Encoding a chain of certificates in ByteString data type|OPC UA Standard|Forum|OPC Foundation

Avatar
Search
Forum Scope


Match



Forum Options



Minimum search word length is 3 characters - maximum search word length is 84 characters
Lost password?
sp_Feed sp_PrintTopic sp_TopicIcon
Encoding a chain of certificates in ByteString data type
Avatar
Phuong Nguyen
Member
Members
Forum Posts: 16
Member Since:
11/22/2018
sp_UserOfflineSmall Offline
1
06/28/2022 - 03:35
sp_Permalink sp_Print

IMHO there seems to be an inconsistency in encoding of a chain of certificates in "OPC UA part 12 v1.04"

  • "Section 7.5.5 AddCertificate" specifies a method of TrustList Type to allow a client to add a single certificate to a Trust List. It is there stated that "If the Certificate is issued by a CA then the Client shall provide the entire chain in the certificate argument". In this case a chain of certificates is passed as a single ByteString to the method.
  • "Section 7.7.4 UpdateCertificate" specifies a method of ServerConfiguration Type to allow a client to update a certificate to a server. This method accepts issuer certificates as an array of ByteString. These issuer certificates are needed for verification of the certificate to update and hence can also contain a chain of certificates e.g., in multi-level PKI.

My question here is what should be the expected way to encapsulate a chain of certificates from OPC UA's perspective? A chain per single ByteString variant or by means of an array of ByteString variants? Or both of them are accepted?

Thanks!

Avatar
Randy Armstrong
Admin
Forum Posts: 1455
Member Since:
05/30/2017
sp_UserOfflineSmall Offline
2
07/01/2022 - 04:20
sp_Permalink sp_Print sp_EditHistory

Yes there are inconsistencies because some APIs were rewritten before the need for a chain was identified.

The specification allows a chain to be sent in any ByteString that contains a Certificate.

That said, with UpdateCertificate you should not want to do that since a separate issuers array is specified.

Forum Timezone: America/Phoenix
Most Users Ever Online: 510
Currently Online:
Guest(s) 18
Currently Browsing this Page:
1 Guest(s)
Top Posters:
Forum Stats:
Groups: 2
Forums: 10
Topics: 1353
Posts: 4587