node-opcua / node-opcua-pki / 32595205916

91%

Build Type

push

github

Committed by erossignon

Commit Message

feat(ca): openssl-free CertificateAuthority, HSM/KMS-held keys, native PKCS#12

Signing, revocation, CRLs and PKCS#12 all move behind a CaBackend seam
with a pure-JS implementation, so a CA can be built and operated with no
openssl executable present. The on-disk layout is unchanged, so a
directory still moves between backends and external openssl tooling
keeps working.

A CaSigner keeps the CA key in an HSM or KMS: a signer-backed CA writes
no private/cakey.pem at all, and ECDSA keys work as of crypto 5.9.0.
CertificateAuthority itself is untouched in behaviour, being a thin
subclass over the injected core, and node-opcua-pki/core ships that core
without the openssl machinery (CJS 60% smaller).

Running the CA suites over all four backends is what found the rest:
keyCertSign on every natively issued certificate, EC certificates
reported as malformed, a sub-CA taking the issuer's SAN, and a lock
whose uncapped backoff turned 8 queued signings into 127 seconds.

Coverage Stats

656 of 878 branches covered (74.72%)

745 of 788 new or added lines in 12 files covered. (94.54%)

11 existing lines in 3 files now uncovered.

1835 of 2012 relevant lines covered (91.2%)

301.99 hits per line