According to the OPC UA Specification (https://reference.opcfoundatio.....docs/6.2.2), Application Instance Certificates shall have subjectAltName and contain the ApplicationUri as URL. For Server applications, DNS Name or IP Address should also be specified.

Thus, some OPC UA applications might accept certificates without subjectAltName, but the Specification states that they are required.

I have a question about the subjectAltName (applicationUri) for the Client Certificate

Is it needed or can it be omitted.

I remeber a long time ago, I've create an Client Certificate without an application uri and I could still connect to a (Demo) Server using the cert without application uri.

So would it be valid to just omit it, or does it maybe also depend on the server if it would accept a client certificate without an application uri?

Thanks!

Thank you very much for your support.

Our server works quite well with different clients, but this problem with kepServerEx has been going on for a few weeks. I'm going to set up the log as you indicate.

I haven't found in the doc I have what the different enumeration values for TraceLevel do. Is the content of the log targeted at different parts, or is there a gradation in the level of detail of the information provided? With stlDebug, it's quite difficult to analyse the contents of the log.

Denis

This error (BadInvalidState, 0x80AF0000) is probably related to the communication channel, which is handled by the UaStack32.dll.

You could try to enable stack level tracing, which I think was enabled in version 7.5.0.

Either one, should create a uaStack.log next to your executable and maybe it reveals more about that.

You can send that to our support email, if you don't find anything useful out of it yourself.

But, I would also recommend to update to the latest version, just in case. There hasn't been much changes to the stack according to the Release Notes, though, but you never know...

Sorry, I'd lost the habit of giving this basic information in my previous exchanges with Jouni.

I'm currently using the Prosys SDK for Delphi, version 7.5.1.

Has the Server you're connecting to been developed with Prosys OPC UA SDK for Java or Prosys OPC UA SDK for Delphi? If it has been, can you tell us which SDK (Java or Delphi) it has been developed with and what is the version number (e.g. 5.3.0) of the SDK used to develop the Server?

If the Server hasn't been developed with on of our SDKs, we can't help you debugging the Server and you should direct this question to Kepware and/or the developers of the Server.

Faults of this type are indicated on the OPC UA client side (KepServerEx 6):

Date Time Level Source Event
29/04/2025 21:09:25 Warning OPC UA Client Unable to use registered read/write for tag 'ns=2;s=10.0.21.1!MIK_OEE.AWAITINGMAINTENANCE.STATUS'. | Status description = 'The operation cannot be completed because the object is closed', Status code = 80AF0000.

On our UA server side, there are no exceptions or errors, and when the problem occurs, the number of connections and subscriptions indicated remain the same. Same tags read with UaExpert remains "good".

The problem occurs very quickly if the subscription mode used by the client is "exception", but it still occurs in "polling" mode.

Would you have any advice on how to solve this problem?

Thank you in advance

Denis

You posted this in the generic forum, not in https://forum.prosysopc.com/fo.....on-server/, but based on your wording I'm going to assume you still mean our https://prosysopc.com/products.....on-server/ application.

Did you already just try connecting? What didn't work?

In short, there is no support for adding additional endpoints, but also there is no need to do that. They sort of have "nothing do with connections" and can more be though to be historical details (If you run more than one OPC UA server in the same port, client chooses with this the one which the traffic is routed). In OPC UA in general most applications just have a single EndpointUrl that uses the machines hostname, but they still do listen to multiple interfaces for that endpoint. The Simulation Server by default binds to all interfaces via the wildcard ip address "0.0.0.0" or "[::]" thus as long as the traffic reaches one, everything should work. Try e.g. testing with https://prosysopc.com/products/opc-ua-browser/ from the other end.

P.S.
https://prosysopc.com/blog/opc-ua-wireshark/ might help for figuring out does the traffic reach the interfaces, but in general we cannot debug your vpn if that doesn't happen.

I'm trying to configure and test IPsec Strongswan on my ubuntu machine. I've created my-vpn.conf file and added
local_ts = 10.0.0.0/24 # Traffic selector for local network
remote_ts = 10.0.1.0/24 # Traffic selector for remote network.

Now I'm trying to set up a opc ua server. As far as i understand, i have to add an Endpoint that will listen on remote_ts address and set 4840 port, so the server's url would look like opc.tcp://10.0.1.1:4840.

Is it possible and if so, how can i do that?

The https://github.com/open62541/o.....541/issues or https://groups.google.com/g/open62541 might be a better place to ask, as we do not know specifics of other SDKs than our own.

It would be easier to answer if you would use https://prosysopc.com/products.....-java-sdk/. Generally speaking the eval edition typically would work for thesis purposes (though discuss with sales and/or mention this on the request DL form). For example in our SDK you can get notifications from a 'PubSubSystem' whenever a new datasetmessage arrives.

The setup will consist of three Raspberry Pi's. One is hosting the server, one is running the client and the third is supposed to measure the timing delays as an independent clock. Right now I am simulating this on a local machine so everything is running on the same system. For the subscriptions I am using the server timestamps and then on clientside calculating the delay with UA_DateTime_now(). But I am afraid this will not work when client and server run on two different machines.

And now for the even bigger problem: I dont know how to measure the delays for PubSub even if Publisher and Subscriber are running on the same system. I have a callback in place for the TargetVariableNode but calculating this with the UA_DateTim_now() just yields a negative time and it does not change at all so it cant be valid.

Now my questoin is how would you go about measuring Subscription performance on two different systems? My idea was to use the GPIO pins and hardwire them to measure timing. But the question remains when to toggle them as there is no callback on the serverside ob subscriptions that gets called everytime you sample. Or is there? I dont know.

The other question is how to measure PubSub performance at all. On the same system or two different system I unfortunately have no clue how to about that. If you have any keywords for me to research or even example code I would be very greatful.

If you need more information or code please ask me.

Specific advice for UaExpert is outside the scope of this forum, but as generic advice, please check that the Server is running at the target machine, that the selected port is correct and that firewall is not blocking connections to that port.

Alternatively, you can try connecting to the Server with Prosys OPC UA Browser, for which we can provide more specific support.

As another alternative, you could use Wireshark to capture traffic between UaExpert and the Server and check the logs for errors. See https://prosysopc.com/blog/opc.....wireshark/ for instructions on how to capture OPC UA communication with Wireshark.

I am newbie about of this

using UaExpert cna not connect example:

endpoint url : opc.tcp://10.10.10.10:4840
I can’t still connect to the OPC UA I tried with NONE security and BASIC256ha256 configuration,

message:
Error ´BadDisconnect´was returned during CreateSession
Error 'BadCommunicationError' was returned during opensecurechannel
Could no connect to server:badcommunicationerror

i can ping the machine 10.10.10.10

Any help would be highly appreciated.
thanks in advance