Hello.

The EasyUAEngineParameters object you have created is just a "free-standing", in-memory object, and modifying its parameters has not effect whatsoever. You need to modify the parameters that are actually used by the EasyUAClient object.

In .NET, that would mean accessing the static EasyUAClient.SharedParameters parameters property (and then, .EngineParameters inside it).

As there are no static members in COM, you need to instantiate the EasyUAClientConfiguration object instead, and then access its .SharedParameters.EngineParameters.

I hope this helps
Best regards

R.,

The AllowCertificatePrompt setting is for a different purpose. It is for client (application) certificate, that gets created (if it doesn’t exist) when an application made with QuickOPC-UA starts.



For checking the server certificates on the client side, you currently (with version 1.00) have to use the standard SDK methods, i.e. the server certificate must be placed (by you, or the installer…) in “trusted peers” certificate store, which (by default) is a directory-based store, "%CommonApplicationData%\OPC Foundation\CertificateStores\UA Applications". You can use “UA Configuration Tool” (but also Windows tools etc.) to manipulate certificates in the stores. It is possible to choose a different store in QuickOPC-UA e.g. by changing EasyUAClient.EngineParameters.TrustedPeersCertificateStore.



The whole process looks roughly like this:
1. When a session to the server is being created, the UA SDK method for verifying the server certificate is used; the SDK is instructed to use the store given by EasyUAClient.EngineParameters.TrustedPeersCertificateStore.
2. If the above fails, but EasyUAClient.EngineParameters.CertificateAcceptancePolicy.AcceptAnyCertificate is true, the certificate is accepted (i.e. ignored – not checked at all).
3. If the server’s URL is in EasyUAClient.EngineParameters.CertificateAcceptancePolicy.TrustedEndpointUrlStrings, the certificate is accepted (i.e. ignored – not checked at all).
4. Otherwise, the certificate is rejected.


In future, I expect that we will enhance this process, by allowing the developer to hook into it and provide own validation.

Best regards,
Zbynek

From: R.
Sent: Friday, February 10, 2012 8:29 PM
To: Zbynek Zahradnik
Subject: RE: Ua Browsing

Ah ok. That makes sense. I have that working now.

I still don’t quite understand how the AllowCertificatePrompt is supposed to work, no if I actually want to add security. I have that set to true (on the EasyUAClient object) but I don’t receive any type of dialog prompting to accept the cert and I still get a certificate error when trying to browse the server.

How do I make sure the client accepts the server’s certificate?


Thanks again,
R.

R.,

In your code, you are changing the AcceptAnyCertificate on a new UACertificateAcceptancePolicy object that is just “yours”, floating around. It is not the one that the component uses.

So, I think you should either (I have not checked the code below, but the ideas should be clear):

a) Assign your object into the component, such as: EasyUAClient.EngineParameters.CertificateAcceptancePolicy = UACert;
or
b) Do not create your own object at all, but simply change the property inside existing object, such as: EasyUAClient.EngineParameters.CertificateAcceptancePolicy. AcceptAnyCertificate = True;

I suggest to use (b), not only because it is simpler, but also because the component might be changing some defaults upon startup in these objects – and if you go the route (a), the newly created object will have the hard-coded initial values, which may not be always ideal.

Best regards,
Z.

From: R.
Sent: Friday, February 10, 2012 3:27 PM
To: Zbynek Zahradnik
Subject: Ua Browsing

Zbynek,

I am trying to test some examples for UA. I am getting an exception that the certificate is not trusted when trying to run the code below. I have the accept any policy set to true. Also my TOP server UA endpoint is setup to have no security requirements. What am I missing?

Dim UACert As New OpcLabs.EasyOpc.UA.UACertificateAcceptancePolicy
UACert.AcceptAnyCertificate = True

Dim nodeElementCollection As UANodeElementCollection = EasyUAClient1.BrowseDataNodes( _
"opc.tcp://192.168.111.52:49380")

For Each nodeElement As UANodeElement In nodeElementCollection
ListBox1.Items.Add(String.Format("nodeElement.NodeId: {0}, nodeElement.DisplayName: {0}", _
nodeElement.NodeId, nodeElement.DisplayName))
Next nodeElement

R.