Log In
Home
12/15/2020
Offline
Hi,
Could you please help me on the certificate expiry. We have followed the folder structure as per the standards and CTT tests.
When OPC server starts - pki folder structure is created and our DA server certificate will create automatically and will save in the "OWN" folder and "trusted" folder.
Question is when OPC DA certificate expires after 1 year - i have the below questions
- Is it mandatory to restart the OPC Server application to regenerate the new certificates from the stack?
- Do we need to delete the certificate from the "OWN" folder after the expiry and then restart if it is mandatory?
- How can we test the expiry of the certificate (if we change the system time and date intentionally will it work? hope it will give us error stating "Bad certificate time invalid"?)
Please help us to answer to these question to go forward. Thank you.
Regards,
Vinod Pydi
Moderators
Moderators-Specifications
Moderators-Companion
Moderators-Implementation
Moderators-Certification
Moderators-ProductsServices
07/11/2017
Offline
Hi Vinod,
the answers to your question regarding the certificates rather depend on your product strategy and less on the OPC UA standard. How you generate new certificates is up to the application. You can generate new ones by deleting the files and restarting the application, you can provide status notification about the expiration and ask for user input to generate and exchange them or you can use the certificate management interfaces describe in the Global Services OPC UA specification (Part 12).
In general from my experience automatically exchanging the certificates by create new ones without interaction with the operator of the application can cause problems. Clients will loose their connections to the server and will need to be reconfigured. If this happens without warnings beforehand the operator may end up with unexpected down-times of his systems.
From that point of view I would suggest to:
1. Provide warnings to the operator already before the certificate expires
2. Continue to use the expired certificate until the operator tells the application to create a new certificate or does configure a newer one they generated themselves
Of course this will require a certificate management user interface and ideally the support of the certificate management interface of OPC UA to centralize these activities by the operator.
Regarding your other questions, I can't really answer them. Whether you will need to delete the old certificates depend on the your applications certificate management. Some will use certificates with certain file names other load the certificate based on the Thumbprint and others use the currently valid certificate with a desired Subject Name. You'll need to check how your application loads the certificate or get in contact with the developers of the SDK/Toolkit your are using.
Regards,
Alexander Allmendinger
1 Guest(s)
Usage Policy