My application can't use the auto-generated certificate due to only 1 year validity. I am able to generate cert's with longer validity using opc.ua.certificategenerator, but since this tool is not supported anymore, and since it's only using openssl, I am eager to learn how I can do this manually using openssl.
I have made a bash file that I run in WSL:
openssl genrsa -out default_pk.pem 2048
openssl req -new -key default_pk.pem -out cert.csr \
-subj "/CN={MyApp}/"
openssl x509 -req -days 760 -extfile extensions.cnf -in cert.csr \
-signkey default_pk.pem -out public.pem
openssl x509 -in public.pem -inform PEM -out public.der -outform DERWith a extensions.cnf config file like this:
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
subjectAltName=@alt_names
basicConstraints=CA:FALSE
keyUsage=dataEncipherment,keyEncipherment,nonRepudiation,digitalSignature,keyCertSign,cRLSign
extendedKeyUsage=serverAuth,clientAuth
[alt_names]
URI = URN:Localhost:{MyApp}:1.0.0.0:neutral:null
DNS.1 = LocalhostThe error message I receive is this:
[14:58:32 ERR] The OPC-UA engine failed to connect to the underlying subsystems.
OPC-UA service result - Cannot access certificate private key. Subject=CN={MyApp} = BadConfigurationError.
---- SERVICE RESULT ----
Status Code: {BadConfigurationError} = 0x80890000 (2156462080)
Description: Cannot access certificate private key. Subject=CN={MyApp}
+ The SDK action called was "ApplicationInstance.CheckApplicationInstanceCertificate".
+ Following (2) events were gathered during the action on activity ID [4], in the order of first occurrence:
SDK trace: Checking application instance certificate.
Exception: {Opc.Ua.ServiceResultException} Cannot access certificate private key. Subject=CN={MyApp}
+ The error occurred while creating or checking the (client) application instance certificate. Check event log entries for errors and warnings.
+ This is an engine-level error.. <s:OpcLabs.EasyOpc.UA.EasyUAClient>I have tried to follow the requirements of the
Application Instance Certificate
, and compare these with the properties of an auto-generated certificate without any luck. Have also been running in elevated mode without any difference.
Is there anyone out there that have figured out a way to generate certificates for the EasyUAClient?
