node-opcua-server-configuration 2.177.0 → 2.179.0

package/source/server/file_transaction_manager.ts

@@ -5,10 +5,11 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { make_debugLog, make_errorLog, make_warningLog } from "node-opcua-debug";
+import { checkDebugFlag, make_debugLog, make_errorLog, make_warningLog } from "node-opcua-debug";
 import { randomBytes } from "node-opcua-utils";
 
 const debugLog = make_debugLog("ServerConfiguration");
+const doDebug = checkDebugFlag("ServerConfiguration");
 const errorLog = make_errorLog("ServerConfiguration");
 const warningLog = make_warningLog("ServerConfiguration");
 
@@ -16,7 +17,8 @@ type Functor = () => Promise<void>;
 
 async function _copyFile(source: string, dest: string): Promise<void> {
     try {
-        debugLog("copying file \n source ", source, "\n =>\n dest ", dest);
+        // c8 ignore next
+        doDebug && debugLog("copying file \n source ", source, "\n =>\n dest ", dest);
         const sourceExist = fs.existsSync(source);
         if (sourceExist) {
             await fs.promises.copyFile(source, dest);
@@ -30,7 +32,8 @@ async function _deleteFile(file: string): Promise<void> {
     try {
         const exists = fs.existsSync(file);
         if (exists) {
-            debugLog("deleting file ", file);
+            // c8 ignore next
+            doDebug && debugLog("deleting file ", file);
             await fs.promises.unlink(file);
         }
     } catch (err) {
@@ -39,7 +42,8 @@ async function _deleteFile(file: string): Promise<void> {
 }
 
 async function _moveFile(source: string, dest: string): Promise<void> {
-    debugLog("moving file file \n source ", source, "\n =>\n dest ", dest);
+    // c8 ignore next
+    doDebug && debugLog("moving file file \n source ", source, "\n =>\n dest ", dest);
     try {
         await _copyFile(source, dest);
         await _deleteFile(source);
@@ -50,7 +54,8 @@ async function _moveFile(source: string, dest: string): Promise<void> {
 
 async function _moveFileWithBackup(source: string, dest: string, backupPath: string): Promise<void> {
     // let make a copy of the destination file
-    debugLog("moveFileWithBackup file \n source ", source, "\n =>\n dest ", dest);
+    // c8 ignore next
+    doDebug && debugLog("moveFileWithBackup file \n source ", source, "\n =>\n dest ", dest);
     await _copyFile(dest, backupPath);
     await _moveFile(source, dest);
 }
@@ -161,7 +166,8 @@ export class FileTransactionManager {
      * Commit the transaction by executing all pending file operations.
      */
     public async applyFileOps(): Promise<void> {
-        debugLog("start applyFileOps");
+        // c8 ignore next
+        doDebug && debugLog("start applyFileOps");
         const fileOperation = this.#pendingFileOps.splice(0);
 
         try {
@@ -169,7 +175,8 @@ export class FileTransactionManager {
                 const op = fileOperation.shift();
                 await op?.();
             }
-            debugLog("end applyFileOps");
+            // c8 ignore next
+            doDebug && debugLog("end applyFileOps");
 
             // Transaction successful - clean up backup files
             await this.#cleanupBackupFiles();
@@ -182,7 +189,8 @@ export class FileTransactionManager {
             // Rollback: restore all backup files to their original locations
             try {
                 await this.#rollbackTransaction();
-                debugLog("Transaction rollback successful");
+                // c8 ignore next
+                doDebug && debugLog("Transaction rollback successful");
             } catch (rollbackErr) {
                 errorLog("Critical: Rollback failed:", (rollbackErr as Error).message);
                 errorLog("Certificate state may be inconsistent - manual intervention required");
@@ -202,7 +210,8 @@ export class FileTransactionManager {
      * This restores files from their *_old backups to recover the previous state.
      */
     async #rollbackTransaction(): Promise<void> {
-        debugLog("Rolling back transaction, restoring", this.#backupFiles.size, "backup files");
+        // c8 ignore next
+        doDebug && debugLog("Rolling back transaction, restoring", this.#backupFiles.size, "backup files");
 
         const rollbackPromises: Promise<void>[] = [];
 
@@ -212,7 +221,8 @@ export class FileTransactionManager {
                     try {
                         // Check if backup exists before trying to restore
                         if (fs.existsSync(backupPath)) {
-                            debugLog("Restoring backup:", backupPath, "to", dest);
+                            // c8 ignore next
+                            doDebug && debugLog("Restoring backup:", backupPath, "to", dest);
                             await _copyFile(backupPath, dest);
                             // Delete backup immediately after restoration
                             await _deleteFile(backupPath);
@@ -225,7 +235,8 @@ export class FileTransactionManager {
         }
 
         await Promise.all(rollbackPromises);
-        debugLog("Transaction rollback completed");
+        // c8 ignore next
+        doDebug && debugLog("Transaction rollback completed");
     }
 
     /**
@@ -233,7 +244,8 @@ export class FileTransactionManager {
      * Removes all *_old backup files that were created during the transaction.
      */
     async #cleanupBackupFiles(): Promise<void> {
-        debugLog("Cleaning up", this.#backupFiles.size, "backup files");
+        // c8 ignore next
+        doDebug && debugLog("Cleaning up", this.#backupFiles.size, "backup files");
 
         const cleanupPromises: Promise<void>[] = [];
 
@@ -265,7 +277,8 @@ export class FileTransactionManager {
     }
 
     async #executeCleanupTasks(): Promise<void> {
-        debugLog("Executing cleanup tasks");
+        // c8 ignore next
+        doDebug && debugLog("Executing cleanup tasks");
         const tasks = this.#cleanupTasks.splice(0);
         for (const task of tasks) {
             try {

package/source/server/install_certificate_file_watcher.ts

@@ -1,12 +1,12 @@
 import fs from "node:fs";
 import path from "node:path";
 import type { ITypedEventEmitter, UAObject, UAObjectEvents } from "node-opcua-address-space-base";
-import { make_debugLog } from "node-opcua-debug";
+import { checkDebugFlag, make_debugLog } from "node-opcua-debug";
 
 const debugLog = make_debugLog("ServerConfiguration");
+const doDebug = checkDebugFlag("ServerConfiguration");
 
-
-export interface CertificateChangeEvents extends UAObjectEvents  {
+export interface CertificateChangeEvents extends UAObjectEvents {
     certificateChange: () => void;
 }
 export function installCertificateFileWatcher(
@@ -20,7 +20,8 @@ export function installCertificateFileWatcher(
         (_eventType: "rename" | "change", filename) => {
             /** */
             if (filename === fileToWatch) {
-                debugLog("filename changed = ", filename, fileToWatch);
+                // c8 ignore next
+                doDebug && debugLog("filename changed = ", filename, fileToWatch);
                 node.emit("certificateChange");
             }
         }

package/source/server/install_push_certificate_management.ts

@@ -8,10 +8,17 @@ import chalk from "chalk";
 import type { AddressSpace, UAServerConfiguration } from "node-opcua-address-space";
 import { assert } from "node-opcua-assert";
 import { OPCUACertificateManager } from "node-opcua-certificate-manager";
-import { DiskCertificateKeyPairProvider, type ICertificateKeyPairProvider } from "node-opcua-common";
-import { type Certificate, split_der, exploreCertificateInfo } from "node-opcua-crypto/web";
+import {
+    DiskCertificateKeyPairProvider,
+    type ICertificateChainProvider,
+    type ICertificateKeyPairProvider,
+    ResolvedCertificateKeyPairProvider,
+    resolvePrivateKeyProviderIfNeeded
+} from "node-opcua-common";
+import { readPrivateKey } from "node-opcua-crypto";
+import { type Certificate, exploreCertificateInfo, split_der } from "node-opcua-crypto/web";
 import { checkDebugFlag, make_debugLog, make_errorLog, make_warningLog } from "node-opcua-debug";
-import { invalidateServerCertificateCache, type OPCUAServer, type OPCUAServerEndPoint } from "node-opcua-server";
+import type { OPCUAServer, OPCUAServerEndPoint } from "node-opcua-server";
 import { type StatusCode, StatusCodes } from "node-opcua-status-code";
 import { type ApplicationDescriptionOptions, ServerState } from "node-opcua-types";
 
@@ -35,6 +42,7 @@ export interface OPCUAServerPartial extends ICertificateKeyPairProvider {
     createDefaultCertificate(): Promise<void>;
     setProvider(provider: ICertificateKeyPairProvider): void;
     invalidateCachedCertificates(): void;
+    getCertificateChainProvider(): ICertificateChainProvider;
 }
 
 async function onCertificateAboutToChange(server: OPCUAServer) {
@@ -56,25 +64,106 @@ async function onCertificateAboutToChange(server: OPCUAServer) {
  */
 async function onCertificateChange(server: OPCUAServer) {
     doDebug && debugLog("on CertificateChanged");
-    invalidateServerCertificateCache(server);
+    await reresolveServerCertificateProvider(server);
 }
 
 /**
- * Deferred channel restart: called after the ApplyChanges method
- * response has been sent.  Shuts down all existing secure channels
- * (which forces clients to reconnect with the new cert) and resumes
- * the endpoints.
+ * Resolve the private key immediately after a rotation, bypassing
+ * `OPCUACertificateManager.getPrivateKey()`'s cache.
+ *
+ * `getPrivateKey()` decrypts the on-disk key *once* and caches it for the
+ * manager instance's whole lifetime (pki's documented behavior — see
+ * `CertificateManager.getPrivateKey`). That's exactly right for a normal
+ * startup resolve (`resolvePrivateKeyProviderIfNeeded`, used by
+ * `initializeCM()`), but wrong here: `UpdateCertificate`/`ApplyChanges` just
+ * replaced the on-disk key file underneath this *same, long-lived*
+ * `certificateManager` instance, so a cached call would silently keep
+ * returning the pre-rotation key — certificate and key would then belong to
+ * different key pairs, and every subsequent handshake fails signature
+ * verification.
+ *
+ * `privateKeyProvider` mode has no such cache — pki consults the injected
+ * provider on every call — so this only special-cases `privateKeyPassphrase`
+ * (reading the file directly, with the manager's own configured passphrase,
+ * instead of going through the memoized `getPrivateKey()`).
+ */
+async function resolvePrivateKeyAfterRotation(certificateManager: OPCUACertificateManager, privateKeyFile: string) {
+    const passphrase = await certificateManager.getPrivateKeyPassphrase();
+    if (passphrase !== undefined) {
+        return readPrivateKey(privateKeyFile, passphrase);
+    }
+    return certificateManager.getPrivateKey();
+}
+
+/**
+ * Refresh the server's certificate/private-key provider after a rotation,
+ * and push the result to every endpoint.
+ *
+ * When the certificate manager is passphrase-/provider-managed, a
+ * synchronous "invalidate, let it lazily re-read the file" (the old
+ * behavior) cannot decrypt the key — so the key is instead resolved here,
+ * eagerly and asynchronously (see `resolvePrivateKeyAfterRotation`), and the
+ * resulting provider handed out explicitly to the server and every
+ * endpoint.
+ *
+ * For a plain (unmanaged) certificate manager, this falls back to exactly
+ * the previous behavior: invalidate the server's and every endpoint's
+ * cached certificate/key so the next access re-reads the (plaintext) files
+ * from disk.
+ */
+async function reresolveServerCertificateProvider(server: OPCUAServer): Promise<void> {
+    const certificateManager = server.serverCertificateManager;
+    const isManaged = certificateManager instanceof OPCUACertificateManager && certificateManager.isPrivateKeyManaged();
+    if (isManaged) {
+        const privateKey = await resolvePrivateKeyAfterRotation(certificateManager, server.privateKeyFile);
+        server.setProvider(new ResolvedCertificateKeyPairProvider(server.certificateFile, server.privateKeyFile, privateKey));
+        const provider = server.getCertificateChainProvider();
+        for (const endpoint of server.endpoints) {
+            endpoint.setCertificateProvider(provider);
+        }
+    } else {
+        server.invalidateCachedCertificates();
+        for (const endpoint of server.endpoints) {
+            endpoint.invalidateCertificates();
+        }
+    }
+}
+
+/**
+ * Deferred step, called after the ApplyChanges method response has been
+ * sent (so the admin client gets its answer before its own channel is
+ * affected).
+ *
+ * With `closeChannelsOnApplyChanges` (the default) every existing secure
+ * channel is shut down immediately, forcing all connected clients to
+ * reconnect with the new certificate right away. Without it, existing
+ * channels are left alone and continue — including OpenSecureChannel
+ * *Renews* — under the certificate/key pair each channel is bound to,
+ * while new connections use the new pair. See
+ * {@link InstallPushCertificateManagementOnServerOptions.closeChannelsOnApplyChanges}
+ * for when each is appropriate.
+ *
+ * Either way the endpoints, suspended in `onCertificateAboutToChange`,
+ * are resumed here.
  */
-async function onApplyChangesCompleted(server: OPCUAServer) {
-    doDebug && debugLog(chalk.yellow(" onApplyChangesCompleted => shutting down channels"));
-    await server.shutdownChannels();
-    doDebug && debugLog(chalk.yellow(" onApplyChangesCompleted => channels shut down"));
+async function onApplyChangesCompleted(server: OPCUAServer, closeChannels: boolean) {
+    if (closeChannels) {
+        doDebug && debugLog(chalk.yellow(" onApplyChangesCompleted => shutting down channels"));
+        await server.shutdownChannels();
+        doDebug && debugLog(chalk.yellow(" onApplyChangesCompleted => channels shut down"));
+    } else {
+        doDebug &&
+            debugLog(chalk.yellow(" onApplyChangesCompleted => leaving existing channels open (bound to their original pair)"));
+    }
 
     doDebug && debugLog(chalk.yellow(" onApplyChangesCompleted => resuming end points"));
     await server.resumeEndPoints();
     doDebug && debugLog(chalk.yellow(" onApplyChangesCompleted => end points resumed"));
 
-    debugLog(chalk.yellow("channels have been closed -> client should reconnect "));
+    if (closeChannels) {
+        // c8 ignore next
+        doDebug && debugLog(chalk.yellow("channels have been closed -> client should reconnect "));
+    }
 }
 
 /**
@@ -88,9 +177,11 @@ async function install(this: OPCUAServerPartial): Promise<void> {
     const certFile = path.join(this.serverCertificateManager.rootDir, CERT_PEM_RELATIVE_PATH);
     const keyFile = this.serverCertificateManager.privateKey;
 
-    // Inject a new disk provider pointing at the cert manager's
-    // paths. The server's certificateFile/privateKeyFile getters
-    // now automatically return the new paths.
+    // Inject a new disk provider pointing at the cert manager's paths. The
+    // server's certificateFile/privateKeyFile getters now automatically
+    // return the new paths. If the key turns out to be passphrase-encrypted,
+    // resolvePrivateKeyProviderIfNeeded() below immediately replaces this
+    // with a resolved, in-memory provider.
     this.setProvider(new DiskCertificateKeyPairProvider(certFile, keyFile));
 
     // Delegate to the base server's createDefaultCertificate() which
@@ -98,20 +189,59 @@ async function install(this: OPCUAServerPartial): Promise<void> {
     // proper subject via makeSubject(), mutex locking, and file checks.
     await this.createDefaultCertificate();
 
-    // Invalidate any previously cached secrets so that
-    // getCertificateChain() / getPrivateKey() will re-read from disk.
-    this.invalidateCachedCertificates();
+    // Resolve the (possibly passphrase-encrypted) private key once,
+    // asynchronously, and install the resolved provider — a synchronous
+    // disk re-read (the old invalidateCachedCertificates() behavior) cannot
+    // decrypt an encrypted key. For a plaintext key this just replaces the
+    // disk provider above with an equivalent resolved one.
+    await resolvePrivateKeyProviderIfNeeded(this, this.serverCertificateManager, false);
 }
 
 interface UAServerConfigurationEx extends UAServerConfiguration {
     $pushCertificateManager: PushCertificateManagerServerImpl;
 }
 
-export async function installPushCertificateManagementOnServer(server: OPCUAServer): Promise<void> {
-    if (!server.engine || !server.engine.addressSpace) {
+export interface InstallPushCertificateManagementOnServerOptions {
+    /**
+     * What happens to secure channels that are already open when
+     * `ApplyChanges` installs a new server certificate (and possibly a new
+     * private key).
+     *
+     * - `true` (default): every existing channel is shut down as soon as
+     *   the ApplyChanges response has been sent. All connected clients
+     *   reconnect immediately with the new certificate. This is the safe
+     *   choice when the rotation is a response to a **compromised or
+     *   revoked** key: nothing keeps running under the old one.
+     *
+     * - `false`: existing channels are left open and the rotation is
+     *   **seamless** for them. Each server channel is bound to the
+     *   certificate/key pair it was created with (OPC UA Part 6 §6.7.2
+     *   defines the thumbprint check against "the Certificate it is using
+     *   for the SecureChannel", and §6.7.4 requires the client to close the
+     *   channel if a response is signed with a different certificate than
+     *   the request was encrypted to — so the old pair is the only one a
+     *   Renew on an old channel can conformantly use). Connected clients
+     *   keep renewing their security token under the old pair, unmodified
+     *   third-party clients included; new connections use the new pair.
+     *   Choose this for a **planned** rotation. The old pair remains in use
+     *   by those channels until they close naturally — which is exactly why
+     *   `true` stays the default: when the rotation answers a **compromised
+     *   or revoked** key, nothing must keep running under it.
+     *
+     * @defaultValue true
+     */
+    closeChannelsOnApplyChanges?: boolean;
+}
+
+export async function installPushCertificateManagementOnServer(
+    server: OPCUAServer,
+    options?: InstallPushCertificateManagementOnServerOptions
+): Promise<void> {
+    const closeChannelsOnApplyChanges = options?.closeChannelsOnApplyChanges ?? true;
+    if (!server.engine?.addressSpace) {
         throw new Error(
             "Server must have a valid address space. " +
-            "You need to call installPushCertificateManagementOnServer after server has been initialized"
+                "You need to call installPushCertificateManagementOnServer after server has been initialized"
         );
     }
     await install.call(server as unknown as OPCUAServerPartial);
@@ -124,15 +254,19 @@ export async function installPushCertificateManagementOnServer(server: OPCUAServ
     if (!(server.serverCertificateManager instanceof OPCUACertificateManager)) {
         throw new Error(
             "installPushCertificateManagementOnServer requires a" +
-            " disk-based OPCUACertificateManager as" +
-            " serverCertificateManager"
+                " disk-based OPCUACertificateManager as" +
+                " serverCertificateManager"
         );
     }
     const cm = server.serverCertificateManager;
-    const certFile = path.join(cm.rootDir, CERT_PEM_RELATIVE_PATH);
-    const keyFile = cm.privateKey;
+    // Reuse the server's own provider (installed by install() above, and
+    // already resolved if the key is passphrase-encrypted) rather than
+    // constructing a fresh DiskCertificateKeyPairProvider from the file
+    // paths — a plain disk provider would re-read the file and fail
+    // synchronously on an encrypted key.
+    const provider = server.getCertificateChainProvider();
     for (const endpoint of server.endpoints) {
-        endpoint.setCertificateProvider(new DiskCertificateKeyPairProvider(certFile, keyFile));
+        endpoint.setCertificateProvider(provider);
     }
 
     await installPushCertificateManagement(server.engine.addressSpace, {
@@ -162,11 +296,11 @@ export async function installPushCertificateManagementOnServer(server: OPCUAServ
     });
 
     serverConfigurationPriv.$pushCertificateManager.on("applyChangesCompleted", () => {
-        // Fire-and-forget: schedule channel teardown + endpoint
+        // Fire-and-forget: schedule (optional) channel teardown + endpoint
         // resumption AFTER the method response is sent.
         setImmediate(async () => {
             try {
-                await onApplyChangesCompleted(server);
+                await onApplyChangesCompleted(server, closeChannelsOnApplyChanges);
             } catch (err) {
                 errorLog("onApplyChangesCompleted error:", (err as Error).message);
             }
@@ -238,18 +372,12 @@ function isRelaxableCertificateError(statusCode: StatusCode): boolean {
  * connection from unintentionally granting trust to every
  * certificate signed by the same CA.
  */
-async function autoTrustCertificateChain(
-    server: OPCUAServer,
-    certificate: Certificate
-): Promise<void> {
+async function autoTrustCertificateChain(server: OPCUAServer, certificate: Certificate): Promise<void> {
     let chain: Certificate[];
     try {
         chain = split_der(certificate);
     } catch (err) {
-        warningLog(
-            "[NoConfiguration] Cannot parse certificate chain for auto-trust:",
-            (err as Error).message
-        );
+        warningLog("[NoConfiguration] Cannot parse certificate chain for auto-trust:", (err as Error).message);
         return;
     }
 
@@ -263,10 +391,7 @@ async function autoTrustCertificateChain(
         try {
             exploreCertificateInfo(cert);
         } catch (err) {
-            warningLog(
-                "[NoConfiguration] Skipping invalid certificate in chain for auto-trust:",
-                (err as Error).message
-            );
+            warningLog("[NoConfiguration] Skipping invalid certificate in chain for auto-trust:", (err as Error).message);
             continue;
         }
 
@@ -278,10 +403,7 @@ async function autoTrustCertificateChain(
                 // ENOENT can happen if another concurrent call already
                 // moved the cert from rejected to trusted.
                 if ((err as Error & { code?: string }).code !== "ENOENT") {
-                    warningLog(
-                        "[NoConfiguration] Failed to auto-trust leaf certificate:",
-                        (err as Error).message
-                    );
+                    warningLog("[NoConfiguration] Failed to auto-trust leaf certificate:", (err as Error).message);
                 }
             }
         } else {
@@ -290,10 +412,7 @@ async function autoTrustCertificateChain(
             try {
                 await cm.addIssuer(cert);
             } catch (err) {
-                warningLog(
-                    "[NoConfiguration] Failed to add issuer certificate:",
-                    (err as Error).message
-                );
+                warningLog("[NoConfiguration] Failed to add issuer certificate:", (err as Error).message);
             }
         }
     }
@@ -312,10 +431,7 @@ async function autoTrustCertificateChain(
  * building but do not become trust anchors.
  */
 function installCertificateRelaxationHook(server: OPCUAServer): void {
-    const adjustCertificateStatus = async (
-        statusCode: StatusCode,
-        certificate: Certificate
-    ): Promise<StatusCode> => {
+    const adjustCertificateStatus = async (statusCode: StatusCode, certificate: Certificate): Promise<StatusCode> => {
         // Only relax in NoConfiguration state
         if (server.engine.getServerState() !== ServerState.NoConfiguration) {
             return statusCode;
@@ -326,11 +442,12 @@ function installCertificateRelaxationHook(server: OPCUAServer): void {
             return statusCode;
         }
 
-        doDebug && warningLog(
-            `[NoConfiguration] Relaxing certificate check:`,
-            `${statusCode.toString()} → Good`,
-            "(server is awaiting GDS provisioning)"
-        );
+        doDebug &&
+            warningLog(
+                `[NoConfiguration] Relaxing certificate check:`,
+                `${statusCode.toString()} → Good`,
+                "(server is awaiting GDS provisioning)"
+            );
 
         // Auto-trust the leaf certificate; issuer CAs go to issuers/
         await autoTrustCertificateChain(server, certificate);

package/source/server/promote_trust_list.ts

@@ -73,7 +73,7 @@ function trustListIsAlreadyOpened(trustList: UATrustList): boolean {
         return false;
     }
     const dataValue = openCountNode.readValue();
-    if (!dataValue || !dataValue.value) {
+    if (!dataValue?.value) {
         return false;
     }
     const openCount = dataValue.value.value as number;
@@ -109,13 +109,10 @@ function updateLastUpdateTime(trustList: UATrustList): void {
  * Uses async fs.promises to avoid blocking the event loop on startup
  * when PKI directories are large or on slow filesystems.
  */
-async function getNewestMtimeFromPkiStore(
-    cm: OPCUACertificateManager,
-    isAborted?: () => boolean
-): Promise<Date | null> {
+async function getNewestMtimeFromPkiStore(cm: OPCUACertificateManager, isAborted?: () => boolean): Promise<Date | null> {
     const dirs = [cm.trustedFolder, cm.crlFolder, cm.issuersCertFolder, cm.issuersCrlFolder];
     let newest: Date | null = null;
-    
+
     for (const dir of dirs) {
         if (isAborted?.()) break;
 
@@ -130,7 +127,7 @@ async function getNewestMtimeFromPkiStore(
         } catch {
             continue;
         }
-        
+
         // Process stats sequentially to avoid threadpool exhaustion
         // and event-loop lag when directories have thousands of files.
         for (const entry of entries) {
@@ -174,10 +171,10 @@ async function _initializeLastUpdateTimeFromFilesystem(trustList: UATrustListEx)
 
     trustList.$$initaliseMTimePromise = (async () => {
         const startTime = Date.now();
-        let isAborted = false;
-        
-        // Note: Removed abortHandler from registerShutdownTask because AddressSpace 
-        // does not have an unregister mechanism, which causes `_shutdownTasks` to leak 
+        const isAborted = false;
+
+        // Note: Removed abortHandler from registerShutdownTask because AddressSpace
+        // does not have an unregister mechanism, which causes `_shutdownTasks` to leak
         // continuously if promoteTrustList is called multiple times.
         // Sequential scanning is fast enough that it won't block shutdown significantly.
 
@@ -193,7 +190,9 @@ async function _initializeLastUpdateTimeFromFilesystem(trustList: UATrustListEx)
             if (!currentValue || currentValue.getTime() <= 0) {
                 const newest = await getNewestMtimeFromPkiStore(cm, () => isAborted);
                 if (isAborted) {
-                    console.log(`[node-opcua] _initializeLastUpdateTimeFromFilesystem aborted for ${trustList.browseName.toString()}`);
+                    console.log(
+                        `[node-opcua] _initializeLastUpdateTimeFromFilesystem aborted for ${trustList.browseName.toString()}`
+                    );
                     return;
                 }
                 if (newest) {
@@ -238,7 +237,9 @@ async function _initializeLastUpdateTimeFromFilesystem(trustList: UATrustListEx)
                 });
             }
 
-            console.log(`[node-opcua] _initializeLastUpdateTimeFromFilesystem took ${Date.now() - startTime}ms for ${trustList.browseName.toString()}`);
+            console.log(
+                `[node-opcua] _initializeLastUpdateTimeFromFilesystem took ${Date.now() - startTime}ms for ${trustList.browseName.toString()}`
+            );
         } finally {
             trustList.$$initaliseMTimePromise = undefined;
         }
@@ -464,7 +465,6 @@ function verificationStatusToStatusCode(status: VerificationStatus): StatusCode
             return StatusCodes.BadCertificateUntrusted;
         case VerificationStatus.BadSecurityChecksFailed:
             return StatusCodes.BadSecurityChecksFailed;
-        case VerificationStatus.BadCertificateInvalid:
         default:
             return StatusCodes.BadCertificateInvalid;
     }
@@ -662,7 +662,8 @@ export async function promoteTrustList(trustList: UATrustList) {
                 MemFs.unlinkSync(filename);
             }
         } catch (err) {
-            debugLog("could not release trust list backing file", filename, (err as Error).message);
+            // c8 ignore next
+            doDebug && debugLog("could not release trust list backing file", filename, (err as Error).message);
         }
     });
 

package/source/server/push_certificate_manager/create_signing_request.ts

@@ -139,8 +139,10 @@ export async function executeCreateSigningRequest(
         errorLog(
             "CreateSigningRequest failed during CSR generation:",
             (err as Error).message,
-            "subject=", subjectName,
-            "applicationUri=", serverImpl.applicationUri
+            "subject=",
+            subjectName,
+            "applicationUri=",
+            serverImpl.applicationUri
         );
         return { statusCode: StatusCodes.BadInternalError };
     }