Details on UACTT test about certificate verification|OPC Certification and Interoperability Testing|Forum|OPC Foundation

Hi,

all the test cases in the Security Certificate Validation conformance unit are based on the Certificate Validation Steps table in section 6.1.3 Determining if a Certificate is Trusted. This test case in particular is also based on the following text snipped from this section:

Building a trust chain requires access to all Certificates in the chain. These Certificates may be stored locally or they may be provided with the application Certificate. Processing fails with Bad_SecurityChecksFailed if a CA Certificate cannot be found.

Lets recap what the idea is behind this and assume we do have the following CA structure:
Company wide root: rootCA
Facility wide which are issued by the company wide (rootCA): secondaryCA
application instance cert which are issued by the facility wide (secondaryCA): issuedCert.

Our goal is to accept all certificates from applications which do belong in our facility. That means every certificate issued by the secondaryCA needs to be trusted, but we do not want to trust certificates from any facility belonging to our company.

As the specification requires an OPC UA server to always check the whole certificate chain, the certificates from all CA levels are required to be available to the server. When there is only one trusted folder that would mean that the rootCA needs to be placed in the trusted folder. Now that has the bad effect, that all certificates that have been issued by the rootCA are automatically trusted. But in our scenario we do have a company wide rootCA and a secondaryCA which is only valid in a specific facility. So we actually would only like to trust all certificates issued by the secondaryCA. So that would require us to only copy the secondaryCA certificate in our trust list. But as the specification snipped provided above is requiring the server to validate all certificates in the chain, it wouldn’t be able to validate the rootCA as it is not available to the server any more. After all this means that there needs to be a different location where those CA certificates which are required to validate the chain are being placed which is not in the trust list. In many servers this folder is being called “issuers”.

I hope this helps,
Alexander Allmendinger