Interface OPCUACertificateManagerOptions

When true, file-system watchers (chokidar) on the PKI folders are disabled. The initial scan still populates the in-memory indexes but live change detection is off.

Useful in test / CI pipelines where many servers start in parallel and the accumulated fs.watch handles exhaust the libuv thread-pool.

the name of the pki store( default value = "pki" )

the PKI folder will be /

Encrypt the private key at rest with this passphrase (opt-in, default off — a plaintext key is written, exactly as before). When set:

• a freshly generated key is written already encrypted (PKCS#8);
• an existing plaintext key is re-encrypted in place by OPCUACertificateManager.initialize, so turning the option on for an existing install never leaves the key in cleartext;
• an existing encrypted key requires the same passphrase — a mismatch, or an encrypted key with no passphrase configured, fails initialize() closed with PrivateKeyPassphraseRequiredError.

A function is called at most once per OPCUACertificateManager instance (the decrypted key is cached in memory for the instance's lifetime, see OPCUACertificateManager.getPrivateKey). Never logged.

The in-process default managers returned by getDefaultCertificateManager (memoized by name, e.g. "PKI" / "UserPKI") are always passphrase-less — construct your own OPCUACertificateManager and pass it as serverCertificateManager / clientCertificateManager to use passphrase protection.

Source the private key from somewhere other than own/private/private_key.pem (an HSM, a KMS, ...). When set, it overrides disk entirely for every operation that needs the private key — the on-disk file is not read, and privateKeyPassphrase is ignored.

where to store the PKI default %APPDATA%/node-opcua-default