doc: update certificate generation information - #212
Conversation
2508d65 to
a89d7bf
Compare
| ### Creating Application Instance Certificates | ||
|
|
||
| **NOTE:** open62541 version 1.3 does not support using a client certificate, | ||
| you need to use 1.4 or higher. |
There was a problem hiding this comment.
That is not true.
I have developed the security stuff against 1.3 and used it in the "Secure OPC UA" Training at the last Collaboration Meeting.
I suspect that 1.3 might not support the specific version of openssl you use. In that case, open62541 compiles without security support.
There was a problem hiding this comment.
Hmm ... interesting, a quick glance at build logs says it found openssh and didn't complain, but it did find 3.0 and the release notes for 1.4 say core: Support for OpenSSL 3.0 . I'll check a bit more. The release notes for 1.4 also said New features and major changes compared to the previous release series 1.3 include: client/server: Authentication with x509 certificates (client and server) so i was thinking that supported my experience of it not working with 1.3? It may also be the CA attributes on certificates, when i googled some of the errors my colleague got that turned up too. So probably a mixture of all sorts of things. Certicicates were made by openssl in "git bash" on windows, so it could be that is not configured right for opcua
There was a problem hiding this comment.
What version of OpenSSL did you use for the training course? open62541 pull request 5349 (i didn't want to paste link in case it made a reference to the ticket) whose commit exists on the 1.3 branch suggests both 3.0 and 1.1.1f should work. I suspect the cause may be a certificate attribute, i did a brief test before using 1.4 and it had failed, but something else may have been amiss with the PLC at that point. I'm not able to re-check again at the moment as the only PLC I have access to is running a soak test with 1.4 and has also been swapped to use a client certificate rather than username+password based authentication. I can retry after this soak test finishes, will i need to go back to username+password or do you think client certificate in the identity file works with 1.3?
| ```bash | ||
| openssl req -x509 -newkey rsa:2048 -keyout private_key.pem -out cert.pem -sha256 -days 365 -nodes -addext "subjectAltName=URI:urn:<IOC>@<HOST>:EPICS:IOC,IP:<IP>" | ||
| ``` | ||
| Depending on you openssl configuration the above command may not set all the requires attributes and may also set `CA:TRUE`, you can display the certificate using |
There was a problem hiding this comment.
typo;
please use semantic line breaks.
| and check the `X509v3 extensions` section. | ||
|
|
||
| To control setting attributes you can create a `opcua_cert.conf` configuration file as follows after editing `< >` parts of the `[ dn ]` section | ||
| ``` |
There was a problem hiding this comment.
linters will complain about no language setting
There was a problem hiding this comment.
I was going for "one-liner or use a proper GUI tool (xca)".
I'm not sure if that in-between way of using command line with a config file is something we should recommend.
But - tbh - I was going back and forth with this myself, so I don't have a final answer yet.
There was a problem hiding this comment.
The one liner for us (git bash on windows) set CA:TRUE which may have been a factor, my colleague ran 1.4 with a certificate generated this way and it didn't work, i ran it using one generated via the config file and it did work. Maybe there was an issue with his 1.4 build, but he's now on leave so i can't check that for a bit. So my experience at the moment is the one liner is possibly system/platform dependent and so not reliable, so I feel we may need a warning to check some of the attributes of the certificate.
There was a problem hiding this comment.
I am not sure how critical all of the options are, we could do a longer one liner adding e.g. -addext "basicConstraints=critical,CA:FALSE" and similar
a89d7bf to
a8ff22a
Compare
| ```bash | ||
| openssl req -x509 -newkey rsa:2048 -keyout private_key.pem -out cert.pem -sha256 -days 365 -nodes -addext "subjectAltName=URI:urn:<IOC>@<HOST>:EPICS:IOC,IP:<IP>" | ||
| ``` | ||
| Depending on you openssl configuration the above command may not set all the required attributes and may also set `CA:TRUE`, you can display the certificate using |
There was a problem hiding this comment.
typo;
please use semantic line breaks.
2 participants
Add additional notes on security certificate creation