node-opcua-server-configuration 2.177.0 → 2.179.0

package/source/server/push_certificate_manager/update_certificate.ts

@@ -3,10 +3,10 @@ import path from "node:path";
 import { assert } from "node-opcua-assert";
 import type { ByteString } from "node-opcua-basic-types";
 import type { CertificateManager, OPCUACertificateManager } from "node-opcua-certificate-manager";
-import { exploreCertificate, readPrivateKey } from "node-opcua-crypto";
+import { _toExportableKeyObject, exploreCertificate } from "node-opcua-crypto";
 import {
-    certificateMatchesPrivateKey,
     type Certificate,
+    certificateMatchesPrivateKey,
     coercePEMorDerToPrivateKey,
     coercePrivateKeyPem,
     combine_der,
@@ -83,6 +83,22 @@ async function preInstallCertificate(
     }
 }
 
+/**
+ * Encode `privateKeyObj` as a PKCS#8 PEM string, encrypted with `passphrase`
+ * (aes-256-cbc — same cipher `writePrivateKeyFile` uses) when given, plaintext
+ * otherwise. Never touches disk — the caller stages the resulting string via
+ * `FileTransactionManager.stageFile()`, so an encrypted key is the only form
+ * that is ever written, whether to the staging temp file or the final
+ * destination.
+ */
+function encodePrivateKeyPem(privateKeyObj: PrivateKey, passphrase: string | undefined): string {
+    if (!passphrase) {
+        return coercePrivateKeyPem(privateKeyObj);
+    }
+    const keyObject = _toExportableKeyObject(privateKeyObj);
+    return keyObject.export({ type: "pkcs8", format: "pem", cipher: "aes-256-cbc", passphrase }) as string;
+}
+
 // Helper: Stage private key to temporary file
 async function preInstallPrivateKey(
     serverImpl: PushCertificateManagerInternalContext,
@@ -94,7 +110,11 @@ async function preInstallPrivateKey(
 
     if (privateKey) {
         const privateKeyObj = coercePEMorDerToPrivateKey(privateKey as string | Buffer);
-        const privateKeyPEM = coercePrivateKeyPem(privateKeyObj);
+        // If the certificate manager is configured with a privateKeyPassphrase,
+        // the staged (and later applied) key must be encrypted with it — never
+        // written back to disk in clear.
+        const passphrase = await (certificateManager as OPCUACertificateManager).getPrivateKeyPassphrase?.();
+        const privateKeyPEM = encodePrivateKeyPem(privateKeyObj, passphrase);
         await serverImpl.fileTransactionManager.stageFile(certificateManager.privateKey, privateKeyPEM, "utf-8");
     }
 }
@@ -117,7 +137,8 @@ export async function executeUpdateCertificate(
     try {
         const context = resolveCertificateGroupContext(serverImpl, certificateGroupId);
         if (context.statusCode.isNotGood() || !context.certificateManager) {
-            debugLog(" cannot find group ", certificateGroupId);
+            // c8 ignore next
+            doDebug && debugLog(" cannot find group ", certificateGroupId);
             return { statusCode: StatusCodes.BadInvalidArgument, applyChangesRequired: false };
         }
 
@@ -170,9 +191,17 @@ export async function executeUpdateCertificate(
         }
 
         if (!hasPrivateKeyFormat && !hasPrivateKey) {
-            const privateKeyObj = readPrivateKey(
-                serverImpl.tmpCertificateManager ? serverImpl.tmpCertificateManager.privateKey : certificateManager.privateKey
-            );
+            // Resolve via getPrivateKey(), for two independent reasons:
+            // - CertificateManager.getPrivateKey() caches the decoded key for the lifetime of the
+            //   instance (see node-opcua-pki). createCertificateRequest()/createSelfSignedCertificate()
+            //   both go through that cache, so the CSR that produced `certificate` was necessarily
+            //   signed with the *cached* key. Comparing against a fresh disk read (readPrivateKey
+            //   on the file path) would compare against whatever is currently on disk instead — which
+            //   can differ right after a previous updateCertificate() call replaced the private key
+            //   file directly (bypassing the cache), causing a spurious BadSecurityChecksFailed.
+            // - the on-disk file may be an encrypted PKCS#8 key (privateKeyPassphrase); a raw
+            //   readPrivateKey without the manager's passphrase would fail on it.
+            const privateKeyObj = await (serverImpl.tmpCertificateManager ?? certificateManager).getPrivateKey();
 
             if (!certificateMatchesPrivateKey(certificate, privateKeyObj)) {
                 warningLog("certificate doesn't match privateKey");

package/source/server/push_certificate_manager_helpers.ts

@@ -16,12 +16,12 @@ import {
 } from "node-opcua-address-space";
 import { EventNotifierFlags, type UAObject, type UAVariable } from "node-opcua-address-space-base";
 import type { ByteString, UAString } from "node-opcua-basic-types";
+import type { CertificateManager } from "node-opcua-certificate-manager";
 import { ObjectIds, ObjectTypeIds } from "node-opcua-constants";
 import { type Certificate, readCertificateChainAsync } from "node-opcua-crypto";
 import { AccessRestrictionsFlag, BrowseDirection, coerceQualifiedName, NodeClass } from "node-opcua-data-model";
-import { make_debugLog, make_errorLog, make_warningLog } from "node-opcua-debug";
+import { checkDebugFlag, make_debugLog, make_errorLog, make_warningLog } from "node-opcua-debug";
 import { NodeId, resolveNodeId } from "node-opcua-nodeid";
-import type { CertificateManager } from "node-opcua-certificate-manager";
 import { StatusCodes } from "node-opcua-status-code";
 import type { CallMethodResultOptions } from "node-opcua-types";
 import { DataType, type Variant, VariantArrayType } from "node-opcua-variant";
@@ -37,6 +37,7 @@ import { rolePermissionAdminOnly, rolePermissionRestricted } from "./roles_and_p
 import { hasEncryptedChannel, hasExpectedUserAccess } from "./tools.js";
 
 const debugLog = make_debugLog("ServerConfiguration");
+const doDebug = checkDebugFlag("ServerConfiguration");
 const warningLog = make_warningLog("ServerConfiguration");
 const errorLog = make_errorLog("ServerConfiguration");
 
@@ -273,14 +274,16 @@ function bindCertificateGroup(certificateGroup: UACertificateGroup, certificateM
         const certificateFile = getCertificateFilename(certificateManager);
         const changeDetector = installCertificateFileWatcher(certificateGroup, certificateFile);
         changeDetector.on("certificateChange", () => {
-            debugLog("detecting certificate change", certificateFile);
+            // c8 ignore next
+            doDebug && debugLog("detecting certificate change", certificateFile);
             updateCertificateAlarm();
         });
     }
 
     async function updateCertificateAlarm() {
         try {
-            debugLog("updateCertificateAlarm", certificateGroup.browseName.toString());
+            // c8 ignore next
+            doDebug && debugLog("updateCertificateAlarm", certificateGroup.browseName.toString());
             const certificateExpired = certificateGroup.getComponentByName("CertificateExpired");
             if (certificateExpired && certificateManager) {
                 const certificateExpiredEx = certificateExpired as unknown as UACertificateExpirationAlarmEx;
@@ -393,7 +396,8 @@ export async function installPushCertificateManagement(
 
     const serverConfigurationPriv = serverConfiguration as UAServerConfigurationPriv;
     if (serverConfigurationPriv.$pushCertificateManager) {
-        debugLog("PushCertificateManagement has already been installed");
+        // c8 ignore next
+        doDebug && debugLog("PushCertificateManagement has already been installed");
         return;
     }
 

package/source/server/push_certificate_manager_server_impl.ts

@@ -39,6 +39,8 @@ export interface PushCertificateManagerEvents {
     applyChangesCompleted: (context?: ISessionContext) => void;
     certificateUpdated: (certificateGroupId: NodeId | string, certificate: Buffer) => void;
     trustListUpdated: (certificateGroupId: string) => void;
+    CertificateAboutToChange: (actionQueue: ActionQueue) => void;
+    CertificateChanged: (actionQueue: ActionQueue) => void;
 }
 
 export interface PushCertificateManagerServerOptions {
@@ -71,18 +73,14 @@ export class PushCertificateManagerServerImpl extends EventEmitter implements Pu
 
     // ── typed event helpers ──────────────────────────────────────────
     public on<K extends keyof PushCertificateManagerEvents>(event: K, listener: PushCertificateManagerEvents[K]): this;
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    public on(event: string | symbol, listener: (...args: any[]) => void): this;
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    public on(event: string | symbol, listener: (...args: any[]) => void): this {
+    public on(event: string | symbol, listener: (...args: unknown[]) => void): this;
+    public on(event: string | symbol, listener: (...args: unknown[]) => void): this {
         return super.on(event, listener);
     }
 
     public once<K extends keyof PushCertificateManagerEvents>(event: K, listener: PushCertificateManagerEvents[K]): this;
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    public once(event: string | symbol, listener: (...args: any[]) => void): this;
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    public once(event: string | symbol, listener: (...args: any[]) => void): this {
+    public once(event: string | symbol, listener: (...args: unknown[]) => void): this;
+    public once(event: string | symbol, listener: (...args: unknown[]) => void): this {
         return super.once(event, listener);
     }
 
@@ -175,7 +173,6 @@ export class PushCertificateManagerServerImpl extends EventEmitter implements Pu
         return await executeGetRejectedList(this._context);
     }
 
-    // eslint-disable-next-line max-statements
     public async updateCertificate(
         certificateGroupId: NodeId | string,
         certificateTypeId: NodeId | string,

package/source/server/tools.ts

@@ -2,7 +2,7 @@ import { type ISessionContext, WellKnownRoles } from "node-opcua-address-space";
 import { MessageSecurityMode } from "node-opcua-secure-channel";
 
 export function hasExpectedUserAccess(context: ISessionContext) {
-    if (!context || !context.session || !context.session.userIdentityToken) {
+    if (!context?.session?.userIdentityToken) {
         return false;
     }
     return context.currentUserHasRole(WellKnownRoles.SecurityAdmin);