@trusted-tech/myca is the official Node.js native module for MyCA — a multi-platform PKIX implementation used as a simple Certificate Authority (CA). It lets you build JavaScript-based interfaces to MyCA and exposes the same administration capabilities as the pkiadmin command-line tool: TLS certificate lifecycle operations, audit information, and trusted timestamping (TSA) integration against a MyCA pkid PKI service.

The primary API is the PkiClient class on the default export (for example import myca from "@trusted-tech/myca" then new myca.PkiClient()).

Features

• Windows and Linux support (multi-platform native add-on)
• Issue TLS certificates for servers, users, or e-mail addresses, with private keys
• Retrieve certificates and keys from the PKI server in multiple formats: tar.gz, tar.bz2, tar.xz, PKCS#12 (.pfx), PEM
• Revoke, re-grant (after revocation), and delete certificates in the server database
• Read certificate state audit information
• Read TSA log information

Requirements

• Node.js 22.14.0 or newer (see the Building in the documentation section for toolchain details when compiling from sources)
• A running MyCA pkid service and appropriate trusted CA certificate (or a CA certificate chain file) on the client machine. You can download MyCA from here. For installation and configuraion please refer to the documentation.
• config.pluginsDir is required only if myca was not installed as an npm package (for example when loading a manually assembled myca.node layout). When you install this package from npm or from a prebuilt .tgz, native binaries are laid out so the default plugin resolution applies—set config.caFile (or config.caDir) in all cases

Installation

npm install @trusted-tech/myca

Quick start

1. Import the module and set global configuration (paths must match your installation):

import myca from "@trusted-tech/myca";

myca.config.caFile = "c:\\ProgramData\\MyCA\\pki\\ca-chain.pem";
// pluginsDir is needed ONLY if myca was NOT installed as an npm package
// myca.config.pluginsDir = "c:\\Program Files\\MyCA\\bin";
myca.config.logFile = "c:\\Users\\joe.average\\myca.log"; // optional

2. Connect to pkid with TLS client credentials and log in:

const tlsConfig = {
  certificatePath: "C:\\Users\\client.p12",
  privateKeyPassphrase: "<passphrase-protecting-client.p12>",
};

const loginInfo = {
  user: "admin",
  passphrase: "<secretpassword>",
};

const client = new myca.PkiClient();
// configureTlsClient() is only necessary if the PKI server runs on a different machine than the client
client.configureTlsClient(tlsConfig);
await client.connect("pki.server.host", 33334);
await client.login(loginInfo);

3. For persistent TLS settings and optional session-based connection setup, you can register TLS configuration once with myca.registerTlsClientConfig and create a connected client with myca.PkiClient.create and a configuration object (including myca.PkiFlags.ConnPersist when using sessions). See Getting Started in the HTML documentation for the full pattern.

For certificate operations (create, revoke, delete), see Certificate Management. For query examples, see Examples in the manual.

Configuration

The module exposes myca.config with settings such as:

| Setting | Notes | |--------|--------| | caFile / caDir | At least one must be set: trusted CA PEM file or OpenSSL-style CA directory | | pluginsDir | Runtime plugin/native helper directory; omit when using a standard npm/tgz install unless your layout requires it | | flags | Bitmask of ConfigFlags (see constants in the manual) | | connectionTimeout, maxConnections, thread pool and chunk sizes | Connection pooling and timeouts | | logThreshold, logFile, logFunction, logApplicationName | Logging | | enumOutputFormat, dateTimeOutputFormat | Default shapes for enumerated values and dates in API results |

See the Configuration chapter in the English HTML help for the complete list, types, and valid ranges.

Documentation

Comprehensive reference documentation is provided as HTML (multiple languages). The English manual is under the en folder when shipped with MyCA documentation, including:

| Topic | File (under en/) | |--------|---------------------| | Node.js overview | introduction-js.html | | Getting started | quickstart-js.html | | PkiClient API | pki-client-js.html | | Constants, types, functions | constants-js.html, types-js.html, functions-js.html | | Certificate management | certificates-js.html | | Reissue / activation | reissue-js.html, activate-js.html | | Building from source | building-js.html | | Configuration | configuration-js.html | | Examples | examples-js.html | | Product overview (pkid, pkiadmin, other bindings) | introduction.html | | FAQ | faq.html | | License | license.html |

Building from source

To build the native add-on yourself instead of using a published or prebuilt .tgz package, you need the MyCA interfaces tree under interfaces/nodejs, Node.js 22.14.0+, and node-gyp (global install). Linux also expects Python 2.x on PATH for legacy node-gyp builds as described in the manual. Windows requires Visual Studio 2026 (Community is fine) and PowerShell for the recommended scripts.

Linux (recommended): from interfaces/nodejs, run scripts/build.sh with your architecture (for example x86_64). This produces package-<ARCH>.tgz.

Windows (recommended): from interfaces\nodejs, run scripts\build.ps1 with -VcVarsBat pointing at your vcvarsall.bat and -Architecture x64 or x86.

Manual node-gyp configure / build steps and the exact file layout next to myca.node are documented in building-js.html.

License

Copyright © 2026, Mariusz Drozdowski. All rights reserved.

Redistribution and use in binary form, without modification, are permitted provided that the copyright notice, the website https://trusted-tech.co.nz, the full condition list, and the disclaimer are reproduced in documentation and/or other materials. Binary redistribution may not be sold or charged for except the physical cost of transferring a copy. See license.html in the documentation package for the complete license text.

Author

Mariusz Drozdowski

This README summarizes the English HTML help (en/) for MyCA-Node.js. Version numbers in footers of those files may lag the npm package version; trust the package version for this build.