[Jeymz]

V1.1.0 Update

High-level summary

This version represents a major functional and security upgrade to the certificate-manager project. It elevates the system from a simple “root-CA issuing certs” tool into a more production-grade PKI service with:

• Intermediate CA support
• Certificate revocation and CRL
• Audit logging for privileged operations
• HTTPS hardening and security headers
• PKCS#12 bundle generation
• LDAP certificate issuance
• Clearer separation of concerns (controllers → services)
• Stricter validation and safer defaults
• Expanded test coverage validating real crypto chains

1. PKI architecture changes (most important)

🔐 Intermediate CA support

• Introduces intermediate CAs as first-class entities:
  • /intermediate HTTP endpoint
  • scripts/setup-intermediate.js
  • Dedicated intermediates/ store directory
• New config flags:
  • requireIntermediate (default: true)
  • defaultIntermediate
• Root CA can be explicitly prevented from issuing leaf certs
• Certificate chains are generated and returned automatically:
  • .chain.crt files
  • chain property in API responses

Why this matters:
This aligns the project with real-world PKI best practices and significantly limits blast radius if a leaf key is compromised.

2. Certificate revocation & CRL

🚫 Revocation system

• New revocation resource backed by revoked.json
• New endpoints:
  • POST /revoke
  • GET /crl
• Revocation metadata tracked:
  • serial number
  • hostname
  • expiration
  • revocation reason
  • timestamp

Why this matters:
Revocation is a fundamental PKI requirement and closes a major functional gap.

3. Audit logging (security & compliance)

🧾 Dedicated audit logger

• Separate audit logger from application logger
• Configurable via AUDIT_LOG_FILE
• Structured JSON output with timestamps
• Logged events include:
  • CA creation
  • Intermediate CA creation
  • Certificate issuance
  • Certificate revocation
  • Passphrase failures (rate-limited)

Audit logs are:

• Append-only
• Independent of LOG_LEVEL
• Sanitized (no private keys or passphrases logged)

Why this matters:
Enables forensic analysis, compliance, and accountability.

4. HTTPS & runtime hardening

🔒 Transport security

• Native HTTPS support
• Configurable via:
  • server.protocol
  • server.key
  • server.cert
• Store validation on startup (fail-fast behavior)

🛡 Express hardening

• Adds helmet middleware
• Safer default HTTP headers

Why this matters:
The service itself is now protected against common web attack vectors.

5. Certificate features & formats

📦 PKCS#12 bundle support

• Optional .p12 generation
• Strong crypto defaults:
  • AES-256
  • PBKDF2
• Written with 0600 permissions
• Password policy enforced

🧬 LDAP certificate support

• New ldapServer cert profile
• Correct EKUs (serverAuth, clientAuth)
• Separate API endpoint: /ldap

🧾 Standards compliance improvements

• Fixes basicConstraints typo
• Adds:
  • subjectKeyIdentifier
  • authorityKeyIdentifier
• Serial numbers correctly hex-encoded

6. Internal refactors & maintainability

🧠 Clearer layering

• Controllers are now thin
• Business logic moved into certService
• CA logic simplified and reused

🗂 Store validation utility

• New storeValidator
• Ensures required files/directories exist:
  • serial
  • log.json
  • revoked.json
  • intermediates/
• Prevents partial or corrupted setups

7. Dependency & tooling updates

• Adds helmet
• Pins node-forge to 1.3.2
• Updates multiple transitive dependencies
• Improves nodemon configuration
• Cleans up .gitignore handling of cert stores
• Refines coverage exclusions

8. Test coverage & verification

🧪 Significant expansion

• New tests for:
  • Audit logging
  • Revocation logic
  • Store validation
  • PKCS#12 bundles
  • Intermediate CA flows
  • End-to-end certificate chain validation
• Uses node-forge to verify:
  • Root → Intermediate → Leaf trust chains
  • LDAP certificate extensions

Why this matters:
Ensures cryptographic correctness.

9. Documentation & workflow updates

• README updated with:
  • Intermediate CA usage
  • LDAP cert examples
  • Audit logging configuration
• Introduces AGENTS.md:
  • Defines AI collaboration norms
  • Emphasizes intent-driven development
• Copilot instructions simplified to focus on Node.js