Step by step C# application with certificats|OPC UA Standard|Forum|OPC Foundation

The C# samples should automatically create any certificates they need when they start up.

Here is the documentation:

https://github.com/OPCFoundati.....ficates.md

All applications built with the NETStandard codebase can create their own certificate when they start (i.e. when CheckApplicationCertificate is called).

// check the application certificate.
bool haveAppCertificate = await application.CheckApplicationInstanceCertificate(
false, CertificateFactory.DefaultKeySize, CertificateFactory.DefaultLifeTime).ConfigureAwait(false);
if (!haveAppCertificate)
{
throw new Exception("Application instance certificate invalid!");
}

The location and contents of the auto-created certificate are specified in the configuration file.

<!-- Where the application instance certificate is stored (MachineDefault) -->
<ApplicationCertificate>
<StoreType>Directory</StoreType>
<StorePath>./pki/own</StorePath>
<SubjectName>CN=Quickstart Reference Server/DC=localhost</SubjectName>
</ApplicationCertificate>

The configuration file also specifies the location of the trust list as a directory on disk.

<!-- Where the issuer certificate are stored (certificate authorities) -->
<TrustedIssuerCertificates>
<StoreType>Directory</StoreType>
<StorePath>./pki/issuer</StorePath>
</TrustedIssuerCertificates>

<!-- Where the trust list is stored (UA Applications) -->
<TrustedPeerCertificates>
<StoreType>Directory</StoreType>
<StorePath>./pki/trusted</StorePath>
</TrustedPeerCertificates>

If client A wants to communicate with application B.

Then server B certificate must be copied to the trust list of client A (location in client A configuration file)

AND

Then client ! certificate must be copied to the trust list of server B (location in server A configuration file)

The rejected certificate folder stores untrusted certificates that allow an admin to review them before copying to the trust list. The location of the rejected folder is also in the configuration file.

<!-- The directory used to store invalid certficates for later review by the administrator. -->
<RejectedCertificateStore>
<StoreType>Directory</StoreType>
<StorePath>./pki/rejected</StorePath>
</RejectedCertificateStore>