Client to server connection with certificates

[ampuEus]

Hello, a newbie user here.
This is my question

Setting:

• Cliente -> UaExpert
• Server -> server-with-encryption.py (User management with certificates #209)
• Certificates -> Example certificates (User management with certificates #209)

My objective:
I want to connect to the server by certificates

The problem:
When I temp to connect to the server this message appears:

The UaExpert setting that I am using for the connection are the following:

I already see #505 and #535 Q&A, but server.set_security_policy([ua.SecurityPolicyType.Basic256Sha256_SignAndEncrypt], permission_ruleset=SimpleRoleRuleset()) line is okay.

Any idea why that error happens?

[AndreasHeine]

your certificate does not match, like the error say you are using a example cert which might be outdated or does not match your application, typically you generate a unique key and cert for each application

and if i remember right certificate-example.der is for MessageSecurity and not for Authentification....

[ampuEus]

THANKS FOR YOUR ANSWER!!

I have checked my mess again . And now I use the "generate_certificate.sh" and "ssl.conf" to generate the 3 files ("my_cert.der", "my_cert.pem" and "my_private_key.pem") and I put this in user manager lines

cert_user_manager = CertificateUserManager()
await cert_user_manager.add_user("certificates/my_cert.der", name='test_user')
server = Server(user_manager=cert_user_manager)

this to load server certificate and private key

await server.load_certificate("certificates/my_cert.pem")
await server.load_private_key("certificates/my_private_key.pem")

and finally in the client part I put

But the error persist, any idea why? I'm a little lost where I have to put the certificates 😅

[MD-V]

Hello @ampuEus,

I think that you are mixing up application certificates and authentication certificates.

Application certificates are used in OPC UA for establishing secure channels between a client and a server.
1

Authentication certificates are used for authentication. 2

What are you trying to achieve? Establishing a secure connection or authenticating a user with a certificate?

[ampuEus]

Hi @MD-V,

My idea is to get both.
I thought that the "CertificateUserManager" was for the user log in / authentification and "server.load_certificate" and "server.load_private_key" to establish a secure communication

[ampuEus]

Hi again,
I already make an authentication using certificates with the UaExpert client, but it only works if I use the UaExpert default certification “uaexpert.der”, when I use a custom certification I have asyncua.ua.uaerrors._auto.BadUserAccessDenied error.
Any idea why?

The Server code is the next one:

[...]
    cert_user_manager = CertificateUserManager()
    await cert_user_manager.add_user("certificates/certificate-client.der", name='test_user')

    server = Server(user_manager=cert_user_manager)

    await server.init()

    server.set_endpoint("opc.tcp://0.0.0.0:4840/freeopcua/server/")
    server.set_security_policy([ua.SecurityPolicyType.Basic256Sha256_SignAndEncrypt],
                               permission_ruleset=SimpleRoleRuleset())
    # load server certificate and private key. This enables endpoints
    # with signing and encryption.
    await server.load_certificate("certificates/certificate.der")
    await server.load_private_key("certificates/key.pem")
[...]

The certificate generation file (".sh"):
I have used this file to create the server and client certificates by changing the names of .pem and .der

# Generate your own x509v3 Certificate
# Step 1: Create a private key for the certificate
openssl genrsa -out key.pem 2048

# Step 2: Change ssl.conf (subjectAltname, country, organizationName, ...)

# Step 3: Create the certificate (Public key) based in the ssl.conf file and the private key that was generated on Step 1
openssl req -x509 -days 365 -new -out certificate.pem -key key.pem -config ssl.conf

# Step 4: Pass the certificate file from ".pem" to ".der" for OPC UA comunication
# (https://reference.opcfoundation.org/v104/Core/docs/Part6/6.2.1/)
openssl x509 -outform der -in certificate.pem -out certificate.der

ssl.conf file:

[ req ]
default_bits = 2048
default_md = sha256
distinguished_name = subject
req_extensions = req_ext
x509_extensions = req_ext
string_mask = utf8only
prompt = no

[ req_ext ]
basicConstraints = CA:FALSE
nsCertType = client, server
keyUsage = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign
extendedKeyUsage= serverAuth, clientAuth
nsComment = "OpenSSL Generated Certificat"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
subjectAltName = URI:urn:example.org:FreeOpcUa:python-opcua,IP: 127.0.0.1

[ subject ]
countryName = EU
stateOrProvinceName = EU
localityName = EU
organizationName = Test
commonName = PythonOpcUaSecureClient