node-opcua / node-opcua-pki / 23983841256

91%

Build Type

push

github

Committed by erossignon

Commit Message

Fix: Properly parse and propagate combined DER certificate chains

- Implemented `coerceCertificateChain` in `certificate_manager.ts` to seamlessly convert
  `Certificate | Certificate[]` into an unpacked `Certificate[]`, resolving instances where
  combined DER concatenated buffers were incorrectly processed as length-1 arrays.
- Applied `coerceCertificateChain` array evaluation systematically across library internals
  such as `findIssuerCertificateInChain`, `verifyCertificateAsync`, and `makeFingerprint`.
- Fixed a bug in `isCertificateRevoked` where looking up the issuer locally ignored the
  in-flight certificate chain array, incorrectly prompting `BadCertificateChainIncomplete`.
  It now natively checks the provided array sequentially.
- Expanded `test_combined_der_chain.ts` with explicit regression testing coverage,
  DRY helpers, and edge-cases including extraneous byte parsing, invalid inputs,
  and relaxed mode behavior.
- Refactored assertions in `test_verify_certificate_rejected_vs_first_seen.ts` to accurately
  assess broken chain verification.

Coverage Stats

311 of 433 branches covered (71.82%)

25 of 26 new or added lines in 1 file covered. (96.15%)

1 existing line in 1 file now uncovered.

1375 of 1519 relevant lines covered (90.52%)

193.91 hits per line