WAAwB,EAAE,EAAE;QAClG,WAAW,CAAC,IAAI,CAAC,KAAK,IAAmB,EAAE;YACvC,OAAO,IAAI,QAAQ,CAAC,mCAAmC,CAAC,CAAC;YACzD,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAClC,OAAO,IAAI,QAAQ,CAAC,oCAAoC,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC"}

package/source/server/install_push_certitifate_management.ts

@@ -1,250 +0,0 @@
-/**
- * @module node-opcua-server-configuration-server
- */
-import fs from "node:fs";
-import path from "node:path";
-
-import chalk from "chalk";
-
-import type { AddressSpace, UAServerConfiguration } from "node-opcua-address-space";
-import { assert } from "node-opcua-assert";
-import type { OPCUACertificateManager } from "node-opcua-certificate-manager";
-import type { ICertificateKeyPairProviderPriv } from "node-opcua-common";
-import { readPrivateKey } from "node-opcua-crypto";
-import { type Certificate, convertPEMtoDER, type PrivateKey, split_der } from "node-opcua-crypto/web";
-import { checkDebugFlag, make_debugLog, make_errorLog } from "node-opcua-debug";
-import { getFullyQualifiedDomainName, getIpAddresses } from "node-opcua-hostname";
-import type { OPCUAServer, OPCUAServerEndPoint } from "node-opcua-server";
-import type { ApplicationDescriptionOptions } from "node-opcua-types";
-
-import { installPushCertificateManagement } from "./push_certificate_manager_helpers.js";
-import type { ActionQueue, PushCertificateManagerServerImpl } from "./push_certificate_manager_server_impl.js";
-
-// node 14 onward : import {  readFile } from "fs/promises";
-const { readFile } = fs.promises;
-
-const debugLog = make_debugLog("ServerConfiguration");
-const errorLog = make_errorLog("ServerConfiguration");
-const doDebug = checkDebugFlag("ServerConfiguration");
-
-export interface OPCUAServerPartial extends ICertificateKeyPairProviderPriv {
-    serverInfo?: ApplicationDescriptionOptions;
-    serverCertificateManager: OPCUACertificateManager;
-    privateKeyFile: string;
-    certificateFile: string;
-    $$certificate: null | Certificate;
-    $$certificateChain: null | Certificate;
-    $$privateKey: null | PrivateKey;
-    engine: { addressSpace?: AddressSpace };
-}
-
-function getCertificate(this: OPCUAServerPartial): Certificate {
-    if (!this.$$certificate) {
-        const certificateChain = getCertificateChain.call(this);
-        this.$$certificate = split_der(certificateChain)[0];
-    }
-    return this.$$certificate;
-}
-
-function getCertificateChain(this: OPCUAServerPartial): Certificate {
-    if (!this.$$certificateChain) {
-        throw new Error("internal Error. cannot find $$certificateChain");
-    }
-    return this.$$certificateChain;
-}
-
-function getPrivateKey(this: OPCUAServerPartial): PrivateKey {
-    // c8 ignore next
-    if (!this.$$privateKey) {
-        throw new Error("internal Error. cannot find $$privateKey");
-    }
-    return this.$$privateKey;
-}
-
-
-
-/**
- *
- */
-async function install(this: OPCUAServerPartial): Promise<void> {
-    doDebug && debugLog("install push certificate management", this.serverCertificateManager.rootDir);
-
-    Object.defineProperty(this, "privateKeyFile", {
-        get: () => this.serverCertificateManager.privateKey,
-        configurable: true
-    });
-    Object.defineProperty(this, "certificateFile", {
-        get: () => path.join(this.serverCertificateManager.rootDir, "own/certs/certificate.pem"),
-        configurable: true
-    });
-
-    if (!this.$$privateKey) {
-        this.$$privateKey = readPrivateKey(this.serverCertificateManager.privateKey);
-    }
-
-    if (!this.$$certificateChain) {
-        const certificateFile = this.certificateFile;
-
-        if (!fs.existsSync(certificateFile)) {
-            // this is the first time server is launch
-            // let's create a default self signed certificate with limited validity
-
-            const fqdn = await getFullyQualifiedDomainName();
-            const ipAddresses = await getIpAddresses();
-
-            const applicationUri = (this.serverInfo ? this.serverInfo.applicationUri : null) || "uri:MISSING";
-
-            const options = {
-                applicationUri,
-
-                dns: [fqdn],
-                ip: ipAddresses,
-
-                subject: `/CN=${applicationUri};/L=Paris`,
-
-                startDate: new Date(),
-
-                validity: 365 * 5, // five year
-
-                /* */
-                outputFile: certificateFile
-            };
-
-            doDebug && debugLog("creating self signed certificate", options);
-            await this.serverCertificateManager.createSelfSignedCertificate(options);
-        }
-        const certificatePEM = await readFile(certificateFile, "utf8");
-
-        this.$$certificateChain = convertPEMtoDER(certificatePEM);
-
-        //  await this.serverCertificateManager.trustCertificate( this.$$certificateChain);
-    }
-}
-
-function getCertificateChainEP(this: OPCUAServerEndPoint): Certificate {
-    const certificateFile = path.join(this.certificateManager.rootDir, "own/certs/certificate.pem");
-    const certificatePEM = fs.readFileSync(certificateFile, "utf8");
-    const $$certificateChain = convertPEMtoDER(certificatePEM);
-    return $$certificateChain;
-}
-
-function getPrivateKeyEP(this: OPCUAServerEndPoint): PrivateKey {
-    const privateKey = readPrivateKey(this.certificateManager.privateKey);
-    return privateKey;
-}
-
-async function onCertificateAboutToChange(server: OPCUAServer) {
-    doDebug && debugLog(chalk.yellow(" onCertificateAboutToChange => Suspending End points"));
-    await server.suspendEndPoints();
-    doDebug && debugLog(chalk.yellow(" onCertificateAboutToChange => End points suspended"));
-}
-
-/**
- * onCertificateChange is called when the serverConfiguration notifies
- * that the server certificate and/or private key has changed.
- *
- * this function suspends all endpoint listeners and stop all existing channels
- * then start all endpoint listener
- *
- * @param server
- */
-async function onCertificateChange(server: OPCUAServer) {
-    doDebug && debugLog("on CertificateChanged");
-
-    const _server = server as unknown as OPCUAServerPartial;
-
-    _server.$$privateKey = readPrivateKey(server.serverCertificateManager.privateKey);
-    const certificateFile = path.join(server.serverCertificateManager.rootDir, "own/certs/certificate.pem");
-    const certificatePEM = fs.readFileSync(certificateFile, "utf8");
-
-    const privateKeyFile = server.serverCertificateManager.privateKey;
-    const privateKey = readPrivateKey(privateKeyFile);
-    // also reread the private key
-
-    _server.$$certificateChain = convertPEMtoDER(certificatePEM);
-    _server.$$privateKey = privateKey;
-    // note : $$certificate will be reconstructed on demand
-    _server.$$certificate = split_der(_server.$$certificateChain)[0];
-
-    setTimeout(async () => {
-        try {
-            doDebug && debugLog(chalk.yellow(" onCertificateChange => shutting down channels"));
-            await server.shutdownChannels();
-            doDebug && debugLog(chalk.yellow(" onCertificateChange => channels shut down"));
-
-            doDebug && debugLog(chalk.yellow(" onCertificateChange => resuming end points"));
-            await server.resumeEndPoints();
-            doDebug && debugLog(chalk.yellow(" onCertificateChange => end points resumed"));
-
-            debugLog(chalk.yellow("channels have been closed -> client should reconnect "));
-        } catch (err) {
-            errorLog("Error in CertificateChanged handler ", (err as Error).message);
-            debugLog("err = ", err);
-        }
-    }, 2000);
-}
-
-interface UAServerConfigurationEx extends UAServerConfiguration {
-    $pushCertificateManager: PushCertificateManagerServerImpl;
-}
-
-type OPCUAServerEndPointEx = typeof OPCUAServerEndPoint & {
-    _certificateChain: Buffer | null;
-    _privateKey: PrivateKey | null;
-};
-
-export async function installPushCertificateManagementOnServer(server: OPCUAServer): Promise<void> {
-    if (!server.engine || !server.engine.addressSpace) {
-        throw new Error(
-            "Server must have a valid address space." +
-                "you need to call installPushCertificateManagementOnServer after server has been initialized"
-        );
-    }
-    await install.call(server as unknown as OPCUAServerPartial);
-
-    server.getCertificate = getCertificate;
-    server.getCertificateChain = getCertificateChain;
-    server.getPrivateKey = getPrivateKey;
-
-    for (const endpoint of server.endpoints) {
-        const endpointPriv: OPCUAServerEndPointEx = endpoint as unknown as OPCUAServerEndPointEx;
-        endpointPriv._certificateChain = null;
-        endpointPriv._privateKey = null;
-
-        endpoint.getCertificateChain = getCertificateChainEP;
-        endpoint.getPrivateKey = getPrivateKeyEP;
-
-        for (const e of endpoint.endpointDescriptions()) {
-            Object.defineProperty(e, "serverCertificate", {
-                get: () => endpoint.getCertificate(),
-                configurable: true
-            });
-        }
-    }
-
-    await installPushCertificateManagement(server.engine.addressSpace, {
-        applicationGroup: server.serverCertificateManager,
-        userTokenGroup: server.userCertificateManager,
-
-        applicationUri: server.serverInfo.applicationUri || "InvalidURI"
-    });
-
-    const serverConfiguration = server.engine.addressSpace.rootFolder.objects.server.getChildByName("ServerConfiguration");
-    const serverConfigurationPriv = serverConfiguration as UAServerConfigurationEx;
-    assert(serverConfigurationPriv.$pushCertificateManager);
-
-    serverConfigurationPriv.$pushCertificateManager.on("CertificateAboutToChange", (actionQueue: ActionQueue) => {
-        actionQueue.push(async (): Promise<void> => {
-            doDebug && debugLog("CertificateAboutToChange Event received");
-            await onCertificateAboutToChange(server);
-            doDebug && debugLog("CertificateAboutToChange Event processed");
-        });
-    });
-    serverConfigurationPriv.$pushCertificateManager.on("CertificateChanged", (actionQueue: ActionQueue) => {
-        actionQueue.push(async (): Promise<void> => {
-            doDebug && debugLog("CertificateChanged Event received");
-            await onCertificateChange(server);
-            doDebug && debugLog("CertificateChanged Event processed");
-        });
-    });
-}