node-opcua-server-configuration 2.168.0 → 2.169.0

package/dist/server/push_certificate_manager/update_certificate.js

@@ -2,7 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { assert } from "node-opcua-assert";
 import { exploreCertificate, readPrivateKey } from "node-opcua-crypto";
-import { certificateMatchesPrivateKey, coercePEMorDerToPrivateKey, coercePrivateKeyPem, makeSHA1Thumbprint, toPem } from "node-opcua-crypto/web";
+import { certificateMatchesPrivateKey, coercePEMorDerToPrivateKey, coercePrivateKeyPem, combine_der, makeSHA1Thumbprint, toPem } from "node-opcua-crypto/web";
 import { checkDebugFlag, make_debugLog, make_warningLog } from "node-opcua-debug";
 import { StatusCodes } from "node-opcua-status-code";
 import { validateCertificateAndChain } from "../certificate_validation.js";
@@ -28,13 +28,25 @@ async function preInstallIssuerCertificates(serverImpl, certificateManager, issu
     }
 }
 // Helper: Stage main certificate to temporary files
-async function preInstallCertificate(serverImpl, certificateManager, certificate) {
+//
+// The PEM file contains the full chain (leaf + issuer CAs) so that
+// getCertificateChain() returns the complete chain.  This allows
+// OpenSecureChannel and CreateSession to present the full chain to
+// connecting clients, enabling them to build and verify the trust
+// path without needing all CA certificates pre-installed.
+async function preInstallCertificate(serverImpl, certificateManager, certificate, issuerCertificates) {
     const certFolder = certificateManager.ownCertFolder;
-    const destDER = path.join(certFolder, "certificate.der");
     const destPEM = path.join(certFolder, "certificate.pem");
-    const certificatePEM = toPem(certificate, "CERTIFICATE");
-    await serverImpl.fileTransactionManager.stageFile(destDER, certificate);
+    // Build the full chain: leaf first, then issuer CAs
+    const certificateChain = [certificate, ...(issuerCertificates ?? [])];
+    const certificatePEM = toPem(combine_der(certificateChain), "CERTIFICATE");
     await serverImpl.fileTransactionManager.stageFile(destPEM, certificatePEM, "utf-8");
+    // Clean up any leftover certificate.der from previous installations.
+    // Since DER is no longer written, a stale file would be misleading.
+    const legacyDER = path.join(certFolder, "certificate.der");
+    if (fs.existsSync(legacyDER)) {
+        serverImpl.fileTransactionManager.stageFileRemoval(legacyDER);
+    }
 }
 // Helper: Stage private key to temporary file
 async function preInstallPrivateKey(serverImpl, certificateManager, privateKeyFormat, privateKey) {
@@ -96,7 +108,7 @@ export async function executeUpdateCertificate(serverImpl, certificateGroupId, c
                 return { statusCode: StatusCodes.BadSecurityChecksFailed, applyChangesRequired: false };
             }
             await preInstallIssuerCertificates(serverImpl, certificateManager, issuerCertificates);
-            await preInstallCertificate(serverImpl, certificateManager, certificate);
+            await preInstallCertificate(serverImpl, certificateManager, certificate, issuerCertificates);
             serverImpl.emit("certificateUpdated", certificateGroupId, certificate);
             return { statusCode: StatusCodes.Good, applyChangesRequired: true };
         }
@@ -131,7 +143,7 @@ export async function executeUpdateCertificate(serverImpl, certificateGroupId, c
             }
             await preInstallPrivateKey(serverImpl, certificateManager, privateKeyFormat, tempPrivateKey);
             await preInstallIssuerCertificates(serverImpl, certificateManager, issuerCertificates);
-            await preInstallCertificate(serverImpl, certificateManager, certificate);
+            await preInstallCertificate(serverImpl, certificateManager, certificate, issuerCertificates);
             serverImpl.emit("certificateUpdated", certificateGroupId, certificate);
             return { statusCode: StatusCodes.Good, applyChangesRequired: true };
         }

package/dist/server/push_certificate_manager/update_certificate.js.map

@@ -1 +1 @@
-{"version":3,"file":"update_certificate.js","sourceRoot":"","sources":["../../../source/server/push_certificate_manager/update_certificate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAG3C,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EACH,4BAA4B,EAC5B,0BAA0B,EAC1B,mBAAmB,EACnB,kBAAkB,EAElB,KAAK,EACR,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAElF,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAGrD,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAE9G,MAAM,UAAU,GAAG,eAAe,CAAC,qBAAqB,CAAC,CAAC;AAC1D,MAAM,QAAQ,GAAG,aAAa,CAAC,qBAAqB,CAAC,CAAC;AACtD,MAAM,OAAO,GAAG,cAAc,CAAC,qBAAqB,CAAC,CAAC;AAEtD,uDAAuD;AACvD,KAAK,UAAU,4BAA4B,CACvC,UAAiD,EACjD,kBAAsC,EACtC,kBAA4C;IAE5C,IAAI,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,YAAY,GAAG,kBAAkB,CAAC,iBAAiB,CAAC;QAC1D,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE3D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,kBAAkB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAElE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,UAAU,MAAM,CAAC,CAAC;YAC/E,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,UAAU,MAAM,CAAC,CAAC;YAC/E,MAAM,aAAa,GAAG,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAEvD,MAAM,UAAU,CAAC,sBAAsB,CAAC,SAAS,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;YAClF,MAAM,UAAU,CAAC,sBAAsB,CAAC,SAAS,CAAC,kBAAkB,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;YAE9F,OAAO,IAAI,QAAQ,CAAC,6BAA6B,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC,CAAC;QAC1G,CAAC;IACL,CAAC;AACL,CAAC;AAED,oDAAoD;AACpD,KAAK,UAAU,qBAAqB,CAChC,UAAiD,EACjD,kBAAsC,EACtC,WAAmB;IAEnB,MAAM,UAAU,GAAG,kBAAkB,CAAC,aAAa,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAEzD,MAAM,UAAU,CAAC,sBAAsB,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACxE,MAAM,UAAU,CAAC,sBAAsB,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;AACxF,CAAC;AAED,8CAA8C;AAC9C,KAAK,UAAU,oBAAoB,CAC/B,UAAiD,EACjD,kBAAsC,EACtC,gBAAwB,EACxB,UAAuC;IAEvC,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAEjD,IAAI,UAAU,EAAE,CAAC;QACb,MAAM,aAAa,GAAG,0BAA0B,CAAC,UAA6B,CAAC,CAAC;QAChF,MAAM,aAAa,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAC;QACzD,MAAM,UAAU,CAAC,sBAAsB,CAAC,SAAS,CAAC,kBAAkB,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAC7G,CAAC;AACL,CAAC;AAED,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC1C,UAAiD,EACjD,kBAAmC,EACnC,iBAAkC,EAClC,WAAmB,EACnB,kBAAgC,EAChC,gBAAyB,EACzB,UAA4B;IAE5B,IAAI,UAAU,CAAC,mBAAmB,EAAE,CAAC;QACjC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;IACzF,CAAC;IAED,UAAU,CAAC,mBAAmB,GAAG,IAAI,CAAC;IACtC,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,8BAA8B,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;QAC/E,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAChE,QAAQ,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;YACpD,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,kBAAkB,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;QACvF,CAAC;QAED,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;QAErD,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,iBAAiB,EAAE,YAAY,IAAI,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC;YAC3F,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;gBAC7C,MAAM,SAAS,GAAG,wBAAwB,CAAC,kBAAkB,CAAC,CAAC;gBAC/D,MAAM,WAAW,GAAG,YAAY,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,aAAa,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,gBAAgB,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,cAAc,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;gBAEhQ,UAAU,CACN,oBAAoB,iBAAiB,yDAAyD,SAAS,MAAM,kBAAkB,CAAC,QAAQ,EAAE,sBAAsB,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,WAAW,EAAE,CAC9P,CAAC;YACN,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,wCAAwC;gBACxC,UAAU,CACN,oBAAoB,iBAAiB,yDAAyD,kBAAkB,CAAC,QAAQ,EAAE,sBAAsB,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA2C,GAAa,CAAC,OAAO,EAAE,CACvQ,CAAC;YACN,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;QAC1F,CAAC;QAED,MAAM,kBAAkB,GAAG,kBAAkB,KAAK,UAAU,CAAC,gBAAgB,CAAC;QAC9E,MAAM,gBAAgB,GAAG,MAAM,2BAA2B,CACtD,kBAA6C,EAC7C,kBAAkB,EAClB,WAAW,EACX,kBAAkB,CACrB,CAAC;QAEF,IAAI,gBAAgB,CAAC,UAAU,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;YAC3D,OAAO,EAAE,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;QACpF,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAE5F,MAAM,mBAAmB,GAAG,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,KAAK,IAAI,IAAI,gBAAgB,KAAK,EAAE,CAAC;QACnH,MAAM,aAAa,GACf,UAAU,KAAK,SAAS;YACxB,UAAU,KAAK,IAAI;YACnB,UAAU,KAAK,EAAE;YACjB,CAAC,CAAC,UAAU,YAAY,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QAE/D,IAAI,mBAAmB,KAAK,aAAa,EAAE,CAAC;YACxC,UAAU,CAAC,0EAA0E,CAAC,CAAC;YACvF,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;YAC3D,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,kBAAkB,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;QACvF,CAAC;QAED,IAAI,CAAC,mBAAmB,IAAI,CAAC,aAAa,EAAE,CAAC;YACzC,MAAM,aAAa,GAAG,cAAc,CAChC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAU,CACjH,CAAC;YAEF,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC5D,UAAU,CAAC,sCAAsC,CAAC,CAAC;gBACnD,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;gBAC3D,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,uBAAuB,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;YAC5F,CAAC;YAED,MAAM,4BAA4B,CAAC,UAAU,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;YACvF,MAAM,qBAAqB,CAAC,UAAU,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;YACzE,UAAU,CAAC,IAAI,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;YACvE,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;QACxE,CAAC;aAAM,CAAC;YACJ,IAAI,gBAAgB,KAAK,KAAK,IAAI,gBAAgB,KAAK,KAAK,EAAE,CAAC;gBAC3D,UAAU,CAAC,wDAAwD,gBAAgB,EAAE,CAAC,CAAC;gBACvF,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;gBAC3D,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,eAAe,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;YACpF,CAAC;YACD,IAAI,gBAAgB,KAAK,KAAK,EAAE,CAAC;gBAC7B,UAAU,CAAC,qEAAqE,gBAAgB,EAAE,CAAC,CAAC;gBACpG,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;gBAC3D,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,eAAe,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;YACpF,CAAC;YAED,IAAI,aAAqC,CAAC;YAC1C,IAAI,cAAc,GAAG,UAAU,CAAC;YAEhC,IAAI,cAAc,YAAY,MAAM,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;gBACzE,IAAI,cAAc,YAAY,MAAM,EAAE,CAAC;oBACnC,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC;oBACnC,cAAc,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACtD,CAAC;gBACD,aAAa,GAAG,0BAA0B,CAAC,cAAc,CAAC,CAAC;YAC/D,CAAC;YAED,IAAI,CAAC,aAAa,EAAE,CAAC;gBACjB,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;gBAC3D,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,eAAe,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;YACpF,CAAC;YAED,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC5D,UAAU,CAAC,sCAAsC,CAAC,CAAC;gBACnD,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;gBAC3D,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,uBAAuB,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;YAC5F,CAAC;YAED,MAAM,oBAAoB,CAAC,UAAU,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;YAC7F,MAAM,4BAA4B,CAAC,UAAU,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;YACvF,MAAM,qBAAqB,CAAC,UAAU,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;YAEzE,UAAU,CAAC,IAAI,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;YACvE,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;QACxE,CAAC;IACL,CAAC;YAAS,CAAC;QACP,UAAU,CAAC,mBAAmB,GAAG,KAAK,CAAC;IAC3C,CAAC;AACL,CAAC"}
+{"version":3,"file":"update_certificate.js","sourceRoot":"","sources":["../../../source/server/push_certificate_manager/update_certificate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAG3C,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EACH,4BAA4B,EAE5B,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACX,kBAAkB,EAElB,KAAK,EACR,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAElF,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAGrD,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAE9G,MAAM,UAAU,GAAG,eAAe,CAAC,qBAAqB,CAAC,CAAC;AAC1D,MAAM,QAAQ,GAAG,aAAa,CAAC,qBAAqB,CAAC,CAAC;AACtD,MAAM,OAAO,GAAG,cAAc,CAAC,qBAAqB,CAAC,CAAC;AAEtD,uDAAuD;AACvD,KAAK,UAAU,4BAA4B,CACvC,UAAiD,EACjD,kBAAsC,EACtC,kBAA4C;IAE5C,IAAI,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,YAAY,GAAG,kBAAkB,CAAC,iBAAiB,CAAC;QAC1D,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE3D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,kBAAkB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAElE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,UAAU,MAAM,CAAC,CAAC;YAC/E,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,UAAU,MAAM,CAAC,CAAC;YAC/E,MAAM,aAAa,GAAG,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAEvD,MAAM,UAAU,CAAC,sBAAsB,CAAC,SAAS,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;YAClF,MAAM,UAAU,CAAC,sBAAsB,CAAC,SAAS,CAAC,kBAAkB,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;YAE9F,OAAO,IAAI,QAAQ,CAAC,6BAA6B,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC,CAAC;QAC1G,CAAC;IACL,CAAC;AACL,CAAC;AAED,oDAAoD;AACpD,EAAE;AACF,mEAAmE;AACnE,iEAAiE;AACjE,mEAAmE;AACnE,kEAAkE;AAClE,0DAA0D;AAC1D,KAAK,UAAU,qBAAqB,CAChC,UAAiD,EACjD,kBAAsC,EACtC,WAAwB,EACxB,kBAAkC;IAElC,MAAM,UAAU,GAAG,kBAAkB,CAAC,aAAa,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAEzD,oDAAoD;IACpD,MAAM,gBAAgB,GAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,cAAc,GAAG,KAAK,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,aAAa,CAAC,CAAC;IAE3E,MAAM,UAAU,CAAC,sBAAsB,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;IAEpF,qEAAqE;IACrE,oEAAoE;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAClE,CAAC;AACL,CAAC;AAED,8CAA8C;AAC9C,KAAK,UAAU,oBAAoB,CAC/B,UAAiD,EACjD,kBAAsC,EACtC,gBAAwB,EACxB,UAAuC;IAEvC,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAEjD,IAAI,UAAU,EAAE,CAAC;QACb,MAAM,aAAa,GAAG,0BAA0B,CAAC,UAA6B,CAAC,CAAC;QAChF,MAAM,aAAa,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAC;QACzD,MAAM,UAAU,CAAC,sBAAsB,CAAC,SAAS,CAAC,kBAAkB,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAC7G,CAAC;AACL,CAAC;AAED,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC1C,UAAiD,EACjD,kBAAmC,EACnC,iBAAkC,EAClC,WAAmB,EACnB,kBAAgC,EAChC,gBAAyB,EACzB,UAA4B;IAE5B,IAAI,UAAU,CAAC,mBAAmB,EAAE,CAAC;QACjC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;IACzF,CAAC;IAED,UAAU,CAAC,mBAAmB,GAAG,IAAI,CAAC;IACtC,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,8BAA8B,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;QAC/E,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAChE,QAAQ,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;YACpD,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,kBAAkB,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;QACvF,CAAC;QAED,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;QAErD,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,iBAAiB,EAAE,YAAY,IAAI,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC;YAC3F,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;gBAC7C,MAAM,SAAS,GAAG,wBAAwB,CAAC,kBAAkB,CAAC,CAAC;gBAC/D,MAAM,WAAW,GAAG,YAAY,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,aAAa,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,gBAAgB,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,cAAc,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;gBAEhQ,UAAU,CACN,oBAAoB,iBAAiB,yDAAyD,SAAS,MAAM,kBAAkB,CAAC,QAAQ,EAAE,sBAAsB,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,WAAW,EAAE,CAC9P,CAAC;YACN,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,wCAAwC;gBACxC,UAAU,CACN,oBAAoB,iBAAiB,yDAAyD,kBAAkB,CAAC,QAAQ,EAAE,sBAAsB,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA2C,GAAa,CAAC,OAAO,EAAE,CACvQ,CAAC;YACN,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;QAC1F,CAAC;QAED,MAAM,kBAAkB,GAAG,kBAAkB,KAAK,UAAU,CAAC,gBAAgB,CAAC;QAC9E,MAAM,gBAAgB,GAAG,MAAM,2BAA2B,CACtD,kBAA6C,EAC7C,kBAAkB,EAClB,WAAW,EACX,kBAAkB,CACrB,CAAC;QAEF,IAAI,gBAAgB,CAAC,UAAU,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;YAC3D,OAAO,EAAE,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;QACpF,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAE5F,MAAM,mBAAmB,GAAG,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,KAAK,IAAI,IAAI,gBAAgB,KAAK,EAAE,CAAC;QACnH,MAAM,aAAa,GACf,UAAU,KAAK,SAAS;YACxB,UAAU,KAAK,IAAI;YACnB,UAAU,KAAK,EAAE;YACjB,CAAC,CAAC,UAAU,YAAY,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QAE/D,IAAI,mBAAmB,KAAK,aAAa,EAAE,CAAC;YACxC,UAAU,CAAC,0EAA0E,CAAC,CAAC;YACvF,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;YAC3D,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,kBAAkB,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;QACvF,CAAC;QAED,IAAI,CAAC,mBAAmB,IAAI,CAAC,aAAa,EAAE,CAAC;YACzC,MAAM,aAAa,GAAG,cAAc,CAChC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAU,CACjH,CAAC;YAEF,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC5D,UAAU,CAAC,sCAAsC,CAAC,CAAC;gBACnD,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;gBAC3D,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,uBAAuB,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;YAC5F,CAAC;YAED,MAAM,4BAA4B,CAAC,UAAU,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;YACvF,MAAM,qBAAqB,CAAC,UAAU,EAAE,kBAAkB,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;YAC7F,UAAU,CAAC,IAAI,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;YACvE,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;QACxE,CAAC;aAAM,CAAC;YACJ,IAAI,gBAAgB,KAAK,KAAK,IAAI,gBAAgB,KAAK,KAAK,EAAE,CAAC;gBAC3D,UAAU,CAAC,wDAAwD,gBAAgB,EAAE,CAAC,CAAC;gBACvF,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;gBAC3D,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,eAAe,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;YACpF,CAAC;YACD,IAAI,gBAAgB,KAAK,KAAK,EAAE,CAAC;gBAC7B,UAAU,CAAC,qEAAqE,gBAAgB,EAAE,CAAC,CAAC;gBACpG,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;gBAC3D,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,eAAe,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;YACpF,CAAC;YAED,IAAI,aAAqC,CAAC;YAC1C,IAAI,cAAc,GAAG,UAAU,CAAC;YAEhC,IAAI,cAAc,YAAY,MAAM,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;gBACzE,IAAI,cAAc,YAAY,MAAM,EAAE,CAAC;oBACnC,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC;oBACnC,cAAc,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACtD,CAAC;gBACD,aAAa,GAAG,0BAA0B,CAAC,cAAc,CAAC,CAAC;YAC/D,CAAC;YAED,IAAI,CAAC,aAAa,EAAE,CAAC;gBACjB,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;gBAC3D,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,eAAe,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;YACpF,CAAC;YAED,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC5D,UAAU,CAAC,sCAAsC,CAAC,CAAC;gBACnD,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;gBAC3D,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,uBAAuB,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;YAC5F,CAAC;YAED,MAAM,oBAAoB,CAAC,UAAU,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;YAC7F,MAAM,4BAA4B,CAAC,UAAU,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;YACvF,MAAM,qBAAqB,CAAC,UAAU,EAAE,kBAAkB,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;YAE7F,UAAU,CAAC,IAAI,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;YACvE,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;QACxE,CAAC;IACL,CAAC;YAAS,CAAC;QACP,UAAU,CAAC,mBAAmB,GAAG,KAAK,CAAC;IAC3C,CAAC;AACL,CAAC"}

package/dist/server/trust_list_server.js

@@ -18,6 +18,11 @@ async function readAll(folder) {
         const ext = path.extname(file);
         if (ext === ".der" || ext === ".pem") {
             const chain = await readCertificateChainAsync(file);
+            // Return the full chain as a single ByteString.
+            // When addTrustedCertificateFromChain stores a chain-on-disk
+            // (leaf + issuer CAs in a single PEM), we preserve that
+            // chain so clients reading the TrustList can use it for
+            // chain-building.
             const concatenated = Buffer.concat(chain);
             results.push(concatenated);
         }

package/dist/server/trust_list_server.js.map

@@ -1 +1 @@
-{"version":3,"file":"trust_list_server.js","sourceRoot":"","sources":["../../source/server/trust_list_server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,MAAM,QAAQ,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAAC;AAElD;;;;GAIG;AACH,KAAK,UAAU,OAAO,CAAC,MAAc;IACjC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACxB,iDAAiD;YACjD,MAAM,GAAG,GAAG,MAAM,6BAA6B,CAAC,IAAI,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACJ,QAAQ,CAAC,6BAA6B,EAAE,CAAC,CAAC,CAAC;QAC/C,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,MAAM,CAAN,IAAY,cAOX;AAPD,WAAY,cAAc;IACtB,mDAAQ,CAAA;IACR,iFAAuB,CAAA;IACvB,iEAAe,CAAA;IACf,+EAAsB,CAAA;IACtB,+DAAc,CAAA;IACd,kDAAQ,CAAA;AACZ,CAAC,EAPW,cAAc,KAAd,cAAc,QAOzB;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,kBAA2C,EAC3C,aAA6B;IAE7B,MAAM,SAAS,GAAG,IAAI,iBAAiB,CAAC;QACpC,cAAc,EAAE,aAAa;QAC7B,kBAAkB,EAAE,SAAS;QAC7B,UAAU,EAAE,SAAS;QACrB,mBAAmB,EAAE,SAAS;QAC9B,WAAW,EAAE,SAAS;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,aAAa,GAAG,cAAc,CAAC,mBAAmB,CAAC,KAAK,cAAc,CAAC,mBAAmB,EAAE,CAAC;QAC9F,SAAS,CAAC,mBAAmB,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,aAAa,GAAG,cAAc,CAAC,WAAW,CAAC,KAAK,cAAc,CAAC,WAAW,EAAE,CAAC;QAC9E,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC;QAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,SAAS,CAAC,WAAW,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACJ,SAAS,CAAC,WAAW,GAAG,EAAE,CAAC;QAC/B,CAAC;IACL,CAAC;IACD,IAAI,CAAC,aAAa,GAAG,cAAc,CAAC,kBAAkB,CAAC,KAAK,cAAc,CAAC,kBAAkB,EAAE,CAAC;QAC5F,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,iBAAiB,CAAC;QAC/D,IAAI,EAAE,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACnC,SAAS,CAAC,kBAAkB,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACJ,SAAS,CAAC,kBAAkB,GAAG,EAAE,CAAC;QACtC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,aAAa,GAAG,cAAc,CAAC,UAAU,CAAC,KAAK,cAAc,CAAC,UAAU,EAAE,CAAC;QAC5E,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,gBAAgB,CAAC;QAC7D,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClC,SAAS,CAAC,UAAU,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACJ,SAAS,CAAC,UAAU,GAAG,EAAE,CAAC;QAC9B,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,EAAc,EACd,QAAgB,EAChB,aAA6B,EAE7B,kBAA2C;IAE3C,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7D,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YACpD,IAAI,GAAG;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"trust_list_server.js","sourceRoot":"","sources":["../../source/server/trust_list_server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,MAAM,QAAQ,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAAC;AAElD;;;;GAIG;AACH,KAAK,UAAU,OAAO,CAAC,MAAc;IACjC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,CAAC;YACpD,gDAAgD;YAChD,6DAA6D;YAC7D,wDAAwD;YACxD,wDAAwD;YACxD,kBAAkB;YAClB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACxB,iDAAiD;YACjD,MAAM,GAAG,GAAG,MAAM,6BAA6B,CAAC,IAAI,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACJ,QAAQ,CAAC,6BAA6B,EAAE,CAAC,CAAC,CAAC;QAC/C,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,MAAM,CAAN,IAAY,cAOX;AAPD,WAAY,cAAc;IACtB,mDAAQ,CAAA;IACR,iFAAuB,CAAA;IACvB,iEAAe,CAAA;IACf,+EAAsB,CAAA;IACtB,+DAAc,CAAA;IACd,kDAAQ,CAAA;AACZ,CAAC,EAPW,cAAc,KAAd,cAAc,QAOzB;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,kBAA2C,EAC3C,aAA6B;IAE7B,MAAM,SAAS,GAAG,IAAI,iBAAiB,CAAC;QACpC,cAAc,EAAE,aAAa;QAC7B,kBAAkB,EAAE,SAAS;QAC7B,UAAU,EAAE,SAAS;QACrB,mBAAmB,EAAE,SAAS;QAC9B,WAAW,EAAE,SAAS;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,aAAa,GAAG,cAAc,CAAC,mBAAmB,CAAC,KAAK,cAAc,CAAC,mBAAmB,EAAE,CAAC;QAC9F,SAAS,CAAC,mBAAmB,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,aAAa,GAAG,cAAc,CAAC,WAAW,CAAC,KAAK,cAAc,CAAC,WAAW,EAAE,CAAC;QAC9E,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC;QAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,SAAS,CAAC,WAAW,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACJ,SAAS,CAAC,WAAW,GAAG,EAAE,CAAC;QAC/B,CAAC;IACL,CAAC;IACD,IAAI,CAAC,aAAa,GAAG,cAAc,CAAC,kBAAkB,CAAC,KAAK,cAAc,CAAC,kBAAkB,EAAE,CAAC;QAC5F,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,iBAAiB,CAAC;QAC/D,IAAI,EAAE,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACnC,SAAS,CAAC,kBAAkB,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACJ,SAAS,CAAC,kBAAkB,GAAG,EAAE,CAAC;QACtC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,aAAa,GAAG,cAAc,CAAC,UAAU,CAAC,KAAK,cAAc,CAAC,UAAU,EAAE,CAAC;QAC5E,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,gBAAgB,CAAC;QAC7D,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClC,SAAS,CAAC,UAAU,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACJ,SAAS,CAAC,UAAU,GAAG,EAAE,CAAC;QAC9B,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,EAAc,EACd,QAAgB,EAChB,aAA6B,EAE7B,kBAA2C;IAE3C,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7D,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YACpD,IAAI,GAAG;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "node-opcua-server-configuration",
-    "version": "2.168.0",
+    "version": "2.169.0",
     "description": "pure nodejs OPCUA SDK - module server-configuration",
     "scripts": {
         "build": "tsc -b",
@@ -15,34 +15,34 @@
     "dependencies": {
         "chalk": "4.1.2",
         "memfs": "^4.57.1",
-        "node-opcua-address-space": "2.168.0",
-        "node-opcua-address-space-base": "2.168.0",
+        "node-opcua-address-space": "2.169.0",
+        "node-opcua-address-space-base": "2.169.0",
         "node-opcua-assert": "2.164.0",
-        "node-opcua-basic-types": "2.168.0",
-        "node-opcua-binary-stream": "2.168.0",
-        "node-opcua-certificate-manager": "2.168.0",
-        "node-opcua-common": "2.168.0",
+        "node-opcua-basic-types": "2.169.0",
+        "node-opcua-binary-stream": "2.169.0",
+        "node-opcua-certificate-manager": "2.169.0",
+        "node-opcua-common": "2.169.0",
         "node-opcua-constants": "2.157.0",
-        "node-opcua-crypto": "5.3.3",
-        "node-opcua-data-model": "2.168.0",
+        "node-opcua-crypto": "5.3.5",
+        "node-opcua-data-model": "2.169.0",
         "node-opcua-debug": "2.168.0",
-        "node-opcua-file-transfer": "2.168.0",
+        "node-opcua-file-transfer": "2.169.0",
         "node-opcua-hostname": "2.167.0",
-        "node-opcua-nodeid": "2.168.0",
-        "node-opcua-pki": "6.12.0",
-        "node-opcua-pseudo-session": "2.168.0",
-        "node-opcua-secure-channel": "2.168.0",
-        "node-opcua-server": "2.168.0",
-        "node-opcua-service-translate-browse-path": "2.168.0",
-        "node-opcua-status-code": "2.168.0",
-        "node-opcua-types": "2.168.0",
-        "node-opcua-variant": "2.168.0"
+        "node-opcua-nodeid": "2.169.0",
+        "node-opcua-pki": "6.13.0",
+        "node-opcua-pseudo-session": "2.169.0",
+        "node-opcua-secure-channel": "2.169.0",
+        "node-opcua-server": "2.169.0",
+        "node-opcua-service-translate-browse-path": "2.169.0",
+        "node-opcua-status-code": "2.169.0",
+        "node-opcua-types": "2.169.0",
+        "node-opcua-variant": "2.169.0"
     },
     "devDependencies": {
         "bcryptjs": "3.0.3",
-        "node-opcua-client": "2.168.0",
-        "node-opcua-data-value": "2.168.0",
-        "node-opcua-leak-detector": "2.168.0",
+        "node-opcua-client": "2.169.0",
+        "node-opcua-data-value": "2.169.0",
+        "node-opcua-leak-detector": "2.169.0",
         "node-opcua-nodesets": "2.163.1"
     },
     "author": "Etienne Rossignon",
@@ -60,7 +60,7 @@
         "internet of things"
     ],
     "homepage": "http://node-opcua.github.io/",
-    "gitHead": "653b6d6df801ca17298308089dee32e5b12102b6",
+    "gitHead": "82d570d3e95bea689cbbe30096279885c5282245",
     "files": [
         "dist",
         "source"

package/source/index.ts

@@ -11,4 +11,5 @@ export * from "./server/promote_trust_list.js";
 export * from "./server/push_certificate_manager/subject_to_string.js";
 export * from "./server/push_certificate_manager_helpers.js";
 export * from "./server/push_certificate_manager_server_impl.js";
+export * from "./server/trust_list_server.js";
 export * from "./standard_certificate_types.js";

package/source/server/file_transaction_manager.ts

@@ -93,6 +93,31 @@ export class FileTransactionManager {
         this.addFileOp(() => this.#moveFileWithBackupTracked(tempFilePath, destinationPath));
     }
 
+    /**
+     * Stages a file for deletion during the transaction.
+     *
+     * The file is backed up before removal so it can be restored
+     * if the transaction is rolled back.  If the file does not
+     * exist at apply time the operation is silently skipped.
+     *
+     * @param filePath - absolute path of the file to remove
+     */
+    public stageFileRemoval(filePath: string): void {
+        this.addFileOp(async () => {
+            if (!fs.existsSync(filePath)) {
+                return;
+            }
+            // Create a backup before deleting so rollback can restore it
+            const tmpDir = await this.getTmpDir();
+            const uniqueFileName = `${crypto.randomBytes(16).toString("hex")}_backup.tmp`;
+            const backupPath = path.join(tmpDir, uniqueFileName);
+            this.#backupFiles.set(filePath, backupPath);
+
+            await _copyFile(filePath, backupPath);
+            await _deleteFile(filePath);
+        });
+    }
+
     public addFileOp(functor: Functor): void {
         this.#pendingFileOps.push(functor);
     }

package/source/server/install_push_certificate_management.ts

@@ -9,9 +9,11 @@ import type { AddressSpace, UAServerConfiguration } from "node-opcua-address-spa
 import { assert } from "node-opcua-assert";
 import type { OPCUACertificateManager } from "node-opcua-certificate-manager";
 import { type ICertificateKeyPairProvider, invalidateCachedSecrets } from "node-opcua-common";
-import { checkDebugFlag, make_debugLog, make_errorLog } from "node-opcua-debug";
-import { invalidateServerCertificateCache, type OPCUAServer } from "node-opcua-server";
-import type { ApplicationDescriptionOptions } from "node-opcua-types";
+import { type Certificate, split_der, exploreCertificateInfo } from "node-opcua-crypto/web";
+import { checkDebugFlag, make_debugLog, make_errorLog, make_warningLog } from "node-opcua-debug";
+import { invalidateServerCertificateCache, type OPCUAServer, type OPCUAServerEndPoint } from "node-opcua-server";
+import { type StatusCode, StatusCodes } from "node-opcua-status-code";
+import { type ApplicationDescriptionOptions, ServerState } from "node-opcua-types";
 
 import { installPushCertificateManagement } from "./push_certificate_manager_helpers.js";
 import type { ActionQueue, PushCertificateManagerServerImpl } from "./push_certificate_manager_server_impl.js";
@@ -19,6 +21,7 @@ import type { ActionQueue, PushCertificateManagerServerImpl } from "./push_certi
 const debugLog = make_debugLog("ServerConfiguration");
 const doDebug = checkDebugFlag("ServerConfiguration");
 const errorLog = make_errorLog("ServerConfiguration");
+const warningLog = make_warningLog("ServerConfiguration");
 
 /** Relative path from cert manager root to the leaf certificate PEM. */
 const CERT_PEM_RELATIVE_PATH = "own/certs/certificate.pem";
@@ -157,4 +160,173 @@ export async function installPushCertificateManagementOnServer(server: OPCUAServ
             }
         });
     });
+
+    // ── Install NoConfiguration certificate relaxation ─────────
+    //
+    // When the server is in NoConfiguration state (awaiting GDS
+    // provisioning), relax certain certificate trust/CRL errors
+    // so that the GDS client can connect and provision the server.
+    //
+    // This hook is ONLY installed when push certificate management
+    // is active — bare servers are completely unaffected.
+    installCertificateRelaxationHook(server);
+}
+
+// ── Certificate relaxation for NoConfiguration state ──────────
+
+/**
+ * Status codes that can be relaxed during NoConfiguration state.
+ *
+ * These represent "trust infrastructure not yet set up" situations
+ * (missing issuers, missing CRLs) — NOT security violations
+ * (revoked, expired, invalid).
+ *
+ * ### Why `BadCertificateUntrusted` MUST be included (SECURITY NOTE)
+ *
+ * In `NoConfiguration` the server's trust store is **empty** — no
+ * trusted certificates and no CRLs exist yet.  A GDS client that
+ * connects to provision the server will inevitably present a
+ * certificate that is "untrusted" simply because nothing is trusted
+ * yet.  Removing `BadCertificateUntrusted` from this list would make
+ * it impossible for the GDS to connect, breaking the entire push
+ * certificate management provisioning workflow (chicken-and-egg).
+ *
+ * **Security boundary:** this relaxation is ONLY active while the
+ * server state is `ServerState.NoConfiguration`.  Once the server
+ * transitions to `Running` (after successful provisioning) the
+ * relaxation hook returns the original status code unchanged and
+ * normal strict certificate validation applies.  The accepted
+ * certificate is auto-trusted (see `autoTrustCertificateChain`)
+ * so that subsequent connections succeed under normal validation.
+ *
+ * Errors that indicate an active security violation (revoked,
+ * expired, invalid signature, wrong usage) are **never** relaxed,
+ * even in `NoConfiguration`.
+ */
+function isRelaxableCertificateError(statusCode: StatusCode): boolean {
+    return (
+        StatusCodes.BadCertificateUntrusted.equals(statusCode) ||
+        StatusCodes.BadCertificateRevocationUnknown.equals(statusCode) ||
+        StatusCodes.BadCertificateIssuerRevocationUnknown.equals(statusCode) ||
+        StatusCodes.BadCertificateChainIncomplete.equals(statusCode)
+    );
+}
+
+/**
+ * Auto-trust the client's leaf certificate during NoConfiguration.
+ *
+ * Only the **leaf** (chain[0]) is placed in the trusted store —
+ * this is sufficient for the GDS client to reconnect after the
+ * server transitions to Running (the PKI verifier short-circuits
+ * to `Good` when the leaf itself is explicitly trusted).
+ *
+ * Issuer (CA) certificates from the chain are added to the
+ * **issuers/** store for chain-building purposes, but they do
+ * NOT become trust anchors.  This prevents a single provisioning
+ * connection from unintentionally granting trust to every
+ * certificate signed by the same CA.
+ */
+async function autoTrustCertificateChain(
+    server: OPCUAServer,
+    certificate: Certificate
+): Promise<void> {
+    let chain: Certificate[];
+    try {
+        chain = split_der(certificate);
+    } catch (err) {
+        warningLog(
+            "[NoConfiguration] Cannot parse certificate chain for auto-trust:",
+            (err as Error).message
+        );
+        return;
+    }
+
+    const cm = server.serverCertificateManager;
+
+    for (let i = 0; i < chain.length; i++) {
+        const cert = chain[i];
+        // Validate the DER structure before persisting.
+        // Garbage data (e.g. zero-filled buffers) parses into tiny blobs
+        // that are not valid X.509 certificates.
+        try {
+            exploreCertificateInfo(cert);
+        } catch (err) {
+            warningLog(
+                "[NoConfiguration] Skipping invalid certificate in chain for auto-trust:",
+                (err as Error).message
+            );
+            continue;
+        }
+
+        if (i === 0) {
+            // Leaf certificate → trust explicitly
+            try {
+                await cm.trustCertificate(cert);
+            } catch (err) {
+                // ENOENT can happen if another concurrent call already
+                // moved the cert from rejected to trusted.
+                if ((err as Error & { code?: string }).code !== "ENOENT") {
+                    warningLog(
+                        "[NoConfiguration] Failed to auto-trust leaf certificate:",
+                        (err as Error).message
+                    );
+                }
+            }
+        } else {
+            // Issuer CA certificate → add to issuers/ (chain-building
+            // only, does NOT establish a trust anchor)
+            try {
+                await cm.addIssuer(cert);
+            } catch (err) {
+                warningLog(
+                    "[NoConfiguration] Failed to add issuer certificate:",
+                    (err as Error).message
+                );
+            }
+        }
+    }
+}
+
+/**
+ * Install the `onAdjustCertificateStatus` hook on every endpoint.
+ *
+ * When the server is in `ServerState.NoConfiguration`, the hook
+ * relaxes trust/CRL errors so that a GDS client with a valid
+ * full-chain certificate can connect and provision the server.
+ *
+ * The leaf certificate is auto-trusted so that after the server
+ * transitions to Running, the same client is accepted by normal
+ * validation.  Issuer CAs are placed in `issuers/` for chain
+ * building but do not become trust anchors.
+ */
+function installCertificateRelaxationHook(server: OPCUAServer): void {
+    const adjustCertificateStatus = async (
+        statusCode: StatusCode,
+        certificate: Certificate
+    ): Promise<StatusCode> => {
+        // Only relax in NoConfiguration state
+        if (server.engine.getServerState() !== ServerState.NoConfiguration) {
+            return statusCode;
+        }
+
+        // Only relax trust-infrastructure errors, NOT security errors
+        if (!isRelaxableCertificateError(statusCode)) {
+            return statusCode;
+        }
+
+        doDebug && warningLog(
+            `[NoConfiguration] Relaxing certificate check:`,
+            `${statusCode.toString()} → Good`,
+            "(server is awaiting GDS provisioning)"
+        );
+
+        // Auto-trust the leaf certificate; issuer CAs go to issuers/
+        await autoTrustCertificateChain(server, certificate);
+
+        return StatusCodes.Good;
+    };
+
+    for (const endpoint of server.endpoints) {
+        (endpoint as OPCUAServerEndPoint).onAdjustCertificateStatus = adjustCertificateStatus;
+    }
 }

package/source/server/promote_trust_list.ts

@@ -2,6 +2,9 @@
  * @module node-opcua-server-configuration
  */
 
+import fs from "node:fs";
+import path from "node:path";
+
 import { fs as MemFs } from "memfs";
 
 import type {
@@ -97,6 +100,151 @@ function updateLastUpdateTime(trustList: UATrustList): void {
     }
 }
 
+/**
+ * Scan the PKI store folders (trusted/certs, trusted/crl, issuers/certs,
+ * issuers/crl) and return the most recent modification time across all
+ * files. Returns null if no files are found.
+ *
+ * Uses async fs.promises to avoid blocking the event loop on startup
+ * when PKI directories are large or on slow filesystems.
+ */
+async function getNewestMtimeFromPkiStore(
+    cm: OPCUACertificateManager,
+    isAborted?: () => boolean
+): Promise<Date | null> {
+    const dirs = [cm.trustedFolder, cm.crlFolder, cm.issuersCertFolder, cm.issuersCrlFolder];
+    let newest: Date | null = null;
+    
+    for (const dir of dirs) {
+        if (isAborted?.()) break;
+
+        try {
+            await fs.promises.access(dir);
+        } catch {
+            continue;
+        }
+        let entries: string[];
+        try {
+            entries = await fs.promises.readdir(dir);
+        } catch {
+            continue;
+        }
+        
+        // Process stats sequentially to avoid threadpool exhaustion
+        // and event-loop lag when directories have thousands of files.
+        for (const entry of entries) {
+            if (isAborted?.()) return null;
+            try {
+                const stat = await fs.promises.stat(path.join(dir, entry));
+                if (stat.isFile() && (!newest || stat.mtime > newest)) {
+                    newest = stat.mtime;
+                }
+            } catch {
+                // skip unreadable entries
+            }
+        }
+    }
+    return newest;
+}
+
+/**
+ * Initialize the LastUpdateTime property from the PKI store's
+ * filesystem timestamps. This avoids displaying MinDate
+ * (0001-01-01T00:00:00Z) when the trust store already contains
+ * certificates or CRLs (e.g. populated by selfOnboard or addIssuer).
+ *
+ * Also subscribes to the CertificateManager's filesystem watcher
+ * events (certificateAdded, certificateRemoved, certificateChange,
+ * crlAdded, crlRemoved) so that LastUpdateTime stays current even
+ * when the trust store is modified externally (e.g. manual file
+ * copy, programmatic addIssuer/trustCertificate calls).
+ *
+ * Listeners are installed at most once per TrustList node
+ * (guarded by $$listenersInstalled) and are removed via
+ * addressSpace.registerShutdownTask to prevent leaks.
+ */
+async function _initializeLastUpdateTimeFromFilesystem(trustList: UATrustListEx): Promise<void> {
+    const cm = trustList.$$certificateManager;
+    if (!cm) return;
+
+    if (trustList.$$initaliseMTimePromise) {
+        return await trustList.$$initaliseMTimePromise;
+    }
+
+    trustList.$$initaliseMTimePromise = (async () => {
+        const startTime = Date.now();
+        let isAborted = false;
+        
+        // Note: Removed abortHandler from registerShutdownTask because AddressSpace 
+        // does not have an unregister mechanism, which causes `_shutdownTasks` to leak 
+        // continuously if promoteTrustList is called multiple times.
+        // Sequential scanning is fast enough that it won't block shutdown significantly.
+
+        try {
+            const lastUpdateTimeNode = trustList.lastUpdateTime;
+            if (!lastUpdateTimeNode) return;
+
+            // Seed the initial timestamp from the filesystem only when
+            // the current value is still unset (MinDate).  The event
+            // listeners below must always be installed regardless, so we
+            // must NOT return early here.
+            const currentValue = lastUpdateTimeNode.readValue().value.value as Date | undefined;
+            if (!currentValue || currentValue.getTime() <= 0) {
+                const newest = await getNewestMtimeFromPkiStore(cm, () => isAborted);
+                if (isAborted) {
+                    console.log(`[node-opcua] _initializeLastUpdateTimeFromFilesystem aborted for ${trustList.browseName.toString()}`);
+                    return;
+                }
+                if (newest) {
+                    lastUpdateTimeNode.setValueFromSource({
+                        dataType: DataType.DateTime,
+                        value: newest
+                    });
+                    doDebug && debugLog("Initialized LastUpdateTime from filesystem:", newest.toISOString());
+                }
+            }
+
+            // Guard: install listeners at most once per TrustList node
+            // to prevent duplicate handler invocation on re-promotion.
+            if (trustList.$$listenersInstalled) {
+                return;
+            }
+            trustList.$$listenersInstalled = true;
+
+            // Subscribe to CertificateManager filesystem watcher events
+            // so LastUpdateTime stays current when the store is modified
+            // outside of OPC UA methods (e.g. addIssuer, trustCertificate,
+            // or manual file operations).
+            const _updateNow = () => {
+                updateLastUpdateTime(trustList);
+            };
+
+            const events = ["certificateAdded", "certificateRemoved", "certificateChange", "crlAdded", "crlRemoved"] as const;
+            for (const event of events) {
+                cm.on(event, _updateNow);
+            }
+
+            // Clean up listeners when the address space shuts down
+            // to avoid MaxListenersExceededWarning and memory leaks.
+            // Guard: addressSpace may be null if dispose() was called
+            // concurrently (e.g. fast test teardown).
+            if (trustList.addressSpace) {
+                trustList.addressSpace.registerShutdownTask(() => {
+                    for (const event of events) {
+                        cm.removeListener(event, _updateNow);
+                    }
+                    trustList.$$listenersInstalled = false;
+                });
+            }
+
+            console.log(`[node-opcua] _initializeLastUpdateTimeFromFilesystem took ${Date.now() - startTime}ms for ${trustList.browseName.toString()}`);
+        } finally {
+            trustList.$$initaliseMTimePromise = undefined;
+        }
+    })();
+    return await trustList.$$initaliseMTimePromise;
+}
+
 interface UAMethodEx extends UAMethod {
     _asyncExecutionFunction?: MethodFunctor;
 }
@@ -104,6 +252,8 @@ interface UATrustListEx extends UATrustList {
     $$certificateManager: OPCUACertificateManager;
     $$filename: string;
     $$openedForWrite: boolean;
+    $$listenersInstalled: boolean;
+    $$initaliseMTimePromise?: Promise<void>;
 }
 
 async function applyTrustListChanges(cm: OPCUACertificateManager, trustListData: TrustListDataType): Promise<StatusCode> {
@@ -445,10 +595,18 @@ async function _removeCertificate(
 let counter = 0;
 
 export async function promoteTrustList(trustList: UATrustList) {
+    const trustListEx = trustList as UATrustListEx & { $$promoted?: boolean };
+    
+    // Prevent double-binding if called multiple times testing
+    if (trustListEx.$$promoted) {
+        await _initializeLastUpdateTimeFromFilesystem(trustListEx);
+        return;
+    }
+    trustListEx.$$promoted = true;
+
     const filename = `/tmpFile${counter}`;
     counter += 1;
 
-    const trustListEx = trustList as UATrustListEx;
     // Store filename for use in _closeAndUpdate
     trustListEx.$$filename = filename;
     // Initialize write lock flag
@@ -541,6 +699,17 @@ export async function promoteTrustList(trustList: UATrustList) {
     addCertificate.bindMethod(_addCertificate);
     removeCertificate.bindMethod(_removeCertificate);
 
+    function _closeCallback(
+        this: UAMethod,
+        inputArgs: Variant[],
+        context: ISessionContext,
+        callback: CallbackT<CallMethodResultOptions>
+    ) {
+        trustListEx.$$openedForWrite = false;
+        _close_asyncExecutionFunction.call(this, inputArgs, context, callback);
+    }
+    close.bindMethod(_closeCallback);
+
     // Wrapper to pass the underlying close method to _closeAndUpdate
     closeAndUpdate?.bindMethod(async function (
         this: UAMethod,
@@ -556,12 +725,17 @@ export async function promoteTrustList(trustList: UATrustList) {
             return;
         }
         fileType.open?.bindMethod(_openCallback);
+        fileType.close?.bindMethod(_closeCallback);
         fileType.addCertificate.bindMethod(_addCertificate);
         fileType.removeCertificate.bindMethod(_removeCertificate);
         fileType.openWithMasks?.bindMethod(_openWithMaskCallback);
         fileType.closeAndUpdate?.bindMethod(_closeAndUpdate);
     }
     install_method_handle_on_TrustListType(trustList.addressSpace);
+
+    // Initialize LastUpdateTime from the PKI store's filesystem timestamps
+    // so it doesn't show MinDate (0001-01-01) when files already exist.
+    await _initializeLastUpdateTimeFromFilesystem(trustListEx);
 }
 
 export function installAccessRestrictionOnTrustList(trustList: UAVariable | UAObject) {