Skip to content

OPC-UA certificates

janelle.tjanelle.t
in PLCnext Engineer

I am trying to write python opc-au client code to communicate to the opc-ua server, however, I cannot figure out the certificates

I have

image.png


image.png


Comments

  • janelle.tjanelle.t

    I have also tried to generate my own certificates with the same outcome "ParseError"

    I've even tried downloaded a certificate to the plc then re-downloading it so that it had the same name.

  • Martin PLCnext TeamMartin PLCnext Team

    I don't know much about python, but I hope some of these suggestions might help:

    • Are you able to connect to another OPC UA Server, not the one on the PLCnext Control device, for example one of the free servers mentioned on the OPC Connect website? That might help figure out where the certificates need to go on the client machine, so that they're recognised by python. On Windows, you probably need to install the server certificate into the Trusted Certificate Store, e.g. using the certmgr tool.
    • There's a minimal client example in this repository - maybe that example will work:
    https://github.com/FreeOpcUa/opcua-asyncio
    • Just as a test, are you able to connect to the OPC UA server on the PLCnext Control device when User Authentication is disabled in WBM, and all Security Policies are disabled in the PLCnext Engineer project? In that case, it should be possible to connect to the server using the Security Policy "None". However, even though this disables User Authentication and Endpoint Encryption, the client might still need to authenticate the server using the server certificate.


  • janelle.tjanelle.t

    Ok disabling user authentication worked to confirm that I can connect to the unit

    Disabled user authentication, (couldn't find anything in PLCnext to not allow): NB must reboot

    The free server connection also worked with no username, password or certificate.


    1) Yesterday I did try to use that example's certificates -> tried to upload them to the identity store.

    -> They are .der files and the controller wants pem or crt


    I tried to load back the security, it rebooted but now the password doesn't work (wbm just reloads each time)

    image.png
    image.png

    Other things I tried yesterday:

    2) Using instructions from this python-opcua/examples/generate_certificate.sh at master · FreeOpcUa/python-opcua · GitHub

    made a certificate (both .pem)

    openssl req -x509 -newkey rsa:2048 -keyout my_private_key.pem -out my_cert.pem -days 355 -nodes -addext "subjectAltName = URI:urn:example.org:FreeOpcUa:python-opcua"

    plcnext -> user file on controller

    wbm -> in the identity store saved the certificates

    rebooted

    Error: Service fault.. uri doesn't match

    3) Redownloaded the certificate I just made and saved

    Gave the usual asn1 parseerror

    4) Tried to generate the certificates in ua config -> when trying to do the certificate part I can only generate a request - did not understand

    5) Went back to self-signed by controller, reboot

    6) Saved my certificate in the trust store instead

    Error was BadCertificateUriInvalid

    7) rebooted

    Not sure exactly which error but then uaexpert also didn't work.

  • Martin PLCnext TeamMartin PLCnext Team

    You shouldn't have to generate or install any custom server certificate on the PLCnext Control device - the default, self-signed server certificate should be enough to start with.

    Going back to the third-party OPC UA server - you said:

    The free server connection also worked with no username, password or certificate.

    How about with security enabled on the third-party OPC UA server? Are you able to successfully establish a connection from your python client in that case? If so, where did you put the server certificate on the client machine, in order to make that work?

  • janelle.tjanelle.t

    Hi Martin, yes I am able to load an example server with a certificate of .der type and a private key of type .pem type and then as a client was able to set the security string with the same certificates, these certificates were placed in the location in which I ran the python code (to both generate the server and the client)

    I am still struggling with the original problem though and have made no headway there

  • Martin PLCnext TeamMartin PLCnext Team

    In relation to certificates, this should be all that's needed:

    • If you're connecting to the OPC UA server using an IP address in the URL, then in the PLCnext Engineer OPC UA Server settings you should change the Endpoint field to the IP address that you're using in the URL. This will prevent the server certificate from being rejected by the client due to the URL not matching the contents of the server certificate.
    • Please also make sure that "Visibility of variables" is not set to "None".
    image.png


    • After making those changes, send the PLCnext Engineer project to the PLC, to update the self-signed server certificate.
    • In web-based management, the client certificate should be loaded to the OPC UA-configurable Trust Store on the PLC.
    • The OPC UA-self-signed server certificate should be downloaded from the Identity Store on the PLC (using web-based management) and given to the client application.

    If the format of any certificates needs to be changed, you can do this using the openssl command-line tool:

    https://knowledge.digicert.com/solution/how-to-convert-a-certificate-into-the-appropriate-format

    (the OPC UA server certificate downloaded from WBM is a .crt file in PEM format).

    The client will also need to provide user credentials during the connection to the server.

  • Martin PLCnext TeamMartin PLCnext Team

    I have now gone into this in more detail, and this procedure works:

    In PLCnext Engineer:

    • Create a new project from the relevant template.
    • Create a global variable of type INT with the OPC attribute ticked.
    • In the OPC UA Server settings, set the Endpoint name to the IP address of the PLC.
    • Set the Visibility of variables to "Marked".
    • Send the project to the PLC.

    In Web-based Management:

    • Download the OPC UA-self-signed server certificate from the Identity Store.
    • Upload the client certificate to the  OPC UA-configurable Trust Store (this will need to be converted from DER to PEM format using something like the openssl command-line tool).

    I used this python example:

    https://github.com/FreeOpcUa/opcua-asyncio/blob/master/examples/client-with-encryption.py
    • In the directory containing the python script, I created a subdirectory called "certificates" (for the client certificate) and another subdirectory called "examples\certificates\trusted" (this is the "trust store" that the client uses).
    • When I ran the script the first time, it produced the self-signed client certificate - that's the one I converted to PEM format and then uploaded to the Trust Store in the PLC.
    • I converted the server certificate to DER format. I put one copy of the server certificate in the same directory as the python script, and another copy of the server certificate in the client's Trust Store (examples\certificates\trusted)

    I made the following changes to the python script:

    • I changed the URL of the OPC UA server:
       url = "opc.tcp://192.168.1.10:4840"
    • In the call to client.set_security, I changed the name of the server certificate to the one from the PLC (this is the one in the client's trust store):
       await client.set_security(
        SecurityPolicyBasic256Sha256,
        certificate=str(cert),
        private_key=str(private_key),
        server_certificate="my_server_certificate.der"
    • Just before calling client.set_security, I added the user credentials for the client:
        client.set_user('admin')
    client.set_password('123abc6')  # Change this to the admin password on your PLC


    This will now establish a connection to the PLC, and you can read and write OPC UA variables in the same way that you did when security was disabled.

    Note that the self-signed server certificate may change if you make changes to the OPC UA server settings in PLCnext Engineer, so you might need to copy that to the client again.

  • janelle.tjanelle.t

    Hi Martin, Thanks for the update I will try this soon, unfortunately changing the security on the plc is a bit disruptive as it seems to do a reset of the plc

  • AlejandroFLAlejandroFL
    https://forum.plcnext-community.net/discussion/comment/13389#Comment_13389

    Dear martin i really needed his help to install plc next , have the error 101

    how i can solve this

    116a4139-18b5-4e58-82ea-89ef019df6bd.jpg


Sign In or Register to comment.