2 certificate key sizes not working anymore | OPC UA SDK for JavaProsys Forum

Please consider registering
guest

Forum

OPC UA SDK for Java
sp_ArrowRight

2 certificate key sizes not working anymore

Topic RSS

2 certificate key sizes not working anymore

July 19, 2018
19:04, EEST

Xavier

Member

Members

Forum Posts: 43

Member Since:
March 26, 2014

Offline

Hi,

I switched from pre-3.0.0 SDK to the 3.1.4 SDK but noticed that the way I was able to handle all security modes is not working anymore.

I used the method loadOrCreateCertificate with 2 key sizes (new int[] { 2048, 4096 }) and I was able to connect using any security mode. Now it’s not working anymore.

You can reproduce the issue with the 3.1.4 SDK and the sampleConsoleServer if you change line 511 to enable the 2 keySizes :
final int[] keySizes = new int[] { 2048, 4096 };

I cannot connect with the sampleClientServer (using security mode none), I have this exception :
Different cert in CreateSessionResponse.serverCertificate and endpoints

But at the same time the documentation is still suggesting that this is the way to do it:
// If you wish to use big certificates (4096 bits), you will need to
// define two certificates for your application, since to interoperate
// with old applications, you will also need to use a small certificate
// (up to 2048 bits).

Thanks 🙂

July 20, 2018
15:33, EEST

Heikki Tahvanainen

Member

Members

Forum Posts: 402

Member Since:
April 17, 2013

Offline

Hi Xavier,

Thank you for reporting this. This is a very good observation.

Actually it seems that there has not been a change on the server side. Rather, the client side certificate validation is done more rigorously with SDK 3.0 or newer. In other words, the same issue happens also with previous server versions, but the situation is not checked by the previous client applications.

The actual issue seems to be that when there’s multiple application instance certificates, only of these will be used in the EndpointDescriptions returned by the GetEndpoints service. In this example situation, the 4096 bit certificate should be used with BASIC256SHA256 endpoints, but the GetEndpoints service always uses the 2048 bit version of application instance certificate. Fixing the issue requires most probably changes to the endpoint handling in the server side SDK.

You cannot easily disable this check from the client SDK, so until further notice there’s no easy workaround. Clients made with SDK older than 3.0 will continue to work normally though.

P.s. As a small note, the SampleConsoleServer example as well as the server tutorial suggest to use 0 to mark the default keysize:

keySizes = new int[] { 0, 4096 };

All RSS

Forum Timezone: Europe/Helsinki

Most Users Ever Online: 1919

Currently Online:
15 Guest(s)

Currently Browsing this Page:
1 Guest(s)