node-opcua / node-opcua-pki / 32149777214

91%

push

github

feat(security): passphrase-protected private key for CertificateAuthority

CertificateAuthority gains privateKeyPassphrase (string or async fn),
getPrivateKey() and reencryptPrivateKey(), mirroring CertificateManager:
a fresh cakey.pem is written encrypted, an existing plaintext key is
encrypted in place on initialize()/initializeCSR(), and a missing or
wrong passphrase fails initialize() closed. Every openssl call that
loads the CA key (CSR, self-sign, subordinate and end-entity signing,
revoke, gencrl via the config's private_key) gets -passin env:; a
subordinate CA uses its issuer's passphrase for the issuer's -CAkey.
privateKeyProvider stays CertificateManager-only: the CA's signing paths
are openssl reading a key file, so a provider needs a native CA backend.
The POSIX permission-repair test seeds a real key (init now reads it).

543 of 719 branches covered (75.52%)

40 of 41 new or added lines in 1 file covered. (97.56%)

1587 of 1737 relevant lines covered (91.36%)

296.87 hits per line