Log In
Home
06/06/2022
Offline
I'm new to OPC UA Server and OPC Standards. I've go through the OPC Standards and downloaded the OPC UA Server sample application and executed it. I wanted to add security certificate and encryption to OPC UA Server. I can see that
application.CheckApplicationInstanceCertificate method is called and
config.CertificateValidator.CertificateValidation += CertificateValidator_CertificateValidation event is set. But still my client call connect to OPC UA Server without any certificates.
How can I enforce the server to make a connection only a valid certificate is available and is there a possibility to encrypt the messages using the certificate.
Help and guidance on above is highly appreciated. Thanks
05/30/2017
Offline
1) The GetEndpoints and FindServers calls always allow no-security. You need to explain what you mean by "connect".
2) You need to select the right EndpointDescription returned from GetEndpoints. If you select the No-Security Endpoint you will connect without security.
06/06/2022
Offline
Randy Armstrong said
1) The GetEndpoints and FindServers calls always allow no-security. You need to explain what you mean by "connect".2) You need to select the right EndpointDescription returned from GetEndpoints. If you select the No-Security Endpoint you will connect without security.
01) Connect means the connection between the OPC UA Server and the client.
02) I'll check the mentioned methods
Thanks Randy Armstrong. I'll check and get back.
06/06/2022
Offline
Hi Randy Armstrong,
Thanks for the information provided. It is really helpful.
I got a list of endpoints with the same URL with different SecurityModes. Is there a way to remove the nodes with SecurityMode = none and keep only the nodes with SecurityMode = SignAndEncrypt. rnI tried below code segment, but not sure it is the the correct way of doing it.
var endpoints = Mserver.GetEndpoints();i
if(endpoints.Any())
{
endpoints.ForEach(c => c.SecurityMode = MessageSecurityMode.SignAndEncrypt);
}
Basically I wanted to allow the UA Server to communicate or connect with only approved clients with a valid certificate with encryption details.
I'm using the UA Expert client browser and I have set thernrnsecurity policy = Aes256Sha256RsaPss ; message security mode = sign & encrypt.
And getting an error saying "Could not connect to server: BadTcpInternalError"
05/30/2017
Offline
Clients are expected to loop through the endpoints and pick the one that they want.
If you have no other criteria pick the one with the highest SecurityLevel.
If you Client does not support some SecurityPolicies you need to pick the highest SecurityLevel with a SecurityPolicyUri that the Client supports.
1 Guest(s)
Usage Policy