Add own certificates to OPC UA Server

[azure-samples]

Add own certificates to OPC UA Server

[cristipogacean]

It seems that there is a bug in the logic of loading the application instance certificate when explicitly provided per command line argument the way you intended.

In the meanwhile, as alternative option you can do the following:

Create the public and private key for the OPC PLC server in /tmp/opcua_certs/ in slightly different manner, as follows:

md certs
md private
openssl req -x509 -newkey rsa:2048 -keyout private/cert.pem -outform der -out certs/cert.der -sha256 -days 365 -nodes `
  -subj "/CN=OpcPlc" `
  -addext "subjectAltName=URI:urn:OpcPlc:opcplc, DNS:opcplc" `
  -addext "keyUsage=critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign" `
  -addext "extendedKeyUsage = critical, serverAuth, clientAuth" `
  -addext "basicConstraints=CA:FALSE"

Run the docker with the following arguments:

docker run -v /tmp/opcua_certs:/app/pki --rm -it -p 50000:50000 -p 8080:8080 --name opcplc mcr.microsoft.com/iotedge/opc-plc:latest
--pn=50000 --autoaccept --sph --sn=5 --sr=10 --st=uint --fn=5 --fr=1 --ft=uint --gn=5 --ll=trace
--ph=opcplc --cdn=opcplc --ap=app/pki/

Besides the bug I mentioned above, your generated cert is probably not really OPC UA compliant. Typically the server require the public key to be in .der format. Besides this, the subject common name is rather hardcoded to OpcPlc therefore your generated cert is not accepted as a valid certificate. The certificate shall also contain the hostname of the system you're running on. In this case is 'opcplc' as per docker name, which I specified here:
-addext "subjectAltName=URI:urn:OpcPlc:opcplc, DNS:opcplc
and here:
--ph=opcplc --cdn=opcplc

I hope this helps you moving forward.

[HenrikMidtun]

Thanks, Luis!

I didn't know that OPC UA had specific requirements to the server certificate, so great of you to share that.
Makes me wonder if there are any requirements with regards to client certificates as well.