Hi,

The application doesn’t use the windows store.

This causes every cert signed by that CA (that is not revoked) to be trusted:
Put the CA certificate to \.prosysopc\prosys-opc-ua-simulation-server\PKI\CA\certs
And put the CRL file of that CA to : \.prosysopc\prosys-opc-ua-simulation-server\PKI\CA\crl

If you instead do not want to trust every cert signed by that CA cert:
Put the CA certificate to \.prosysopc\prosys-opc-ua-simulation-server\PKI\CA\issuers\certs
And put the CRL file of that CA to : \.prosysopc\prosys-opc-ua-simulation-server\PKI\CA\issuers\crl
Put the certificate (that was signed by the CA) to: \.prosysopc\prosys-opc-ua-simulation-server\PKI\CA\certs

At the moment the application doesnt support disabling revocation checks, thus you must have the CRL file of that CA cert. The option to disable revocation checks might be added in a future version of the application.

Also, since you have tried the connection, the certs might be in the rejected folder (next to certs folders). In that case you must remove it from there as well (if it is in both it is considered to be rejected).

Only the public key parts are transmitted and what you should copy, i.e. they are not considered as secrets. The private key parts should never leave the machine where the keypair was generated. Though, sometimes the term “cert” could mean both the whole keypair or just the public key part. In my earlier text I meant just the public key part. We mostly use the .der format for public keys and .pem for private keys. Sometimes (outside of our apps) they could also come in the form where they are combined in a single file, if so you should extract the public key part and only copy that.

The only ‘secret’ here is the server’s own private key for it’s ApplicationInstanceCertificate. That could benefit from some security chip storage, such as a Trusted Platform Module, but for the time being we do not support that. Unless you have something like that I would expect windows store to also be effectively somewhere on the disk.

Also our apps are cross-platform and this directory way work for all of them. Most OPC UA Servers that I have personally seen use something similar, but I also see only a part of the world so to say. The ones that are coded with .NET might support windows store, but that is outside of my expertise.