How to reuse already trusted certificate in .NET OPC UA client|OPC UA Standard|Forum|OPC Foundation

Avatar
Search
Forum Scope


Match



Forum Options



Minimum search word length is 3 characters - maximum search word length is 84 characters
Lost password?
sp_Feed sp_PrintTopic sp_TopicIcon
How to reuse already trusted certificate in .NET OPC UA client
Avatar
Benjamin Hodzic_1
Member
Members
Forum Posts: 3
Member Since:
06/22/2023
sp_UserOfflineSmall Offline
1
08/27/2024 - 01:54
sp_Permalink sp_Print sp_EditHistory

The .NET client, when restarted, fails to establish the connection. I think it fails to find the certificate which is already trusted in the store. (The certificate is already trusted by the server)
Here are the code screenshots:

View post on imgur.com

View post on imgur.com

Any help with this? Error establishing a connection: Error received from remote host: BadSecurityCheecksFailed

Avatar
Randy Armstrong
Admin
Forum Posts: 1559
Member Since:
05/30/2017
sp_UserOfflineSmall Offline
2
08/28/2024 - 03:07
sp_Permalink sp_Print

BadSecurityCheecksFailed = check the server logs for the actual error. (error suppressed to reduce info hackers can use).

Avatar
Benjamin Hodzic
New Member
Members
Forum Posts: 1
Member Since:
01/30/2023
sp_UserOfflineSmall Offline
3
08/29/2024 - 01:07
sp_Permalink sp_Print

It says the cert has to be trusted. I do that manually but the client doesn't know when it got trusted. Is there an event handler or something similar?

Avatar
Randy Armstrong
Admin
Forum Posts: 1559
Member Since:
05/30/2017
sp_UserOfflineSmall Offline
4
08/30/2024 - 02:24
sp_Permalink sp_Print

If it is coming from the Server then the Server needs to be told to trust the Client certificate.

The client then has to trust the Server certificate in separate step.

Code to manage certificates on  the client side is here:

https://github.com/OPCFoundati.....AClient.cs

Avatar
Robbie Demaegdt
Member
Members
Forum Posts: 5
Member Since:
09/02/2024
sp_UserOfflineSmall Offline
5
09/02/2024 - 06:26
sp_Permalink sp_Print

I tried changing the code like that example but it's still not working.

So let me explain the usecase.

I have a client which creates his own certificate I think through the OPC Nuget code.

It tries to connect to the server with that cert and it get auto rejected, my client immediatly gets a validation error: BadCertificateUntrusted back.

When I manually trust the cert on the server side, my client isn't getting any feedback from the server about this, I suspected that the same eventhandler would than say something like Cert Trusted.

I did add the e.Accept = true in the eventhandler but that didn't change anything.

 

The other problem is when I try to connect again it (the client) recreates a new certificate and not reusing the previous (manual trusted) certification, which I think could also potentially solve the previous issue.

Avatar
Randy Armstrong
Admin
Forum Posts: 1559
Member Since:
05/30/2017
sp_UserOfflineSmall Offline
6
09/03/2024 - 11:20
sp_Permalink sp_Print

If the client is creating a new certificate each time there is something wrong with configuration.

i.e. the client configuration does not allow it to find the previously created certificate.

you may need to debug
var certOK = application.CheckApplicationInstanceCertificate(false, 0).Result;

To figure what is wrong in configuration.

Avatar
Robbie Demaegdt
Member
Members
Forum Posts: 5
Member Since:
09/02/2024
sp_UserOfflineSmall Offline
7
09/05/2024 - 06:03
sp_Permalink sp_Print

The call returns True, does this means that the certificate is good?

Avatar
Patrick de Kuijer
New Member
Members
Forum Posts: 1
Member Since:
09/06/2024
sp_UserOfflineSmall Offline
8
09/06/2024 - 04:33
sp_Permalink sp_Print

I'm facing the same issue. in some way, when supplying a new CertificateIdentifier with an existing trusted certificate keeps giving errors.

var cert = new X509Certificate2(certificateLocation);
var cid = new CertificateIdentifier(cert);

it keeps creating new instances of the certificate instead of reusing an existing one.

 

Any progress on the previous replies?

Avatar
Randy Armstrong
Admin
Forum Posts: 1559
Member Since:
05/30/2017
sp_UserOfflineSmall Offline
9
09/06/2024 - 08:09
sp_Permalink sp_Print

Certificates are re-created if there is a mismatch between configuration and the certificate.

Set application.DisableCertificateAutoCreation = true;

To stop this from happening.

However, if there is a mismatch you will not have a certificate.

There appear to be a lot of log messages in the code in:

https://github.com/OPCFoundati.....ce.cs#L437

So please turn on logging.

Avatar
Robbie Demaegdt
Member
Members
Forum Posts: 5
Member Since:
09/02/2024
sp_UserOfflineSmall Offline
10
09/09/2024 - 04:52
sp_Permalink sp_Print sp_EditHistory

I tried the disablecertificateautocreation true and indeed it doesn't do anything now.

But it threw an exception:

[Image Can Not Be Found]

(Added an extra comment because I'm not sure if my pictures are working)

Exception: Opc.Ua.ServiceResultException: There is no cert... with subject... in the configuration.

Please generate a cert for you application,

then copy the new cert to this location:

C:\Skyline DataMiner\Documents\own

 

But in that directory I have 2 folders (certs and private) with some files but no files in the "own" folder.

[Image Can Not Be Found]

[Image Can Not Be Found]

[Image Can Not Be Found]

Any idea why it would not fine the correct certificate, I tried putting it in the own directory but got the same exception logging.

Avatar
Randy Armstrong
Admin
Forum Posts: 1559
Member Since:
05/30/2017
sp_UserOfflineSmall Offline
11
09/09/2024 - 07:37
sp_Permalink sp_Print

There is no cert... with subject... in the configuration.

mean the SubjectName in the configuration does not match the certificate in the directory

What is the SubjectName in the configuration ?

Avatar
Robbie Demaegdt
Member
Members
Forum Posts: 5
Member Since:
09/02/2024
sp_UserOfflineSmall Offline
12
09/10/2024 - 23:58
sp_Permalink sp_Print

The issue is resolved, it was because of the name of the certificate, when changing to a more normal text it was fixed.

I do get another issue now: Baduseraccessdenied but still have to investigate if this is a configuration issue on the server or not.

Avatar
Randy Armstrong
Admin
Forum Posts: 1559
Member Since:
05/30/2017
sp_UserOfflineSmall Offline
13
09/11/2024 - 20:37
sp_Permalink sp_Print

Check the value of UserIdentity that you are providing to the ActivateSession call.

This identity must be accepted by the Server.

Avatar
Robbie Demaegdt
Member
Members
Forum Posts: 5
Member Since:
09/02/2024
sp_UserOfflineSmall Offline
14
09/20/2024 - 00:59
sp_Permalink sp_Print

Thanks for all the help Randy, I managed to have my client to connect to the server.

Forum Timezone: America/Phoenix
Most Users Ever Online: 510
Currently Online:
Guest(s) 57
Currently Browsing this Page:
1 Guest(s)
Top Posters:
Forum Stats:
Groups: 2
Forums: 10
Topics: 1426
Posts: 4836