Well ... so far basically there has been no demand to do it differently. Do you have a use-case where it would be of use?

Currently the logic is shared with MQTT-UADP. In MQTT it is likely that each Writer has a different Topic. It is not possible to publish to multiple topics in a single MQTT network message. Thus, at the moment the WriterGroup simply does loop all Writers and each Writer will produce the NetworkMessages related to it. The only scenario where multiple DataSetMessages would exist in a single NetworkMessage at the moment are for Event-DataSets.

P.S.
It is not related to the sequence number issue.

As far as I remember the U(A)DP logic didn't yet properly support wildcards, though it mostly appears to do so via common logic. A proper wildcard-supporting version would need to keep track of the numbers for each PublisherId+WriterId combination it sees. Though in reality probably something like last 100 seen to avoid memory leaks.

Adding few extra notes, though mostly it is as said above.

The configuration can be changed via PubSubSystem.updateConfiguration(..). That method will take a function, which receives the current live configuration as input (PubSubSystemConf) and it must output the desired new configuration (PubSubSystemConf) or throw PubSubException to abort. Once the function outputs the desired state, PubSubSystem will internally create/modify/remove connections/groups/writers/readers to match the new configuration (or throws PubSubException, if that fails for some reason).

The design was to allow multiple concurrent update operations from multiple threads. Due to intentional synchronizations, only one of the update-functions runs at a time, but they would always see the result of the previous function output as their input. This would have been a need for making an address space -based configuration, since each Write/Call operation happens on the blocking-work threads. Though, nowadays it mostly enables SDK itself updating the configuration as that is used to store received metadatas.

Thus, in general one PubSubSystem should be enough. If for some reason the updating doesn't work, let us know.

P.S.
Since the PubSubSystem takes the UaApplication (UaClient/UaServer), if you have multiples in a single application, then you would need a PubSubSystem for each. Skipping some details regarding Subscriber side for now. Skipping also some details regarding MQTT.

In the meantime I'm using the workaround above.

I'll make an issue on this as a possible future improvement.

Is there any way to accept a .pem file which contains both using the SDK?

This constructor expects the certificate and private key as separate files. The .der file is used as the certificate file, and the .pem file should contain only the private key. Therefore, removing the BEGIN CERTIFICATE / END CERTIFICATE block from the PEM file is the correct workaround.

OPC UA itself does not mandate this local PEM file layout. Tools such as UaExpert may accept a PEM file containing both certificate and private key, but this SDK constructor expects the private key file separately.

I checked the code and it seems like the current implementation never bundles values from different WriterGroups into the same NetworkMessage while the documentation states otherwise. I cannot however currently tell why this is, it's possible that this is a bug that hasn't been tested. Regardless, either the docs or the implementation needs to be adjusted.

Thanks for the report, I'll create an issue on this.

basically the creation of a UserIdentity using a .der and .pem file works.

But now I have a specific case, where the .der and .pem file is provided by the EQ vendor to be able to connect to the OpcUA server and it seems that the .pem file can not be loaded correctly.

The code to create the user identy (with SDK version 4.10.2-62) is following:

UserIdentity userIdentity = new UserIdentity(new File("UserCert.der"), new File("UserCert.pem"), "pwd");

The exception is:

org.bouncycastle.util.encoders.DecoderException: unable to decode base64 string: invalid characters encountered in base64 data
at org.bouncycastle.util.encoders.Base64.decode(Unknown Source)
at com.prosysopc.ua.stack.transport.security.BcCryptoProvider.base64Decode(SourceFile:78)
at com.prosysopc.ua.stack.utils.CryptoUtil.base64Decode(SourceFile:122)
at com.prosysopc.ua.stack.transport.security.PrivKey.load(SourceFile:117)
at com.prosysopc.ua.stack.transport.security.PrivKey.load(SourceFile:191)
at com.prosysopc.ua.SecureIdentity.a(SourceFile:473)
at com.prosysopc.ua.SecureIdentity.(SourceFile:235)
at com.prosysopc.ua.UserIdentity.(SourceFile:123)

The .der file looks like this (I've removed th middle part for better readability)

UserCert.der

0‚Ê0‚² ®É¢r®Vá,^0å}C¸n:Oê0
*†H†÷
....
5²fØad˾ò»‡º ×–_

The .pem file contains a 'BEGIN/END CERTIFICATE' section and a 'BEGIN/END PRIVATE KEY' section like shown here:

-----BEGIN CERTIFICATE-----
MIIGyjCCBLKgAwIBAgIUD67JonKuVuEsHV4w5X1DuG46T+owDQYJKoZIhvcNAQEL
....
ZMu+8rsDh7oaANeWAV8=
-----END CERTIFICATE-----
-----BEGIN PRIVATE KEY-----
MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQCcDX0o7ADB8gJb
....
bstj/beIj9MfXzAsgd84KMZCKK3m
-----END PRIVATE KEY-----

When I remove the 'BEGIN/END CERTIFICATE' section, the UserIdenty can be created.

So it seems that the .pem file shall contain only the 'BEGIN/END PRIVATE KEY' section, but not the CERTIFICATE, right?

Is there any specification that it should be like this?

Or is there any way to load the UserIdentity with a .der and .pem file which contains CERTIFICATE and PRIVATE KEY'

P.S. The UaExpert can load the UserIdentity using the .der and .pem (including CERTIFICATE and PRIVATE KEY) without problems.

Thank you for you help!

I have configured 2 DataSetWriters in a single WriterGroup (using the same publishingInterval). The UadpNetworkMessageContentMask does NOT contain the DataSetClassId (i.e. it is null). The DataSets only comprise 2 and 3 double values, respectively, which should fit well into the maxMessageSize of 4096 bytes.

What could be the reason for sending multiple networkmessages with one dataSet each instead of one networkMessage containing the dataSets from both dataSetWriters?

Some shortened log messages below. My expectation would be that a single networkmessage would transport both dataSets (dataSetWriterIds=[1,2]). Could this be related to the issue of the dataSet seqNos counting across all dataSetMessages? (see previous forum entry)

Use of opc.https is not recommended in products developed with our SDK. We recommend using opc.tcp endpoints instead. Support for opc.https is deprecated, so new integrations should not rely on it.

You seem to be correct. Looking at the code, the DataSetReader implementation currently holds only one lastDataSetSequenceNumber, which is used when producing that warning log. Consequently, if multiple DataSetWriters are received by the same DataSetReader, the implementation does not distinguish the source of the sequence number.

Based on this, the sequence number validation should likely be tracked at least per DataSetWriter, even when the DataSetReader is the same.

I’ll create an issue for this. Thanks for the report.

I have a UDP publisher publishing 2 DataSets in 2 different DataSetWriterGroups at different publishingIntervals (1000ms and 2000ms).

The subscriber uses a single DataSetReader/group without preconfigured writer/publisher/.. ids to receive all possible messages on that multicast socket.

When logging the subscriber side, the SDK warns about old sequenceNumbers, comparing the sequenceNumbers from both received DataSetWriters. It is my understanding from the Standard Part 14, 7.2.4.5.4 DataSetMessage header, that the SequenceNumber is related to the DataSet and not to a publisher. Is the SDK sequence number evaluation possibly incorrect here?

One PubSubSystem with multiple connections appears to support adding connections on the fly without stopping existing ones. Multiple PubSubSystems are not required just to avoid interruption when adding another multicast subscriber, based on the implementation. Additionally the docs show that the configuration updates are applied live meaning start/stop shouldnt be required when adding connections:

https://documentation.prosysop.....bFunction-

Of course, multiple PubSubSystems could provide better Application-level isolation (e.g. if you want separate life cycles/listeners for each connection) but based on your question, a single one should be suitable.