Hi,

Note: The Kepware UA Server is running on a remote server. I could see the certificate on the local computer. I used the UA Configuration on the local computer, I have deleted the certificate on the local computer and saw it created again after I started my program.

On the Kepware server computer I couldn't see the certificate on the UA Configuration tool... I tried to export it and import it to the server computer, but my UA client keeps failing browsing. See the attached screen capture and the exception error below.
In Kepware server I don't see my certificate. It was not rejected by the Kepware server...

Please advise.

Thank you.

Michael

Exceptions

Type: OpcLabs.BaseLib.Browsing.BrowseException
Data:
HelpLink:
HResult: -2146233088 (0x80131500)
InnerException:
OpcLabs.EasyOpc.UA.Engine.UAEngineException: UA SDK error (Opc.UA.ServiceResult=0x801A0000) in 'static Session.Create'. OPC UA service result - {BadCertificateUntrusted}. The certificate is not trusted.
+ Connection attempt #1; last connected at 01/01/0001 00:00:00 (local); unconnected for 00:00:00.1560000.
+ One reason for this error could be that the server certificate is not trusted by the client. The error can be resolved by properly configuring the certificate trusts. For development and testing purposes, or if your application does not require the server certificate check, you can set EasyUAClient.EngineParameters.CertificateAcceptancePolicy.AcceptAnyCertificate = true in your application to bypass the server certificate check on the client side, or (a bit safer), include the endpoint URL of your server in EasyUAClient.SharedParameters.EngineParameters.CertificateAcceptancePolicy.TrustedEndpointUrlStrings list.
+ The client method called (or event/callback invoked) was 'BrowseMultiple[1]'. ---> OpcLabs.EasyOpc.UA.UAServiceException: OPC UA service result - {BadCertificateUntrusted}. The certificate is not trusted.
--> {BadCertificateUntrusted}. Self Signed Certificate is not trusted.
IssuerName: CN=KEPServerEX/UA Server, O=Unknown, C=US, DC=DESKTOP-AUPBJMQ.
--- End of inner exception stack trace ---
Activity Trace:
Following (6) events were gathered during the action on activity ID [19], in the order of first occurrence:
3*Exception: {Opc.Ua.ServiceResultException} Self Signed Certificate is not trusted. IssuerName: CN=KEPServerEX/UA Server, O=Unknown, C=US, DC=DESKTOP-AUPBJMQ
Exception: {System.InvalidOperationException} Cannot see if a key has been pressed when either application does not have a console or when console input has been redirected from a file. Try Console.In.Peek.
SDK trace: Certificate 'CN=KEPServerEX/UA Server, O=Unknown, C=US, DC=DESKTOP-AUPBJMQ' rejected. Reason=BadCertificateUntrusted
SDK trace: Writing rejected certificate to directory: [Directory]%CommonApplicationData%\OPC Foundation\CertificateStores\RejectedCertificates

Data:
ErrorId_{045406CD-8EEA-4F21-B3D6-DC9DB5A34E58}: OpcLabs.UAEngine=1
7b4d9f28-22a8-41d6-93ea-e4d8c2a75da8:
((19, 1), System.Runtime.ExceptionServices.FirstChanceExceptionEventArgs)
((19, 1), System.Runtime.ExceptionServices.FirstChanceExceptionEventArgs)
((19, 1), Opc.Ua.TraceEventArgs)
((19, 1), Opc.Ua.TraceEventArgs)
((19, 1), System.Runtime.ExceptionServices.FirstChanceExceptionEventArgs)
((19, 1), System.Runtime.ExceptionServices.FirstChanceExceptionEventArgs)
c3c0e69e-bf8f-4bfa-8e93-816783737e55: 19
8970fe52-aaa4-40f7-9a6e-74cdcee56724: static Session.Create
OpcLabs.EasyOpc.UA.Implementation.ErrorEnhancingEasyUAClient.Processed: True
Error Code: 1
HelpLink:
HResult: -2146232832 (0x80131600)
InnerException:
OpcLabs.EasyOpc.UA.UAServiceException: OPC UA service result - {BadCertificateUntrusted}. The certificate is not trusted.
--> {BadCertificateUntrusted}. Self Signed Certificate is not trusted.
IssuerName: CN=KEPServerEX/UA Server, O=Unknown, C=US, DC=DESKTOP-AUPBJMQ.
Data:
ErrorId_{045406CD-8EEA-4F21-B3D6-DC9DB5A34E58}: Opc.UA.ServiceResult=0x801A0000
OpcLabs.EasyOpc.UA.Implementation.ErrorEnhancingEasyUAClient.Processed: True
Help Link:
HResult: -2146232832 (0x80131600)
InnerException:
Internal Code: 2149187584
Message:
OPC UA service result - {BadCertificateUntrusted}. The certificate is not trusted.
--> {BadCertificateUntrusted}. Self Signed Certificate is not trusted.
IssuerName: CN=KEPServerEX/UA Server, O=Unknown, C=US, DC=DESKTOP-AUPBJMQ.
Service Result: BadCertificateUntrusted
Additional Info:
Description:
Inner Result: BadCertificateUntrusted
Additional Info:
>>> Self Signed Certificate is not trusted.
IssuerName: CN=KEPServerEX/UA Server, O=Unknown, C=US, DC=DESKTOP-AUPBJMQ
--- at Opc.Ua.CertificateValidator.GetIssuersWithChainSupportEnabled(X509Certificate2Collection certificates, List`1 issuers)
--- at Opc.Ua.CertificateValidator.InternalValidateWithChainSupportEnabled(X509Certificate2Collection certificates)
--- at Opc.Ua.CertificateValidator.Validate(X509Certificate2Collection chain)
Description:
Self Signed Certificate is not trusted.
IssuerName: CN=KEPServerEX/UA Server, O=Unknown, C=US, DC=DESKTOP-AUPBJMQ
Inner Result:
Message:
Self Signed Certificate is not trusted.
IssuerName: CN=KEPServerEX/UA Server, O=Unknown, C=US, DC=DESKTOP-AUPBJMQ.
Qualified Symbolic ID:
Expanded Text:
Is Null: True
Is Standard: True
Name:
Namespace Index: 0
Namespace URI:
Namespace URI String:
Standard Name:
Status Code: BadCertificateUntrusted
Code Bits: 32794
Code Bits Symbol: BadCertificateUntrusted
Condition: 26
Description: The certificate is not trusted.
Flag Bits: 0
Has Data Value Info: False
Info Type: NotUsed
Internal Value: 2149187584
Is Bad: True
Is Good: False
Is Uncertain: False
Limit Info: None
Overflow: False
Semantics Changed: False
Severity: BadOrFailure
Status Info: Error
Structure Changed: False
Text:
{BadCertificateUntrusted}. Self Signed Certificate is not trusted.
IssuerName: CN=KEPServerEX/UA Server, O=Unknown, C=US, DC=DESKTOP-AUPBJMQ.
Message: The certificate is not trusted.
Qualified Symbolic ID:
Expanded Text:
Is Null: True
Is Standard: True
Name:
Namespace Index: 0
Namespace URI:
Namespace URI String:
Standard Name:
Status Code: BadCertificateUntrusted
Code Bits: 32794
Code Bits Symbol: BadCertificateUntrusted
Condition: 26
Description: The certificate is not trusted.
Flag Bits: 0
Has Data Value Info: False
Info Type: NotUsed
Internal Value: 2149187584
Is Bad: True
Is Good: False
Is Uncertain: False
Limit Info: None
Overflow: False
Semantics Changed: False
Severity: BadOrFailure
Status Info: Error
Structure Changed: False
Text:
{BadCertificateUntrusted}. The certificate is not trusted.
--> {BadCertificateUntrusted}. Self Signed Certificate is not trusted.
IssuerName: CN=KEPServerEX/UA Server, O=Unknown, C=US, DC=DESKTOP-AUPBJMQ.
Service Target Site: Void Validate(System.Security.Cryptography.X509Certificates.X509Certificate2Collection)
DeclaringType: Opc.Ua.CertificateValidator
Module: Opc.Ua.Core.dll
Assembly: Opc.Ua.Core, Version=1.3.342.0, Culture=neutral, PublicKeyToken=6faddca41dacb409
CustomAttributes:
FullyQualifiedName: C:\Program Files (x86)\Control-See\EBO-OPC Client\BIN\Opc.Ua.Core.dll
MDStreamVersion: 131072
MetadataToken: 1
ModuleHandle: System.ModuleHandle
MDStreamVersion: 131072
ModuleVersionId: de76a6af-12bb-481b-8ef7-2df5f7a00d0a
Name: Opc.Ua.Core.dll
ScopeName: Opc.Ua.Core.dll
Source: Opc.Ua.Core
Stack Trace:
at Opc.Ua.CertificateValidator.Validate(X509Certificate2Collection chain)
at OpcLabs.EasyOpc.UA.Toolkit.Sdk.ToolkitCertificateValidator.Validate(X509Certificate2Collection chain)
at Opc.Ua.Client.Session.Open(String sessionName, UInt32 sessionTimeout, IUserIdentity identity, IList`1 preferredLocales, Boolean checkDomain)
at OpcLabs.EasyOpc.UA.Sdk.Shims.SessionShim.Create(ApplicationConfiguration configuration, ConfiguredEndpoint endpoint, Boolean updateBeforeConnect, Boolean checkDomain, String sessionName, UInt32 millisecondsSessionTimeout, Func`2 identityFunction, IList`1 preferredLocales, Action`2 domainCheckError, Action`1 setupSession, Action`1 setupTransportChannel)
at OpcLabs.EasyOpc.UA.Toolkit.Sdk.ToolkitSession.Create(ApplicationConfiguration configuration, ConfiguredEndpoint endpoint, Boolean updateBeforeConnect, Boolean checkDomain, String sessionName, UInt32 millisecondsSessionTimeout, Func`2 identityFunction, IList`1 preferredLocales, Action`2 domainCheckError, Action`1 setupTransportChannel, UAClientSessionBase clientSession)
at OpcLabs.EasyOpc.UA.Toolkit.Client.UAClientSessionBase.<>c__DisplayClass144_0.<CreateSdkSession>b__2()
at OpcLabs.EasyOpc.UA.Toolkit.UAEngineBase.PerformSdkAction(UASdkCallType callType, Func`1 usingFunction, String name, Action sdkAction)
TargetSite:
Message:
UA SDK error (Opc.UA.ServiceResult=0x801A0000) in 'static Session.Create'. OPC UA service result - {BadCertificateUntrusted}. The certificate is not trusted.
+ Connection attempt #1; last connected at 01/01/0001 00:00:00 (local); unconnected for 00:00:00.1560000.
+ One reason for this error could be that the server certificate is not trusted by the client. The error can be resolved by properly configuring the certificate trusts. For development and testing purposes, or if your application does not require the server certificate check, you can set EasyUAClient.EngineParameters.CertificateAcceptancePolicy.AcceptAnyCertificate = true in your application to bypass the server certificate check on the client side, or (a bit safer), include the endpoint URL of your server in EasyUAClient.SharedParameters.EngineParameters.CertificateAcceptancePolicy.TrustedEndpointUrlStrings list.
+ The client method called (or event/callback invoked) was 'BrowseMultiple[1]'.
Source:
Stack Trace:
== Activity Trace ==
Following (6) events were gathered during the action on activity ID [19], in the order of first occurrence:
3*Exception: {Opc.Ua.ServiceResultException} Self Signed Certificate is not trusted. IssuerName: CN=KEPServerEX/UA Server, O=Unknown, C=US, DC=DESKTOP-AUPBJMQ
Exception: {System.InvalidOperationException} Cannot see if a key has been pressed when either application does not have a console or when console input has been redirected from a file. Try Console.In.Peek.
SDK trace: Certificate 'CN=KEPServerEX/UA Server, O=Unknown, C=US, DC=DESKTOP-AUPBJMQ' rejected. Reason=BadCertificateUntrusted
SDK trace: Writing rejected certificate to directory: [Directory]%CommonApplicationData%\OPC Foundation\CertificateStores\RejectedCertificates

TargetSite:
Message: Problem browsing OPC Unified Architecture nodes.
Source:
StackTrace:
TargetSite:

So can you explain what should I do?

Thanks

Hi,

Thank you. Should I use the "Create Certificate Authority" option?

Michael

Hi,
Our customer is getting the attached error/exception. Any idea what is the problem?
The customer is able to browse using UA Expert.

Exceptions

Type: OpcLabs.BaseLib.Browsing.BrowseException
Data:
HelpLink:
HResult: -2146233088 (0x80131500)
InnerException:
OpcLabs.EasyOpc.UA.Engine.UAEngineException: UA SDK error (Opc.UA.ServiceResult=0x801A0000) in 'ApplicationInstance.CheckApplicationInstanceCertificate'. OPC UA service result - {BadCertificateUntrusted}. The certificate is not trusted.
+ The error occurred while creating or checking the (client) application instance certificate. Check event log entries for errors and warnings.
+ Suggestion: Check the trusted peers certificate store for the presence of the application instance certificate. This error can happen if the instance certificate is in the application instance store, but not in the trusted peers certificate store.
+ The certificate generator path was "C:\Program Files (x86)\Control-See\EBO-OPC Client\BIN\Opc.Ua.CertificateGenerator.exe".
+ This is an engine-level error. It is unrelated to any specific target server connection.
+ Connection attempt #1; last connected at 01/01/0001 00:00:00 (local); unconnected for 00:00:00.
+ The client method called (or event/callback invoked) was 'BrowseMultiple[1]'. ---> OpcLabs.EasyOpc.UA.UAServiceException: OPC UA service result - {BadCertificateUntrusted}. The certificate is not trusted.
--> {BadCertificateUntrusted}. Self Signed Certificate is not trusted.
IssuerName: CN=EBO-OPC Client Configuration, DC=LP-PC.
--- End of inner exception stack trace ---
Activity Trace:
Following (6) events were gathered during the action on activity ID [21], in the order of first occurrence:
SDK trace: Checking application instance certificate.
SDK trace: Checking application instance certificate. CN=EBO-OPC Client Configuration, DC=LP-PC
2*Exception: {Opc.Ua.ServiceResultException} Self Signed Certificate is not trusted. IssuerName: CN=EBO-OPC Client Configuration, DC=LP-PC
SDK trace: Certificate 'CN=EBO-OPC Client Configuration, DC=LP-PC' rejected. Reason=BadCertificateUntrusted
SDK trace: Writing rejected certificate to directory: [Directory]%CommonApplicationData%\OPC Foundation\CertificateStores\RejectedCertificates

Data:
ErrorId_{045406CD-8EEA-4F21-B3D6-DC9DB5A34E58}: OpcLabs.UAEngine=1
7b4d9f28-22a8-41d6-93ea-e4d8c2a75da8:
((21, 1), Opc.Ua.TraceEventArgs)
((21, 1), Opc.Ua.TraceEventArgs)
((21, 1), System.Runtime.ExceptionServices.FirstChanceExceptionEventArgs)
((21, 1), Opc.Ua.TraceEventArgs)
((21, 1), Opc.Ua.TraceEventArgs)
((21, 1), System.Runtime.ExceptionServices.FirstChanceExceptionEventArgs)
c3c0e69e-bf8f-4bfa-8e93-816783737e55: 21
8970fe52-aaa4-40f7-9a6e-74cdcee56724: ApplicationInstance.CheckApplicationInstanceCertificate
ef601440-74b8-42b7-a72f-9bd0ce097422: True
OpcLabs.EasyOpc.UA.Implementation.ErrorEnhancingEasyUAClient.Processed: True
Error Code: 1
HelpLink:
HResult: -2146232832 (0x80131600)
InnerException:
OpcLabs.EasyOpc.UA.UAServiceException: OPC UA service result - {BadCertificateUntrusted}. The certificate is not trusted.
--> {BadCertificateUntrusted}. Self Signed Certificate is not trusted.
IssuerName: CN=EBO-OPC Client Configuration, DC=LP-PC.
Data:
ErrorId_{045406CD-8EEA-4F21-B3D6-DC9DB5A34E58}: Opc.UA.ServiceResult=0x801A0000
OpcLabs.EasyOpc.UA.Implementation.ErrorEnhancingEasyUAClient.Processed: True
Help Link:
HResult: -2146232832 (0x80131600)
InnerException:
Internal Code: 2149187584
Message:
OPC UA service result - {BadCertificateUntrusted}. The certificate is not trusted.
--> {BadCertificateUntrusted}. Self Signed Certificate is not trusted.
IssuerName: CN=EBO-OPC Client Configuration, DC=LP-PC.
Service Result: BadCertificateUntrusted
Additional Info:
Description:
Inner Result: BadCertificateUntrusted
Additional Info:
>>> Self Signed Certificate is not trusted.
IssuerName: CN=EBO-OPC Client Configuration, DC=LP-PC
--- at Opc.Ua.CertificateValidator.GetIssuersWithChainSupportEnabled(X509Certificate2Collection certificates, List`1 issuers)
--- at Opc.Ua.CertificateValidator.InternalValidateWithChainSupportEnabled(X509Certificate2Collection certificates)
--- at Opc.Ua.CertificateValidator.Validate(X509Certificate2Collection chain)
Description:
Self Signed Certificate is not trusted.
IssuerName: CN=EBO-OPC Client Configuration, DC=LP-PC
Inner Result:
Message:
Self Signed Certificate is not trusted.
IssuerName: CN=EBO-OPC Client Configuration, DC=LP-PC.
Qualified Symbolic ID:
Expanded Text:
Is Null: True
Is Standard: True
Name:
Namespace Index: 0
Namespace URI:
Namespace URI String:
Standard Name:
Status Code: BadCertificateUntrusted
Code Bits: 32794
Code Bits Symbol: BadCertificateUntrusted
Condition: 26
Description: The certificate is not trusted.
Flag Bits: 0
Has Data Value Info: False
Info Type: NotUsed
Internal Value: 2149187584
Is Bad: True
Is Good: False
Is Uncertain: False
Limit Info: None
Overflow: False
Semantics Changed: False
Severity: BadOrFailure
Status Info: Error
Structure Changed: False
Text:
{BadCertificateUntrusted}. Self Signed Certificate is not trusted.
IssuerName: CN=EBO-OPC Client Configuration, DC=LP-PC.
Message: The certificate is not trusted.
Qualified Symbolic ID:
Expanded Text:
Is Null: True
Is Standard: True
Name:
Namespace Index: 0
Namespace URI:
Namespace URI String:
Standard Name:
Status Code: BadCertificateUntrusted
Code Bits: 32794
Code Bits Symbol: BadCertificateUntrusted
Condition: 26
Description: The certificate is not trusted.
Flag Bits: 0
Has Data Value Info: False
Info Type: NotUsed
Internal Value: 2149187584
Is Bad: True
Is Good: False
Is Uncertain: False
Limit Info: None
Overflow: False
Semantics Changed: False
Severity: BadOrFailure
Status Info: Error
Structure Changed: False
Text:
{BadCertificateUntrusted}. The certificate is not trusted.
--> {BadCertificateUntrusted}. Self Signed Certificate is not trusted.
IssuerName: CN=EBO-OPC Client Configuration, DC=LP-PC.
Service Target Site: Void Validate(System.Security.Cryptography.X509Certificates.X509Certificate2Collection)
DeclaringType: Opc.Ua.CertificateValidator
Module: Opc.Ua.Core.dll
Assembly: Opc.Ua.Core, Version=1.3.342.0, Culture=neutral, PublicKeyToken=6faddca41dacb409
CustomAttributes:
FullyQualifiedName: C:\Program Files (x86)\Control-See\EBO-OPC Client\BIN\Opc.Ua.Core.dll
MDStreamVersion: 131072
MetadataToken: 1
ModuleHandle: System.ModuleHandle
MDStreamVersion: 131072
ModuleVersionId: de76a6af-12bb-481b-8ef7-2df5f7a00d0a
Name: Opc.Ua.Core.dll
ScopeName: Opc.Ua.Core.dll
Source: Opc.Ua.Core
Stack Trace:
at Opc.Ua.CertificateValidator.Validate(X509Certificate2Collection chain)
at OpcLabs.EasyOpc.UA.Toolkit.Sdk.ToolkitCertificateValidator.Validate(X509Certificate2Collection chain)
at Opc.Ua.CertificateValidator.Validate(X509Certificate2 certificate)
at OpcLabs.EasyOpc.UA.Toolkit.Sdk.ToolkitCertificateValidator.Validate(X509Certificate2 certificate)
at Opc.Ua.Configuration.ApplicationInstance.CheckApplicationInstanceCertificate(ApplicationConfiguration configuration, X509Certificate2 certificate, Boolean silent, UInt16 minimumKeySize)
at Opc.Ua.Configuration.ApplicationInstance.CheckApplicationInstanceCertificate(Boolean silent, UInt16 minimumKeySize)
at OpcLabs.EasyOpc.UA.Toolkit.ClientServer.UAClientServerEngineBase.<>c__DisplayClass61_0.<ValidateOrCreateClientCertificate>b__2()
at OpcLabs.EasyOpc.UA.Toolkit.UAEngineBase.PerformSdkAction(UASdkCallType callType, Func`1 usingFunction, String name, Action sdkAction)
TargetSite:
Message:
UA SDK error (Opc.UA.ServiceResult=0x801A0000) in 'ApplicationInstance.CheckApplicationInstanceCertificate'. OPC UA service result - {BadCertificateUntrusted}. The certificate is not trusted.
+ The error occurred while creating or checking the (client) application instance certificate. Check event log entries for errors and warnings.
+ Suggestion: Check the trusted peers certificate store for the presence of the application instance certificate. This error can happen if the instance certificate is in the application instance store, but not in the trusted peers certificate store.
+ The certificate generator path was "C:\Program Files (x86)\Control-See\EBO-OPC Client\BIN\Opc.Ua.CertificateGenerator.exe".
+ This is an engine-level error. It is unrelated to any specific target server connection.
+ Connection attempt #1; last connected at 01/01/0001 00:00:00 (local); unconnected for 00:00:00.
+ The client method called (or event/callback invoked) was 'BrowseMultiple[1]'.
Source:
Stack Trace:
== Activity Trace ==
Following (6) events were gathered during the action on activity ID [21], in the order of first occurrence:
SDK trace: Checking application instance certificate.
SDK trace: Checking application instance certificate. CN=EBO-OPC Client Configuration, DC=LP-PC
2*Exception: {Opc.Ua.ServiceResultException} Self Signed Certificate is not trusted. IssuerName: CN=EBO-OPC Client Configuration, DC=LP-PC
SDK trace: Certificate 'CN=EBO-OPC Client Configuration, DC=LP-PC' rejected. Reason=BadCertificateUntrusted
SDK trace: Writing rejected certificate to directory: [Directory]%CommonApplicationData%\OPC Foundation\CertificateStores\RejectedCertificates

TargetSite:
Message: Problem browsing OPC Unified Architecture nodes.
Source:
StackTrace:
TargetSite:

Thank you.

Michael