node-opcua-server-configuration 2.186.3 → 2.186.5

package/source/server/application_setup.ts

@@ -0,0 +1,169 @@
+/**
+ * @module node-opcua-server-configuration
+ *
+ * Clients trusted automatically in the application setup state.
+ *
+ * While a server reports `ServerState.NoConfiguration` (the application setup
+ * state of OPC 10000-12 §G.2), push certificate management admits any client
+ * and trusts its certificate, so that a CertificateManager can reach the
+ * server for the first time. Anyone else who connects in that window is
+ * trusted the same way. This module remembers which certificates were
+ * trusted that way (leaves in the trusted list, and the issuers that came
+ * with them), so that they can be withdrawn when the server leaves the setup
+ * state, unless a TrustList written since then kept them.
+ *
+ * The record is kept next to the PKI store, so a restart in the middle of the
+ * setup does not turn provisional trust into permanent trust.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import type { CertificateManager } from "node-opcua-certificate-manager";
+import { makeSHA1Thumbprint, readCertificateChainAsync } from "node-opcua-crypto";
+import { make_errorLog, make_warningLog } from "node-opcua-debug";
+
+const warningLog = make_warningLog("ServerConfiguration");
+const errorLog = make_errorLog("ServerConfiguration");
+
+const RECORD_FILE = "provisional_trust.json";
+
+/** Which list of the TrustList a provisionally trusted certificate sits in. */
+export type ProvisionalList = "trusted" | "issuers";
+
+const records = new WeakMap<CertificateManager, Set<string>>();
+
+const key = (list: ProvisionalList, thumbprint: string) => `${list}:${thumbprint}`;
+
+function recordFile(cm: CertificateManager): string {
+    return path.join(cm.rootDir, RECORD_FILE);
+}
+
+function load(cm: CertificateManager): Set<string> {
+    let record = records.get(cm);
+    if (record) return record;
+    record = new Set<string>();
+    const file = recordFile(cm);
+    try {
+        if (fs.existsSync(file)) {
+            for (const entry of JSON.parse(fs.readFileSync(file, "utf8")) as string[]) {
+                record.add(entry);
+            }
+        }
+    } catch (err) {
+        // The record is written atomically (see save), so this is not a torn
+        // write: someone edited or damaged it. Nothing here can tell which
+        // trusted certificates were provisional any more; say so loudly.
+        errorLog(
+            `[ApplicationSetup] cannot read ${file}: certificates trusted automatically during the setup will not be withdrawn.`,
+            (err as Error).message
+        );
+    }
+    records.set(cm, record);
+    return record;
+}
+
+async function save(cm: CertificateManager, record: Set<string>): Promise<void> {
+    const file = recordFile(cm);
+    if (record.size === 0) {
+        await fs.promises.rm(file, { force: true });
+        return;
+    }
+    // Write-then-rename: a crash mid-write must not leave a record that
+    // cannot be read, which would make provisional trust permanent.
+    const tmp = `${file}.tmp`;
+    await fs.promises.writeFile(tmp, JSON.stringify([...record], null, 1), "utf8");
+    await fs.promises.rename(tmp, file);
+}
+
+/** The certificate identified by `thumbprint` was put in `list` only because the server is in the setup state. */
+export async function recordProvisionalTrust(cm: CertificateManager, list: ProvisionalList, thumbprint: string): Promise<void> {
+    const record = load(cm);
+    const entry = key(list, thumbprint);
+    if (record.has(entry)) return;
+    record.add(entry);
+    await save(cm, record);
+}
+
+/** A TrustList write put these certificates in `list`: they are no longer provisional. */
+export async function confirmTrust(cm: CertificateManager, list: ProvisionalList, thumbprints: string[]): Promise<void> {
+    const record = load(cm);
+    let changed = false;
+    for (const thumbprint of thumbprints) {
+        changed = record.delete(key(list, thumbprint)) || changed;
+    }
+    if (changed) {
+        await save(cm, record);
+    }
+}
+
+/**
+ * Thumbprints (lowercase hex SHA-1, as the PKI store keys them) of the leaf
+ * certificate of each certificate file in a PKI folder. A file that cannot be
+ * parsed is skipped with a warning rather than failing the caller.
+ */
+export async function leafThumbprintsIn(folder: string): Promise<string[]> {
+    if (!fs.existsSync(folder)) return [];
+    const thumbprints: string[] = [];
+    for (const file of await fs.promises.readdir(folder)) {
+        const ext = path.extname(file);
+        if (ext !== ".der" && ext !== ".pem") continue;
+        try {
+            const chain = await readCertificateChainAsync(path.join(folder, file));
+            if (chain.length > 0) thumbprints.push(makeSHA1Thumbprint(chain[0]).toString("hex"));
+        } catch (err) {
+            warningLog(`[TrustList] skipping ${path.join(folder, file)}: not a certificate`, (err as Error).message);
+        }
+    }
+    return thumbprints;
+}
+
+/** Whether the trusted list holds at least one certificate that was not trusted provisionally. */
+export async function hasConfirmedTrust(cm: CertificateManager): Promise<boolean> {
+    const record = load(cm);
+    return (await leafThumbprintsIn(cm.trustedFolder)).some((thumbprint) => !record.has(key("trusted", thumbprint)));
+}
+
+/**
+ * Remove every provisionally trusted certificate from the TrustList. An
+ * issuer that a remaining trusted certificate still needs is kept. Returns
+ * the number of certificates removed.
+ */
+export async function withdrawProvisionalTrust(cm: CertificateManager): Promise<number> {
+    const record = load(cm);
+    let withdrawn = 0;
+    const entries = [...record];
+    for (const entry of entries.filter((e) => e.startsWith("trusted:"))) {
+        if (await cm.removeTrustedCertificate(entry.slice("trusted:".length))) withdrawn++;
+    }
+    for (const entry of entries.filter((e) => e.startsWith("issuers:"))) {
+        const issuer = await cm.removeIssuer(entry.slice("issuers:".length));
+        if (!issuer) continue;
+        if (await cm.isIssuerInUseByTrustedCertificate(issuer)) {
+            await cm.addIssuer(issuer);
+        } else {
+            withdrawn++;
+        }
+    }
+    record.clear();
+    await save(cm, record);
+    return withdrawn;
+}
+
+// ── TrustList stores shared between CertificateGroups ─────────────
+
+const sharedStores = new WeakSet<CertificateManager>();
+
+/**
+ * `a` and `b` back two CertificateGroups with one PKI store. A TrustList
+ * write to either group then cannot replace its list without also removing
+ * the other group's certificates (see applyTrustListChanges).
+ */
+export function markSharedTrustListStore(a: CertificateManager, b: CertificateManager): void {
+    if (a === b || path.resolve(a.rootDir) === path.resolve(b.rootDir)) {
+        sharedStores.add(a);
+        sharedStores.add(b);
+    }
+}
+
+export function isSharedTrustListStore(cm: CertificateManager): boolean {
+    return sharedStores.has(cm);
+}

package/source/server/install_push_certificate_management.ts

@@ -16,12 +16,19 @@ import {
     resolvePrivateKeyProviderIfNeeded
 } from "node-opcua-common";
 import { readPrivateKey } from "node-opcua-crypto";
-import { type Certificate, exploreCertificateInfo, split_der } from "node-opcua-crypto/web";
+import {
+    type Certificate,
+    exploreCertificateInfo,
+    makeSHA1Thumbprint,
+    split_der,
+    verifyCertificateSignature
+} from "node-opcua-crypto/web";
 import { checkDebugFlag, make_debugLog, make_errorLog, make_warningLog } from "node-opcua-debug";
 import type { OPCUAServer, OPCUAServerEndPoint } from "node-opcua-server";
 import { type StatusCode, StatusCodes } from "node-opcua-status-code";
 import { type ApplicationDescriptionOptions, ServerState } from "node-opcua-types";
 
+import { hasConfirmedTrust, leafThumbprintsIn, recordProvisionalTrust, withdrawProvisionalTrust } from "./application_setup.js";
 import { installPushCertificateManagement } from "./push_certificate_manager_helpers.js";
 import type { ActionQueue, PushCertificateManagerServerImpl } from "./push_certificate_manager_server_impl.js";
 
@@ -239,6 +246,42 @@ export interface InstallPushCertificateManagementOnServerOptions {
      * @defaultValue true
      */
     closeChannelsOnApplyChanges?: boolean;
+
+    /**
+     * How the server leaves the application setup state
+     * (`ServerState.NoConfiguration`, OPC 10000-12 §G.2).
+     */
+    applicationSetup?: ApplicationSetupOptions;
+}
+
+export interface ApplicationSetupOptions {
+    /**
+     * Leave the application setup state automatically once the server is
+     * configured. §G.2: "Once an application has been configured it
+     * automatically leaves the application setup state. This step is
+     * necessary to ensure that security is not compromised."
+     *
+     * While the server reports `NoConfiguration`, push certificate
+     * management admits any client and trusts its certificate, so that a
+     * CertificateManager can reach it for the first time (see
+     * `installCertificateRelaxationHook`). With this option:
+     *
+     * - the server moves to `Running` when ApplyChanges has put a
+     *   CA-issued certificate into service and the TrustList holds a
+     *   certificate that was not trusted automatically;
+     * - on leaving `NoConfiguration` (this way or when the application sets
+     *   the state itself), the certificates trusted automatically are
+     *   removed again, except those a TrustList write kept (CloseAndUpdate
+     *   of the trusted list, AddCertificate). Whoever configured the server
+     *   stays trusted through the TrustList it wrote; anyone else who
+     *   connected during the setup does not.
+     *
+     * Without it the application decides when the setup ends, and the
+     * certificates trusted automatically stay trusted.
+     *
+     * @defaultValue false
+     */
+    leaveWhenConfigured?: boolean;
 }
 
 export async function installPushCertificateManagementOnServer(
@@ -246,6 +289,7 @@ export async function installPushCertificateManagementOnServer(
     options?: InstallPushCertificateManagementOnServerOptions
 ): Promise<void> {
     const closeChannelsOnApplyChanges = options?.closeChannelsOnApplyChanges ?? true;
+    const leaveWhenConfigured = options?.applicationSetup?.leaveWhenConfigured ?? false;
     if (!server.engine?.addressSpace) {
         throw new Error(
             "Server must have a valid address space. " +
@@ -309,6 +353,9 @@ export async function installPushCertificateManagementOnServer(
         setImmediate(async () => {
             try {
                 await onApplyChangesCompleted(server, closeChannelsOnApplyChanges);
+                if (leaveWhenConfigured) {
+                    await leaveApplicationSetupIfConfigured(server, cm);
+                }
             } catch (err) {
                 errorLog("onApplyChangesCompleted error:", (err as Error).message);
             }
@@ -323,8 +370,10 @@ export async function installPushCertificateManagementOnServer(
     // write a certificate straight into serverCertificateManager's
     // trusted-certs folder. Only the method path emits "trustListUpdated",
     // so a consumer waiting on it to learn that the server has been
-    // provisioned - to leave NoConfiguration, say - would never hear about
-    // a TrustList populated the other way.
+    // provisioned would never hear about a TrustList populated the other
+    // way. It is not a signal to leave NoConfiguration: the first client
+    // trusted automatically populates the TrustList too. Use
+    // `applicationSetup.leaveWhenConfigured` for that.
     //
     // This deliberately does NOT emit "applyChangesCompleted": that event
     // means "a certificate rotation was applied" and carries channel
@@ -375,7 +424,149 @@ export async function installPushCertificateManagementOnServer(
     //
     // This hook is ONLY installed when push certificate management
     // is active — bare servers are completely unaffected.
-    installCertificateRelaxationHook(server);
+    installCertificateRelaxationHook(server, leaveWhenConfigured);
+
+    // ── Re-evaluate open channels when the TrustList changes ──
+    //
+    // §7.8.2.5: "When the TrustList changes the Server shall re-evaluate the
+    // Certificate associated with any open Sessions and SecureChannels.
+    // Sessions or SecureChannels with an untrusted or revoked Certificate
+    // shall be closed." The event fires inside the method, before its
+    // response is on the wire; the delay gives the Client that changed the
+    // TrustList time to receive it before its own channel may be closed
+    // ("This process may not complete before the Method returns").
+    serverConfigurationPriv.$pushCertificateManager.on("trustListUpdated", () => {
+        setTimeout(() => {
+            closeChannelsNoLongerTrusted(server).catch((err) =>
+                errorLog("[TrustList] cannot re-evaluate open channels:", (err as Error).message)
+            );
+        }, REEVALUATION_DELAY_MS);
+    });
+
+    if (leaveWhenConfigured) {
+        withdrawProvisionalTrustOnLeavingSetup(server, cm);
+        // The TrustList may be written after ApplyChanges: without a
+        // transaction CloseAndUpdate applies on its own, so check then too.
+        serverConfigurationPriv.$pushCertificateManager.on("trustListUpdated", () => {
+            setTimeout(() => {
+                leaveApplicationSetupIfConfigured(server, cm).catch((err) =>
+                    errorLog("[ApplicationSetup] cannot evaluate the setup state:", (err as Error).message)
+                );
+            }, REEVALUATION_DELAY_MS);
+        });
+    }
+}
+
+// ── Re-evaluating open channels (§7.8.2.5) ─────────────────────
+
+const reevaluations = new WeakMap<OPCUAServer, Promise<unknown>>();
+
+/** How long after a TrustList change open channels are re-evaluated (see the "trustListUpdated" listener). */
+const REEVALUATION_DELAY_MS = 250;
+
+/**
+ * Close every SecureChannel, and the Sessions on it, whose client
+ * certificate the server no longer accepts. In the setup state an untrusted
+ * certificate is still admitted, so only a revoked or otherwise invalid one
+ * closes the channel then. Returns the number of channels closed.
+ *
+ * The check never trusts a certificate on its own: the relaxation hook,
+ * which does, is not called.
+ */
+export function closeChannelsNoLongerTrusted(server: OPCUAServer): Promise<number> {
+    const run = (reevaluations.get(server) ?? Promise.resolve()).then(() => _closeChannelsNoLongerTrusted(server));
+    reevaluations.set(
+        server,
+        run.catch(() => undefined)
+    );
+    return run;
+}
+
+async function _closeChannelsNoLongerTrusted(server: OPCUAServer): Promise<number> {
+    const cm = server.serverCertificateManager;
+    let closed = 0;
+    for (const endpoint of server.endpoints as OPCUAServerEndPoint[]) {
+        for (const channel of endpoint.getChannels()) {
+            const certificate = channel.clientCertificate;
+            if (!certificate) {
+                continue;
+            }
+            const statusCode = await cm.checkCertificate(certificate);
+            if (statusCode.isGood()) {
+                continue;
+            }
+            if (server.engine.getServerState() === ServerState.NoConfiguration && isRelaxableCertificateError(statusCode)) {
+                continue;
+            }
+            warningLog(`[TrustList] closing SecureChannel ${channel.channelId}: client certificate is now ${statusCode.name}`);
+            for (const session of server.engine.getSessions()) {
+                if (session.channel === channel) {
+                    server.engine.closeSession(session.authenticationToken, false, "Terminated");
+                }
+            }
+            channel.close();
+            closed++;
+        }
+    }
+    return closed;
+}
+
+// ── Leaving the application setup state (§G.2) ─────────────────
+
+function isSelfSigned(certificate: Certificate): boolean {
+    try {
+        return verifyCertificateSignature(certificate, certificate);
+    } catch {
+        return false;
+    }
+}
+
+/**
+ * Move to Running once ApplyChanges has put a CA-issued certificate into
+ * service and the TrustList holds a certificate that was not trusted
+ * automatically. Leaving earlier would lock every client out, the
+ * CertificateManager included.
+ */
+async function leaveApplicationSetupIfConfigured(server: OPCUAServer, cm: OPCUACertificateManager): Promise<void> {
+    if (server.engine.getServerState() !== ServerState.NoConfiguration) {
+        return;
+    }
+    if (isSelfSigned(server.getCertificate())) {
+        doDebug && debugLog("[ApplicationSetup] still self-signed: staying in NoConfiguration");
+        return;
+    }
+    if (!(await hasConfirmedTrust(cm))) {
+        warningLog(
+            "[ApplicationSetup] a CA-issued certificate is in service but no TrustList was written: staying in NoConfiguration"
+        );
+        return;
+    }
+    warningLog("[ApplicationSetup] configured: leaving NoConfiguration");
+    server.engine.setServerState(ServerState.Running);
+}
+
+/** When the server leaves NoConfiguration, remove the certificates trusted automatically during the setup. */
+function withdrawProvisionalTrustOnLeavingSetup(server: OPCUAServer, cm: OPCUACertificateManager): void {
+    const onStateChanged = (oldState: ServerState, newState: ServerState) => {
+        if (newState === ServerState.Shutdown) {
+            server.engine.removeListener("serverStateChanged", onStateChanged);
+            return;
+        }
+        if (oldState !== ServerState.NoConfiguration || newState === ServerState.NoConfiguration) {
+            return;
+        }
+        withdrawProvisionalTrust(cm)
+            .then(async (withdrawn) => {
+                if (withdrawn > 0) {
+                    warningLog(
+                        `[ApplicationSetup] setup ended: ${withdrawn} certificate(s) trusted automatically are no longer trusted`
+                    );
+                }
+                await closeChannelsNoLongerTrusted(server);
+            })
+            .catch((err) => errorLog("[ApplicationSetup] cannot withdraw provisional trust:", (err as Error).message));
+    };
+    server.engine.on("serverStateChanged", onStateChanged);
 }
 
 // ── Certificate relaxation for NoConfiguration state ──────────
@@ -403,7 +594,10 @@ export async function installPushCertificateManagementOnServer(
  * relaxation hook returns the original status code unchanged and
  * normal strict certificate validation applies.  The accepted
  * certificate is auto-trusted (see `autoTrustCertificateChain`)
- * so that subsequent connections succeed under normal validation.
+ * so that subsequent connections succeed under normal validation;
+ * with `applicationSetup.leaveWhenConfigured` that trust is
+ * withdrawn again when the setup ends, unless a TrustList write
+ * kept it.
  *
  * Errors that indicate an active security violation (revoked,
  * expired, invalid signature, wrong usage) are **never** relaxed,
@@ -432,7 +626,7 @@ function isRelaxableCertificateError(statusCode: StatusCode): boolean {
  * connection from unintentionally granting trust to every
  * certificate signed by the same CA.
  */
-async function autoTrustCertificateChain(server: OPCUAServer, certificate: Certificate): Promise<void> {
+async function autoTrustCertificateChain(server: OPCUAServer, certificate: Certificate, recordProvisional: boolean): Promise<void> {
     let chain: Certificate[];
     try {
         chain = split_der(certificate);
@@ -456,8 +650,12 @@ async function autoTrustCertificateChain(server: OPCUAServer, certificate: Certi
         }
 
         if (i === 0) {
-            // Leaf certificate → trust explicitly
+            // Leaf certificate → trust explicitly, and remember that it was
+            // trusted only because the server is in the setup state.
             try {
+                if (recordProvisional && (await cm.isCertificateTrusted(cert)) !== "Good") {
+                    await recordProvisionalTrust(cm, "trusted", makeSHA1Thumbprint(cert).toString("hex"));
+                }
                 await cm.trustCertificate(cert);
             } catch (err) {
                 // ENOENT can happen if another concurrent call already
@@ -470,6 +668,12 @@ async function autoTrustCertificateChain(server: OPCUAServer, certificate: Certi
             // Issuer CA certificate → add to issuers/ (chain-building
             // only, does NOT establish a trust anchor)
             try {
+                if (recordProvisional) {
+                    const thumbprint = makeSHA1Thumbprint(cert).toString("hex");
+                    if (!(await leafThumbprintsIn(cm.issuersCertFolder)).includes(thumbprint)) {
+                        await recordProvisionalTrust(cm, "issuers", thumbprint);
+                    }
+                }
                 await cm.addIssuer(cert);
             } catch (err) {
                 warningLog("[NoConfiguration] Failed to add issuer certificate:", (err as Error).message);
@@ -490,7 +694,7 @@ async function autoTrustCertificateChain(server: OPCUAServer, certificate: Certi
  * validation.  Issuer CAs are placed in `issuers/` for chain
  * building but do not become trust anchors.
  */
-function installCertificateRelaxationHook(server: OPCUAServer): void {
+function installCertificateRelaxationHook(server: OPCUAServer, recordProvisional: boolean): void {
     const adjustCertificateStatus = async (statusCode: StatusCode, certificate: Certificate): Promise<StatusCode> => {
         // Only relax in NoConfiguration state
         if (server.engine.getServerState() !== ServerState.NoConfiguration) {
@@ -510,7 +714,7 @@ function installCertificateRelaxationHook(server: OPCUAServer): void {
             );
 
         // Auto-trust the leaf certificate; issuer CAs go to issuers/
-        await autoTrustCertificateChain(server, certificate);
+        await autoTrustCertificateChain(server, certificate, recordProvisional);
 
         return StatusCodes.Good;
     };

package/source/server/promote_trust_list.ts

@@ -21,7 +21,7 @@ import type {
 } from "node-opcua-address-space";
 import { BinaryStream } from "node-opcua-binary-stream";
 import type { OPCUACertificateManager } from "node-opcua-certificate-manager";
-import { split_der, verifyCertificateChain } from "node-opcua-crypto/web";
+import { exploreCertificate, makeSHA1Thumbprint, split_der, verifyCertificateChain } from "node-opcua-crypto/web";
 import { AccessRestrictionsFlag } from "node-opcua-data-model";
 import { checkDebugFlag, make_debugLog, make_errorLog, make_warningLog } from "node-opcua-debug";
 import { type AbstractFs, installFileType, OpenFileMode } from "node-opcua-file-transfer";
@@ -29,6 +29,7 @@ import { VerificationStatus } from "node-opcua-pki";
 import { type CallbackT, type StatusCode, StatusCodes } from "node-opcua-status-code";
 import { type CallMethodResultOptions, TrustListDataType } from "node-opcua-types";
 import { DataType, Variant } from "node-opcua-variant";
+import { confirmTrust, isSharedTrustListStore, leafThumbprintsIn } from "./application_setup.js";
 import type { PushCertificateManagerServerImpl } from "./push_certificate_manager_server_impl.js";
 import { rolePermissionAdminOnly } from "./roles_and_permissions.js";
 import { hasEncryptedChannel, hasExpectedUserAccess } from "./tools.js";
@@ -274,29 +275,6 @@ async function applyTrustListChanges(cm: OPCUACertificateManager, trustListData:
             trustListData.specifiedLists |= TrustListMasks.IssuerCertificates;
         }
 
-        // Process CRLs
-        if ((trustListData.specifiedLists & TrustListMasks.IssuerCrls) === TrustListMasks.IssuerCrls) {
-            doDebug && debugLog("Processing issuer CRLs");
-            await cm.clearRevocationLists("issuers");
-            if (trustListData.issuerCrls && trustListData.issuerCrls.length > 0) {
-                doDebug && debugLog(` Writing ${trustListData.issuerCrls.length} issuer CRLs`);
-                for (const crl of trustListData.issuerCrls) {
-                    await cm.addRevocationList(crl, "issuers");
-                }
-            }
-        }
-
-        if ((trustListData.specifiedLists & TrustListMasks.TrustedCrls) === TrustListMasks.TrustedCrls) {
-            doDebug && debugLog("Processing trusted CRLs");
-            await cm.clearRevocationLists("trusted");
-            if (trustListData.trustedCrls && trustListData.trustedCrls.length > 0) {
-                doDebug && debugLog(` Writing ${trustListData.trustedCrls.length} trusted CRLs`);
-                for (const crl of trustListData.trustedCrls) {
-                    await cm.addRevocationList(crl, "trusted");
-                }
-            }
-        }
-
         // Validate all trusted certificates
         if (
             (trustListData.specifiedLists & TrustListMasks.TrustedCertificates) === TrustListMasks.TrustedCertificates &&
@@ -305,6 +283,9 @@ async function applyTrustListChanges(cm: OPCUACertificateManager, trustListData:
             for (const cert of trustListData.trustedCertificates) {
                 try {
                     const certs = split_der(cert);
+                    // verifyCertificateChain checks nothing on a one-element chain;
+                    // parsing is what rejects bytes that are not a certificate.
+                    exploreCertificate(certs[0]);
                     const validationResult = await verifyCertificateChain([certs[0]]);
                     if (validationResult.status !== "Good") {
                         warningLog("Invalid certificate in trust list:", validationResult.status, validationResult.reason);
@@ -325,6 +306,9 @@ async function applyTrustListChanges(cm: OPCUACertificateManager, trustListData:
             for (const cert of trustListData.issuerCertificates) {
                 try {
                     const certs = split_der(cert);
+                    // verifyCertificateChain checks nothing on a one-element chain;
+                    // parsing is what rejects bytes that are not a certificate.
+                    exploreCertificate(certs[0]);
                     const validationResult = await verifyCertificateChain([certs[0]]);
                     if (validationResult.status !== "Good") {
                         warningLog("Invalid issuer certificate in trust list:", validationResult.status, validationResult.reason);
@@ -337,22 +321,53 @@ async function applyTrustListChanges(cm: OPCUACertificateManager, trustListData:
             }
         }
 
-        // Update certificates
-        if (
-            (trustListData.specifiedLists & TrustListMasks.TrustedCertificates) === TrustListMasks.TrustedCertificates &&
-            trustListData.trustedCertificates
-        ) {
-            for (const cert of trustListData.trustedCertificates) {
+        // Nothing below runs unless every uploaded certificate is valid, so an
+        // invalid upload leaves the TrustList (CRLs included) as it was.
+        // Process CRLs
+        if ((trustListData.specifiedLists & TrustListMasks.IssuerCrls) === TrustListMasks.IssuerCrls) {
+            doDebug && debugLog("Processing issuer CRLs");
+            await cm.clearRevocationLists("issuers");
+            if (trustListData.issuerCrls && trustListData.issuerCrls.length > 0) {
+                doDebug && debugLog(` Writing ${trustListData.issuerCrls.length} issuer CRLs`);
+                for (const crl of trustListData.issuerCrls) {
+                    await cm.addRevocationList(crl, "issuers");
+                }
+            }
+        }
+
+        if ((trustListData.specifiedLists & TrustListMasks.TrustedCrls) === TrustListMasks.TrustedCrls) {
+            doDebug && debugLog("Processing trusted CRLs");
+            await cm.clearRevocationLists("trusted");
+            if (trustListData.trustedCrls && trustListData.trustedCrls.length > 0) {
+                doDebug && debugLog(` Writing ${trustListData.trustedCrls.length} trusted CRLs`);
+                for (const crl of trustListData.trustedCrls) {
+                    await cm.addRevocationList(crl, "trusted");
+                }
+            }
+        }
+
+        // Update certificates. A list whose bit is set is replaced by the one
+        // uploaded, not added to (§7.8.2.5: the Server "creates a new TrustList
+        // that includes the existing TrustList plus any updates"; §7.8.2.9: a
+        // list whose bit is not set is not changed). The uploaded certificates
+        // are added before the others are removed: should an add fail, the
+        // list is left larger than asked, never emptier, so nobody who was
+        // trusted is locked out by a half-applied write.
+        if ((trustListData.specifiedLists & TrustListMasks.TrustedCertificates) === TrustListMasks.TrustedCertificates) {
+            const uploaded = trustListData.trustedCertificates ?? [];
+            for (const cert of uploaded) {
                 await cm.trustCertificate(cert);
             }
+            await confirmTrust(cm, "trusted", uploaded.map(leafThumbprint));
+            await removeCertificatesNotIn(cm, cm.trustedFolder, uploaded, (thumbprint) => cm.removeTrustedCertificate(thumbprint));
         }
-        if (
-            (trustListData.specifiedLists & TrustListMasks.IssuerCertificates) === TrustListMasks.IssuerCertificates &&
-            trustListData.issuerCertificates
-        ) {
-            for (const cert of trustListData.issuerCertificates) {
+        if ((trustListData.specifiedLists & TrustListMasks.IssuerCertificates) === TrustListMasks.IssuerCertificates) {
+            const uploaded = trustListData.issuerCertificates ?? [];
+            for (const cert of uploaded) {
                 await cm.addIssuer(cert);
             }
+            await confirmTrust(cm, "issuers", uploaded.map(leafThumbprint));
+            await removeCertificatesNotIn(cm, cm.issuersCertFolder, uploaded, (thumbprint) => cm.removeIssuer(thumbprint));
         }
 
         return StatusCodes.Good;
@@ -362,6 +377,38 @@ async function applyTrustListChanges(cm: OPCUACertificateManager, trustListData:
     }
 }
 
+function leafThumbprint(certificateOrChain: Buffer): string {
+    return makeSHA1Thumbprint(split_der(certificateOrChain)[0]).toString("hex");
+}
+
+/**
+ * Remove from `folder` every certificate that is not in `uploaded`.
+ *
+ * Skipped, with a warning, when the store backs another CertificateGroup as
+ * well: the certificates of both groups sit in the same folder, and removing
+ * what this group's upload leaves out would remove the other group's too.
+ * Such a store keeps the previous behaviour, adding only.
+ */
+async function removeCertificatesNotIn(
+    cm: OPCUACertificateManager,
+    folder: string,
+    uploaded: Buffer[],
+    remove: (thumbprint: string) => Promise<unknown>
+): Promise<void> {
+    if (isSharedTrustListStore(cm)) {
+        warningLog(
+            `[TrustList] ${cm.rootDir} backs more than one CertificateGroup: the uploaded list is added to it, not replacing it (OPC 10000-12 §7.8.2.5). Give each group its own CertificateManager.`
+        );
+        return;
+    }
+    const kept = new Set(uploaded.map(leafThumbprint));
+    for (const thumbprint of await leafThumbprintsIn(folder)) {
+        if (!kept.has(thumbprint)) {
+            await remove(thumbprint);
+        }
+    }
+}
+
 async function _closeAndUpdate(
     this: UAMethod,
     inputArguments: Variant[],
@@ -515,6 +562,7 @@ async function _addCertificate(
             return { statusCode: verificationStatusToStatusCode(status) };
         }
 
+        await confirmTrust(cm, "trusted", [leafThumbprint(certificateBuffer)]);
         updateLastUpdateTime(trustList);
         emitTrustListUpdated(trustList);
 
@@ -562,6 +610,7 @@ async function _removeCertificate(
             if (!removed) {
                 return { statusCode: StatusCodes.BadInvalidArgument };
             }
+            await confirmTrust(cm, "trusted", [normalizedThumbprint]);
         } else {
             // Removing an issuer certificate — first check if it's still
             // needed by any trusted certificate
@@ -580,6 +629,7 @@ async function _removeCertificate(
 
             // Also remove CRLs issued by this CA
             await cm.removeRevocationListsForIssuer(issuerCert, "issuers");
+            await confirmTrust(cm, "issuers", [normalizedThumbprint]);
         }
 
         updateLastUpdateTime(trustList);