node-opcua / node-opcua-pki / 25151428540

90%

push

github

fix(ca): emit SubjectAltName on CA self-signed certificate

UaExpert (and OPC UA compliance validators) reject CA certificates
that lack a SubjectAltName extension with the error
"SubjectAltName is missing — this extension is mandatory according to
the UA specification". The openssl config template's [ v3_ca ] and
[ v3_ca_req ] sections requested no SAN, and the CA construction set
ALTNAME via processAltNames({} as Params), which produced the literal
"URI:undefined".

- ca_config_template.cnf: add subjectAltName=$ENV::ALTNAME to
  [ v3_ca ] and [ v3_ca_req ].
- certificate_authority: derive ALTNAME from the CA CommonName
  (URI:urn:<CN>) before invoking openssl req / x509 -req.
- add a regression test asserting the CA cert carries a SAN with
  uri = urn:<CN>.

466 of 635 branches covered (73.39%)

1 of 1 new or added line in 1 file covered. (100.0%)

1416 of 1574 relevant lines covered (89.96%)

248.85 hits per line