feat(cert-manager): Schlüssel, PFX und CSR erkennen, Passwort je Datei

- Private Schlüssel (PKCS#1, PKCS#8, SEC1; PEM und DER; unverschlüsselt, verschlüsselt, klassisch verschlüsselt) für RSA und EC über node:crypto
- PKCS#12 lesen (OpenSSL 3, kompatibel, RC2; EC-Zertifikate und -Schlüssel), auch ohne Endung und im ZIP
- Zertifikatsanfragen (CSR) als PEM und DER mit Inhaber, SAN und Schlüssel
- Zuordnung von Schlüssel und Anfrage zum Zertifikat (checkPrivateKey, SPKI-Vergleich)
- Feld passwords je Datei, gesperrte Dateien fragen nach dem Passwort; kein Passwort in Antwort oder Log
- Oberfläche: Passwortfeld mit Anzeigen/Verbergen, Schlüssel- und Anfragekarten im Reiter Analysieren

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

apps/api/src/cert-manager/cert-analyze.spec.ts

@@ -3,7 +3,7 @@ import { join } from 'node:path';
 import AdmZip from 'adm-zip';
 import { describe, expect, it } from 'vitest';
 import { analyzeWorkingSet, cleanSourcePath } from './cert-analyze';
-import type { CertItem } from './cert-types';
+import type { CertItem, CsrItem, KeyItem } from './cert-types';
 
 const fx = (name: string) => readFileSync(join(__dirname, '__fixtures__', name));
 const file = (name: string, as = name) => ({ originalname: as, buffer: fx(name) });
@@ -137,3 +137,129 @@ describe('cleanSourcePath', () => {
     expect(cleanSourcePath('x'.repeat(400))).toHaveLength(255);
   });
 });
+
+describe('analyzeWorkingSet: Schluessel, PFX und Anfragen mit Passwort je Datei', () => {
+  const PASSWORD = 'Test-Pass-123';
+  const names = [
+    'rsa-leaf.pem',
+    'rsa-inter.pem',
+    'rsa-root.pem',
+    'rsa-leaf-key-enc-trad.pem',
+    'rsa-leaf.csr',
+    'ec-compat.pfx',
+    'ec-leaf.csr.der',
+  ];
+  const withPasswords = analyzeWorkingSet(
+    names.map((n) => file(n)),
+    ['', '', '', PASSWORD, '', PASSWORD, ''],
+  );
+  const certs = withPasswords.items.filter((i): i is CertItem => i.kind === 'certificate');
+  const keys = withPasswords.items.filter((i): i is KeyItem => i.kind === 'privateKey');
+  const csrs = withPasswords.items.filter((i): i is CsrItem => i.kind === 'csr');
+
+  it('erkennt Zertifikate, zwei Schluessel und zwei Anfragen, nichts bleibt gesperrt', () => {
+    expect(certs).toHaveLength(6);
+    expect(keys.map((k) => k.keyType).sort()).toEqual(['EC', 'RSA']);
+    expect(csrs.map((r) => r.keyType).sort()).toEqual(['EC', 'RSA']);
+    expect(withPasswords.locked).toEqual([]);
+  });
+
+  it('ordnet Schluessel und Anfragen zu: RSA-Server und der EC-Server aus der PFX', () => {
+    const rsa = certs.find((c) => c.cn === 'www.example.test') as CertItem;
+    const ec = certs.find((c) => c.cn === 'ec.example.test') as CertItem;
+    const rsaKey = keys.find((k) => k.keyType === 'RSA') as KeyItem;
+    const ecKey = keys.find((k) => k.keyType === 'EC') as KeyItem;
+    expect(rsa.keyId).toBe(rsaKey.id);
+    expect(rsaKey.certIds).toEqual([rsa.id]);
+    expect(ec.keyId).toBe(ecKey.id);
+    const rsaCsr = csrs.find((r) => r.keyType === 'RSA') as CsrItem;
+    expect(rsa.csrIds).toEqual([rsaCsr.id]);
+    expect(rsaCsr.keyId).toBe(rsaKey.id);
+    expect(rsaCsr.certIds).toEqual([rsa.id]);
+    const ecCsr = csrs.find((r) => r.keyType === 'EC') as CsrItem;
+    expect(ecCsr.certIds).toEqual([ec.id]);
+    expect(ecCsr.keyId).toBe(ecKey.id);
+  });
+
+  it('Zertifikate zuerst, dann Schluessel, dann Anfragen', () => {
+    expect(withPasswords.items.map((i) => i.kind)).toEqual([
+      ...Array(6).fill('certificate'),
+      'privateKey',
+      'privateKey',
+      'csr',
+      'csr',
+    ]);
+  });
+
+  it('die Antwort enthaelt kein Passwort', () => {
+    expect(JSON.stringify(withPasswords)).not.toContain(PASSWORD);
+  });
+
+  it('ohne Passwoerter: Schluessel und PFX sind gesperrt (passwordNeeded), der Rest bleibt', () => {
+    const r = analyzeWorkingSet(names.map((n) => file(n)));
+    expect(r.locked).toEqual([
+      {
+        file: 3,
+        path: 'rsa-leaf-key-enc-trad.pem',
+        container: 'privateKey',
+        reason: 'passwordNeeded',
+      },
+      { file: 5, path: 'ec-compat.pfx', container: 'pkcs12', reason: 'passwordNeeded' },
+    ]);
+    expect(r.items.filter((i) => i.kind === 'certificate')).toHaveLength(3);
+  });
+
+  it('falsches Passwort fuer eine Datei: passwordWrong nur fuer diese Datei', () => {
+    const r = analyzeWorkingSet(
+      names.map((n) => file(n)),
+      ['', '', '', 'falsch', '', '', ''],
+    );
+    const reasons = Object.fromEntries(r.locked.map((l) => [l.path, l.reason]));
+    expect(reasons).toEqual({
+      'rsa-leaf-key-enc-trad.pem': 'passwordWrong',
+      'ec-compat.pfx': 'passwordNeeded',
+    });
+  });
+
+  it('ein Passwort fuer Datei 1 oeffnet auch Datei 2, wenn es dasselbe ist', () => {
+    const r = analyzeWorkingSet([file('rsa-modern.pfx'), file('ec-compat.pfx')], [PASSWORD, '']);
+    expect(r.locked).toEqual([]);
+    expect(r.items.filter((i) => i.kind === 'certificate').length).toBeGreaterThanOrEqual(5);
+  });
+
+  it('eine PFX im ZIP: gesperrt mit dem Pfad im ZIP, entsperrt vom Passwort des ZIPs', () => {
+    const zip = new AdmZip();
+    zip.addFile('Windows/server.pfx', fx('rsa-modern.pfx'));
+    zip.addFile('readme.txt', Buffer.from('hallo'));
+    const buffer = zip.toBuffer();
+    const closed = analyzeWorkingSet([{ originalname: 'hersteller.zip', buffer }]);
+    expect(closed.locked).toEqual([
+      {
+        file: 0,
+        path: 'hersteller.zip/Windows/server.pfx',
+        container: 'pkcs12',
+        reason: 'passwordNeeded',
+      },
+    ]);
+    const open = analyzeWorkingSet([{ originalname: 'hersteller.zip', buffer }], [PASSWORD]);
+    expect(open.locked).toEqual([]);
+    expect(open.items.filter((i) => i.kind === 'certificate')).toHaveLength(3);
+    expect(open.items.filter((i) => i.kind === 'privateKey')).toHaveLength(1);
+  });
+
+  it('mehr als zehn verschiedene Passwoerter: die Datei probiert hoechstens zehn', () => {
+    // Das richtige steht an elfter Stelle der anderen Dateien und wird nicht mehr probiert.
+    const pws = [...Array.from({ length: 11 }, (_, i) => `falsch-${i}`), PASSWORD];
+    const r = analyzeWorkingSet(
+      [
+        file('rsa-modern.pfx'),
+        ...pws.map((_, i) => ({
+          originalname: `x${i}.txt`,
+          buffer: Buffer.from('x'),
+        })),
+      ],
+      ['', ...pws],
+    );
+    expect(r.locked[0]?.reason).toBe('passwordNeeded');
+  });
+});

apps/api/src/cert-manager/cert-analyze.ts

@@ -1,19 +1,23 @@
-import { buildChains } from './cert-chain';
+import { buildChains, matchKeys } from './cert-chain';
+import { candidatePasswords } from './cert-keys';
 import { detectBlob } from './cert-model';
 import { cleanSourcePath } from './cert-names';
 import type {
   AnalysisResult,
   AnyItem,
   CertItem,
+  CsrItem,
   IgnoredEntry,
   ItemSource,
+  KeyItem,
   LockedEntry,
 } from './cert-types';
 
 /**
  * Fassade der Analyse (quick-261009-ikt, D-15): alle hochgeladenen Dateien erkennen,
  * gleiche Teile zusammenfassen und ordnen. Zustandslos; nichts wird gespeichert.
- * Ketten ab Task 2; Schluessel/CSR-Zuordnung und gesperrte Container (Task 4) folgen.
+ * Passwoerter (Task 4): `passwords[i]` gehoert zu Datei i; jede Datei probiert zuerst ihr eigenes,
+ * danach die uebrigen verschiedenen (hoechstens 10). Passwoerter stehen in keiner Antwort.
  */
 
 export { cleanSourcePath };
@@ -46,10 +50,17 @@ export function analyzeWorkingSet(files: AnalyzeFile[], passwords: string[] = []
   const byId = new Map<string, AnyItem>();
   const ignored: IgnoredEntry[] = [];
   const locked: LockedEntry[] = [];
+  const lockedSeen = new Set<string>();
 
   files.forEach((f, index) => {
     const path = cleanSourcePath(f.originalname);
-    const result = detectBlob(f.buffer, { file: index, path, passwords });
+    const own = passwords[index] ?? '';
+    const result = detectBlob(f.buffer, {
+      file: index,
+      path,
+      passwords: candidatePasswords(own, passwords),
+      ownPassword: own,
+    });
     for (const item of result.items) {
       const known = byId.get(item.id);
       if (!known) {
@@ -61,10 +72,20 @@ export function analyzeWorkingSet(files: AnalyzeFile[], passwords: string[] = []
       }
     }
     ignored.push(...result.ignored);
-    locked.push(...result.locked);
+    for (const entry of result.locked) {
+      const key = `${entry.file}|${entry.path}|${entry.container}|${entry.reason}`;
+      if (lockedSeen.has(key)) continue;
+      lockedSeen.add(key);
+      locked.push(entry);
+    }
   });
 
   const items = orderItems([...byId.values()]);
   const certs = items.filter((i): i is CertItem => i.kind === 'certificate');
+  matchKeys(
+    certs,
+    items.filter((i): i is KeyItem => i.kind === 'privateKey'),
+    items.filter((i): i is CsrItem => i.kind === 'csr'),
+  );
   return { items, chains: buildChains(certs).chains, locked, ignored };
 }

apps/api/src/cert-manager/cert-chain.spec.ts

@@ -1,9 +1,9 @@
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { describe, expect, it } from 'vitest';
-import { buildChains } from './cert-chain';
+import { buildChains, matchKeys } from './cert-chain';
 import { detectBlob } from './cert-model';
-import type { CertItem } from './cert-types';
+import type { AnyItem, CertItem, CsrItem, KeyItem } from './cert-types';
 
 const fx = (name: string) => readFileSync(join(__dirname, '__fixtures__', name));
 
@@ -150,3 +150,75 @@ describe('buildChains', () => {
     expect(buildChains([])).toEqual({ chains: [] });
   });
 });
+
+describe('matchKeys', () => {
+  const PASSWORD = 'Test-Pass-123';
+  function all(...names: [string, string?][]): AnyItem[] {
+    const items: AnyItem[] = [];
+    names.forEach(([name, password], file) => {
+      const result = detectBlob(fx(name), {
+        file,
+        path: name,
+        passwords: password ? [password] : [],
+        ownPassword: password ?? '',
+      });
+      items.push(...result.items);
+    });
+    return items;
+  }
+  const certsOf = (items: AnyItem[]) =>
+    items.filter((i): i is CertItem => i.kind === 'certificate');
+  const keysOf = (items: AnyItem[]) => items.filter((i): i is KeyItem => i.kind === 'privateKey');
+  const csrsOf = (items: AnyItem[]) => items.filter((i): i is CsrItem => i.kind === 'csr');
+
+  it('ordnet Schluessel und Anfrage dem Serverzertifikat zu (RSA und EC)', () => {
+    const items = all(
+      ['rsa-leaf.pem'],
+      ['rsa-leaf-key-enc-trad.pem', PASSWORD],
+      ['rsa-leaf.csr'],
+      ['ec-leaf.pem'],
+      ['ec-leaf-key-sec1.der'],
+      ['ec-leaf.csr.der'],
+    );
+    matchKeys(certsOf(items), keysOf(items), csrsOf(items));
+    const certs = certsOf(items);
+    const rsa = certs.find((c) => c.cn === 'www.example.test') as CertItem;
+    const ec = certs.find((c) => c.cn === 'ec.example.test') as CertItem;
+    const rsaKey = keysOf(items).find((k) => k.keyType === 'RSA') as KeyItem;
+    const ecKey = keysOf(items).find((k) => k.keyType === 'EC') as KeyItem;
+    const rsaCsr = csrsOf(items).find((r) => r.keyType === 'RSA') as CsrItem;
+    const ecCsr = csrsOf(items).find((r) => r.keyType === 'EC') as CsrItem;
+    expect(rsa.keyId).toBe(rsaKey.id);
+    expect(rsaKey.certIds).toEqual([rsa.id]);
+    expect(rsa.csrIds).toEqual([rsaCsr.id]);
+    expect(rsaCsr.keyId).toBe(rsaKey.id);
+    expect(rsaCsr.certIds).toEqual([rsa.id]);
+    expect(ec.keyId).toBe(ecKey.id);
+    expect(ecKey.certIds).toEqual([ec.id]);
+    expect(ecCsr.keyId).toBe(ecKey.id);
+    expect(ecCsr.certIds).toEqual([ec.id]);
+  });
+
+  it('ein fremder Schluessel gehoert zu keinem Zertifikat', () => {
+    const items = all(['rsa-leaf.pem'], ['ec-leaf-key.pem']);
+    matchKeys(certsOf(items), keysOf(items), csrsOf(items));
+    expect(certsOf(items)[0].keyId).toBeNull();
+    expect(keysOf(items)[0].certIds).toEqual([]);
+  });
+
+  it('Anfrage ohne Zertifikat und ohne Schluessel bleibt ohne Zuordnung', () => {
+    const items = all(['ec-leaf.csr']);
+    matchKeys(certsOf(items), keysOf(items), csrsOf(items));
+    expect(csrsOf(items)[0].keyId).toBeNull();
+    expect(csrsOf(items)[0].certIds).toEqual([]);
+  });
+
+  it('Zwischenzertifikat und Wurzel bekommen nie einen Schluessel, die Zuordnung ist wiederholbar', () => {
+    const items = all(['rsa-leaf.pem'], ['rsa-inter.pem'], ['rsa-leaf-key.pem']);
+    matchKeys(certsOf(items), keysOf(items), csrsOf(items));
+    matchKeys(certsOf(items), keysOf(items), csrsOf(items));
+    const withKey = certsOf(items).filter((c) => c.keyId !== null);
+    expect(withKey.map((c) => c.cn)).toEqual(['www.example.test']);
+    expect(keysOf(items)[0].certIds).toHaveLength(1);
+  });
+});

apps/api/src/cert-manager/cert-chain.ts

@@ -1,5 +1,7 @@
-import { X509Certificate } from 'node:crypto';
+import { createPrivateKey, createPublicKey, X509Certificate } from 'node:crypto';
-import type { CertItem, ChainGap, ChainInfo } from './cert-types';
+import { csrPublicKeyOf } from './cert-csr';
+import { spkiDerOf } from './cert-keys';
+import type { CertItem, ChainGap, ChainInfo, CsrItem, KeyItem } from './cert-types';
 
 /**
  * Kettenbau des Zertifikat-Managers (quick-261009-ikt, D-18). Reine Funktionen, kein Netz.
@@ -146,3 +148,69 @@ export function buildChains(certs: CertItem[], headIds?: string[]): { chains: Ch
   const now = Date.now();
   return { chains: heads.map((h) => chainOf(nodes, h, now)) };
 }
+
+/**
+ * Ordnet Schluessel und Zertifikatsanfragen ihren Zertifikaten zu (D-18) und traegt die Zuordnung
+ * in die Eintraege ein (`keyId`, `certIds`, `csrIds`); vorherige Zuordnungen werden ersetzt.
+ *
+ * - Schluessel und Zertifikat: `cert.checkPrivateKey(key)`.
+ * - Anfrage und Zertifikat oder Schluessel: der oeffentliche Schluessel (SPKI-DER) ist derselbe.
+ * Nie ueber Namen oder Modulus-Zeichenketten: das geht bei EC nicht und waere bei RSA unsauber.
+ */
+export function matchKeys(certs: CertItem[], keys: KeyItem[], csrs: CsrItem[]): void {
+  const certObjects = certs.map((item) => {
+    item.keyId = null;
+    item.csrIds = [];
+    try {
+      const x = new X509Certificate(item.pem);
+      return { item, x, spki: spkiDerOf(x.publicKey) };
+    } catch {
+      return { item, x: null, spki: null };
+    }
+  });
+  const keyObjects = keys.map((item) => {
+    item.certIds = [];
+    try {
+      const key = createPrivateKey(item.pem);
+      return { item, key, spki: spkiDerOf(createPublicKey(key)) };
+    } catch {
+      return { item, key: null, spki: null };
+    }
+  });
+
+  for (const c of certObjects) {
+    if (!c.x) continue;
+    for (const k of keyObjects) {
+      if (!k.key) continue;
+      let matches = false;
+      try {
+        matches = c.x.checkPrivateKey(k.key);
+      } catch {
+        // nicht pruefbar (unbekannter Schluesseltyp): kein Treffer
+      }
+      if (matches) {
+        c.item.keyId ??= k.item.id;
+        k.item.certIds.push(c.item.id);
+      }
+    }
+  }
+
+  for (const csr of csrs) {
+    csr.keyId = null;
+    csr.certIds = [];
+    let spki: Buffer;
+    try {
+      spki = csrPublicKeyOf(csr.pem).spki;
+    } catch {
+      continue;
+    }
+    const key = keyObjects.find((k) => k.spki?.equals(spki));
+    if (key) csr.keyId = key.item.id;
+    for (const c of certObjects) {
+      if (c.spki?.equals(spki)) {
+        csr.certIds.push(c.item.id);
+        c.item.csrIds.push(csr.id);
+      }
+    }
+  }
+}

apps/api/src/cert-manager/cert-csr.spec.ts

@@ -0,0 +1,84 @@
+import { X509Certificate } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { describe, expect, it } from 'vitest';
+import { csrPublicKeyOf } from './cert-csr';
+import { keyIdOf } from './cert-keys';
+import { detectBlob } from './cert-model';
+import type { CsrItem } from './cert-types';
+
+const fx = (name: string) => readFileSync(join(__dirname, '__fixtures__', name));
+
+function csrs(name: string): CsrItem[] {
+  const r = detectBlob(fx(name), { file: 0, path: name, passwords: [] });
+  return r.items.filter((i): i is CsrItem => i.kind === 'csr');
+}
+
+describe('Zertifikatsanfragen (CSR)', () => {
+  it('RSA-CSR als PEM: Inhaber, SAN aus der extensionRequest, Schluessel', () => {
+    const [csr] = csrs('rsa-leaf.csr');
+    expect(csr).toBeDefined();
+    expect(csr.kind).toBe('csr');
+    expect(csr.cn).toBe('www.example.test');
+    expect(csr.organization).toBe('Tessera Test');
+    expect(csr.san).toEqual(['www.example.test', 'example.test']);
+    expect(csr.keyType).toBe('RSA');
+    expect(csr.keyBits).toBe(2048);
+    expect(csr.curve).toBeNull();
+    expect(csr.id).toMatch(/^r-[0-9a-f]{16}$/);
+    expect(csr.pem.startsWith('-----BEGIN CERTIFICATE REQUEST-----')).toBe(true);
+    expect(csr.baseName).toBe('www.example.test');
+    expect(csr.sources).toEqual([{ file: 0, path: 'rsa-leaf.csr' }]);
+  });
+
+  it('EC-CSR als PEM: P-256', () => {
+    const [csr] = csrs('ec-leaf.csr');
+    expect(csr.cn).toBe('ec.example.test');
+    expect(csr.keyType).toBe('EC');
+    expect(csr.curve).toBe('P-256');
+    expect(csr.keyBits).toBe(256);
+    expect(csr.san).toContain('ec.example.test');
+  });
+
+  it('PEM und DER derselben Anfrage teilen die Kennung', () => {
+    expect(csrs('rsa-leaf.csr')[0].id).toBe(csrs('rsa-leaf.csr.der')[0].id);
+    expect(csrs('ec-leaf.csr')[0].id).toBe(csrs('ec-leaf.csr.der')[0].id);
+    expect(csrs('rsa-leaf.csr')[0].id).not.toBe(csrs('ec-leaf.csr')[0].id);
+  });
+
+  it('der Schluessel der Anfrage ist der des Zertifikats (SPKI)', () => {
+    for (const [csr, cert] of [
+      ['rsa-leaf.csr', 'rsa-leaf.pem'],
+      ['ec-leaf.csr.der', 'ec-leaf.pem'],
+    ]) {
+      const [item] = csrs(csr);
+      const { id, spki } = csrPublicKeyOf(item.pem);
+      const x = new X509Certificate(fx(cert));
+      expect(id).toBe(keyIdOf(x.publicKey));
+      expect(spki.equals(x.publicKey.export({ type: 'spki', format: 'der' }))).toBe(true);
+    }
+  });
+
+  it('keyId und certIds setzt erst die Zuordnung', () => {
+    const [csr] = csrs('rsa-leaf.csr');
+    expect(csr.keyId).toBeNull();
+    expect(csr.certIds).toEqual([]);
+  });
+
+  it('ein Zertifikat oder Schluessel wird nie als CSR gelesen', () => {
+    for (const name of ['rsa-leaf.cer', 'ec-leaf-key-sec1.der', 'rsa-chain.p7c']) {
+      expect(csrs(name)).toEqual([]);
+    }
+  });
+
+  it('abgeschnittene und kaputte Anfragen ergeben nur „unbekannt“', () => {
+    const half = fx('rsa-leaf.csr.der').subarray(0, 200);
+    const r = detectBlob(half, { file: 4, path: 'halb.csr', passwords: [] });
+    expect(r.items).toEqual([]);
+    expect(r.ignored).toEqual([{ file: 4, path: 'halb.csr', reason: 'unknown' }]);
+    const brokenPem = Buffer.from(
+      '-----BEGIN CERTIFICATE REQUEST-----\nQUJDREVGR0hJSktMTU5PUA==\n-----END CERTIFICATE REQUEST-----\n',
+    );
+    expect(detectBlob(brokenPem, { file: 0, path: 'k.csr', passwords: [] }).items).toEqual([]);
+  });
+});

apps/api/src/cert-manager/cert-csr.ts

@@ -0,0 +1,162 @@
+import { createPublicKey } from 'node:crypto';
+import * as forge from 'node-forge';
+import { describeKey, keyIdOf, sha256Hex, spkiDerOf } from './cert-keys';
+import { safeBaseName } from './cert-names';
+import type { CsrItem, ItemSource } from './cert-types';
+
+/**
+ * Zertifikatsanfragen (CSR) des Zertifikat-Managers (quick-261009-ikt, D-05, D-16).
+ *
+ * Die CSR-Leser von forge koennen nur RSA. Darum wird der ASN.1-Aufbau selbst gelesen
+ * (CertificationRequestInfo: Version, Inhaber, oeffentlicher Schluessel, Attribute) und der
+ * Schluessel an node:crypto gegeben. Die Selbstunterschrift wird nicht geprueft: die Anfrage
+ * dient hier nur der Anzeige und der Zuordnung zu Zertifikat und Schluessel.
+ */
+
+const OID_EXTENSION_REQUEST = '1.2.840.113549.1.9.14';
+const OID_SUBJECT_ALT_NAME = '2.5.29.17';
+
+type Asn1 = forge.asn1.Asn1;
+
+function children(node: Asn1): Asn1[] {
+  return Array.isArray(node.value) ? (node.value as Asn1[]) : [];
+}
+
+function readAsn1(der: Buffer): Asn1 {
+  // Typdefinition kennt nur `strict: boolean`; decodeBitStrings aus, damit der Schluessel
+  // (SPKI) beim erneuten Schreiben Byte fuer Byte dem Original entspricht.
+  const options = { decodeBitStrings: false } as unknown as boolean;
+  return forge.asn1.fromDer(forge.util.createBuffer(der.toString('binary')), options);
+}
+
+function toBuffer(node: Asn1): Buffer {
+  return Buffer.from(forge.asn1.toDer(node).getBytes(), 'binary');
+}
+
+interface ParsedRequest {
+  subject: Asn1;
+  spki: Asn1;
+  attributes: Asn1 | null;
+}
+
+/** Prueft den Aufbau streng genug, dass weder ein Zertifikat noch ein Schluessel als CSR durchgeht. */
+function parseRequest(der: Buffer): ParsedRequest {
+  const root = readAsn1(der);
+  const [info, algorithm, signature] = children(root);
+  if (
+    root.type !== forge.asn1.Type.SEQUENCE ||
+    children(root).length !== 3 ||
+    algorithm.type !== forge.asn1.Type.SEQUENCE ||
+    signature.type !== forge.asn1.Type.BITSTRING ||
+    info.type !== forge.asn1.Type.SEQUENCE
+  ) {
+    throw new Error('not a certification request');
+  }
+  const [version, subject, spki, attributes] = children(info);
+  if (
+    version?.type !== forge.asn1.Type.INTEGER ||
+    version.value !== '\x00' ||
+    subject?.type !== forge.asn1.Type.SEQUENCE ||
+    spki?.type !== forge.asn1.Type.SEQUENCE ||
+    children(spki).length !== 2 ||
+    children(spki)[1].type !== forge.asn1.Type.BITSTRING
+  ) {
+    throw new Error('not a certification request');
+  }
+  const hasAttributes =
+    attributes?.tagClass === forge.asn1.Class.CONTEXT_SPECIFIC && attributes.type === 0;
+  return { subject, spki, attributes: hasAttributes ? attributes : null };
+}
+
+function formatIp(bytes: string): string | null {
+  if (bytes.length === 4) return [...bytes].map((c) => c.charCodeAt(0)).join('.');
+  if (bytes.length === 16) {
+    const groups: string[] = [];
+    for (let i = 0; i < 16; i += 2) {
+      groups.push(
+        ((bytes.charCodeAt(i) << 8) | bytes.charCodeAt(i + 1)).toString(16).toUpperCase(),
+      );
+    }
+    return groups.join(':');
+  }
+  return null;
+}
+
+/** SAN aus dem Attribut „extensionRequest“: DNS-Namen unveraendert, IP-Adressen mit Praefix 'IP:'. */
+function sanOf(attributes: Asn1 | null): string[] {
+  const names: string[] = [];
+  if (!attributes) return names;
+  for (const attribute of children(attributes)) {
+    const [oid, set] = children(attribute);
+    if (!oid || oid.type !== forge.asn1.Type.OID) continue;
+    if (forge.asn1.derToOid(oid.value as string) !== OID_EXTENSION_REQUEST) continue;
+    const extensionList = children(set ?? attribute)[0];
+    const extensions = extensionList ? children(extensionList) : [];
+    for (const extension of extensions) {
+      const parts = children(extension);
+      if (parts[0]?.type !== forge.asn1.Type.OID) continue;
+      if (forge.asn1.derToOid(parts[0].value as string) !== OID_SUBJECT_ALT_NAME) continue;
+      const octets = parts[parts.length - 1];
+      if (octets?.type !== forge.asn1.Type.OCTETSTRING) continue;
+      const generalNames = forge.asn1.fromDer(forge.util.createBuffer(octets.value as string));
+      for (const name of children(generalNames)) {
+        if (name.tagClass !== forge.asn1.Class.CONTEXT_SPECIFIC) continue;
+        if (name.type === 2) names.push(name.value as string); // dNSName
+        if (name.type === 7) {
+          const ip = formatIp(name.value as string); // iPAddress
+          if (ip) names.push(`IP:${ip}`);
+        }
+      }
+    }
+  }
+  return names;
+}
+
+/** forge.pki.RDNAttributesAsArray fehlt in den Typdefinitionen, ist aber Teil von forge (liest nur den Namen). */
+const rdnAttributesAsArray = (
+  forge.pki as unknown as {
+    RDNAttributesAsArray(rdn: Asn1): { shortName?: string; value: unknown }[];
+  }
+).RDNAttributesAsArray;
+
+function rdnValue(subject: Asn1, shortName: string): string {
+  const attributes = rdnAttributesAsArray(subject);
+  const found = attributes.find((a) => a.shortName === shortName);
+  return typeof found?.value === 'string' ? found.value : '';
+}
+
+function pemOf(der: Buffer): string {
+  const lines = der.toString('base64').match(/.{1,64}/g) ?? [];
+  return `-----BEGIN CERTIFICATE REQUEST-----\n${lines.join('\n')}\n-----END CERTIFICATE REQUEST-----\n`;
+}
+
+/** Baut den Eintrag aus einem DER-CSR. Wirft, wenn es keine Zertifikatsanfrage ist. `keyId` setzt matchKeys. */
+export function csrItemFromDer(der: Buffer, source: ItemSource): CsrItem {
+  const request = parseRequest(der);
+  const publicKey = createPublicKey({ key: toBuffer(request.spki), format: 'der', type: 'spki' });
+  const details = describeKey(publicKey);
+  const cn = rdnValue(request.subject, 'CN');
+  return {
+    id: `r-${sha256Hex(der).slice(0, 16)}`,
+    kind: 'csr',
+    sources: [{ ...source }],
+    pem: pemOf(der),
+    baseName: safeBaseName(cn, 'anfrage'),
+    cn,
+    organization: rdnValue(request.subject, 'O'),
+    san: sanOf(request.attributes),
+    keyType: details.keyType,
+    keyBits: details.keyBits,
+    curve: details.curve,
+    keyId: null,
+    certIds: [],
+  };
+}
+
+/** Kennung des Schluessels einer Anfrage (aus dem PEM des Eintrags), fuer die Zuordnung. */
+export function csrPublicKeyOf(pem: string): { id: string; spki: Buffer } {
+  const body = pem.replace(/-----(BEGIN|END) CERTIFICATE REQUEST-----/g, '').replace(/\s+/g, '');
+  const request = parseRequest(Buffer.from(body, 'base64'));
+  const publicKey = createPublicKey({ key: toBuffer(request.spki), format: 'der', type: 'spki' });
+  return { id: keyIdOf(publicKey), spki: spkiDerOf(publicKey) };
+}

apps/api/src/cert-manager/cert-keys.spec.ts

@@ -0,0 +1,169 @@
+import { createPrivateKey, createPublicKey } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { describe, expect, it } from 'vitest';
+import { candidatePasswords, keyIdOf, MAX_PASSWORDS } from './cert-keys';
+import { detectBlob } from './cert-model';
+import type { KeyItem } from './cert-types';
+
+const fx = (name: string) => readFileSync(join(__dirname, '__fixtures__', name));
+const PASSWORD = 'Test-Pass-123';
+
+function detect(name: string, own = '', others: string[] = []) {
+  return detectBlob(fx(name), {
+    file: 0,
+    path: name,
+    passwords: candidatePasswords(own, [own, ...others]),
+    ownPassword: own,
+  });
+}
+
+function keys(name: string, own = ''): KeyItem[] {
+  return detect(name, own).items.filter((i): i is KeyItem => i.kind === 'privateKey');
+}
+
+/** Kennung, die zur Schluesselhaelfte der Zertifikate in den Fixtures gehoert */
+function idOfFile(name: string): string {
+  return keyIdOf(createPublicKey(createPrivateKey(fx(name))));
+}
+
+const RSA_IDS = idOfFile('rsa-leaf-key.pem');
+const EC_IDS = idOfFile('ec-leaf-key.pem');
+
+describe('Schluessel ohne Passwort', () => {
+  const plain = [
+    ['rsa-leaf-key.pem', RSA_IDS, 'RSA'],
+    ['rsa-leaf-key-pkcs1.pem', RSA_IDS, 'RSA'],
+    ['rsa-leaf-key-pkcs8.der', RSA_IDS, 'RSA'],
+    ['rsa-leaf-key-pkcs1.der', RSA_IDS, 'RSA'],
+    ['ec-leaf-key.pem', EC_IDS, 'EC'],
+    ['ec-leaf-key-sec1.pem', EC_IDS, 'EC'],
+    ['ec-leaf-key-sec1.der', EC_IDS, 'EC'],
+  ] as const;
+
+  it.each(
+    plain,
+  )('%s ergibt einen Eintrag mit derselben Kennung je Schluesselpaar', (name, id, type) => {
+    const result = detect(name);
+    expect(result.locked).toEqual([]);
+    expect(result.ignored).toEqual([]);
+    expect(result.items).toHaveLength(1);
+    const [key] = result.items as KeyItem[];
+    expect(key.kind).toBe('privateKey');
+    expect(key.id).toBe(id);
+    expect(key.keyType).toBe(type);
+    expect(key.wasEncrypted).toBe(false);
+    expect(key.pem.startsWith('-----BEGIN PRIVATE KEY-----')).toBe(true);
+    expect(key.sources).toEqual([{ file: 0, path: name }]);
+    expect(key.certIds).toEqual([]);
+  });
+
+  it('RSA 2048 und EC P-256 werden beschrieben', () => {
+    const rsa = keys('rsa-leaf-key.pem')[0];
+    expect(rsa.keyBits).toBe(2048);
+    expect(rsa.curve).toBeNull();
+    const ec = keys('ec-leaf-key.pem')[0];
+    expect(ec.curve).toBe('P-256');
+    expect(ec.keyBits).toBe(256);
+  });
+
+  it('das PEM des Eintrags ist der Schluessel selbst (PKCS#8, lesbar)', () => {
+    const k = keys('ec-leaf-key-sec1.pem')[0];
+    expect(createPrivateKey(k.pem).asymmetricKeyType).toBe('ec');
+  });
+});
+
+describe('verschluesselte Schluessel', () => {
+  const encrypted = [
+    ['rsa-leaf-key-enc-pkcs8.pem', RSA_IDS],
+    ['rsa-leaf-key-enc-trad.pem', RSA_IDS],
+    ['ec-leaf-key-enc-pkcs8.pem', EC_IDS],
+    ['ec-leaf-key-enc-trad.pem', EC_IDS],
+    ['ec-leaf-key-enc-pkcs8.der', EC_IDS],
+  ] as const;
+
+  it.each(encrypted)('%s mit Passwort: derselbe Schluessel, wasEncrypted wahr', (name, id) => {
+    const result = detect(name, PASSWORD);
+    expect(result.locked).toEqual([]);
+    const [key] = result.items as KeyItem[];
+    expect(key.id).toBe(id);
+    expect(key.wasEncrypted).toBe(true);
+    expect(key.pem.startsWith('-----BEGIN PRIVATE KEY-----')).toBe(true);
+  });
+
+  it.each(encrypted)('%s ohne Passwort: gesperrt (passwordNeeded)', (name) => {
+    const result = detect(name);
+    expect(result.items).toEqual([]);
+    expect(result.locked).toEqual([
+      { file: 0, path: name, container: 'privateKey', reason: 'passwordNeeded' },
+    ]);
+  });
+
+  it.each(encrypted)('%s mit falschem Passwort: passwordWrong', (name) => {
+    const result = detect(name, 'falsch');
+    expect(result.items).toEqual([]);
+    expect(result.locked).toEqual([
+      { file: 0, path: name, container: 'privateKey', reason: 'passwordWrong' },
+    ]);
+  });
+
+  it('ein Passwort einer anderen Datei oeffnet die Datei, ohne dass sie ein eigenes hat', () => {
+    const result = detect('rsa-leaf-key-enc-trad.pem', '', [PASSWORD]);
+    expect(result.locked).toEqual([]);
+    expect(result.items).toHaveLength(1);
+  });
+
+  it('ein fremdes falsches Passwort bleibt „Passwort noetig“, nicht „falsch“', () => {
+    const result = detect('rsa-leaf-key-enc-pkcs8.pem', '', ['falsch']);
+    expect(result.locked[0].reason).toBe('passwordNeeded');
+  });
+
+  it('die Antwort enthaelt das Passwort nicht', () => {
+    const json = JSON.stringify(detect('rsa-leaf-key-enc-pkcs8.pem', PASSWORD));
+    expect(json).not.toContain(PASSWORD);
+    const locked = JSON.stringify(detect('rsa-leaf-key-enc-pkcs8.pem', 'geheim-xyz'));
+    expect(locked).not.toContain('geheim-xyz');
+  });
+});
+
+describe('Schluessel im Text', () => {
+  it('mehrere Bloecke in einer Datei: Zertifikat und Schluessel', () => {
+    const both = Buffer.concat([fx('rsa-leaf.pem'), Buffer.from('\n'), fx('rsa-leaf-key.pem')]);
+    const r = detectBlob(both, { file: 1, path: 'beides.pem', passwords: [] });
+    expect(r.items.map((i) => i.kind).sort()).toEqual(['certificate', 'privateKey']);
+  });
+
+  it('ein Schluesselblock mit kaputtem Inhalt wird als nicht unterstuetzt gemeldet', () => {
+    const broken = Buffer.from(
+      '-----BEGIN PRIVATE KEY-----\nQUJDREVGR0hJSktMTU5PUA==\n-----END PRIVATE KEY-----\n',
+    );
+    const r = detectBlob(broken, { file: 3, path: 'kaputt.pem', passwords: [] });
+    expect(r.items).toEqual([]);
+    expect(r.ignored).toEqual([{ file: 3, path: 'kaputt.pem', reason: 'unsupportedKey' }]);
+  });
+
+  it('DER-Zufallsbytes werden nie als Schluessel gelesen', () => {
+    const r = detectBlob(Buffer.from([0x30, 0x03, 0x02, 0x01, 0x05]), {
+      file: 0,
+      path: 'x.bin',
+      passwords: [],
+    });
+    expect(r.items).toEqual([]);
+    expect(r.ignored).toEqual([{ file: 0, path: 'x.bin', reason: 'unknown' }]);
+  });
+});
+
+describe('candidatePasswords', () => {
+  it('das eigene zuerst, verschiedene Werte, leere fallen weg', () => {
+    expect(candidatePasswords('a', ['b', 'a', '', 'c', 'b'])).toEqual(['a', 'b', 'c']);
+    expect(candidatePasswords('', ['x'])).toEqual(['x']);
+    expect(candidatePasswords('', [])).toEqual([]);
+  });
+
+  it('hoechstens zehn verschiedene', () => {
+    const many = Array.from({ length: 25 }, (_, i) => `pw-${i}`);
+    const out = candidatePasswords('eigen', many);
+    expect(out).toHaveLength(MAX_PASSWORDS);
+    expect(out[0]).toBe('eigen');
+  });
+});

apps/api/src/cert-manager/cert-keys.ts

@@ -0,0 +1,226 @@
+import { createHash, createPrivateKey, createPublicKey, type KeyObject } from 'node:crypto';
+import * as forge from 'node-forge';
+import type { IgnoredEntry, ItemSource, KeyItem, LockedEntry } from './cert-types';
+
+/**
+ * Private Schluessel des Zertifikat-Managers (quick-261009-ikt, D-05, D-11, D-16).
+ *
+ * Alles laeuft ueber node:crypto (`createPrivateKey`): PKCS#1, PKCS#8 und SEC1, als PEM und als DER,
+ * unverschluesselt, als verschluesseltes PKCS#8 und klassisch verschluesselt (Proc-Type), fuer RSA,
+ * EC und alle weiteren Typen, die Node lesen kann. Passwoerter und Schluessel kommen hier nie in
+ * eine Ausgabe oder ein Log; Fehlertexte aus OpenSSL werden nicht weitergereicht.
+ */
+
+/** Hoechstens so viele verschiedene Passwoerter werden je Datei probiert. */
+export const MAX_PASSWORDS = 10;
+
+/** Was die Erkennung eines Schluessels liefert (gleiche Form wie das Ergebnis von detectBlob). */
+export interface KeyDetectResult {
+  items: KeyItem[];
+  ignored: IgnoredEntry[];
+  locked: LockedEntry[];
+}
+
+export interface KeyContext {
+  file: number;
+  path: string;
+  /** Kandidaten, das Passwort der Datei zuerst; hoechstens MAX_PASSWORDS */
+  passwords: string[];
+  /** Das fuer genau diese Datei eingegebene Passwort (leer, wenn keines) */
+  ownPassword?: string;
+}
+
+export function sha256Hex(data: Buffer | string): string {
+  return createHash('sha256').update(data).digest('hex');
+}
+
+const CURVE_NAMES: Record<string, { name: string; bits: number }> = {
+  prime256v1: { name: 'P-256', bits: 256 },
+  secp256r1: { name: 'P-256', bits: 256 },
+  secp384r1: { name: 'P-384', bits: 384 },
+  secp521r1: { name: 'P-521', bits: 521 },
+};
+
+/** Beschreibung eines oeffentlichen oder privaten Schluessels, fuer Zertifikat, Schluessel und CSR gleich. */
+export function describeKey(key: KeyObject): {
+  keyType: string;
+  keyBits: number | null;
+  curve: string | null;
+} {
+  const type = key.asymmetricKeyType ?? 'unknown';
+  const details = key.asymmetricKeyDetails ?? {};
+  if (type === 'rsa') {
+    return { keyType: 'RSA', keyBits: details.modulusLength ?? null, curve: null };
+  }
+  if (type === 'ec') {
+    const raw = details.namedCurve ?? '';
+    const known = CURVE_NAMES[raw];
+    return {
+      keyType: 'EC',
+      keyBits: known?.bits ?? null,
+      curve: known?.name ?? (raw || null),
+    };
+  }
+  if (type === 'ed25519') return { keyType: 'ED25519', keyBits: 256, curve: null };
+  return { keyType: type.toUpperCase(), keyBits: null, curve: null };
+}
+
+/** SPKI-DER eines oeffentlichen Schluessels: die Grundlage jeder Zuordnung. */
+export function spkiDerOf(publicKey: KeyObject): Buffer {
+  return publicKey.export({ type: 'spki', format: 'der' });
+}
+
+/** 'k-' + 16 Hex von sha256 des SPKI-DER: gleiche Kennung fuer Zertifikat, Schluessel und CSR. */
+export function keyIdOf(publicKey: KeyObject): string {
+  return `k-${sha256Hex(spkiDerOf(publicKey)).slice(0, 16)}`;
+}
+
+/**
+ * Passwoerter, die fuer eine Datei probiert werden: zuerst das eigene (falls eingegeben), danach die
+ * uebrigen verschiedenen Passwoerter der Anfrage, zusammen hoechstens MAX_PASSWORDS. Leere Werte fallen weg.
+ */
+export function candidatePasswords(own: string, all: string[]): string[] {
+  const out: string[] = [];
+  const add = (p: string) => {
+    if (p !== '' && !out.includes(p) && out.length < MAX_PASSWORDS) out.push(p);
+  };
+  add(own);
+  for (const p of all) add(p);
+  return out;
+}
+
+/** Baut den Eintrag aus einem lesbaren privaten Schluessel (unverschluesseltes PKCS#8 als PEM). */
+export function keyItemFromObject(
+  key: KeyObject,
+  source: ItemSource,
+  wasEncrypted: boolean,
+): KeyItem {
+  const publicKey = createPublicKey(key);
+  const details = describeKey(key);
+  return {
+    id: keyIdOf(publicKey),
+    kind: 'privateKey',
+    sources: [{ ...source }],
+    pem: key.export({ type: 'pkcs8', format: 'pem' }) as string,
+    baseName: 'schluessel',
+    keyType: details.keyType,
+    keyBits: details.keyBits,
+    curve: details.curve,
+    wasEncrypted,
+    certIds: [],
+  };
+}
+
+function lockReason(ctx: KeyContext): 'passwordNeeded' | 'passwordWrong' {
+  return ctx.ownPassword ? 'passwordWrong' : 'passwordNeeded';
+}
+
+function locked(ctx: KeyContext): KeyDetectResult {
+  return {
+    items: [],
+    ignored: [],
+    locked: [{ file: ctx.file, path: ctx.path, container: 'privateKey', reason: lockReason(ctx) }],
+  };
+}
+
+function found(key: KeyObject, ctx: KeyContext, wasEncrypted: boolean): KeyDetectResult {
+  return {
+    items: [keyItemFromObject(key, { file: ctx.file, path: ctx.path }, wasEncrypted)],
+    ignored: [],
+    locked: [],
+  };
+}
+
+/** Probiert die Kandidaten der Reihe nach; der erste, der den Schluessel oeffnet, gewinnt. */
+function openWithPasswords(
+  open: (passphrase: string) => KeyObject,
+  ctx: KeyContext,
+): KeyObject | null {
+  for (const passphrase of ctx.passwords) {
+    try {
+      return open(passphrase);
+    } catch {
+      // falsches Passwort (oder nicht unterstuetztes Verfahren): naechstes probieren
+    }
+  }
+  return null;
+}
+
+/**
+ * Ein PEM-Block mit Etikett „... PRIVATE KEY“. `text` ist der ganze Block samt BEGIN/END-Zeilen,
+ * `encrypted` ist wahr bei „ENCRYPTED PRIVATE KEY“ oder einer Kopfzeile `Proc-Type: 4,ENCRYPTED`.
+ */
+export function keyFromPemBlock(
+  text: string,
+  label: string,
+  encrypted: boolean,
+  ctx: KeyContext,
+): KeyDetectResult | null {
+  if (!label.endsWith('PRIVATE KEY')) return null;
+  if (!encrypted && label !== 'ENCRYPTED PRIVATE KEY') {
+    try {
+      return found(createPrivateKey(text), ctx, false);
+    } catch {
+      return {
+        items: [],
+        ignored: [{ file: ctx.file, path: ctx.path, reason: 'unsupportedKey' }],
+        locked: [],
+      };
+    }
+  }
+  const key = openWithPasswords((passphrase) => createPrivateKey({ key: text, passphrase }), ctx);
+  return key ? found(key, ctx, true) : locked(ctx);
+}
+
+/** ASN.1 mit unveraenderten Bitfolgen; Typdefinition kennt nur `strict: boolean`, forge nimmt ein Objekt. */
+function readAsn1(der: Buffer): forge.asn1.Asn1 {
+  const options = { decodeBitStrings: false, strict: false } as unknown as boolean;
+  return forge.asn1.fromDer(forge.util.createBuffer(der.toString('binary')), options);
+}
+
+/**
+ * Verschluesseltes PKCS#8 (EncryptedPrivateKeyInfo) hat genau zwei Teile: die Verfahrensangabe
+ * (SEQUENCE mit einer Kennung) und die verschluesselten Daten (OCTET STRING). Anders als ein
+ * unverschluesselter Schluessel beginnt es nicht mit einer Versionsnummer.
+ */
+function isEncryptedPkcs8(root: forge.asn1.Asn1): boolean {
+  const parts = root.value;
+  if (root.type !== forge.asn1.Type.SEQUENCE || !Array.isArray(parts) || parts.length !== 2) {
+    return false;
+  }
+  const [algorithm, data] = parts as forge.asn1.Asn1[];
+  const algorithmParts = algorithm.value;
+  return (
+    algorithm.type === forge.asn1.Type.SEQUENCE &&
+    Array.isArray(algorithmParts) &&
+    (algorithmParts as forge.asn1.Asn1[])[0]?.type === forge.asn1.Type.OID &&
+    data.type === forge.asn1.Type.OCTETSTRING
+  );
+}
+
+const DER_KEY_TYPES = ['pkcs8', 'pkcs1', 'sec1'] as const;
+
+/** Privater Schluessel als DER (PKCS#8, PKCS#1, SEC1 oder verschluesseltes PKCS#8). Kein Schluessel: null. */
+export function keyFromDer(der: Buffer, ctx: KeyContext): KeyDetectResult | null {
+  let root: forge.asn1.Asn1;
+  try {
+    root = readAsn1(der);
+  } catch {
+    return null;
+  }
+  if (isEncryptedPkcs8(root)) {
+    const key = openWithPasswords(
+      (passphrase) => createPrivateKey({ key: der, format: 'der', type: 'pkcs8', passphrase }),
+      ctx,
+    );
+    return key ? found(key, ctx, true) : locked(ctx);
+  }
+  for (const type of DER_KEY_TYPES) {
+    try {
+      return found(createPrivateKey({ key: der, format: 'der', type }), ctx, false);
+    } catch {
+      // anderer Aufbau: naechsten Typ probieren
+    }
+  }
+  return null;
+}

apps/api/src/cert-manager/cert-manager.controller.spec.ts

@@ -4,7 +4,7 @@ import { join } from 'node:path';
 import { RequestMethod } from '@nestjs/common';
 import { describe, expect, it } from 'vitest';
 import { MODULE_SLUG_KEY } from '../module-registry/module.guard';
-import { CertManagerController, repairFileName } from './cert-manager.controller';
+import { CertManagerController, parsePasswords, repairFileName } from './cert-manager.controller';
 
 const fx = (name: string) => readFileSync(join(__dirname, '__fixtures__', name));
 const upload = (name: string, buffer: Buffer = fx(name)) => ({
@@ -89,6 +89,47 @@ describe('CertManagerController', () => {
   });
 });
 
+describe('analyze: Feld passwords', () => {
+  const controller = new CertManagerController();
+  const files = () => [upload('rsa-leaf-key-enc-trad.pem'), upload('ec-compat.pfx')];
+
+  it('das Passwort je Datei erreicht den Parser', () => {
+    const none = controller.analyze(files());
+    expect(none.locked).toHaveLength(2);
+    const open = controller.analyze(files(), JSON.stringify(['Test-Pass-123', 'Test-Pass-123']));
+    expect(open.locked).toEqual([]);
+    expect(open.items.some((i) => i.kind === 'privateKey')).toBe(true);
+  });
+
+  it('die Antwort enthaelt das Passwort nicht', () => {
+    const open = controller.analyze(files(), JSON.stringify(['Test-Pass-123', '']));
+    expect(JSON.stringify(open)).not.toContain('Test-Pass-123');
+  });
+
+  it('ohne das Feld gibt es keine Passwoerter', () => {
+    expect(parsePasswords(undefined)).toEqual([]);
+    expect(parsePasswords('')).toEqual([]);
+  });
+
+  it.each([
+    ['kein JSON', 'nope'],
+    ['ein Objekt', '{"a":1}'],
+    ['eine Zahl in der Liste', '[1]'],
+    ['eine Zeichenkette statt Liste', '"x"'],
+    ['mehr als 30 Eintraege', JSON.stringify(Array(31).fill('a'))],
+    ['ein Eintrag ueber 1024 Zeichen', JSON.stringify(['a'.repeat(1025)])],
+  ])('%s: 400 invalidInput', (_name, raw) => {
+    expect(codeOf(() => controller.analyze(files(), raw))).toEqual({
+      status: 400,
+      code: 'invalidInput',
+    });
+  });
+
+  it('genau 30 Eintraege zu je 1024 Zeichen sind erlaubt', () => {
+    expect(parsePasswords(JSON.stringify(Array(30).fill('a'.repeat(1024))))).toHaveLength(30);
+  });
+});
+
 describe('repairFileName', () => {
   it('gewinnt UTF-8-Namen zurueck, die als Latin-1 ankamen', () => {
     const asLatin1 = Buffer.from('Zertifikat-Müller.pem', 'utf8').toString('latin1');

apps/api/src/cert-manager/cert-manager.controller.ts

@@ -12,6 +12,35 @@ export const CERT_MAX_FILES = 30;
 export const CERT_MAX_FILE_BYTES = 5 * 1024 * 1024;
 export const CERT_MAX_TOTAL_BYTES = 20 * 1024 * 1024;
 
+/** Das Feld `passwords`: ein JSON-Array von Zeichenketten, je Datei eines (Task 4). */
+export const CERT_MAX_PASSWORDS = 30;
+export const CERT_MAX_PASSWORD_CHARS = 1024;
+
+/**
+ * Liest das multipart-Feld `passwords`. Fehlt es, gibt es keine Passwoerter. Alles andere als ein
+ * JSON-Array aus hoechstens 30 Zeichenketten zu je hoechstens 1024 Zeichen: 400 invalidInput.
+ * Der Inhalt erscheint nie in einer Fehlermeldung.
+ */
+export function parsePasswords(raw: unknown): string[] {
+  if (raw === undefined || raw === null || raw === '') return [];
+  let value: unknown = raw;
+  if (typeof raw === 'string') {
+    try {
+      value = JSON.parse(raw);
+    } catch {
+      certError('invalidInput', 400, 'passwords must be a JSON array of strings');
+    }
+  }
+  if (
+    !Array.isArray(value) ||
+    value.length > CERT_MAX_PASSWORDS ||
+    value.some((p) => typeof p !== 'string' || p.length > CERT_MAX_PASSWORD_CHARS)
+  ) {
+    certError('invalidInput', 400, 'passwords must be a JSON array of strings');
+  }
+  return value as string[];
+}
+
 /**
  * multer liest Dateinamen als Latin-1. Waren es UTF-8-Bytes (Umlaute), den Namen zurueckgewinnen;
  * ist das Ergebnis kein gueltiges UTF-8, bleibt der Name wie er ist.
@@ -29,7 +58,7 @@ export function repairFileName(name: string): string {
  * Geschuetzt durch den globalen JwtAuthGuard, den TenantGuard und @UseModule('cert-manager').
  *
  * Routen (alle POST, 200):
- * - analyze       Task 1  mehrere Dateien (multipart) erkennen und zusammenfassen
+ * - analyze       Task 1  mehrere Dateien (multipart) erkennen und zusammenfassen; Task 4: optionales Feld `passwords`
  * - build         Task 2  Ausgabe bauen (JSON, eigene Grenze 512 KiB, siehe cert-json-body.ts), ab Task 5/6 erweitert
  * - fetch-issuer  Task 7  fehlendes Zwischenzertifikat nur auf Knopfdruck holen
  */
@@ -41,7 +70,10 @@ export class CertManagerController {
   @UseInterceptors(
     FilesInterceptor('files', CERT_MAX_FILES, { limits: { fileSize: CERT_MAX_FILE_BYTES } }),
   )
-  analyze(@UploadedFiles() files: UploadedFileLike[] | undefined): AnalysisResult {
+  analyze(
+    @UploadedFiles() files: UploadedFileLike[] | undefined,
+    @Body('passwords') rawPasswords?: unknown,
+  ): AnalysisResult {
     if (!files || files.length === 0) {
       certError('invalidInput', 400, 'No files provided');
     }
@@ -49,8 +81,10 @@ export class CertManagerController {
     if (total > CERT_MAX_TOTAL_BYTES) {
       certError('tooLarge', 413, 'Files together exceed 20 MiB');
     }
+    const passwords = parsePasswords(rawPasswords);
     return analyzeWorkingSet(
       files.map((f) => ({ originalname: repairFileName(f.originalname), buffer: f.buffer })),
+      passwords,
     );
   }
 

apps/api/src/cert-manager/cert-model.spec.ts

@@ -34,7 +34,7 @@ describe('detectBlob: Zertifikate', () => {
     expect(c.sources).toEqual([{ file: 0, path: 'rsa-leaf.pem' }]);
     expect(c.pem.startsWith('-----BEGIN CERTIFICATE-----')).toBe(true);
     expect(c.baseName).toBe('www.example.test');
-    expect(c.keyId).toMatch(/^k-[0-9a-f]{16}$/);
+    expect(c.keyId).toBeNull(); // die Zuordnung zu einem Schluessel setzt matchKeys
     expect(c.isExpired).toBe(false);
     expect(c.daysLeft).toBeGreaterThan(30000);
   });

apps/api/src/cert-manager/cert-model.ts

@@ -1,6 +1,16 @@
-import { createHash, type KeyObject, X509Certificate } from 'node:crypto';
+import { X509Certificate } from 'node:crypto';
 import * as forge from 'node-forge';
+import { csrItemFromDer } from './cert-csr';
+import {
+  describeKey,
+  keyFromDer,
+  keyFromPemBlock,
+  keyIdOf,
+  keyItemFromObject,
+  sha256Hex,
+} from './cert-keys';
 import { safeBaseName } from './cert-names';
+import { isPkcs12Der, readPkcs12 } from './cert-pkcs12';
 import type {
   AnyItem,
   CertItem,
@@ -11,6 +21,9 @@ import type {
 } from './cert-types';
 import { expandZip, isZip } from './zip-expand';
 
+// Die Schluesselhelfer wohnen in cert-keys.ts (dort ohne Importschleife nutzbar); hier weiter erreichbar.
+export { describeKey, keyIdOf, sha256Hex };
+
 /**
  * Der eine Parser des Zertifikat-Managers (quick-261009-ikt, D-08, D-16).
  *
@@ -20,9 +33,9 @@ import { expandZip, isZip } from './zip-expand';
  *
  * Erkennung nach Inhalt, nie nach Dateiendung. Jede Stufe steht in try/catch: eine kaputte
  * Datei ergibt hoechstens einen Eintrag „unbekannt“, nie einen Fehler fuer die ganze Anfrage.
- * Stand Task 3: Zertifikate als PEM (auch TRUSTED CERTIFICATE) und als DER, PKCS#7 als PEM und DER
+ * Stand Task 4: Zertifikate als PEM (auch TRUSTED CERTIFICATE) und als DER, PKCS#7 als PEM und DER
- * (auch fuer EC, ueber den ASN.1-Lauf von forge) und ZIP (eine Ebene, Grenzen in zip-expand.ts).
+ * (auch fuer EC, ueber den ASN.1-Lauf von forge), ZIP (eine Ebene, Grenzen in zip-expand.ts),
- * Schluessel, PKCS#12 und CSR (Task 4) sind benannte, noch leere Stufen.
+ * private Schluessel (cert-keys.ts), PKCS#12 (cert-pkcs12.ts) und Zertifikatsanfragen (cert-csr.ts).
  */
 
 export interface DetectContext {
@@ -30,8 +43,10 @@ export interface DetectContext {
   file: number;
   /** Dateiname, bei ZIP-Inhalt "zip/eintrag" */
   path: string;
-  /** Passwoerter fuer geschuetzte Container (ab Task 4) */
+  /** Kandidaten fuer geschuetzte Container, das Passwort der Datei zuerst (hoechstens 10) */
   passwords: string[];
+  /** Das fuer genau diese Datei eingegebene Passwort; leer, wenn keines. Nur fuer „gesperrt: Passwort falsch“. */
+  ownPassword?: string;
 }
 
 export interface DetectResult {
@@ -42,50 +57,10 @@ export interface DetectResult {
 
 const CERT_LABELS = new Set(['CERTIFICATE', 'X509 CERTIFICATE', 'TRUSTED CERTIFICATE']);
 const PKCS7_LABELS = new Set(['PKCS7', 'CMS']);
+const CSR_LABELS = new Set(['CERTIFICATE REQUEST', 'NEW CERTIFICATE REQUEST']);
 const PEM_BLOCK = /-----BEGIN ([A-Z0-9 ]+)-----([\s\S]*?)-----END \1-----/g;
 const BASE64_BODY = /^[A-Za-z0-9+/]+={0,2}$/;
 
-const CURVE_NAMES: Record<string, { name: string; bits: number }> = {
-  prime256v1: { name: 'P-256', bits: 256 },
-  secp256r1: { name: 'P-256', bits: 256 },
-  secp384r1: { name: 'P-384', bits: 384 },
-  secp521r1: { name: 'P-521', bits: 521 },
-};
-
-export function sha256Hex(data: Buffer | string): string {
-  return createHash('sha256').update(data).digest('hex');
-}
-
-/** Beschreibung eines oeffentlichen oder privaten Schluessels, fuer Zertifikat, Schluessel und CSR gleich. */
-export function describeKey(key: KeyObject): {
-  keyType: string;
-  keyBits: number | null;
-  curve: string | null;
-} {
-  const type = key.asymmetricKeyType ?? 'unknown';
-  const details = key.asymmetricKeyDetails ?? {};
-  if (type === 'rsa') {
-    return { keyType: 'RSA', keyBits: details.modulusLength ?? null, curve: null };
-  }
-  if (type === 'ec') {
-    const raw = details.namedCurve ?? '';
-    const known = CURVE_NAMES[raw];
-    return {
-      keyType: 'EC',
-      keyBits: known?.bits ?? null,
-      curve: known?.name ?? (raw || null),
-    };
-  }
-  if (type === 'ed25519') return { keyType: 'ED25519', keyBits: 256, curve: null };
-  return { keyType: type.toUpperCase(), keyBits: null, curve: null };
-}
-
-/** 'k-' + 16 Hex von sha256 des SPKI-DER: gleiche Kennung fuer Zertifikat, Schluessel und CSR. */
-export function keyIdOf(publicKey: KeyObject): string {
-  const spki = publicKey.export({ type: 'spki', format: 'der' });
-  return `k-${sha256Hex(spki).slice(0, 16)}`;
-}
-
 function firstValue(v: unknown): string {
   if (Array.isArray(v)) return typeof v[0] === 'string' ? v[0] : '';
   return typeof v === 'string' ? v : '';
@@ -181,7 +156,7 @@ export function certItemFromDer(der: Buffer, source: ItemSource): CertItem {
     isCa,
     selfSigned,
     aiaIssuerUrls: aiaUrls(legacy.infoAccess),
-    keyId: keyIdOf(x.publicKey),
+    keyId: null,
     csrIds: [],
   };
 }
@@ -285,6 +260,8 @@ function pkcs7Items(der: Buffer, ctx: DetectContext): CertItem[] {
 
 interface PemBlock {
   label: string;
+  /** der Block samt BEGIN/END-Zeilen, unveraendert (fuer verschluesselte Schluessel) */
+  text: string;
   der: Buffer | null;
   encrypted: boolean;
 }
@@ -301,7 +278,7 @@ function pemBlocks(text: string): PemBlock[] {
       .join('')
       .replace(/\s+/g, '');
     const valid = BASE64_BODY.test(body) && body.length % 4 === 0;
-    blocks.push({ label, der: valid ? Buffer.from(body, 'base64') : null, encrypted });
+    blocks.push({ label, text: m[0], der: valid ? Buffer.from(body, 'base64') : null, encrypted });
   }
   return blocks;
 }
@@ -316,12 +293,31 @@ function certFromDer(der: Buffer, ctx: DetectContext): CertItem | null {
   }
 }
 
+function mergeInto(result: DetectResult, part: DetectResult | null): void {
+  if (!part) return;
+  result.items.push(...part.items);
+  result.ignored.push(...part.ignored);
+  result.locked.push(...part.locked);
+}
+
 /** Text mit -----BEGIN-Bloecken: jeder Block nach seinem Etikett. */
 function detectPem(blob: Buffer, ctx: DetectContext): DetectResult | null {
-  const text = blob.toString('utf8').replace(/^/, '');
+  const text = blob.toString('utf8').replace(/^\uFEFF/, '');
   if (!text.includes('-----BEGIN ')) return null;
   const result = emptyResult();
   for (const block of pemBlocks(text)) {
+    // Verschluesselte Schluessel (Proc-Type) tragen im Rumpf Kopfzeilen; ihr Text geht unveraendert an Node.
+    if (block.label.endsWith('PRIVATE KEY')) {
+      try {
+        mergeInto(
+          result,
+          keyFromPemBlock(block.text, block.label, block.encrypted, keyContext(ctx)),
+        );
+      } catch {
+        // kaputter Schluesselblock: die anderen Bloecke der Datei bleiben gueltig
+      }
+      continue;
+    }
     if (!block.der) continue;
     if (CERT_LABELS.has(block.label)) {
       const item = certFromDer(block.der, ctx);
@@ -334,10 +330,17 @@ function detectPem(blob: Buffer, ctx: DetectContext): DetectResult | null {
         // kaputter PKCS#7-Block: die anderen Bloecke der Datei bleiben gueltig
       }
     }
-    // PRIVATE KEY, RSA/EC PRIVATE KEY, ENCRYPTED PRIVATE KEY und CERTIFICATE REQUEST
+    if (CSR_LABELS.has(block.label)) {
-    // (Task 4) folgen in dieser Schleife.
+      try {
+        result.items.push(csrItemFromDer(block.der, { file: ctx.file, path: ctx.path }));
+      } catch {
+        // keine lesbare Anfrage: ueberspringen
       }
-  return result.items.length > 0 ? result : null;
+    }
+  }
+  const empty =
+    result.items.length === 0 && result.ignored.length === 0 && result.locked.length === 0;
+  return empty ? null : result;
 }
 
 /** Einzelnes DER-Zertifikat (.cer/.crt/.der). */
@@ -347,9 +350,38 @@ function detectDerCertificate(blob: Buffer, ctx: DetectContext): DetectResult |
   return { items: [item], ignored: [], locked: [] };
 }
 
-/** PKCS#12 (Task 4). */
+function keyContext(ctx: DetectContext) {
-function detectPkcs12(_blob: Buffer, _ctx: DetectContext): DetectResult | null {
+  return {
-  return null;
+    file: ctx.file,
+    path: ctx.path,
+    passwords: ctx.passwords,
+    ownPassword: ctx.ownPassword,
+  };
+}
+
+/**
+ * PKCS#12 (.pfx/.p12), erkannt am Aufbau und nicht an der Endung. Zertifikate und Schluessel werden
+ * zu gewoehnlichen Eintraegen mit dem Container als Quelle; ohne passendes Passwort: gesperrt.
+ */
+function detectPkcs12(blob: Buffer, ctx: DetectContext): DetectResult | null {
+  if (!isPkcs12Der(blob)) return null;
+  const read = readPkcs12(blob, ctx.passwords, ctx.ownPassword ?? '');
+  if (!read.ok) {
+    return {
+      items: [],
+      ignored: [],
+      locked: [{ file: ctx.file, path: ctx.path, container: 'pkcs12', reason: read.reason }],
+    };
+  }
+  const result = emptyResult();
+  for (const der of read.contents.certDers) {
+    const item = certFromDer(der, ctx);
+    if (item) result.items.push(item);
+  }
+  for (const { key, shrouded } of read.contents.keys) {
+    result.items.push(keyItemFromObject(key, { file: ctx.file, path: ctx.path }, shrouded));
+  }
+  return result.items.length > 0 ? result : null;
 }
 
 /** PKCS#7 signedData als DER. */
@@ -358,14 +390,18 @@ function detectPkcs7(blob: Buffer, ctx: DetectContext): DetectResult | null {
   return items.length > 0 ? { items, ignored: [], locked: [] } : null;
 }
 
-/** Privater Schluessel als DER (Task 4). */
+/** Privater Schluessel als DER (PKCS#8, PKCS#1, SEC1, verschluesseltes PKCS#8). */
-function detectPrivateKey(_blob: Buffer, _ctx: DetectContext): DetectResult | null {
+function detectPrivateKey(blob: Buffer, ctx: DetectContext): DetectResult | null {
-  return null;
+  return keyFromDer(blob, keyContext(ctx));
 }
 
-/** Zertifikatsanfrage als DER (Task 4). */
+/** Zertifikatsanfrage als DER. */
-function detectCsr(_blob: Buffer, _ctx: DetectContext): DetectResult | null {
+function detectCsr(blob: Buffer, ctx: DetectContext): DetectResult | null {
-  return null;
+  return {
+    items: [csrItemFromDer(blob, { file: ctx.file, path: ctx.path })],
+    ignored: [],
+    locked: [],
+  };
 }
 
 const STAGES: ((blob: Buffer, ctx: DetectContext) => DetectResult | null)[] = [

apps/api/src/cert-manager/cert-pkcs12.spec.ts

@@ -0,0 +1,112 @@
+import { X509Certificate } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { describe, expect, it } from 'vitest';
+import { candidatePasswords, keyIdOf } from './cert-keys';
+import { detectBlob } from './cert-model';
+import { isPkcs12Der, readPkcs12 } from './cert-pkcs12';
+import type { CertItem, KeyItem } from './cert-types';
+
+const fx = (name: string) => readFileSync(join(__dirname, '__fixtures__', name));
+const PASSWORD = 'Test-Pass-123';
+
+const sha = (name: string) => new X509Certificate(fx(name)).fingerprint256;
+
+describe('readPkcs12', () => {
+  const cases = [
+    ['rsa-modern.pfx', 'rsa', ['rsa-leaf.pem', 'rsa-inter.pem', 'rsa-root.pem']],
+    ['rsa-compat.pfx', 'rsa', ['rsa-leaf.pem', 'rsa-inter.pem', 'rsa-root.pem']],
+    ['rsa-legacy.pfx', 'rsa', ['rsa-leaf.pem', 'rsa-inter.pem', 'rsa-root.pem']],
+    ['ec-modern.pfx', 'ec', ['ec-leaf.pem', 'ec-inter.pem', 'ec-root.pem']],
+    ['ec-compat.pfx', 'ec', ['ec-leaf.pem', 'ec-inter.pem', 'ec-root.pem']],
+  ] as const;
+
+  it.each(
+    cases,
+  )('%s: Zertifikate (auch EC) und Schluessel mit dem Passwort', (name, type, certFiles) => {
+    const result = readPkcs12(fx(name), [PASSWORD], PASSWORD);
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    const fingerprints = result.contents.certDers.map((d) => new X509Certificate(d).fingerprint256);
+    expect(fingerprints.sort()).toEqual(certFiles.map(sha).sort());
+    expect(result.contents.keys).toHaveLength(1);
+    expect(result.contents.keys[0].key.asymmetricKeyType).toBe(type);
+    expect(result.contents.keys[0].shrouded).toBe(true);
+  });
+
+  it('rsa-nopass.pfx oeffnet sich ohne Passwort (leeres Passwort)', () => {
+    const result = readPkcs12(fx('rsa-nopass.pfx'), []);
+    expect(result.ok).toBe(true);
+    if (result.ok) expect(result.contents.certDers).toHaveLength(3);
+  });
+
+  it('ohne Passwort: passwordNeeded, mit falschem: passwordWrong', () => {
+    expect(readPkcs12(fx('rsa-modern.pfx'), [])).toEqual({ ok: false, reason: 'passwordNeeded' });
+    expect(readPkcs12(fx('rsa-modern.pfx'), ['falsch'], 'falsch')).toEqual({
+      ok: false,
+      reason: 'passwordWrong',
+    });
+  });
+
+  it('probiert die uebrigen Passwoerter der Anfrage, wenn das eigene nicht passt', () => {
+    const result = readPkcs12(fx('ec-compat.pfx'), ['falsch', 'noch-falsch', PASSWORD], 'falsch');
+    expect(result.ok).toBe(true);
+  });
+
+  it('erkennt PKCS#12 am Aufbau, nicht an der Endung', () => {
+    expect(isPkcs12Der(fx('rsa-modern.bin'))).toBe(true);
+    expect(isPkcs12Der(fx('rsa-leaf.cer'))).toBe(false);
+    expect(isPkcs12Der(Buffer.from('kein Container'))).toBe(false);
+  });
+});
+
+describe('detectBlob: PKCS#12', () => {
+  function detect(name: string, own = '', others: string[] = []) {
+    return detectBlob(fx(name), {
+      file: 0,
+      path: name,
+      passwords: candidatePasswords(own, [own, ...others]),
+      ownPassword: own,
+    });
+  }
+
+  it('ec-compat.pfx: EC-Zertifikate und EC-Schluessel werden Eintraege mit dem Container als Quelle', () => {
+    const r = detect('ec-compat.pfx', PASSWORD);
+    expect(r.locked).toEqual([]);
+    const certs = r.items.filter((i): i is CertItem => i.kind === 'certificate');
+    expect(certs.map((c) => c.cn).sort()).toEqual([
+      'Tessera Test Inter EC',
+      'Tessera Test Root EC',
+      'ec.example.test',
+    ]);
+    expect(certs.every((c) => c.keyType === 'EC')).toBe(true);
+    expect(certs[0].sources).toEqual([{ file: 0, path: 'ec-compat.pfx' }]);
+    const key = r.items.find((i): i is KeyItem => i.kind === 'privateKey');
+    const leaf = new X509Certificate(fx('ec-leaf.pem'));
+    expect(key?.id).toBe(keyIdOf(leaf.publicKey));
+    expect(key?.wasEncrypted).toBe(true);
+  });
+
+  it('rsa-modern.bin wird am Inhalt erkannt', () => {
+    const r = detect('rsa-modern.bin', PASSWORD);
+    expect(r.items.filter((i) => i.kind === 'certificate')).toHaveLength(3);
+    expect(r.items.filter((i) => i.kind === 'privateKey')).toHaveLength(1);
+  });
+
+  it('ohne Passwort: gesperrt mit Container pkcs12', () => {
+    expect(detect('rsa-modern.pfx').locked).toEqual([
+      { file: 0, path: 'rsa-modern.pfx', container: 'pkcs12', reason: 'passwordNeeded' },
+    ]);
+    expect(detect('rsa-modern.pfx', 'falsch').locked[0].reason).toBe('passwordWrong');
+  });
+
+  it('das Passwort einer anderen Datei oeffnet auch diese Datei', () => {
+    const r = detect('rsa-legacy.pfx', '', [PASSWORD]);
+    expect(r.locked).toEqual([]);
+    expect(r.items.length).toBeGreaterThan(0);
+  });
+
+  it('die Antwort enthaelt das Passwort nicht', () => {
+    expect(JSON.stringify(detect('rsa-modern.pfx', PASSWORD))).not.toContain(PASSWORD);
+  });
+});

apps/api/src/cert-manager/cert-pkcs12.ts

@@ -0,0 +1,124 @@
+import { createPrivateKey, type KeyObject } from 'node:crypto';
+import * as forge from 'node-forge';
+import { MAX_PASSWORDS } from './cert-keys';
+
+/**
+ * PKCS#12 (.pfx/.p12) des Zertifikat-Managers (quick-261009-ikt, D-20).
+ *
+ * Lesen laeuft ueber forge (`pkcs12FromAsn1`): OpenSSL-3-Standard (AES-256, SHA-256), das
+ * kompatible 3DES-Format und das alte RC2-Format werden gelesen. forge kennt aber nur RSA:
+ * bei EC-Zertifikaten ist `bag.cert` leer, bei EC-Schluesseln ist `bag.key` falsch. Darum wird
+ * das Zertifikat aus `bag.asn1` und der Schluessel aus dem PKCS#8-ASN.1 des Beutels gelesen und
+ * an node:crypto weitergegeben. Passwoerter erscheinen weder in Fehlern noch in Logs.
+ */
+
+export interface Pkcs12Key {
+  key: KeyObject;
+  /** der Schluessel lag verschluesselt im Container (pkcs8ShroudedKeyBag) */
+  shrouded: boolean;
+}
+
+export interface Pkcs12Contents {
+  /** Zertifikate als DER, in der Reihenfolge des Containers */
+  certDers: Buffer[];
+  keys: Pkcs12Key[];
+}
+
+export type Pkcs12Read =
+  | { ok: true; contents: Pkcs12Contents }
+  | { ok: false; reason: 'passwordNeeded' | 'passwordWrong' };
+
+function parseAsn1(der: Buffer): forge.asn1.Asn1 {
+  // Die Typdefinition kennt nur `strict: boolean`; forge nimmt zur Laufzeit ein Optionsobjekt.
+  const options = { strict: false } as unknown as boolean;
+  return forge.asn1.fromDer(forge.util.createBuffer(der.toString('binary')), options);
+}
+
+/**
+ * PKCS#12 erkennt man am Aufbau: oberste SEQUENCE, deren erstes Element die INTEGER 3 ist
+ * (Version). Die Dateiendung spielt keine Rolle.
+ */
+export function isPkcs12Der(der: Buffer): boolean {
+  try {
+    const root = parseAsn1(der);
+    const first = Array.isArray(root.value) ? (root.value as forge.asn1.Asn1[])[0] : undefined;
+    return (
+      root.type === forge.asn1.Type.SEQUENCE &&
+      first?.type === forge.asn1.Type.INTEGER &&
+      first.value === '\x03'
+    );
+  } catch {
+    return false;
+  }
+}
+
+function toBuffer(asn1: forge.asn1.Asn1): Buffer {
+  return Buffer.from(forge.asn1.toDer(asn1).getBytes(), 'binary');
+}
+
+function bagsOf(p12: forge.pkcs12.Pkcs12Pfx, bagType: string): forge.pkcs12.Bag[] {
+  return p12.getBags({ bagType })[bagType] ?? [];
+}
+
+function extract(p12: forge.pkcs12.Pkcs12Pfx): Pkcs12Contents {
+  const certDers: Buffer[] = [];
+  for (const bag of bagsOf(p12, forge.pki.oids.certBag)) {
+    // RSA: bag.cert ist ein forge-Zertifikat; EC: bag.cert ist leer, das Zertifikat steht in bag.asn1.
+    const asn1 =
+      bag.asn1 ??
+      (bag.cert ? forge.pki.certificateToAsn1(bag.cert as forge.pki.Certificate) : null);
+    if (asn1) certDers.push(toBuffer(asn1));
+  }
+  const keys: Pkcs12Key[] = [];
+  const shroudedFirst: [string, boolean][] = [
+    [forge.pki.oids.pkcs8ShroudedKeyBag, true],
+    [forge.pki.oids.keyBag, false],
+  ];
+  for (const [bagType, shrouded] of shroudedFirst) {
+    for (const bag of bagsOf(p12, bagType)) {
+      try {
+        // RSA: forge hat den Schluessel gelesen; EC: bag.key ist falsch, bag.asn1 ist das PKCS#8.
+        const key = bag.key
+          ? createPrivateKey(forge.pki.privateKeyToPem(bag.key as forge.pki.rsa.PrivateKey))
+          : createPrivateKey({
+              key: toBuffer(bag.asn1 as forge.asn1.Asn1),
+              format: 'der',
+              type: 'pkcs8',
+            });
+        keys.push({ key, shrouded });
+      } catch {
+        // ein Schluessel, den Node nicht lesen kann, fehlt in der Auswertung; der Rest bleibt gueltig
+      }
+    }
+  }
+  return { certDers, keys };
+}
+
+/**
+ * Oeffnet einen PKCS#12-Container. Probiert das Passwort der Datei (`ownPassword`), das leere
+ * Passwort und danach die uebrigen `passwords`, zusammen hoechstens MAX_PASSWORDS + 1 Versuche.
+ * Ohne passendes Passwort: gesperrt; `passwordWrong`, wenn die Datei ein eigenes Passwort hatte.
+ * Ein Container, den forge aus anderem Grund nicht lesen kann, wirft (der Aufrufer meldet „unbekannt“).
+ */
+export function readPkcs12(der: Buffer, passwords: string[], ownPassword = ''): Pkcs12Read {
+  const asn1 = parseAsn1(der);
+  const tries: string[] = [];
+  for (const p of [ownPassword, '', ...passwords]) {
+    if (!tries.includes(p) && tries.length < MAX_PASSWORDS + 1) tries.push(p);
+  }
+  let passwordProblem = false;
+  let lastError: unknown = new Error('unreadable PKCS#12');
+  for (const password of tries) {
+    try {
+      return { ok: true, contents: extract(forge.pkcs12.pkcs12FromAsn1(asn1, false, password)) };
+    } catch (error) {
+      lastError = error;
+      const message = error instanceof Error ? error.message : '';
+      if (/mac|password|decrypt|padding|invalid|asn\.?1|too few bytes/i.test(message)) {
+        passwordProblem = true;
+      }
+    }
+  }
+  if (!passwordProblem) throw lastError;
+  return { ok: false, reason: ownPassword ? 'passwordWrong' : 'passwordNeeded' };
+}

apps/web/src/app/(portal)/modules/cert-manager/components/AnalyzeTab.test.tsx

@@ -3,7 +3,7 @@ import { NextIntlClientProvider } from 'next-intl';
 import type { ReactElement } from 'react';
 import { afterEach, describe, expect, it } from 'vitest';
 import de from '@/messages/de.json';
-import type { AnalysisResult, CertItem, ChainInfo } from '../actions';
+import type { AnalysisResult, CertItem, ChainInfo, CsrItem, KeyItem } from '../actions';
 import type { CertWorkspace } from '../use-cert-workspace';
 import type { WorkingEntry } from '../working-set';
 import { AnalyzeTab } from './AnalyzeTab';
@@ -69,6 +69,7 @@ function workspace(
     errorKey: null,
     addFiles: () => [],
     addText: () => null,
+    setPassword: () => {},
     remove: () => {},
     clear: () => {},
     retry: () => {},
@@ -229,3 +230,134 @@ describe('AnalyzeTab', () => {
     expect(container.innerHTML).not.toContain('uppercase');
   });
 });
+
+describe('AnalyzeTab: Schluessel, Anfragen, gesperrte Dateien', () => {
+  const keyed = cert({
+    id: 'c-k',
+    cn: 'www.example.test',
+    role: 'end-entity',
+    keyId: 'k-1',
+    csrIds: ['r-1'],
+  });
+  const key: KeyItem = {
+    id: 'k-1',
+    kind: 'privateKey',
+    sources: [{ file: 0, path: 'key.pem' }],
+    pem: 'PEM-KEY',
+    baseName: 'schluessel',
+    keyType: 'RSA',
+    keyBits: 2048,
+    curve: null,
+    wasEncrypted: true,
+    certIds: ['c-k'],
+  };
+  const csr: CsrItem = {
+    id: 'r-1',
+    kind: 'csr',
+    sources: [{ file: 1, path: 'www.csr' }],
+    pem: 'PEM-CSR',
+    baseName: 'www.example.test',
+    cn: 'www.example.test',
+    organization: 'Tessera Test',
+    san: ['www.example.test', 'example.test'],
+    keyType: 'RSA',
+    keyBits: 2048,
+    curve: null,
+    keyId: 'k-1',
+    certIds: ['c-k'],
+  };
+  const analysis: AnalysisResult = {
+    items: [keyed, key, csr],
+    chains: [],
+    locked: [
+      { file: 2, path: 'vendor.pfx', container: 'pkcs12', reason: 'passwordNeeded' },
+      { file: 3, path: 'zweiter.pfx', container: 'pkcs12', reason: 'passwordWrong' },
+    ],
+    ignored: [],
+  };
+  const entries = [entry('e1', 'key.pem'), entry('e2', 'www.csr')];
+
+  it('Zertifikat mit passendem Schluessel traegt den Hinweis, ohne Schluessel nicht', () => {
+    render(<AnalyzeTab workspace={workspace(analysis, entries, ['e1', 'e2'])} />);
+    const [card] = screen.getAllByTestId('cert-card');
+    expect(within(card).getByText('Passender Schlüssel vorhanden')).toBeInTheDocument();
+    cleanup();
+    render(
+      <AnalyzeTab
+        workspace={workspace(
+          {
+            items: [cert({ id: 'c-n', cn: 'ohne.example.test', role: 'end-entity' })],
+            chains: [],
+            locked: [],
+            ignored: [],
+          },
+          entries,
+          ['e1'],
+        )}
+      />,
+    );
+    expect(screen.queryByText('Passender Schlüssel vorhanden')).not.toBeInTheDocument();
+  });
+
+  it('Schluesselkarte: Art, Groesse, „War verschlüsselt“, zu welchem Zertifikat er gehoert', () => {
+    render(<AnalyzeTab workspace={workspace(analysis, entries, ['e1', 'e2'])} />);
+    const card = screen.getByTestId('key-card');
+    expect(within(card).getByText('Privater Schlüssel')).toBeInTheDocument();
+    expect(within(card).getByText('RSA, 2048 Bit')).toBeInTheDocument();
+    expect(within(card).getByText('War verschlüsselt')).toBeInTheDocument();
+    expect(within(card).getByText('www.example.test')).toBeInTheDocument();
+    expect(card).toHaveTextContent('key.pem');
+  });
+
+  it('Schluessel ohne Zertifikat sagt es ruhig', () => {
+    const lonely: AnalysisResult = {
+      items: [{ ...key, certIds: [] }],
+      chains: [],
+      locked: [],
+      ignored: [],
+    };
+    render(<AnalyzeTab workspace={workspace(lonely, entries, ['e1'])} />);
+    expect(screen.getByText('Dazu liegt noch kein Zertifikat vor.')).toBeInTheDocument();
+  });
+
+  it('Anfragekarte: Inhaber, Namen, Schluessel, Zuordnung', () => {
+    render(<AnalyzeTab workspace={workspace(analysis, entries, ['e1', 'e2'])} />);
+    const card = screen.getByTestId('csr-card');
+    expect(within(card).getByText('Zertifikatsanfrage (CSR)')).toBeInTheDocument();
+    expect(within(card).getByText('Tessera Test')).toBeInTheDocument();
+    expect(within(card).getByText('www.example.test, example.test')).toBeInTheDocument();
+    expect(within(card).getByText('RSA, 2048 Bit')).toBeInTheDocument();
+    expect(within(card).getByText('Passender Schlüssel').nextSibling).toHaveTextContent(
+      'vorhanden',
+    );
+  });
+
+  it('die Zusammenfassung nennt gesperrte Dateien und verweist auf den Reiter Dateien', () => {
+    render(<AnalyzeTab workspace={workspace(analysis, entries, ['e1', 'e2'])} />);
+    const region = screen.getByRole('region', { name: 'Geschützte Dateien' });
+    const rows = within(region).getAllByRole('listitem');
+    expect(rows[0]).toHaveTextContent('vendor.pfx braucht ein Passwort');
+    expect(rows[1]).toHaveTextContent('zweiter.pfx Das Passwort passt nicht');
+    expect(region).toHaveTextContent('im Reiter „Dateien“');
+  });
+
+  it('nur gesperrte Dateien: kein „nichts erkannt“, sondern die Zusammenfassung', () => {
+    render(
+      <AnalyzeTab
+        workspace={workspace({ items: [], chains: [], locked: analysis.locked, ignored: [] })}
+      />,
+    );
+    expect(
+      screen.queryByText('In den Dateien wurde noch kein Zertifikat erkannt.'),
+    ).not.toBeInTheDocument();
+    expect(screen.getByRole('region', { name: 'Geschützte Dateien' })).toBeInTheDocument();
+  });
+
+  it('kein Passwort und kein Schluesselinhalt im Text', () => {
+    const { container } = render(
+      <AnalyzeTab workspace={workspace(analysis, entries, ['e1', 'e2'])} />,
+    );
+    expect(container.textContent).not.toContain('PEM-KEY');
+    expect(container.textContent).not.toMatch(/[→←·]/);
+  });
+});

apps/web/src/app/(portal)/modules/cert-manager/components/AnalyzeTab.tsx

@@ -1,7 +1,7 @@
 'use client';
 
 import { useTranslations } from 'next-intl';
-import type { CertItem } from '../actions';
+import type { CertItem, CsrItem, KeyItem } from '../actions';
 import type { CertWorkspace } from '../use-cert-workspace';
 import { ChainView } from './ChainView';
 import { ItemCard } from './ItemCard';
@@ -27,8 +27,14 @@ export function AnalyzeTab({ workspace }: AnalyzeTabProps) {
   }
 
   const certs = analysis.items.filter((i): i is CertItem => i.kind === 'certificate');
+  const keys = analysis.items.filter((i): i is KeyItem => i.kind === 'privateKey');
+  const csrs = analysis.items.filter((i): i is CsrItem => i.kind === 'csr');
 
-  if (certs.length === 0 && analysis.ignored.length === 0) {
+  if (
+    analysis.items.length === 0 &&
+    analysis.ignored.length === 0 &&
+    analysis.locked.length === 0
+  ) {
     return <p className="text-sm text-muted-foreground">{t('analyze.nothingFound')}</p>;
   }
 
@@ -52,12 +58,69 @@ export function AnalyzeTab({ workspace }: AnalyzeTabProps) {
           </h2>
           <ul className="space-y-4">
             {certs.map((cert) => (
-              <ItemCard key={cert.id} cert={cert} entries={entries} analysisIds={analysisIds} />
+              <ItemCard
+                key={cert.id}
+                item={cert}
+                items={analysis.items}
+                entries={entries}
+                analysisIds={analysisIds}
+              />
             ))}
           </ul>
         </section>
       )}
 
+      {keys.length > 0 && (
+        <section className="space-y-3" aria-label={t('analyze.keysTitle')}>
+          <h2 className="text-sm font-semibold text-foreground">{t('analyze.keysTitle')}</h2>
+          <ul className="space-y-4">
+            {keys.map((key) => (
+              <ItemCard
+                key={key.id}
+                item={key}
+                items={analysis.items}
+                entries={entries}
+                analysisIds={analysisIds}
+              />
+            ))}
+          </ul>
+        </section>
+      )}
+
+      {csrs.length > 0 && (
+        <section className="space-y-3" aria-label={t('analyze.csrsTitle')}>
+          <h2 className="text-sm font-semibold text-foreground">{t('analyze.csrsTitle')}</h2>
+          <ul className="space-y-4">
+            {csrs.map((csr) => (
+              <ItemCard
+                key={csr.id}
+                item={csr}
+                items={analysis.items}
+                entries={entries}
+                analysisIds={analysisIds}
+              />
+            ))}
+          </ul>
+        </section>
+      )}
+
+      {analysis.locked.length > 0 && (
+        <section className="space-y-2" aria-label={t('analyze.lockedTitle')}>
+          <h2 className="text-sm font-semibold text-foreground">{t('analyze.lockedTitle')}</h2>
+          <ul className="space-y-1 text-sm text-muted-foreground">
+            {analysis.locked.map((l) => (
+              <li key={`${l.file}-${l.path}-${l.container}`}>
+                <span className="break-all text-foreground">{l.path}</span>{' '}
+                {l.reason === 'passwordWrong'
+                  ? t('analyze.lockedWrong')
+                  : t('analyze.lockedNeeded')}
+              </li>
+            ))}
+          </ul>
+          <p className="text-xs text-muted-foreground">{t('analyze.lockedHint')}</p>
+        </section>
+      )}
+
       {analysis.ignored.length > 0 && (
         <section className="space-y-2" aria-label={t('analyze.ignoredTitle')}>
           <h2 className="text-sm font-semibold text-foreground">{t('analyze.ignoredTitle')}</h2>

apps/web/src/app/(portal)/modules/cert-manager/components/FilesTab.test.tsx

@@ -10,7 +10,7 @@ import { NextIntlClientProvider } from 'next-intl';
 import type { ReactElement } from 'react';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import de from '@/messages/de.json';
-import type { AnalysisResult, CertItem } from '../actions';
+import type { AnalysisResult, CertItem, CsrItem, KeyItem } from '../actions';
 import { CertManagerRequestError } from '../actions';
 import { useCertWorkspace } from '../use-cert-workspace';
 import { FilesTab } from './FilesTab';
@@ -290,4 +290,180 @@ describe('FilesTab', () => {
     expect(screen.getByRole('alert')).toHaveTextContent('länger als');
     expect(mockAnalyze).not.toHaveBeenCalled();
   });
+
+  describe('geschuetzte Dateien', () => {
+    const locked = (over: Partial<AnalysisResult['locked'][number]> = {}) => ({
+      file: 0,
+      path: 'server.pfx',
+      container: 'pkcs12' as const,
+      reason: 'passwordNeeded' as const,
+      ...over,
+    });
+    const keyItem = (): KeyItem => ({
+      id: 'k-1',
+      kind: 'privateKey',
+      sources: [{ file: 0, path: 'key.pem' }],
+      pem: '',
+      baseName: 'schluessel',
+      keyType: 'EC',
+      keyBits: 256,
+      curve: 'P-256',
+      wasEncrypted: true,
+      certIds: [],
+    });
+    const csrItem = (): CsrItem => ({
+      id: 'r-1',
+      kind: 'csr',
+      sources: [{ file: 0, path: 'req.csr' }],
+      pem: '',
+      baseName: 'anfrage',
+      cn: 'www.example.test',
+      organization: '',
+      san: [],
+      keyType: 'RSA',
+      keyBits: 2048,
+      curve: null,
+      keyId: null,
+      certIds: [],
+    });
+
+    it('zeigt den Hinweis und ein Passwortfeld; „Entsperren“ sendet das Passwort in der Analyse', async () => {
+      mockAnalyze
+        .mockResolvedValueOnce({
+          items: [],
+          chains: [],
+          locked: [locked()],
+          ignored: [],
+        } satisfies AnalysisResult)
+        .mockResolvedValueOnce({
+          items: [cert('c-srv', 'www.example.test', 'end-entity', [0], ['server.pfx'])],
+          chains: [],
+          locked: [],
+          ignored: [],
+        } satisfies AnalysisResult);
+      render(<Harness />);
+      selectFiles([makeFile('server.pfx')]);
+      expect(
+        await screen.findByText('„server.pfx“ ist mit einem Passwort geschützt.'),
+      ).toBeInTheDocument();
+      const field = screen.getByLabelText('Passwort für „server.pfx“') as HTMLInputElement;
+      expect(field.type).toBe('password');
+      expect(field).toHaveAttribute('autocomplete', 'off');
+      const unlock = screen.getByRole('button', { name: 'Entsperren' });
+      expect(unlock).toBeDisabled();
+      fireEvent.change(field, { target: { value: 'geheim' } });
+      fireEvent.click(unlock);
+      await screen.findByText('www.example.test');
+      const sent = mockAnalyze.mock.calls.at(-1)?.[0] as { password: string }[];
+      expect(sent.map((e) => e.password)).toEqual(['geheim']);
+      expect(screen.queryByLabelText('Passwort für „server.pfx“')).not.toBeInTheDocument();
+    });
+
+    it('Enter im Feld entsperrt ebenfalls', async () => {
+      mockAnalyze.mockResolvedValue({
+        items: [],
+        chains: [],
+        locked: [locked()],
+        ignored: [],
+      } satisfies AnalysisResult);
+      render(<Harness />);
+      selectFiles([makeFile('server.pfx')]);
+      const field = await screen.findByLabelText('Passwort für „server.pfx“');
+      fireEvent.change(field, { target: { value: 'geheim' } });
+      fireEvent.submit(field.closest('form') as HTMLFormElement);
+      await waitFor(() => {
+        const last = mockAnalyze.mock.calls.at(-1)?.[0] as { password: string }[];
+        expect(last[0].password).toBe('geheim');
+      });
+    });
+
+    it('ein falsches Passwort wird als solches gemeldet, das Feld bleibt', async () => {
+      mockAnalyze.mockResolvedValueOnce({
+        items: [],
+        chains: [],
+        locked: [locked()],
+        ignored: [],
+      } satisfies AnalysisResult);
+      mockAnalyze.mockResolvedValueOnce({
+        items: [],
+        chains: [],
+        locked: [locked({ reason: 'passwordWrong' })],
+        ignored: [],
+      } satisfies AnalysisResult);
+      render(<Harness />);
+      selectFiles([makeFile('server.pfx')]);
+      const field = await screen.findByLabelText('Passwort für „server.pfx“');
+      fireEvent.change(field, { target: { value: 'falsch' } });
+      fireEvent.click(screen.getByRole('button', { name: 'Entsperren' }));
+      expect(await screen.findByText('Das Passwort passt nicht.')).toBeInTheDocument();
+      expect(screen.getByLabelText('Passwort für „server.pfx“')).toBeInTheDocument();
+    });
+
+    it('der Knopf zeigt und verbirgt das Passwort', async () => {
+      mockAnalyze.mockResolvedValue({
+        items: [],
+        chains: [],
+        locked: [locked()],
+        ignored: [],
+      } satisfies AnalysisResult);
+      render(<Harness />);
+      selectFiles([makeFile('server.pfx')]);
+      const field = (await screen.findByLabelText('Passwort für „server.pfx“')) as HTMLInputElement;
+      fireEvent.click(screen.getByRole('button', { name: 'Passwort anzeigen' }));
+      expect(field.type).toBe('text');
+      fireEvent.click(screen.getByRole('button', { name: 'Passwort verbergen' }));
+      expect(field.type).toBe('password');
+    });
+
+    it('eine gesperrte PFX bei vorhandenem Zertifikat samt Schluessel: ruhiger Hinweis, Feld erst nach „Trotzdem entsperren“', async () => {
+      const withKey = {
+        ...cert('c-srv', 'www.example.test', 'end-entity', [0], ['leaf.pem']),
+        keyId: 'k-1',
+      };
+      mockAnalyze.mockResolvedValue({
+        items: [withKey, keyItem()],
+        chains: [],
+        locked: [locked({ file: 1, path: 'server.pfx' })],
+        ignored: [],
+      } satisfies AnalysisResult);
+      render(<Harness />);
+      selectFiles([makeFile('leaf.pem'), makeFile('server.pfx')]);
+      expect(await screen.findByText(/Sie brauchen die Datei nicht/)).toBeInTheDocument();
+      expect(screen.queryByLabelText('Passwort für „server.pfx“')).not.toBeInTheDocument();
+      fireEvent.click(screen.getByRole('button', { name: 'Trotzdem entsperren' }));
+      expect(screen.getByLabelText('Passwort für „server.pfx“')).toBeInTheDocument();
+    });
+
+    it('Schluessel und Anfragen stehen je Eintrag wie Zertifikate, ohne Passwort im Text', async () => {
+      mockAnalyze.mockResolvedValue({
+        items: [keyItem(), csrItem()],
+        chains: [],
+        locked: [],
+        ignored: [],
+      } satisfies AnalysisResult);
+      render(<Harness />);
+      selectFiles([makeFile('key.pem'), makeFile('req.csr')]);
+      expect(await screen.findByText('Privater Schlüssel')).toBeInTheDocument();
+      expect(screen.getByText('EC, Kurve P-256')).toBeInTheDocument();
+      expect(screen.getByText('war verschlüsselt')).toBeInTheDocument();
+      expect(screen.getByText('Zertifikatsanfrage (CSR)')).toBeInTheDocument();
+      expect(screen.getByText('www.example.test')).toBeInTheDocument();
+    });
+
+    it('kein dargestellter Text enthaelt das eingegebene Passwort', async () => {
+      mockAnalyze.mockResolvedValue({
+        items: [],
+        chains: [],
+        locked: [locked({ reason: 'passwordWrong' })],
+        ignored: [],
+      } satisfies AnalysisResult);
+      const { container } = render(<Harness />);
+      selectFiles([makeFile('server.pfx')]);
+      const field = await screen.findByLabelText('Passwort für „server.pfx“');
+      fireEvent.change(field, { target: { value: 'geheim-xyz' } });
+      fireEvent.click(screen.getByRole('button', { name: 'Entsperren' }));
+      await waitFor(() => expect(mockAnalyze).toHaveBeenCalledTimes(2));
+      expect(container.textContent).not.toContain('geheim-xyz');
+    });
+  });
 });

apps/web/src/app/(portal)/modules/cert-manager/components/FilesTab.tsx

@@ -2,7 +2,7 @@
 
 import { useTranslations } from 'next-intl';
 import { useRef, useState } from 'react';
-import type { AnyItem, IgnoredEntry } from '../actions';
+import type { AnyItem, IgnoredEntry, LockedEntry } from '../actions';
 import type { CertWorkspace } from '../use-cert-workspace';
 import {
   formatBytes,
@@ -13,6 +13,7 @@ import {
   type RejectedFile,
   type WorkingEntry,
 } from '../working-set';
+import { PasswordInput } from './PasswordInput';
 
 /** Farben der Rollenmarken (wie in der frueheren Uebersicht). */
 export const ROLE_STYLES: Record<string, string> = {
@@ -48,8 +49,86 @@ function roleKey(item: AnyItem): string {
   return item.kind === 'certificate' ? item.role : item.kind;
 }
 
-function itemName(item: AnyItem): string {
+function keyDescription(
-  return item.kind === 'privateKey' ? item.baseName : item.cn || item.baseName;
+  item: Extract<AnyItem, { kind: 'privateKey' }>,
+  t: ReturnType<typeof useTranslations>,
+): string {
+  if (item.keyType === 'RSA') return t('analyze.keyRsa', { bits: item.keyBits ?? 0 });
+  if (item.keyType === 'EC') return t('analyze.keyEc', { curve: item.curve ?? '' });
+  return item.keyType;
+}
+
+function itemName(item: AnyItem, t: ReturnType<typeof useTranslations>): string {
+  return item.kind === 'privateKey' ? keyDescription(item, t) : item.cn || item.baseName;
+}
+
+interface UnlockPanelProps {
+  entry: WorkingEntry;
+  locked: LockedEntry[];
+  /** Die Datei wird nicht gebraucht (Zertifikat und Schluessel liegen schon vor): ruhiger Hinweis statt Feld */
+  optional: boolean;
+  onUnlock: (password: string) => void;
+}
+
+/**
+ * Gesperrte Datei: sagt, welche Teile ein Passwort brauchen, und nimmt es entgegen (Enter oder
+ * „Entsperren“). Ist die Datei entbehrlich, steht zuerst nur ein ruhiger Hinweis mit „Trotzdem entsperren“.
+ */
+function UnlockPanel({ entry, locked, optional, onUnlock }: UnlockPanelProps) {
+  const t = useTranslations('certManager');
+  const [value, setValue] = useState('');
+  const [forced, setForced] = useState(false);
+  const wrong = locked.some((l) => l.reason === 'passwordWrong');
+  const calm = optional && !forced;
+
+  return (
+    <div
+      className={`mt-2 rounded-lg p-3 text-sm ${calm ? 'bg-muted text-muted-foreground' : 'border border-border bg-muted'}`}
+      data-testid="cert-locked"
+    >
+      <ul className="space-y-0.5">
+        {locked.map((l) => (
+          <li key={`${l.path}-${l.container}`} className={calm ? '' : 'text-foreground'}>
+            {t(calm ? 'files.locked.optional' : 'files.locked.message', { path: l.path })}
+          </li>
+        ))}
+      </ul>
+      {calm ? (
+        <button
+          type="button"
+          onClick={() => setForced(true)}
+          className="mt-2 rounded border border-border px-3 py-1 text-foreground hover:bg-card focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+        >
+          {t('files.locked.unlockAnyway')}
+        </button>
+      ) : (
+        <form
+          className="mt-2 space-y-2"
+          onSubmit={(e) => {
+            e.preventDefault();
+            if (value !== '') onUnlock(value);
+          }}
+        >
+          <PasswordInput
+            label={t('files.locked.passwordLabel', { name: entry.label })}
+            value={value}
+            onChange={setValue}
+          />
+          <div className="flex flex-wrap items-center gap-3">
+            <button type="submit" disabled={value === ''} className="btn btn-secondary">
+              {t('files.locked.unlock')}
+            </button>
+            {wrong && entry.password !== '' && (
+              <span className="text-sm text-status-down-fg" aria-live="polite">
+                {t('files.locked.wrong')}
+              </span>
+            )}
+          </div>
+          <p className="text-xs text-muted-foreground">{t('files.locked.note')}</p>
+        </form>
+      )}
+    </div>
+  );
 }
 
 /** Was in einer Datei (bei ZIP: unter einem Pfad im ZIP) erkannt oder uebersprungen wurde. */
@@ -113,6 +192,14 @@ export function FilesTab({ workspace }: FilesTabProps) {
     return [...groups.values()].sort((a, b) => a.path.localeCompare(b.path));
   };
 
+  const lockedOf = (entry: WorkingEntry): LockedEntry[] =>
+    (analysis?.locked ?? []).filter((l) => analysisIds[l.file] === entry.id);
+
+  // Liegt schon ein Serverzertifikat samt passendem Schluessel vor, ist eine gesperrte PFX entbehrlich.
+  const haveCertWithKey = (analysis?.items ?? []).some(
+    (i) => i.kind === 'certificate' && i.role === 'end-entity' && i.keyId !== null,
+  );
+
   return (
     <div className="space-y-4">
       <button
@@ -251,6 +338,10 @@ export function FilesTab({ workspace }: FilesTabProps) {
           <ul className="space-y-2">
             {entries.map((entry) => {
               const groups = groupsOf(entry);
+              const lockedHere = lockedOf(entry);
+              const optional =
+                haveCertWithKey &&
+                lockedHere.every((l) => l.container === 'pkcs12' && l.reason === 'passwordNeeded');
               const analysed = analysisIds.includes(entry.id);
               return (
                 <li key={entry.id} className="rounded-lg border border-border p-3">
@@ -285,7 +376,12 @@ export function FilesTab({ workspace }: FilesTabProps) {
                               >
                                 {t(`roles.${roleKey(item)}`)}
                               </span>
-                              <span className="break-all text-foreground">{itemName(item)}</span>
+                              <span className="break-all text-foreground">{itemName(item, t)}</span>
+                              {item.kind === 'privateKey' && item.wasEncrypted && (
+                                <span className="text-xs text-muted-foreground">
+                                  {t('files.keyWasEncrypted')}
+                                </span>
+                              )}
                               {item.kind === 'certificate' && item.isExpired && (
                                 <span className="rounded bg-red-100 px-2 py-0.5 text-xs font-medium text-red-800 dark:bg-red-900/40 dark:text-red-300">
                                   {t('files.expired')}
@@ -308,6 +404,14 @@ export function FilesTab({ workspace }: FilesTabProps) {
                       <li className="text-sm text-muted-foreground">{t('files.checking')}</li>
                     )}
                   </ul>
+                  {lockedHere.length > 0 && (
+                    <UnlockPanel
+                      entry={entry}
+                      locked={lockedHere}
+                      optional={optional}
+                      onUnlock={(password) => workspace.setPassword(entry.id, password)}
+                    />
+                  )}
                 </li>
               );
             })}

apps/web/src/app/(portal)/modules/cert-manager/components/ItemCard.tsx

@@ -1,12 +1,14 @@
 'use client';
 
 import { useFormatter, useTranslations } from 'next-intl';
-import type { CertItem, ItemSource } from '../actions';
+import type { AnyItem, CertItem, CsrItem, ItemSource, KeyItem } from '../actions';
 import type { WorkingEntry } from '../working-set';
 import { ROLE_STYLES } from './FilesTab';
 
 interface ItemCardProps {
-  cert: CertItem;
+  item: AnyItem;
+  /** Alle erkannten Teile: Schluessel und Anfragen nennen damit ihre Zertifikate */
+  items: AnyItem[];
   /** Eintraege des Arbeitsbereichs und ihre Kennungen zum Analysezeitpunkt, fuer die Namen der Quellen */
   entries: WorkingEntry[];
   analysisIds: string[];
@@ -19,12 +21,129 @@ function sourceLabel(source: ItemSource, entries: WorkingEntry[], analysisIds: s
   return source.path;
 }
 
+type Translate = ReturnType<typeof useTranslations>;
+
+function keyDescription(
+  item: { keyType: string; keyBits: number | null; curve: string | null },
+  t: Translate,
+): string {
+  if (item.keyType === 'RSA') return t('analyze.keyRsa', { bits: item.keyBits ?? 0 });
+  if (item.keyType === 'EC') return t('analyze.keyEc', { curve: item.curve ?? '' });
+  return item.keyType;
+}
+
+/** Eine Karte je erkanntem Teil im Reiter „Analysieren“: Zertifikat, privater Schluessel oder Anfrage. */
+export function ItemCard({ item, items, entries, analysisIds }: ItemCardProps) {
+  if (item.kind === 'certificate') {
+    return <CertCard cert={item} entries={entries} analysisIds={analysisIds} />;
+  }
+  if (item.kind === 'privateKey') {
+    return <KeyCard item={item} items={items} entries={entries} analysisIds={analysisIds} />;
+  }
+  return <CsrCard item={item} items={items} entries={entries} analysisIds={analysisIds} />;
+}
+
+function certNames(ids: string[], items: AnyItem[]): string[] {
+  return ids.flatMap((id) => {
+    const found = items.find((i): i is CertItem => i.kind === 'certificate' && i.id === id);
+    return found ? [found.cn || found.baseName] : [];
+  });
+}
+
+interface PartCardProps<T> {
+  item: T;
+  items: AnyItem[];
+  entries: WorkingEntry[];
+  analysisIds: string[];
+}
+
+function KeyCard({ item, items, entries, analysisIds }: PartCardProps<KeyItem>) {
+  const t = useTranslations('certManager');
+  const owners = certNames(item.certIds, items);
+  const sources = item.sources.map((s) => sourceLabel(s, entries, analysisIds));
+  return (
+    <li className="rounded-lg border border-border p-4" data-testid="key-card">
+      <div className="flex flex-wrap items-center gap-2">
+        <span className={`rounded px-2 py-0.5 text-xs font-semibold ${ROLE_STYLES.privateKey}`}>
+          {t('roles.privateKey')}
+        </span>
+        <span className="break-all font-medium text-foreground">{keyDescription(item, t)}</span>
+        {item.wasEncrypted && (
+          <span className="rounded bg-muted px-2 py-0.5 text-xs font-medium text-muted-foreground">
+            {t('analyze.wasEncrypted')}
+          </span>
+        )}
+      </div>
+      <p className="mt-1 text-xs text-muted-foreground">{t('analyze.explainKey')}</p>
+      <dl className="mt-3 grid grid-cols-[max-content_1fr] gap-x-4 gap-y-1 text-sm">
+        <dt className="text-muted-foreground">{t('analyze.belongsTo')}</dt>
+        <dd className="break-all text-foreground">
+          {owners.length > 0 ? owners.join(', ') : t('analyze.noCertificateYet')}
+        </dd>
+        <dt className="text-muted-foreground">{t('analyze.source')}</dt>
+        <dd className="break-all text-foreground">{sources.join(', ')}</dd>
+      </dl>
+    </li>
+  );
+}
+
+function CsrCard({ item, items, entries, analysisIds }: PartCardProps<CsrItem>) {
+  const t = useTranslations('certManager');
+  const owners = certNames(item.certIds, items);
+  const sources = item.sources.map((s) => sourceLabel(s, entries, analysisIds));
+  return (
+    <li className="rounded-lg border border-border p-4" data-testid="csr-card">
+      <div className="flex flex-wrap items-center gap-2">
+        <span className={`rounded px-2 py-0.5 text-xs font-semibold ${ROLE_STYLES.csr}`}>
+          {t('roles.csr')}
+        </span>
+        <span className="break-all font-medium text-foreground">{item.cn || item.baseName}</span>
+      </div>
+      <p className="mt-1 text-xs text-muted-foreground">{t('analyze.explainCsr')}</p>
+      <dl className="mt-3 grid grid-cols-[max-content_1fr] gap-x-4 gap-y-1 text-sm">
+        {item.organization && (
+          <>
+            <dt className="text-muted-foreground">{t('analyze.subject')}</dt>
+            <dd className="break-all text-foreground">{item.organization}</dd>
+          </>
+        )}
+        {item.san.length > 0 && (
+          <>
+            <dt className="text-muted-foreground">{t('analyze.names')}</dt>
+            <dd className="break-all text-foreground">{item.san.join(', ')}</dd>
+          </>
+        )}
+        <dt className="text-muted-foreground">{t('analyze.key')}</dt>
+        <dd className="text-foreground">{keyDescription(item, t)}</dd>
+        <dt className="text-muted-foreground">{t('analyze.matchedKey')}</dt>
+        <dd className="text-foreground">
+          {item.keyId ? t('analyze.present') : t('analyze.absent')}
+        </dd>
+        <dt className="text-muted-foreground">{t('analyze.matchedCertificates')}</dt>
+        <dd className="break-all text-foreground">
+          {owners.length > 0 ? owners.join(', ') : t('analyze.absent')}
+        </dd>
+        <dt className="text-muted-foreground">{t('analyze.source')}</dt>
+        <dd className="break-all text-foreground">{sources.join(', ')}</dd>
+      </dl>
+    </li>
+  );
+}
+
 /**
- * Eine Karte je Zertifikat im Reiter „Analysieren“ (D-23): Rolle, Name, Gueltigkeit, Namen,
+ * Karte eines Zertifikats (D-23): Rolle, Name, Gueltigkeit, Namen, Schluessel, Seriennummer,
- * Schluessel, Seriennummer, Fingerabdruecke und woher das Zertifikat kam.
+ * Fingerabdruecke und woher das Zertifikat kam; mit Hinweis, wenn der passende Schluessel vorliegt.
  * Daten kommen in UTC, wie im Zertifikat; der Aussteller nennt dasselbe Datum.
  */
-export function ItemCard({ cert, entries, analysisIds }: ItemCardProps) {
+function CertCard({
+  cert,
+  entries,
+  analysisIds,
+}: {
+  cert: CertItem;
+  entries: WorkingEntry[];
+  analysisIds: string[];
+}) {
   const t = useTranslations('certManager');
   const format = useFormatter();
   const date = (iso: string) =>
@@ -39,12 +158,7 @@ export function ItemCard({ cert, entries, analysisIds }: ItemCardProps) {
         }
       : { cls: 'bg-status-ok/15 text-status-ok-fg', text: t('analyze.valid') };
 
-  const keyText =
+  const keyText = keyDescription(cert, t);
-    cert.keyType === 'RSA'
-      ? t('analyze.keyRsa', { bits: cert.keyBits ?? 0 })
-      : cert.keyType === 'EC'
-        ? t('analyze.keyEc', { curve: cert.curve ?? '' })
-        : cert.keyType;
 
   const sources = cert.sources.map((s) => sourceLabel(s, entries, analysisIds));
 
@@ -58,6 +172,11 @@ export function ItemCard({ cert, entries, analysisIds }: ItemCardProps) {
         <span className={`rounded px-2 py-0.5 text-xs font-medium ${status.cls}`}>
           {status.text}
         </span>
+        {cert.keyId && (
+          <span className="rounded bg-status-ok/15 px-2 py-0.5 text-xs font-medium text-status-ok-fg">
+            {t('analyze.matchingKey')}
+          </span>
+        )}
       </div>
       <p className="mt-1 text-xs text-muted-foreground">{t(`analyze.explain.${cert.role}`)}</p>
 

apps/web/src/app/(portal)/modules/cert-manager/components/MergeTab.test.tsx

@@ -78,6 +78,7 @@ function workspace(items: CertItem[], chains: ChainInfo[]): CertWorkspace {
     errorKey: null,
     addFiles: () => [],
     addText: () => null,
+    setPassword: () => {},
     remove: () => {},
     clear: () => {},
     retry: () => {},

apps/web/src/app/(portal)/modules/cert-manager/components/PasswordInput.tsx

@@ -0,0 +1,44 @@
+'use client';
+
+import { useTranslations } from 'next-intl';
+import { useId, useState } from 'react';
+
+interface PasswordInputProps {
+  /** Sichtbare Beschriftung des Feldes */
+  label: string;
+  value: string;
+  onChange: (value: string) => void;
+}
+
+/**
+ * Passwortfeld mit Knopf zum Anzeigen und Verbergen (D-11). Das Passwort wird nie gespeichert:
+ * kein Autovervollstaendigen, kein Schreiben in den Speicher des Browsers.
+ */
+export function PasswordInput({ label, value, onChange }: PasswordInputProps) {
+  const t = useTranslations('certManager');
+  const id = useId();
+  const [visible, setVisible] = useState(false);
+  return (
+    <div className="flex flex-wrap items-center gap-2">
+      <label htmlFor={id} className="text-sm text-foreground">
+        {label}
+      </label>
+      <input
+        id={id}
+        type={visible ? 'text' : 'password'}
+        value={value}
+        onChange={(e) => onChange(e.target.value)}
+        autoComplete="off"
+        spellCheck={false}
+        className="min-w-48 flex-1 rounded border border-border bg-background px-3 py-1.5 text-sm text-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+      />
+      <button
+        type="button"
+        onClick={() => setVisible((v) => !v)}
+        className="rounded border border-border px-2 py-1 text-xs text-foreground hover:bg-muted focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+      >
+        {visible ? t('passwordInput.hide') : t('passwordInput.show')}
+      </button>
+    </div>
+  );
+}

apps/web/src/app/(portal)/modules/cert-manager/components/SplitTab.test.tsx

@@ -71,6 +71,7 @@ function workspace(items: AnyItem[] | null): CertWorkspace {
     errorKey: null,
     addFiles: () => [],
     addText: () => null,
+    setPassword: () => {},
     remove: () => {},
     clear: () => {},
     retry: () => {},

apps/web/src/app/(portal)/modules/cert-manager/use-cert-workspace.ts

@@ -7,6 +7,7 @@ import {
   addFiles as addToSet,
   type RejectedFile,
   removeEntry,
+  setEntryPassword,
   type WorkingEntry,
 } from './working-set';
 
@@ -25,6 +26,8 @@ export interface CertWorkspace {
   /** Eingefuegten PEM-Text als Eintrag anhaengen; `label` liefert die Beschriftung in der Sprache der Oberflaeche */
   addText: (text: string, label?: (n: number) => string) => RejectedFile | null;
   remove: (id: string) => void;
+  /** Passwort fuer eine Datei setzen und alles neu pruefen; das Passwort lebt nur in diesem Zustand */
+  setPassword: (id: string, password: string) => void;
   clear: () => void;
   retry: () => void;
 }
@@ -110,6 +113,14 @@ export function useCertWorkspace(): CertWorkspace {
     [commit],
   );
 
+  const setPassword = useCallback(
+    (id: string, password: string) => {
+      const next = setEntryPassword(entriesRef.current, id, password);
+      if (next !== entriesRef.current) commit(next);
+    },
+    [commit],
+  );
+
   const clear = useCallback(() => {
     commit([]);
   }, [commit]);
@@ -127,6 +138,7 @@ export function useCertWorkspace(): CertWorkspace {
     addFiles,
     addText,
     remove,
+    setPassword,
     clear,
     retry,
   };

apps/web/src/app/(portal)/modules/cert-manager/working-set.test.ts

@@ -6,6 +6,7 @@ import {
   MAX_FILE_BYTES,
   MAX_PASTE_CHARS,
   removeEntry,
+  setEntryPassword,
   toFormData,
   type WorkingEntry,
 } from './working-set';
@@ -143,3 +144,30 @@ describe('toFormData', () => {
     expect(names).toEqual(['b.pem', 'a.pem']);
   });
 });
+
+describe('Passwoerter', () => {
+  it('setEntryPassword aendert nur den einen Eintrag, ohne Aenderung bleibt die Liste gleich', () => {
+    const { entries } = addFiles(NONE, [makeFile('a.pem'), makeFile('b.pfx')], nextId);
+    const next = setEntryPassword(entries, entries[1].id, 'geheim');
+    expect(next.map((e) => e.password)).toEqual(['', 'geheim']);
+    expect(next[0]).toBe(entries[0]);
+    expect(setEntryPassword(next, entries[1].id, 'geheim')).toBe(next);
+    expect(setEntryPassword(next, 'gibt-es-nicht', 'x')).toBe(next);
+  });
+
+  it('toFormData sendet `passwords` nur, wenn ein Passwort gesetzt ist, im Takt der Dateien', () => {
+    const { entries } = addFiles(NONE, [makeFile('a.pem'), makeFile('b.pfx')], nextId);
+    expect(toFormData(entries).has('passwords')).toBe(false);
+    const withPassword = setEntryPassword(entries, entries[1].id, 'geheim');
+    const form = toFormData(withPassword);
+    expect(JSON.parse(form.get('passwords') as string)).toEqual(['', 'geheim']);
+    expect(form.getAll('files')).toHaveLength(2);
+  });
+
+  it('das Passwort steht in keinem Dateinamen und keiner Beschriftung', () => {
+    const { entries } = addFiles(NONE, [makeFile('b.pfx')], nextId);
+    const [entry] = setEntryPassword(entries, entries[0].id, 'geheim');
+    expect(entry.label).not.toContain('geheim');
+    expect(entry.file.name).not.toContain('geheim');
+  });
+});

apps/web/src/app/(portal)/modules/cert-manager/working-set.ts

@@ -21,7 +21,7 @@ export interface WorkingEntry {
   origin: EntryOrigin;
   /** Nur fuer nachgeladene Zertifikate: der Server, von dem sie kamen */
   host: string | null;
-  /** Passwort fuer diese Datei (ab Task 4); bleibt im Arbeitsspeicher */
+  /** Passwort fuer diese Datei; bleibt im Arbeitsspeicher, wird nie gespeichert */
   password: string;
 }
 
@@ -127,10 +127,27 @@ export function removeEntry(entries: WorkingEntry[], id: string): WorkingEntry[]
   return entries.filter((e) => e.id !== id);
 }
 
-/** Multipart-Koerper fuer die Analyse: `files` in der Reihenfolge der Eintraege. */
+/** Setzt das Passwort eines Eintrags; ohne Aenderung kommt dieselbe Liste zurueck. */
+export function setEntryPassword(
+  entries: WorkingEntry[],
+  id: string,
+  password: string,
+): WorkingEntry[] {
+  if (!entries.some((e) => e.id === id && e.password !== password)) return entries;
+  return entries.map((e) => (e.id === id ? { ...e, password } : e));
+}
+
+/**
+ * Multipart-Koerper fuer die Analyse: `files` in der Reihenfolge der Eintraege und, nur wenn
+ * mindestens ein Passwort eingegeben wurde, `passwords` als JSON-Liste im Takt der Dateien.
+ * Passwoerter stehen nur in diesem Koerper, nie in einer Adresse.
+ */
 export function toFormData(entries: WorkingEntry[]): FormData {
   const form = new FormData();
   for (const entry of entries) form.append('files', entry.file, entry.file.name);
+  if (entries.some((e) => e.password !== '')) {
+    form.append('passwords', JSON.stringify(entries.map((e) => e.password)));
+  }
   return form;
 }
 

apps/web/src/messages/de.json

@@ -1303,7 +1303,17 @@
       "pasteLabel": "Eingefügter PEM-Text",
       "pasteAdd": "Hinzufügen",
       "pastedLabel": "Eingefügter Text {n}",
-      "originPaste": "Eingefügter Text"
+      "originPaste": "Eingefügter Text",
+      "locked": {
+        "message": "„{path}“ ist mit einem Passwort geschützt.",
+        "optional": "„{path}“ ist mit einem Passwort geschützt. Sie brauchen die Datei nicht, solange Zertifikat und Schlüssel schon vorliegen.",
+        "passwordLabel": "Passwort für „{name}“",
+        "unlock": "Entsperren",
+        "unlockAnyway": "Trotzdem entsperren",
+        "wrong": "Das Passwort passt nicht.",
+        "note": "Das Passwort bleibt in diesem Browserfenster und wird nur zum Öffnen der Datei übertragen."
+      },
+      "keyWasEncrypted": "war verschlüsselt"
     },
     "errors": {
       "generic": "Die Dateien konnten nicht geprüft werden. Bitte versuchen Sie es erneut.",
@@ -1351,7 +1361,25 @@
         "end-entity": "Das eigentliche Zertifikat für Ihre Domain. Das gehört auf den Webserver.",
         "intermediate": "Bestätigt Ihr Serverzertifikat gegenüber dem Browser. Wird zusammen mit dem Serverzertifikat eingespielt (Kette).",
         "root": "Oberste Zertifizierungsstelle. Ist in Browsern und Betriebssystemen meist schon vorhanden."
-      }
+      },
+      "matchingKey": "Passender Schlüssel vorhanden",
+      "keysTitle": "Private Schlüssel",
+      "csrsTitle": "Zertifikatsanfragen",
+      "lockedTitle": "Geschützte Dateien",
+      "lockedNeeded": "braucht ein Passwort",
+      "lockedWrong": "Das Passwort passt nicht",
+      "lockedHint": "Geben Sie das Passwort im Reiter „Dateien“ ein.",
+      "wasEncrypted": "War verschlüsselt",
+      "belongsTo": "Gehört zu",
+      "noCertificateYet": "Dazu liegt noch kein Zertifikat vor.",
+      "subject": "Inhaber",
+      "matchedKey": "Passender Schlüssel",
+      "matchedCertificates": "Passendes Zertifikat",
+      "matchedCsr": "Passende Anfrage",
+      "present": "vorhanden",
+      "absent": "nicht vorhanden",
+      "explainKey": "Gehört zu Ihrem Serverzertifikat und bleibt geheim. Geben Sie ihn nie weiter.",
+      "explainCsr": "Die Anfrage, mit der ein Zertifikat bei der Zertifizierungsstelle bestellt wird."
     },
     "split": {
       "intro": "Jedes erkannte Teil können Sie einzeln in seinem natürlichen Format herunterladen, oder alle zusammen als ZIP.",
@@ -1379,6 +1407,10 @@
       "gapAfterLeaf": "Zwischenzertifikat fehlt: „{name}“",
       "gapAfterLeafHint": "Ohne dieses Zertifikat vertrauen manche Geräte dem Server nicht. Fügen Sie es im Reiter „Dateien“ hinzu.",
       "gapAfterCa": "Darüber fehlt noch ein Zertifikat, meist das Stammzertifikat „{name}“. Für eine Fullchain ohne Stammzertifikat wird es nicht gebraucht."
+    },
+    "passwordInput": {
+      "show": "Passwort anzeigen",
+      "hide": "Passwort verbergen"
     }
   },
   "tenderRadar": {

apps/web/src/messages/en.json

@@ -1303,7 +1303,17 @@
       "pasteLabel": "Pasted PEM text",
       "pasteAdd": "Add",
       "pastedLabel": "Pasted text {n}",
-      "originPaste": "Pasted text"
+      "originPaste": "Pasted text",
+      "locked": {
+        "message": "\"{path}\" is password protected.",
+        "optional": "\"{path}\" is password protected. You do not need the file as long as the certificate and the key are already there.",
+        "passwordLabel": "Password for \"{name}\"",
+        "unlock": "Unlock",
+        "unlockAnyway": "Unlock anyway",
+        "wrong": "The password does not match.",
+        "note": "The password stays in this browser window and is only sent to open the file."
+      },
+      "keyWasEncrypted": "was encrypted"
     },
     "errors": {
       "generic": "The files could not be checked. Please try again.",
@@ -1351,7 +1361,25 @@
         "end-entity": "The actual certificate for your domain. This one belongs on the web server.",
         "intermediate": "Vouches for your server certificate towards the browser. It is installed together with the server certificate (chain).",
         "root": "The top certificate authority. Browsers and operating systems usually have it already."
-      }
+      },
+      "matchingKey": "Matching key present",
+      "keysTitle": "Private keys",
+      "csrsTitle": "Certificate requests",
+      "lockedTitle": "Protected files",
+      "lockedNeeded": "needs a password",
+      "lockedWrong": "The password does not match",
+      "lockedHint": "Enter the password in the \"Files\" tab.",
+      "wasEncrypted": "Was encrypted",
+      "belongsTo": "Belongs to",
+      "noCertificateYet": "There is no certificate for it yet.",
+      "subject": "Owner",
+      "matchedKey": "Matching key",
+      "matchedCertificates": "Matching certificate",
+      "matchedCsr": "Matching request",
+      "present": "present",
+      "absent": "not present",
+      "explainKey": "Belongs to your server certificate and stays secret. Never pass it on.",
+      "explainCsr": "The request used to order a certificate from the certification authority."
     },
     "split": {
       "intro": "You can download every recognised part on its own in its natural format, or all of them together as a ZIP.",
@@ -1379,6 +1407,10 @@
       "gapAfterLeaf": "Intermediate certificate missing: “{name}”",
       "gapAfterLeafHint": "Without this certificate some devices will not trust the server. Add it in the “Files” tab.",
       "gapAfterCa": "A certificate above this one is missing, usually the root certificate “{name}”. A fullchain without the root does not need it."
+    },
+    "passwordInput": {
+      "show": "Show password",
+      "hide": "Hide password"
     }
   },
   "tenderRadar": {

apps/web/src/messages/umlaut-dictionary.ts

@@ -250,4 +250,8 @@ export const UMLAUT_ALLOWLIST: readonly string[] = [
   'passendes',
   'Ausstellers',
   'vertrauen',
+  // quick-261009-ikt Task 4: Schlüssel und Anfragen zuordnen
+  'Passender',
+  'Passendes',
+  'Passende',
 ];