Hi,

basically the creation of a UserIdentity using a .der and .pem file works.

But now I have a specific case, where the .der and .pem file is provided by the EQ vendor to be able to connect to the OpcUA server and it seems that the .pem file can not be loaded correctly.

The code to create the user identy (with SDK version 4.10.2-62) is following:

UserIdentity userIdentity = new UserIdentity(new File(“UserCert.der”), new File(“UserCert.pem”), “pwd”);

The exception is:

org.bouncycastle.util.encoders.DecoderException: unable to decode base64 string: invalid characters encountered in base64 data
at org.bouncycastle.util.encoders.Base64.decode(Unknown Source)
at com.prosysopc.ua.stack.transport.security.BcCryptoProvider.base64Decode(SourceFile:78)
at com.prosysopc.ua.stack.utils.CryptoUtil.base64Decode(SourceFile:122)
at com.prosysopc.ua.stack.transport.security.PrivKey.load(SourceFile:117)
at com.prosysopc.ua.stack.transport.security.PrivKey.load(SourceFile:191)
at com.prosysopc.ua.SecureIdentity.a(SourceFile:473)
at com.prosysopc.ua.SecureIdentity.(SourceFile:235)
at com.prosysopc.ua.UserIdentity.(SourceFile:123)

The .der file looks like this (I’ve removed th middle part for better readability)

UserCert.der

0‚Ê0‚² ®É¢r®Vá,^0å}C¸n:Oê0
*†H†÷
….
5²fØad˾ò»‡º ×–_

The .pem file contains a ‘BEGIN/END CERTIFICATE’ section and a ‘BEGIN/END PRIVATE KEY’ section like shown here:

—–BEGIN CERTIFICATE—–
MIIGyjCCBLKgAwIBAgIUD67JonKuVuEsHV4w5X1DuG46T+owDQYJKoZIhvcNAQEL
….
ZMu+8rsDh7oaANeWAV8=
—–END CERTIFICATE—–
—–BEGIN PRIVATE KEY—–
MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQCcDX0o7ADB8gJb
….
bstj/beIj9MfXzAsgd84KMZCKK3m
—–END PRIVATE KEY—–

When I remove the ‘BEGIN/END CERTIFICATE’ section, the UserIdenty can be created.

So it seems that the .pem file shall contain only the ‘BEGIN/END PRIVATE KEY’ section, but not the CERTIFICATE, right?

Is there any specification that it should be like this?

Or is there any way to load the UserIdentity with a .der and .pem file which contains CERTIFICATE and PRIVATE KEY’

P.S. The UaExpert can load the UserIdentity using the .der and .pem (including CERTIFICATE and PRIVATE KEY) without problems.

Thank you for you help!