Is there something like an AutoAcceptUntrustedCertificates Flag ?

[johannwesely]

Hi,
we need the option to auto accept untrusted Certificates i built a method which checks the rejected folder for new files and copies them to the trusted folder but in this case the first time a client connects i still get "BadSecurityChecksFailed" and second dtime i connect it works. So i wonder if there is a possibility to set something like AutoAcceptUntrustedCertificates Flag in server config ?

Kind Regards
Johann

[kevinherron]

You can add something like this InsecureValidator but for the server instead: https://github.com/eclipse/milo/blob/cfb0aaa6ea5778d225fe7eabaf1c3bb73883293e/opc-ua-stack/stack-client/src/main/java/org/eclipse/milo/opcua/stack/client/security/ClientCertificateValidator.java#L29-L52

[johannwesely]

Hi Kevin, i dont know how to add something like InsecureValidator to server because in DefaultApplicationGroup the ServerCertificateValidator is Final could you give me an example how to achieve this ?

[kevinherron]

I didn't realize you were using the dev/1.0 branch. It looks like I need to add another constructor to DefaultApplicationGroup to allow it to be built with a custom validator.

[kevinherron]

@johannwesely not sure if this was ever that important to you, but WIP in #1317.

[kevinherron]

Setting up all the certificate-related stuff changed a little with these API changes, there is some example/test code that shows it, as well as this: https://github.com/digitalpetri/opc-ua-demo-server/blob/112c7164a763b0a747863c52102171c5cb6fac07/src/main/kotlin/com/digitalpetri/opcua/server/DemoServer.kt#L101-L164

[johannwesely]

Hi Kevin i have some problems while testing I configured our server to always trust incoming certificates and when i want to connect with UAExpert i get Error BadIdentityTokenInvalid i use the certs in C:\Users\jwesely\AppData\Roaming\unifiedautomation\uaexpert\PKI\own\certs to connect via certificate.

Here is my Server Configuration:

`private OpcUaServerConfig getServerConfigFromSetting(ILoggerService loggerService, String namespaceName) throws Exception {

		OpcUaServerConfig serverConfig = null;

		String namespaceUri;

		namespaceUri = configuration.getApplicationUri();


		File securityTempDir = new File(System.getProperty("java.io.tmpdir"), "security");
		if (!securityTempDir.exists() && !securityTempDir.mkdirs()) {
			throw new OpcUAConnectionException("unable to create security temp dir: " + securityTempDir);
		}
		loggerService.getLogger(getClass()).info("security temp dir: {}", securityTempDir.getAbsolutePath());

		KeyStoreLoader loader = new KeyStoreLoader().load(Path.of(configuration.getServerCertificate()), loggerService, namespaceUri);

		File pkiDir = securityTempDir.toPath().resolve("pki").toFile();
		TrustListManager trustListManager = FileBasedTrustListManager.createAndInitialize(pkiDir.toPath());
		loggerService.getLogger(getClass()).info("pki dir: {}", pkiDir.getAbsolutePath());

		var certificateQuarantine = FileBasedCertificateQuarantine.create(pkiDir.toPath().resolve("rejected").resolve("certs"));

		var certificateFactory = new RsaSha256CertificateFactory() {
			@Override
			protected KeyPair createRsaSha256KeyPair() {
				return loader.getServerKeyPair();
			}

			@Override
			protected X509Certificate[] createRsaSha256CertificateChain(KeyPair keyPair) {
				return loader.getServerCertificateChain();
			}
		};


		var certificateStore = KeyStoreCertificateStore.createAndInitialize(new KeyStoreCertificateStore.Settings(Path.of(configuration.getServerCertificate()), "password"::toCharArray, alias -> "password".toCharArray()));

		var certificateValidator = new DefaultServerCertificateValidator(trustListManager, certificateQuarantine);


		KeyPair httpsKeyPair = SelfSignedCertificateGenerator.generateRsaKeyPair(2048);


		UsernameIdentityValidator identityValidator = new UsernameIdentityValidator(configuration.isAnonymous(), authChallenge -> {
			String username = authChallenge.getUsername();
			String password = authChallenge.getPassword();

			for (Map.Entry<String, OpcUaPasswordAndUserType> entry : configuration.getIdentityValidator().entrySet()) {

				if (entry.getValue().isReadOnlyUser() && entry.getKey().equals(username) && entry.getValue().getPassword().equals(password)) {
					//standard user
					return true;
				} else if (entry.getValue().isAdminUser() && entry.getKey().equals(username) && entry.getValue().getPassword().equals(password)) {
					//admin user
					return true;
				}

			}
			//no matching user&password found
			return false;
		});

		CertificateValidator insecureCertificateValidator = new CertificateValidator() {


			@Override
			public void validateCertificateChain(List<X509Certificate> certificateChain, @Nullable String applicationUri, @Nullable String[] validHostnames) throws UaException {
				if (!certificateChain.isEmpty()) {
					X509Certificate certificate = certificateChain.get(0);

					loggerService.getLogger(this).debug("Skipping validation for certificate: {}", certificate.getSubjectX500Principal());
				}
			}
		};

		DefaultApplicationGroup defaultGroup;

		if (configuration.isAlwaysTrustCert()) {
			defaultGroup = DefaultApplicationGroup.createAndInitialize(trustListManager, certificateStore, certificateFactory, insecureCertificateValidator);
		} else {
			defaultGroup = DefaultApplicationGroup.createAndInitialize(trustListManager, certificateStore, certificateFactory, certificateValidator);
		}

		var certificateManager = new DefaultCertificateManager(certificateQuarantine, defaultGroup);


		X509Certificate certificate = loader.getServerCertificate();

		OpcUaServerLimits limits = new OpcUaServerLimits();
		limits.setMaxSessions(configuration.getMaxSessions());
		limits.setMaxNodesPerRead(configuration.getMaxNodesPerRead());
		limits.setMaxSubscriptions(configuration.getMaxSubscriptions());
		limits.setMaxSessionTimeout(configuration.getMaxSessionTimeout());
		limits.setMinSupportedSampleRate(configuration.getMinSupportedSampleRate());
		// The configured application URI must match the one in the certificate(s)
		String applicationUri = CertificateUtil.getSanUri(certificate).orElseThrow(() -> new UaRuntimeException(StatusCodes.Bad_ConfigurationError, "certificate is missing the application URI"));
		Set<EndpointConfig> endpointConfigurations = createEndpointConfigurations(certificate);
		serverConfig = OpcUaServerConfig.builder().setApplicationUri(applicationUri).setApplicationName(LocalizedText.english(configuration.getApplicationName())).setEndpoints(endpointConfigurations).setBuildInfo(new BuildInfo(namespaceUri, "ToxPressotechnik", "Tox OPCUA Server", OpcUaServer.SDK_VERSION, "", DateTime.now())).setCertificateManager(certificateManager).setIdentityValidator(identityValidator).setProductUri(namespaceUri).setLimits(limits).build();

		return serverConfig;

	}`

what am i doing wrong ? Im also not so familiar with Certificate Validation. Thanks in Advance Johann

[kevinherron]

You are conflating application instance certificates, which are used to identify an OPC UA application and secure communications, with X509 certificates used to authenticate a Session user.

CertificateValidator is not used at all for this.

You would need to configure a CompositeValidator that included an X509IdentityValidator as well as advertise in your EndpointConfigs that you support a X509 identity policy.

[johannwesely]

Ah ok thank you for the clarification. But how do i generate x509 certificates used to authenticate a Session User ? Right now in my GUI OpcUa Server Setup i can add as many Users with Password i want. Now when i want to connect with Session user authentication with certificate i need a x509certificate for every user/password. How can i generate them ?

[kevinherron]

The spec has basically nothing to say about the certificates used for X509 user identity, so the SDK offers you no help in generating or validating them.

If you want to use that kind of authentication you need to know how to generate and validate them, which is why the X509IdentityValidator implementation is built with just a Predicate that you use to signal yes/no for a given certificate.

[johannwesely]

So in the case of CTT Testing i just validate against the copied x509UserIdentity Certificates i copied to the folder you mentioned in #1283 ?

[kevinherron]

Yes I suppose so. I've never set that up for testing. It looks like the CTT is expecting some amount of validation from you, though.

[kevinherron]

Looking at this, I can see might help if CertificateValidationUtil had another method on it for validating the cert path of a user certificate, as opposed to an application instance certificate, or if there was a separate utility all together. The basic checks are the same because these are all X509 certificates, but user certificates do not need the same key usage etc... checks applied to them (unless that's an application/implementation requirement).

[kevinherron]

User certificate requirements: https://reference.opcfoundation.org/Core/Part6/v105/docs/6.2.3