Thank you. It is strange that QuickOPC/OPCFoundataion requires the root CA in the chain (although not authoritative, please see [1]). I hope that Kepware Kepserver includes the root. If it does not, then I'm not sure how I will get QuickOPC to work with Kepserver. QuickOPC/OPCFoundation is pretty clear with the exception text that the root is not included by KepServer. But I will try to confirm it either way.

I will confirm that whether or not AcceptAnyCertificate works. If I am correct and it doesn't work, it might be because OPCFoundation is throwing an exception that the chain is bad -- which may be handled differently in the QuickOPC code base than the error that is triggered when a cert is untrusted.

Chris

[1] security.stackexchange.com/questions/65332/ssl-root-certific...qa&utm_campaign=google_rich_qa

Thanks for your help. I'm using the version that I downloaded yesterday: QuickOPC-2018.2-Full.exe

My OPC UA server is Kepware Kepserver 6.4 offering only an encrypted endpoint. The endpoint uses a cert/key that was issued by a "private" CA.

I have several Kepware clients that securely connect to this server. These other clients do not complain that the "certificate chain is not complete".

When I try to connect to this server with QuickOPC it fails with "certificate chain is not complete" (see below). The error is so offensive that QuickOPC does not even pop up the familiar QuickOPC "do you want to trust this server" dialog.

Does QuickOPC work with servers certs that were issued by a CA (not self-signed)?

What do I need to do to get QuickOPC to connect to OPC UA servers with certs signed by a CA?

Does QuickOPC require certs in "chain style"?

Is Kepware capable of supplying "chain style" certs?

I attempted to solve/workaround the problem (to no avail) with these steps:

1. Add the issuing CA's cert to the windows "Trusted Root Authorities" store on the computer running the QuickOPC software. I would not have expected this to help since QuickOPC has a long history of interactively allowing me at runtime to vouch for a server's trustworthiness.

2. Add the issuing CA's cert to c:\ProgramData\OPC Foundation\CertificateStores\UA Certificate Authorities\certs. I did not expect this to help for the same reason as 1.

3. Set AcceptAnyCertificate to true

I understand that PKI certs can optionally contain a 'chain' that includes issuing intermediate certs. My understanding is also that this chain traditionally does not include the root (as the root is assumed to exist on the client). I'm not sure how Kepware Kepserver handles this (I'm not sure if it includes the root or not) and I'm not sure what QuickOPCs very strict requirement is (although it appears to require the root to be provided by the server?).


Thank you,

Chris