Class PkiService

PKI Service for cryptographic operations including key generation and CSR creation.

Remarks

Uses dependency injection pattern. The EccProvider dependency must be passed to the constructor. Instantiate via composition root or directly for testing.

Example

const eccProvider = new EccProvider();
const pkiService = new PkiService(eccProvider);
const keyPair = await pkiService.generateKeyPair({ algo: 'rsa', size: 2048 });

Index

Constructors

constructor

new PkiService(eccProvider: EccProvider): PkiService
Creates an instance of PkiService.
Parameters
- eccProvider: EccProvider
  The ECC provider for ECDSA/Ed25519 operations
Returns PkiService
- Defined in src/services/pki.service.ts:97

Properties

`Private` `Readonly`eccProvider

eccProvider: EccProvider

Methods

generateKeyPair

generateKeyPair(options: KeyPairOptions): Promise<GeneratedKeyPair>
Generates a key pair based on the provided options. Uses a switch for native type narrowing without casting.
Parameters
- options: KeyPairOptions
Returns Promise<GeneratedKeyPair>
- Defined in src/services/pki.service.ts:109

`Private`generateRsaKeyPair

generateRsaKeyPair(bits: number): Promise<RsaGeneratedKeyPair>
Generate RSA Key Pair (via node-forge)
Parameters
- bits: number
Returns Promise<RsaGeneratedKeyPair>
- Defined in src/services/pki.service.ts:133

`Private`generateEcdsaKeyPair

generateEcdsaKeyPair(curve: EcdsaCurve): Promise<EccGeneratedKeyPair>
Generate ECDSA Key Pair (via @peculiar/x509)
Parameters
- curve: EcdsaCurve
Returns Promise<EccGeneratedKeyPair>
- Defined in src/services/pki.service.ts:153

`Private`generateEd25519KeyPair

generateEd25519KeyPair(): Promise<EccGeneratedKeyPair>
Generate Ed25519 Key Pair (via @peculiar/x509)

Returns Promise<EccGeneratedKeyPair>
- Defined in src/services/pki.service.ts:169

createCsr

createCsr(options: CsrOptions): Promise<string | Buffer>
Create a Certificate Signing Request (CSR) Routes to RSA (node-forge) or ECC (@peculiar/x509) based on key type
Parameters
- options: CsrOptions
Returns Promise<string | Buffer>
- Defined in src/services/pki.service.ts:190

createRsaCsr

createRsaCsr(options: CsrOptions): string | Buffer
Create CSR with RSA key (node-forge) - synchronous for backward compatibility.
Parameters
- options: CsrOptions
  CSR generation options including subject, extensions, and key pair
Returns string | Buffer
PEM string or DER Buffer depending on options.encoding

Throws
If key pair is not RSA type

Throws
If SAN contains invalid IP address
- Defined in src/services/pki.service.ts:205

`Private`createEccCsr

createEccCsr(options: CsrOptions): Promise<string | Buffer>
Create CSR with ECC key (ECDSA or Ed25519) via @peculiar/x509.
Parameters
- options: CsrOptions
  CSR generation options including subject, extensions, and key pair
Returns Promise<string | Buffer>
PEM string or DER Buffer depending on options.encoding

Throws
If key pair is RSA type (use createRsaCsr instead)
- Defined in src/services/pki.service.ts:289

savePrivateKey

savePrivateKey(
    filePath: string,
    key: string | PrivateKey,
    encoding?: "pem" | "der",
): Promise<void>
Save a Private Key to disk with secure permissions (400)
Parameters
- filePath: string
- key: string | PrivateKey
- encoding: "pem" | "der" = 'pem'
Returns Promise<void>
- Defined in src/services/pki.service.ts:367

savePublicDoc

savePublicDoc(filePath: string, content: string | Buffer): Promise<void>
Save a Public Key / Certificate / CSR to disk with read-only permissions (444)
Parameters
- filePath: string
- content: string | Buffer
Returns Promise<void>
- Defined in src/services/pki.service.ts:403

`Private`saveFile

saveFile(
    filePath: string,
    content: string | Buffer,
    mode: number,
): Promise<void>
Parameters
- filePath: string
- content: string | Buffer
- mode: number
Returns Promise<void>
- Defined in src/services/pki.service.ts:408

loadPrivateKey

loadPrivateKey(filePath: string): PrivateKey
Load a Private Key from a file (PEM format).
Parameters
- filePath: string
  Path to the PEM-encoded private key file
Returns PrivateKey
Parsed private key object

Throws
If file does not exist

Throws
If file cannot be read or parsed as PEM
- Defined in src/services/pki.service.ts:424

`Private`parseSANsForForge

parseSANsForForge(sans: string[]): { type: number; value: string }[]
Parse Subject Alternative Names into node-forge format. Supports DNS, IP (v4/v6), URI, and EMAIL types.
Parameters
- sans: string[]
Returns { type: number; value: string }[]
- Defined in src/services/pki.service.ts:440

`Private`parseSingleSAN

parseSingleSAN(san: string): { type: number; value: string }
Parse a single SAN entry (e.g., "DNS:example.com", "IP:192.168.1.1").
Parameters
- san: string
Returns { type: number; value: string }
- Defined in src/services/pki.service.ts:447

`Private`parseIPToBytes

parseIPToBytes(ip: string): string
Convert an IP address (v4 or v6) to binary string for node-forge.
Parameters
- ip: string
  IP address string (IPv4 or IPv6)
Returns string
Binary string representation for node-forge SAN

Throws
If IP address is empty or invalid
- Defined in src/services/pki.service.ts:473

Class PkiService

Remarks

Example

Index

Constructors

Properties

Methods

Constructors

constructor

Parameters

Returns PkiService

Properties

Private ReadonlyeccProvider

Methods

generateKeyPair

Parameters

Returns Promise<GeneratedKeyPair>

PrivategenerateRsaKeyPair

Parameters

Returns Promise<RsaGeneratedKeyPair>

PrivategenerateEcdsaKeyPair

Parameters

Returns Promise<EccGeneratedKeyPair>

PrivategenerateEd25519KeyPair

Returns Promise<EccGeneratedKeyPair>

createCsr

Parameters

Returns Promise<string | Buffer>

createRsaCsr

Parameters

Returns string | Buffer

Throws

Throws

PrivatecreateEccCsr

Parameters

Returns Promise<string | Buffer>

Throws

savePrivateKey

Parameters

Returns Promise<void>

savePublicDoc

Parameters

Returns Promise<void>

PrivatesaveFile

Parameters

Returns Promise<void>

loadPrivateKey

Parameters

Returns PrivateKey

Throws

Throws

PrivateparseSANsForForge

Parameters

Returns { type: number; value: string }[]

PrivateparseSingleSAN

Parameters

Returns { type: number; value: string }

PrivateparseIPToBytes

Parameters

Returns string

Throws

Settings

On This Page

`Private` `Readonly`eccProvider

`Private`generateRsaKeyPair

`Private`generateEcdsaKeyPair

`Private`generateEd25519KeyPair

`Private`createEccCsr

`Private`saveFile

`Private`parseSANsForForge

`Private`parseSingleSAN

`Private`parseIPToBytes