Hello,

I have this error when trying to connect to OPC-UA server using ProSys Java client SDK. Using the same certificate in UaExpert works, so I guess the issue is with my code. The server is a B&R CPU. I cannot figure out which part of the certificate should match the URI in the application description. Neither if it has to match something in the client or the server certificate.

Here are the commands used to generate the certificate:
# Create RootCA cert
openssl genrsa -des3 -out ./certs/OpcUa_CA_key.key 2048
openssl req -x509 -new -nodes -key ./certs/OpcUa_CA_key.key -days 3000 -out ./certs/OpcUA_CA.pem -config OpcUA_openssl.cfg -extensions v3_req
openssl x509 -outform der -in ./certs/OpcUA_CA.pem -out ./certs/OpcUA_CA.der
cp ./certs/OpcUA_CA.der ./certs/OpcUA_CA.cer
cp ./certs/OpcUA_CA_key.key ./certs/OpcUA_CA_key.pem

# Create Server cert
openssl genrsa -out ./certs/OpcUa_Server_key.key 2048
openssl req -new -key ./certs/OpcUa_Server_key.key -out ./certs/OpcUa_Server.csr
openssl x509 -req -in ./certs/OpcUa_Server.csr -CA ./certs/OpcUA_CA.pem -CAkey ./certs/OpcUA_CA_key.key -CAcreateserial -out ./certs/OpcUa_Server.der -outform der -days 3000 -extfile OpcUA_openssl.cfg -extensions v4_req
cp ./certs/OpcUa_Server.der ./certs/OpcUa_Server.cer
cp ./certs/OpcUa_Server_key.key ./certs/OpcUa_Server_key.pem

# Create App cert
openssl genrsa -out ./certs/OpcUa_Client_key.key 2048
openssl req -new -key ./certs/OpcUa_Client_key.key -out ./certs/OpcUa_Client.csr
openssl x509 -req -in ./certs/OpcUa_Client.csr -CA ./certs/OpcUA_CA.pem -CAkey ./certs/OpcUA_CA_key.key -CAcreateserial -out ./certs/OpcUa_Client.der -outform der -days 3000 -extfile OpcUA_openssl.cfg -extensions v4_req
cp ./certs/OpcUa_Client.der ./certs/OpcUa_Client.cer
cp ./certs/OpcUa_Client_key.key ./certs/OpcUa_Client_key.pem

Here is the client code:

ApplicationIdentity identity = new ApplicationIdentity([path to the cert generated above], [path to the pkey generated above], “mypass”);
identity.getApplicationDescription().setApplicationName(new LocalizedText(OpcUtils.getAppName(), Locale.ENGLISH));
identity.getApplicationDescription().setApplicationUri(“urn:pms-stubbed”);
identity.getApplicationDescription().setProductUri(“urn:pms-stubbed”);
identity.getApplicationDescription().setApplicationType(ApplicationType.Client);

Note: I used ‘urn:pms-stubbed’ as common name to generate my client CSR.

Can you help?

Thanks,

Patrick