Hello,

In general, you can take a look at the Browser’s own certificate and generate a similar certificate to be used as a user certificate. In fact, you can try using Browser’s certificate as user certificate. Its password is opcua.

I don’t know how to use Open SSL so I can only advice you on how the output certificate should look like. To match the certificate used by Browser, you will need to add the following extensions to your certificate:

– Key usage with the following flags: Digital Signature, Non-Repudiation, Key Encipherment, Data Encipherment, Certificate Signing, you can experiment with other combinations but this one works for sure

– Enhanced Key Usage with Server Authentication (1.3.6.1.5.5.7.3.1) and Client Authentication (1.3.6.1.5.5.7.3.2) (I think our applications require both of these, but you can also try without this extension)

– Subject Alternative Name with URL and DNS Name might be required, but I’m not certain.

Also, Subject Type of Basic Constraints should be End Entity, though I’m not 100% certain of this either.

Hello,

I’ve been testing generating user certificates with OpenSSL and I’ve figured out a process that works.

First of all, you will need to generate the private key in RSA format as Browser doesn’t support other types of private keys at the moment. You can generate an RSA private key by using “openssl genrsa” command.

You can add extensions to certificates in OpenSSL by specifying them in a configuration file. See https://www.phcomp.co.uk/Tutorials/Web-Technologies/Understanding-and-generating-OpenSSL.cnf-files.html for an example of configuration file. You will need to add “-extensions” parameter to your “openssl req” command to specify which set of extensions to load from the configuration file. In the previously linked example, this would be “v3_req”.

Finally, use “openssl x509” command to generate the certificate in DER format.

When your configuration file is saved as “openssl.cnf” and you want to use extensions specified in section “v3_req”, you would use the following commands.

openssl genrsa -out myUserCert_key.pem
openssl req -x509 -config .\openssl.cnf -key myUserCert_key.pem -outform PEM -out myUserCert.pem -days 7200 -extensions v3_req
openssl x509 -in myUserCert.pem -outform der -out myUserCert.der

You will need to use myUserCert_key.pem in Browser instead of myUserCert.pem. The configuration in the linked example will generate a certificate that works with Browser and Simulation Server without changing anything in the configuration file, but you might want to use your information instead of example.com etc.

Let me know if you are able to generate a key pair with these instructions and use it connect to Simulation Server.