node-opcua / node-opcua-pki / 23975070883

91%

push

github

fix: remove keyCertSign from non-CA certificate templates

Per X.509 and OPC UA Part 6 section 6.2.2, only CA
certificates may have the keyCertSign key usage bit.
Application instance certificates must use:
  digitalSignature, nonRepudiation, keyEncipherment,
  dataEncipherment

Affected sections:
- simple_config_template: v3_req, v3_ca_signed, v3_selfsigned
- ca_config_template: usr_cert

Fixes "Key usage keyCertSign invalid for non-CA cert"
validation errors seen in OPC UA clients.

Tests: 207 passing, 1 pending

322 of 445 branches covered (72.36%)

1367 of 1509 relevant lines covered (90.59%)

179.11 hits per line