Online Forums
Technical support is provided through Support Forums below. Anybody can view them; you need to Register/Login to our site (see links in upper right corner) in order to Post questions. You do not have to be a licensed user of our product.
Please read Rules for forum posts before reporting your issue or asking a question. OPC Labs team is actively monitoring the forums, and replies as soon as possible. Various technical information can also be found in our Knowledge Base. For your convenience, we have also assembled a Frequently Asked Questions page.
Do not use the Contact page for technical issues.
- Forum
- Discussions
- QuickOPC-UA in COM
- Connection, Reconnections, Certificates
- BadSecurityChecksFailed error
BadSecurityChecksFailed error
The server's certificate is not a self-signed certificate. It is a certificate issued by a CA, because the issuer name differs from the subject name.
Subject: O=Siemens, C=DE, CN=PLC-Model/OPCUAServerClient
Issuer: O=Siemens, C=DE, CN=Siemens TIA Project(Qiang-sha256)
This means that 1) it cannot be made trusted on the client by putting into "trusted peers", and 2) AcceptAnyCertificate won't work either.
The proper solution, if the server certificate is "constant" and cannot be replaced by a self-signed cert, requires that
1) You obtain the certificate of the CA that has issued the server certificate, and place it into the "Trusted issuers" store (note: not just "trusted peers")
2) and, there may be an issue with the fact that the root (CA) cert is not in the chain. Hopefully not.
Regards
Please Log in or Create an account to join the conversation.
Yes, it has been set to true since I started to test connection to this server.
Best,
Ahmad
Please Log in or Create an account to join the conversation.
Is your code currently setting AcceptAnyCertificate to 'true'? If not, can you test it out? (this is not a secure solution, but a troubleshooting helper in order to get us further).
Regards
Please Log in or Create an account to join the conversation.
No, I do not get any RejectedCertificates in OPC Foundation.
Best,
Ahmad
Please Log in or Create an account to join the conversation.
As far I can tell, it is now your QuickOPC client application rejecting the server's certificate. Do you find that certificate in RejectedCertificates? If so, move it the the trusted peers store (UA Applications).
This said, the actual error may indicate that the server's certificate is not a self-signed certificate, but a certificate signed by a Certificate Authority (CA). But hopefully it would be possible to make it trusted just as if it were self-signed.
Regards
Please Log in or Create an account to join the conversation.
Now I have sent the right and latest .der file in MachineDefault folder to our customer and he has put that in the Trust list but I am now getting a bit different but might relevant to the previous issue;
{
The SDK action called was "static Session.Create".
+ Following (1) events were gathered during the action on activity ID [9], in the order of first occurrence:
Exception: {Opc.Ua.ServiceResultException} Certificate chain not complete. SubjectName: O=Siemens, C=DE, CN=PLC-Model/OPCUAServerClient IssuerName: O=Siemens, C=DE, CN=Siemens TIA Project(Qiang-sha256)
+ The client method called was 'ReadMultiple'.
}
How this error should be handled?
found a similar post regarding the chain not complete but could figure out how the problem was solved for the person who was asking.
Best,
Ahmad
Please Log in or Create an account to join the conversation.
The local server you are referring to is based on the same/similar OPC Foundation code we are using in the lower layers of our QuickOPC. This means it is using the same shared certificate stores/directories. The certificates of your client app were not copied to the RejectedCertificates by QuickOPC. They were copied there by this local server, when the QuickOPC app was connecting to it. Which is kind of normal.
By copying or moving them to "UA Applications", you made this local server trust the client certificates. This might be the only way to do it, or there might be other, more user-friendly way provided by that server, but in general it is the right approach.
There are still some less clear parts: why does private key part (PFX) also appear in RejectedCertificates, and why did not your QuickOPC client app also put the copy into UA Applications (it is supposed to do that for convenience for usage with local servers). You saometimes say "I deleted XXXX folder" - even if you decide to remove everything from cert store folder for a good reason, you should not delete the folder as such - you should only delete the files in it, but keep the folder itself. I suspect this might be behind some of these issues.
Regards
Please Log in or Create an account to join the conversation.
I moved the certs and private subfolders (with .der and .pfx files inside) in the RejectedCertificates folder into the UA Applications folder in CertificateStores. Actually there was no UA Applications folder in CertificateStores folder. I created a folder and then moved what I said from RejectedCertificates to UA Applications folder. Then I deleted RejectedCertificates folder. Then I ran the client and it connected to the local server fine. Is this a reasonale approach finally?
I sent the same .der file in MachineDefault (that I will not delete anymore) to the customer to add it to his trust list.
Will revert if there are more questions.
Please Log in or Create an account to join the conversation.
1.
What I was trying to say is that by deleting the MachineDefault store, if there were any certificates that are already trusted by other parties, they would be lost, so new certs will have to be created and the trust will have to be reestablished. So it is OK to remove a certificate if you know what you are doing, but not to routinely remove the folder "just in case".
If the certificate for your own application gets copied to RejectedCertificates (did I understand that correctly?), then this would be the first really unexpected behavior. It *may* happen in some rare cases, but it should not in your case.
It may be necessary that you repeat the test with recent QuickOPC version - because we cannot rule out a problem in the earlier version, plus there is an improved error diagnostics in newer versions.
2. I do not know in which state you got into the project. It is possible that the certificates used with other client were made trusted before you took it over.
3. In order to troubleshoot the crash, try to obtain the exception that has caused it, and the call stack associated with it. Also, any .InnerException object, its call stack, etc. recursively. It should be possible to set the debugger to stop only on "unhandled" exceptions, not on all that are thrown and handled internally.
Regards
Please Log in or Create an account to join the conversation.
1- Ok, I see. I didn't delete the MachineDefault folder anymore. So the thumbprint will stay the same as you mentioned. But now I see that the same .DER file (with the same thumbprint) was thrown into the RejectedCertificates folder in CertificateStores. Actually the RejectedCertificates folder contains two sub-folders; certs wth the .der file and private folder with .pfx file. What should I do with these rejected ones now? should it be moved?
Another thing is that sometimes I noticed that an UA Applications folder (with certs subfolder and the same .der file as in certs subfolder of MachinDefault folder) also was created in CertificateStore folder but I don't see that folder to be thrown/created anymore.
2- I didn't mean to undermine your product. Just wanted to inform you that it might not be anything wrong on the server sides because I can connect to both servers that I am trying to connect with QuickOPC based client, with the other SDK based client and I have not set any certificates configuration as the servers side. But it might be the other client manage certificates automatically somehow.
3- Because the application crashes while running. For me to see what are exceptions I enabled the feature and the OPCForms was one of the exceptions I noticed.
I have installed all QuickOPC with using nuget package manager and I was consistent on that in the entire work. That's why I am surprised why it is complaining about that. But as you mentioned I need to probably continue on that.
Best,
Ahmad
Please Log in or Create an account to join the conversation.
- Forum
- Discussions
- QuickOPC-UA in COM
- Connection, Reconnections, Certificates
- BadSecurityChecksFailed error