From 2148d65084dba117898fa4bfb68ca78203e25a0e Mon Sep 17 00:00:00 2001 From: Martin Regen Date: Wed, 7 Dec 2016 18:29:24 +0100 Subject: [PATCH] improve cert handling of sample apps - create self signed cert on first start (kudos to bouncy castle) - fix path handling in many areas, - ./ or ../ is treated as rooted dir - special %LocalFolder% for UWP apps to allow to write certs in app temp storage - all batch helpers to create certs removed --- .gitignore | 3 + CreateAllCerts.cmd | 30 -- .../ApplicationInstance.cs | 150 +++++++- .../Schema/InstalledApplication.cs | 4 +- .../Samples/Client.Net4/CreateCert.cmd | 10 - .../Client.Net4/UA Sample Client.csproj | 3 - SampleApplications/Samples/Client/App.xaml.cs | 5 + .../Samples/Client/CreateCert.cmd | 10 - .../Client/Opc.Ua.SampleClient.Config.xml | 37 +- .../Samples/Client/project.json | 1 + .../NetCoreConsoleClient/CreateCert.cmd | 10 - .../Samples/NetCoreConsoleClient/Program.cs | 37 +- .../NetCoreConsoleClient/createcert.sh | 17 - .../NetCoreConsoleClient/sampleclient.ext | 8 - .../NetCoreConsoleServer/CreateCert.cmd | 10 - .../Opc.Ua.SampleServer.Config.xml | 9 +- .../Samples/NetCoreConsoleServer/Program.cs | 2 +- .../NetCoreConsoleServer/createcert.sh | 17 - .../NetCoreConsoleServer/sampleserver.ext | 8 - .../Samples/Server.Net4/CreateCert.cmd | 10 - .../Server.Net4/UA Sample Server.csproj | 1 - SampleApplications/Samples/Server/App.xaml.cs | 5 + .../Samples/Server/CreateCert.cmd | 10 - .../Server/Opc.Ua.SampleServer.Config.xml | 42 ++- .../Samples/Server/Opc.Ua.SampleServer.csproj | 1 - .../Samples/Server/project.json | 1 + .../Workshop/Reference/Client/CreateCert.cmd | 10 - .../Quickstarts.ReferenceClient.Config.xml | 2 +- .../ConsoleReferenceServer/CreateCert.cmd | 10 - .../ConsoleReferenceServer/Program.cs | 2 +- .../Quickstarts.ReferenceServer.Config.xml | 2 +- .../ConsoleReferenceServer/createcert.sh | 17 - .../ConsoleReferenceServer/sampleserver.ext | 8 - .../Workshop/Reference/Server/CreateCert.cmd | 10 - .../Quickstarts.ReferenceServer.Config.xml | 16 +- .../Reference/Server/Reference Server.csproj | 3 +- .../Schema/ApplicationConfiguration.cs | 26 +- .../Certificates/CertificateFactory.cs | 354 +++++++++++++++++- .../Certificates/SecurityConfiguration.cs | 2 +- .../Configuration/ApplicationConfiguration.cs | 2 +- Stack/Opc.Ua.Core/Types/Utils/Utils.cs | 34 +- Stack/Opc.Ua.Core/project.json | 8 +- 42 files changed, 642 insertions(+), 305 deletions(-) delete mode 100644 CreateAllCerts.cmd delete mode 100644 SampleApplications/Samples/Client.Net4/CreateCert.cmd delete mode 100644 SampleApplications/Samples/Client/CreateCert.cmd delete mode 100644 SampleApplications/Samples/NetCoreConsoleClient/CreateCert.cmd delete mode 100755 SampleApplications/Samples/NetCoreConsoleClient/createcert.sh delete mode 100644 SampleApplications/Samples/NetCoreConsoleClient/sampleclient.ext delete mode 100644 SampleApplications/Samples/NetCoreConsoleServer/CreateCert.cmd delete mode 100755 SampleApplications/Samples/NetCoreConsoleServer/createcert.sh delete mode 100644 SampleApplications/Samples/NetCoreConsoleServer/sampleserver.ext delete mode 100644 SampleApplications/Samples/Server.Net4/CreateCert.cmd delete mode 100644 SampleApplications/Samples/Server/CreateCert.cmd delete mode 100644 SampleApplications/Workshop/Reference/Client/CreateCert.cmd delete mode 100644 SampleApplications/Workshop/Reference/ConsoleReferenceServer/CreateCert.cmd delete mode 100644 SampleApplications/Workshop/Reference/ConsoleReferenceServer/createcert.sh delete mode 100644 SampleApplications/Workshop/Reference/ConsoleReferenceServer/sampleserver.ext delete mode 100644 SampleApplications/Workshop/Reference/Server/CreateCert.cmd diff --git a/.gitignore b/.gitignore index 0a9ea7b6a2..11f93fe016 100644 --- a/.gitignore +++ b/.gitignore @@ -68,6 +68,7 @@ artifacts/ *.svclog *.scc + # Chutzpah Test files _Chutzpah* @@ -236,4 +237,6 @@ _Pvt_Extensions # OPC UA Sample app certificate stores OPC\ Foundation/ *.der +*.pfx /UA-NetStandard.VC.db +*.log.txt diff --git a/CreateAllCerts.cmd b/CreateAllCerts.cmd deleted file mode 100644 index ff8c0abff9..0000000000 --- a/CreateAllCerts.cmd +++ /dev/null @@ -1,30 +0,0 @@ -@echo off - -REM Create all certs for OPC UA apps -cd /D %~dp0 - -echo Clear all certificate stores and renew all certificates -echo Press key to continue or Ctrl-C to exit -pause >NUL - -rem ensure Opc.Ua.CertificateGenerator.exe exists -where /q Opc.Ua.CertificateGenerator.exe -if errorlevel 1 goto :NeedCertGenerator - -echo Creating all applications certificates - -For /R .\ %%G IN (CreateCer?.cmd) DO ( - pushd "%%~pG" - cmd /c CreateCert.cmd - popd -) -cd /D %~dp0 - -echo All certificates generated - -exit /b 0 - -:NeedCertGenerator -@Echo Opc.Ua.CertificateGenerator.exe not found -@Echo Please download from https://github.com/OPCFoundation/UA-.NETStandardLibrary -exit /b 1 \ No newline at end of file diff --git a/SampleApplications/SDK/Opc.Ua.Configuration/ApplicationInstance.cs b/SampleApplications/SDK/Opc.Ua.Configuration/ApplicationInstance.cs index 7ee5250c57..00ea655a54 100644 --- a/SampleApplications/SDK/Opc.Ua.Configuration/ApplicationInstance.cs +++ b/SampleApplications/SDK/Opc.Ua.Configuration/ApplicationInstance.cs @@ -696,6 +696,12 @@ namespace Opc.Ua.Configuration } } + // create a new certificate. + if (certificate == null) + { + certificate = await CreateApplicationInstanceCertificate(configuration, InstallConfig.MinimumKeySize, InstallConfig.LifeTimeInMonths); + } + // ensure the certificate is trusted. await AddToTrustedStore(configuration, certificate); @@ -981,25 +987,31 @@ namespace Opc.Ua.Configuration } } } - + if ((certificate == null) || !certificateValid) { - string message = Utils.Format( - "There is no cert with subject {0} in the configuration." + - "\r\n Please generate a cert for your application," + - "\r\n for example using the provided scripts in the sample" + - "\r\n application's project directory, or OpenSSL, or the" + - "\r\n OPC Foundation's certificate generator." + - "\r\n Then copy the new cert to this location:" + - "\r\n{1}", - id.SubjectName, - id.StorePath); - throw ServiceResultException.Create(StatusCodes.BadConfigurationError, message); - } + certificate = await CreateApplicationInstanceCertificate(configuration, minimumKeySize); - // ensure it is trusted. - await AddToTrustedStore(configuration, certificate); - + if (certificate == null) + { + string message = Utils.Format( + "There is no cert with subject {0} in the configuration." + + "\r\n Please generate a cert for your application," + + "\r\n for example using the provided scripts in the sample" + + "\r\n application's project directory, or OpenSSL, or the" + + "\r\n OPC Foundation's certificate generator." + + "\r\n Then copy the new cert to this location:" + + "\r\n{1}", + id.SubjectName, + id.StorePath); + throw ServiceResultException.Create(StatusCodes.BadConfigurationError, message); + } + } + else + { + // ensure it is trusted. + await AddToTrustedStore(configuration, certificate); + } // add to discovery server. if (configuration.ApplicationType == ApplicationType.Server || configuration.ApplicationType == ApplicationType.ClientAndServer) @@ -1202,7 +1214,111 @@ namespace Opc.Ua.Configuration return valid; } - + + /// + /// Creates the application instance certificate. + /// + /// The configuration. + /// Size of the key. + /// The lifetime in months. + /// The new certificate + private static async Task CreateApplicationInstanceCertificate( + ApplicationConfiguration configuration, + ushort minimumKeySize = CertificateFactory.defaultKeySize, + ushort lifeTimeInMonths = CertificateFactory.defaultLifeTime + ) + { + Utils.Trace(Utils.TraceMasks.Information, "Creating application instance certificate."); + + // delete any existing certificate. + DeleteApplicationInstanceCertificate(configuration); + + CertificateIdentifier id = configuration.SecurityConfiguration.ApplicationCertificate; + + // get the domains from the configuration file. + IList serverDomainNames = configuration.GetServerDomainNames(); + + if (serverDomainNames.Count == 0) + { + serverDomainNames.Add(Utils.GetHostName()); + } + + // ensure the certificate store directory exists. + if (id.StoreType == CertificateStoreType.Directory) + { + Utils.GetAbsoluteDirectoryPath(id.StorePath, true, true, true); + } + + X509Certificate2 certificate = CertificateFactory.CreateCertificate( + id.StoreType, + id.StorePath, + configuration.ApplicationUri, + configuration.ApplicationName, + id.SubjectName, + serverDomainNames, + minimumKeySize, + lifeTimeInMonths + ); + + id.Certificate = certificate; + + await AddToTrustedStore(configuration, certificate); + + await configuration.CertificateValidator.Update(configuration.SecurityConfiguration); + + Utils.Trace(Utils.TraceMasks.Information, "Certificate created. Thumbprint={0}", certificate.Thumbprint); + + // reload the certificate from disk. + await configuration.SecurityConfiguration.ApplicationCertificate.LoadPrivateKey(null); + + return certificate; + } + + /// + /// Deletes an existing application instance certificate. + /// + /// The configuration instance that stores the configurable information for a UA application. + private static async void DeleteApplicationInstanceCertificate(ApplicationConfiguration configuration) + { + Utils.Trace(Utils.TraceMasks.Information, "Deleting application instance certificate."); + + // create a default certificate id none specified. + CertificateIdentifier id = configuration.SecurityConfiguration.ApplicationCertificate; + + if (id == null) + { + return; + } + + // delete private key. + X509Certificate2 certificate = await id.Find(); + + // delete trusted peer certificate. + if (configuration.SecurityConfiguration != null && configuration.SecurityConfiguration.TrustedPeerCertificates != null) + { + string thumbprint = id.Thumbprint; + + if (certificate != null) + { + thumbprint = certificate.Thumbprint; + } + + using (ICertificateStore store = configuration.SecurityConfiguration.TrustedPeerCertificates.OpenStore()) + { + await store.Delete(thumbprint); + } + } + + // delete private key. + if (certificate != null) + { + using (ICertificateStore store = id.OpenStore()) + { + await store.Delete(certificate.Thumbprint); + } + } + } + /// /// Adds the application certificate to the discovery server trust list. /// diff --git a/SampleApplications/SDK/Opc.Ua.Configuration/Schema/InstalledApplication.cs b/SampleApplications/SDK/Opc.Ua.Configuration/Schema/InstalledApplication.cs index 53105107a9..3ef283b808 100644 --- a/SampleApplications/SDK/Opc.Ua.Configuration/Schema/InstalledApplication.cs +++ b/SampleApplications/SDK/Opc.Ua.Configuration/Schema/InstalledApplication.cs @@ -77,8 +77,8 @@ namespace Opc.Ua.Configuration ServicePassword = null; ServiceDescription = null; LocallyRegisterOIDs = false; - MinimumKeySize = 1024; - LifeTimeInMonths = 300; + MinimumKeySize = CertificateFactory.defaultKeySize; + LifeTimeInMonths = CertificateFactory.defaultLifeTime; } #endregion diff --git a/SampleApplications/Samples/Client.Net4/CreateCert.cmd b/SampleApplications/Samples/Client.Net4/CreateCert.cmd deleted file mode 100644 index 10300fbf74..0000000000 --- a/SampleApplications/Samples/Client.Net4/CreateCert.cmd +++ /dev/null @@ -1,10 +0,0 @@ -@echo off -REM create the app certificate -cd /D %~dp0 -set CERTSTORE=".\OPC Foundation\CertificateStores\MachineDefault" -rd /S/Q %CERTSTORE% -md %CERTSTORE% -..\..\..\Opc.Ua.CertificateGenerator.exe -cmd issue -sp %CERTSTORE% -ks 2048 -an "UA Sample Client" -dn %COMPUTERNAME% -sn "CN=UA Sample Client/DC=%COMPUTERNAME%" -au "urn:%COMPUTERNAME%:OPCFoundation:SampleClient" -set CERTSTORE= - - diff --git a/SampleApplications/Samples/Client.Net4/UA Sample Client.csproj b/SampleApplications/Samples/Client.Net4/UA Sample Client.csproj index 59b0b9cd26..ee0c2a1bdf 100644 --- a/SampleApplications/Samples/Client.Net4/UA Sample Client.csproj +++ b/SampleApplications/Samples/Client.Net4/UA Sample Client.csproj @@ -207,9 +207,6 @@ Always - - - - OPC Foundation\CertificateStores\MachineDefault + %LocalFolder%\OPC Foundation\CertificateStores\MachineDefault - UA Sample Client + Opc.Ua.SampleClient Directory - OPC Foundation\CertificateStores\UA Certificate Authorities + %LocalFolder%\OPC Foundation\CertificateStores\UA Certificate Authorities Directory - OPC Foundation\CertificateStores\UA Applications + %LocalFolder%\OPC Foundation\CertificateStores\UA Applications @@ -88,7 +88,7 @@ Directory - OPC Foundation\CertificateStores\RejectedCertificates + %LocalFolder%\OPC Foundation\CertificateStores\RejectedCertificates @@ -144,7 +144,6 @@ http://localhost:61211/UA/SampleClient/Basic256 --> opc.tcp://localhost:61210/UA/SampleClient - https://localhost:61212/UA/SampleClient/ http://opcfoundation.org/UA/SecurityPolicy#Basic256 + + Certificate_2 @@ -227,12 +238,12 @@ Issued tokens are any type of WS-Security compliant token This is a URN assigned by OASIS to SAML Security Tokens tokens must be encrypted - this specifies what algorithm to use - --> IssuedToken_3 urn:oasis:names:tc:SAML:1.0:assertion:Assertion http://opcfoundation.org/UA/SecurityPolicy#Basic256 + --> @@ -404,14 +415,14 @@ --> - Logs\Opc.Ua.SampleClient.log.txt + %LocalFolder%\Logs\Opc.Ua.SampleClient.log.txt true - + 513 - 515 + diff --git a/SampleApplications/Samples/Client/project.json b/SampleApplications/Samples/Client/project.json index f485155aa6..25fecea223 100644 --- a/SampleApplications/Samples/Client/project.json +++ b/SampleApplications/Samples/Client/project.json @@ -1,5 +1,6 @@ { "dependencies": { + "Portable.BouncyCastle": "1.8.1.2", "Microsoft.NETCore.UniversalWindowsPlatform": "5.2.2", "System.Xml.XmlDocument": "4.0.1" }, diff --git a/SampleApplications/Samples/NetCoreConsoleClient/CreateCert.cmd b/SampleApplications/Samples/NetCoreConsoleClient/CreateCert.cmd deleted file mode 100644 index a2571080bb..0000000000 --- a/SampleApplications/Samples/NetCoreConsoleClient/CreateCert.cmd +++ /dev/null @@ -1,10 +0,0 @@ -@echo off -REM create the app certificate for NetCoreConsoleClient -cd /D %~dp0 -set CERTSTORE=".\OPC Foundation\CertificateStores\MachineDefault" -rd /S/Q %CERTSTORE% -md %CERTSTORE% -..\..\..\Opc.Ua.CertificateGenerator.exe -cmd issue -sp %CERTSTORE% -ks 2048 -an "UA Sample Client" -dn %COMPUTERNAME% -sn "CN=UA Sample Client/DC=%COMPUTERNAME%" -au "urn:%COMPUTERNAME%:OPCFoundation:SampleClient" -set CERTSTORE= - - diff --git a/SampleApplications/Samples/NetCoreConsoleClient/Program.cs b/SampleApplications/Samples/NetCoreConsoleClient/Program.cs index fd511d8354..bb9c83dbb3 100644 --- a/SampleApplications/Samples/NetCoreConsoleClient/Program.cs +++ b/SampleApplications/Samples/NetCoreConsoleClient/Program.cs @@ -15,6 +15,7 @@ using System.Collections.Generic; using System.Threading.Tasks; using Opc.Ua; using Opc.Ua.Client; +using System.Security.Cryptography.X509Certificates; namespace NetCoreConsoleClient { @@ -49,31 +50,31 @@ namespace NetCoreConsoleClient Console.WriteLine("1 - Create an Application Configuration."); var config = new ApplicationConfiguration() { - ApplicationName = "UA Sample Client", + ApplicationName = "UA Core Sample Client", ApplicationType = ApplicationType.Client, - ApplicationUri = "urn:"+Utils.GetHostName()+":OPCFoundation:SampleClient", + ApplicationUri = "urn:"+Utils.GetHostName()+":OPCFoundation:CoreSampleClient", SecurityConfiguration = new SecurityConfiguration { ApplicationCertificate = new CertificateIdentifier { StoreType = "Directory", - StorePath = "./OPC Foundation/CertificateStores/MachineDefault", - SubjectName = Utils.Format("CN={0}, DC={1}", "UA Sample Client", Utils.GetHostName()) + StorePath = "OPC Foundation/CertificateStores/MachineDefault", + SubjectName = "UA Core Sample Client" }, TrustedPeerCertificates = new CertificateTrustList { StoreType = "Directory", - StorePath = "./OPC Foundation/CertificateStores/UA Applications", + StorePath = "OPC Foundation/CertificateStores/UA Applications", }, TrustedIssuerCertificates = new CertificateTrustList { StoreType = "Directory", - StorePath = "./OPC Foundation/CertificateStores/UA Certificate Authorities", + StorePath = "OPC Foundation/CertificateStores/UA Certificate Authorities", }, RejectedCertificateStore = new CertificateTrustList { StoreType = "Directory", - StorePath = "./OPC Foundation/CertificateStores/RejectedCertificates", + StorePath = "OPC Foundation/CertificateStores/RejectedCertificates", }, NonceLength = 32, AutoAcceptUntrustedCertificates = true @@ -82,10 +83,28 @@ namespace NetCoreConsoleClient TransportQuotas = new TransportQuotas { OperationTimeout = 15000 }, ClientConfiguration = new ClientConfiguration { DefaultSessionTimeout = 60000 } }; + await config.Validate(ApplicationType.Client); bool haveAppCertificate = config.SecurityConfiguration.ApplicationCertificate.Certificate != null; + if (!haveAppCertificate) + { + Console.WriteLine(" INFO: Create new application certificate: {0}", config.ApplicationName); + + X509Certificate2 certificate = CertificateFactory.CreateCertificate( + config.SecurityConfiguration.ApplicationCertificate.StoreType, + config.SecurityConfiguration.ApplicationCertificate.StorePath, + config.ApplicationUri, + config.ApplicationName + ); + + config.SecurityConfiguration.ApplicationCertificate.Certificate = certificate; + + } + + haveAppCertificate = config.SecurityConfiguration.ApplicationCertificate.Certificate != null; + if (haveAppCertificate) { config.ApplicationUri = Utils.GetApplicationUriFromCertificate(config.SecurityConfiguration.ApplicationCertificate.Certificate); @@ -95,7 +114,7 @@ namespace NetCoreConsoleClient config.CertificateValidator.CertificateValidation += new CertificateValidationEventHandler(CertificateValidator_CertificateValidation); } } - if (!haveAppCertificate) + else { Console.WriteLine(" WARN: missing application certificate, using unsecure connection."); } @@ -104,6 +123,8 @@ namespace NetCoreConsoleClient Uri endpointURI = new Uri(endpointURL); var endpointCollection = DiscoverEndpoints(config, endpointURI, 10); var selectedEndpoint = SelectUaTcpEndpoint(endpointCollection, haveAppCertificate); + Console.WriteLine(" Selected endpoint uses: {0}", + selectedEndpoint.SecurityPolicyUri.Substring(selectedEndpoint.SecurityPolicyUri.LastIndexOf('#') + 1)); Console.WriteLine("3 - Create a session with OPC UA server."); var endpointConfiguration = EndpointConfiguration.Create(config); diff --git a/SampleApplications/Samples/NetCoreConsoleClient/createcert.sh b/SampleApplications/Samples/NetCoreConsoleClient/createcert.sh deleted file mode 100755 index 4dfdb8acaf..0000000000 --- a/SampleApplications/Samples/NetCoreConsoleClient/createcert.sh +++ /dev/null @@ -1,17 +0,0 @@ -#!/bin/bash -# Create a UA Sample Client cert for OPC UA client -# -MYHOSTNAME=`echo $HOSTNAME | cut -f1 -d. ` -echo Create certificate $MYHOSTNAME for UA Sample Client -openssl req -newkey rsa:1024 -out cert.crt -keyout cert.key -subj "/DC=$MYHOSTNAME/CN=UA Sample Client" -nodes -openssl x509 -days 365 -req -in cert.crt -signkey cert.key -out cert.pem -sha1 -extfile sampleclient.ext -openssl pkcs12 -export -in cert.pem -inkey cert.key -out $MYHOSTNAME.pfx -nodes -passout pass: -openssl x509 -in cert.pem -out $MYHOSTNAME.der -outform DER -openssl x509 -in $MYHOSTNAME.der -inform DER -text -rm cert.* -rm -rf "./OPC Foundation" -mkdir -p "./OPC Foundation/CertificateStores/MachineDefault/certs" -mkdir -p "./OPC Foundation/CertificateStores/MachineDefault/private" -mv $MYHOSTNAME.der "./OPC Foundation/CertificateStores/MachineDefault/certs" -mv $MYHOSTNAME.pfx "./OPC Foundation/CertificateStores/MachineDefault/private" - diff --git a/SampleApplications/Samples/NetCoreConsoleClient/sampleclient.ext b/SampleApplications/Samples/NetCoreConsoleClient/sampleclient.ext deleted file mode 100644 index b5e1daf044..0000000000 --- a/SampleApplications/Samples/NetCoreConsoleClient/sampleclient.ext +++ /dev/null @@ -1,8 +0,0 @@ -# Extensions to add to a certificate request - -subjectKeyIdentifier=hash -subjectAltName=URI:urn:localhost:OPCFoundation:SampleClient -authorityKeyIdentifier=critical,keyid,issuer:always -basicConstraints = critical, CA:FALSE -keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign -extendedKeyUsage = critical, serverAuth, clientAuth diff --git a/SampleApplications/Samples/NetCoreConsoleServer/CreateCert.cmd b/SampleApplications/Samples/NetCoreConsoleServer/CreateCert.cmd deleted file mode 100644 index adcd89fdf4..0000000000 --- a/SampleApplications/Samples/NetCoreConsoleServer/CreateCert.cmd +++ /dev/null @@ -1,10 +0,0 @@ -@echo off -REM create the app certificate -cd /D %~dp0 -set CERTSTORE=".\OPC Foundation\CertificateStores\MachineDefault" -rd /S/Q %CERTSTORE% -md %CERTSTORE% -..\..\..\Opc.Ua.CertificateGenerator.exe -cmd issue -sp %CERTSTORE% -ks 2048 -an "UA Sample Server" -dn %COMPUTERNAME% -sn "CN=UA Sample Server/DC=%COMPUTERNAME%" -au "urn:%COMPUTERNAME%:OPCFoundation:SampleServer" -set CERTSTORE= - - diff --git a/SampleApplications/Samples/NetCoreConsoleServer/Opc.Ua.SampleServer.Config.xml b/SampleApplications/Samples/NetCoreConsoleServer/Opc.Ua.SampleServer.Config.xml index 3c58700050..08c5738add 100644 --- a/SampleApplications/Samples/NetCoreConsoleServer/Opc.Ua.SampleServer.Config.xml +++ b/SampleApplications/Samples/NetCoreConsoleServer/Opc.Ua.SampleServer.Config.xml @@ -4,8 +4,8 @@ xmlns="http://opcfoundation.org/UA/SDK/Configuration.xsd" schemaLocation="./Schema/ApplicationConfiguration.xsd" > - Opc.Ua.SampleServer - urn:localhost:OPCFoundation:SampleServer + UA Core Sample Server + urn:localhost:OPCFoundation:CoreSampleServer http://opcfoundation.org/UA/SampleServer Server_0 @@ -15,7 +15,7 @@ Directory OPC Foundation/CertificateStores/MachineDefault - UA Sample Server + UA Core Sample Server @@ -180,9 +180,8 @@ - Logs/Opc.Ua.SampleServer.log.txt + ./Logs/Opc.Ua.SampleServer.log.txt true - 0 diff --git a/SampleApplications/Samples/NetCoreConsoleServer/Program.cs b/SampleApplications/Samples/NetCoreConsoleServer/Program.cs index 67f596a470..8b1d0e486e 100644 --- a/SampleApplications/Samples/NetCoreConsoleServer/Program.cs +++ b/SampleApplications/Samples/NetCoreConsoleServer/Program.cs @@ -124,7 +124,7 @@ namespace NetCoreConsoleServer ApplicationInstance.MessageDlg = new ApplicationMessageDlg(); ApplicationInstance application = new ApplicationInstance(); - application.ApplicationName = "UA Sample Server"; + application.ApplicationName = "UA Core Sample Server"; application.ApplicationType = ApplicationType.Server; application.ConfigSectionName = "Opc.Ua.SampleServer"; diff --git a/SampleApplications/Samples/NetCoreConsoleServer/createcert.sh b/SampleApplications/Samples/NetCoreConsoleServer/createcert.sh deleted file mode 100755 index dde7b4d80a..0000000000 --- a/SampleApplications/Samples/NetCoreConsoleServer/createcert.sh +++ /dev/null @@ -1,17 +0,0 @@ -#!/bin/bash -# Create a UA Sample Server cert for OPC UA server -# -MYHOSTNAME=`echo $HOSTNAME | cut -f1 -d. ` -echo Create certificate $MYHOSTNAME for UA Sample Server -openssl req -newkey rsa:1024 -out cert.crt -keyout cert.key -subj "/DC=$MYHOSTNAME/CN=UA Sample Server" -nodes -openssl x509 -days 365 -req -in cert.crt -signkey cert.key -out cert.pem -sha1 -extfile sampleserver.ext -openssl pkcs12 -export -in cert.pem -inkey cert.key -out $MYHOSTNAME.pfx -nodes -passout pass: -openssl x509 -in cert.pem -out $MYHOSTNAME.der -outform DER -openssl x509 -in $MYHOSTNAME.der -inform DER -text -rm cert.* -rm -rf "./OPC Foundation" -mkdir -p "./OPC Foundation/CertificateStores/MachineDefault/certs" -mkdir -p "./OPC Foundation/CertificateStores/MachineDefault/private" -mv $MYHOSTNAME.der "./OPC Foundation/CertificateStores/MachineDefault/certs" -mv $MYHOSTNAME.pfx "./OPC Foundation/CertificateStores/MachineDefault/private" - diff --git a/SampleApplications/Samples/NetCoreConsoleServer/sampleserver.ext b/SampleApplications/Samples/NetCoreConsoleServer/sampleserver.ext deleted file mode 100644 index 66e611c66f..0000000000 --- a/SampleApplications/Samples/NetCoreConsoleServer/sampleserver.ext +++ /dev/null @@ -1,8 +0,0 @@ -# Extensions to add to a certificate request - -subjectKeyIdentifier=hash -subjectAltName=URI:urn:localhost:OPCFoundation:SampleServer -authorityKeyIdentifier=critical,keyid,issuer:always -basicConstraints = critical, CA:FALSE -keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign -extendedKeyUsage = critical, serverAuth, clientAuth diff --git a/SampleApplications/Samples/Server.Net4/CreateCert.cmd b/SampleApplications/Samples/Server.Net4/CreateCert.cmd deleted file mode 100644 index 1ede41b6d1..0000000000 --- a/SampleApplications/Samples/Server.Net4/CreateCert.cmd +++ /dev/null @@ -1,10 +0,0 @@ -@echo off -REM create the app certificate -cd /D %~dp0 -set CERTSTORE=".\OPC Foundation\CertificateStores\MachineDefault" -rd /S/Q %CERTSTORE% -md %CERTSTORE% -..\..\..\Opc.Ua.CertificateGenerator.exe -cmd issue -sp %CERTSTORE% -ks 2048 -an "UA Sample Server" -dn %COMPUTERNAME% -sn "CN=UA Sample Server/DC=%COMPUTERNAME%" -au "urn:%COMPUTERNAME%:OPCFoundation:SampleServer" -set CERTSTORE= - - diff --git a/SampleApplications/Samples/Server.Net4/UA Sample Server.csproj b/SampleApplications/Samples/Server.Net4/UA Sample Server.csproj index d9e2fe1ebc..9a8fa5c2a8 100644 --- a/SampleApplications/Samples/Server.Net4/UA Sample Server.csproj +++ b/SampleApplications/Samples/Server.Net4/UA Sample Server.csproj @@ -163,7 +163,6 @@ Always - Directory - OPC Foundation\CertificateStores\MachineDefault - UA Sample Server + %LocalFolder%\OPC Foundation\CertificateStores\MachineDefault + Opc.Ua.SampleServer Directory - OPC Foundation\CertificateStores\UA Certificate Authorities + %LocalFolder%\OPC Foundation\CertificateStores\UA Certificate Authorities Directory - OPC Foundation\CertificateStores\UA Applications + %LocalFolder%\OPC Foundation\CertificateStores\UA Applications Directory - OPC Foundation\CertificateStores\RejectedCertificates + %LocalFolder%\OPC Foundation\CertificateStores\RejectedCertificates @@ -55,7 +55,6 @@ opc.tcp://localhost:51210/UA/SampleServer - https://localhost:51212/UA/SampleServer/ + Anonymous_0 http://opcfoundation.org/UA/SecurityPolicy#None + + UserName_1 + + http://opcfoundation.org/UA/SecurityPolicy#Basic256 + + Certificate_2 + + http://opcfoundation.org/UA/SecurityPolicy#Basic256 - false + true 100 10000 3600000 @@ -166,12 +186,12 @@ - Logs\Opc.Ua.SampleServer.log.txt + %LocalFolder%\Logs\Opc.Ua.SampleServer.log.txt true - 515 + 513 diff --git a/SampleApplications/Samples/Server/Opc.Ua.SampleServer.csproj b/SampleApplications/Samples/Server/Opc.Ua.SampleServer.csproj index f0ed64e8ef..8cdbe5155f 100644 --- a/SampleApplications/Samples/Server/Opc.Ua.SampleServer.csproj +++ b/SampleApplications/Samples/Server/Opc.Ua.SampleServer.csproj @@ -103,7 +103,6 @@ Always - diff --git a/SampleApplications/Samples/Server/project.json b/SampleApplications/Samples/Server/project.json index f485155aa6..25fecea223 100644 --- a/SampleApplications/Samples/Server/project.json +++ b/SampleApplications/Samples/Server/project.json @@ -1,5 +1,6 @@ { "dependencies": { + "Portable.BouncyCastle": "1.8.1.2", "Microsoft.NETCore.UniversalWindowsPlatform": "5.2.2", "System.Xml.XmlDocument": "4.0.1" }, diff --git a/SampleApplications/Workshop/Reference/Client/CreateCert.cmd b/SampleApplications/Workshop/Reference/Client/CreateCert.cmd deleted file mode 100644 index 993ebedfcb..0000000000 --- a/SampleApplications/Workshop/Reference/Client/CreateCert.cmd +++ /dev/null @@ -1,10 +0,0 @@ -@echo off -REM create the app certificate -cd /D %~dp0 -set CERTSTORE=".\OPC Foundation\CertificateStores\MachineDefault" -rd /S/Q %CERTSTORE% -md %CERTSTORE% -..\..\..\..\Opc.Ua.CertificateGenerator.exe -cmd issue -sp %CERTSTORE% -ks 2048 -an "Quickstart Reference Client" -dn %COMPUTERNAME% -sn "CN=Quickstart Reference Client/DC=%COMPUTERNAME%" -au "urn:%COMPUTERNAME%:UA:Quickstarts:ReferenceServer" -set CERTSTORE= - - diff --git a/SampleApplications/Workshop/Reference/Client/Quickstarts.ReferenceClient.Config.xml b/SampleApplications/Workshop/Reference/Client/Quickstarts.ReferenceClient.Config.xml index c57a48812d..f2370a1238 100644 --- a/SampleApplications/Workshop/Reference/Client/Quickstarts.ReferenceClient.Config.xml +++ b/SampleApplications/Workshop/Reference/Client/Quickstarts.ReferenceClient.Config.xml @@ -78,7 +78,7 @@ - 515 + diff --git a/SampleApplications/Workshop/Reference/ConsoleReferenceServer/CreateCert.cmd b/SampleApplications/Workshop/Reference/ConsoleReferenceServer/CreateCert.cmd deleted file mode 100644 index fa723b8f5f..0000000000 --- a/SampleApplications/Workshop/Reference/ConsoleReferenceServer/CreateCert.cmd +++ /dev/null @@ -1,10 +0,0 @@ -@echo off -REM create the app certificate -cd /D %~dp0 -set CERTSTORE=".\OPC Foundation\CertificateStores\MachineDefault" -rd /S/Q %CERTSTORE% -md %CERTSTORE% -..\..\..\..\Opc.Ua.CertificateGenerator.exe -cmd issue -sp %CERTSTORE% -ks 2048 -an "Quickstart Reference Server" -dn %COMPUTERNAME% -sn "CN=Quickstart Reference Server/DC=%COMPUTERNAME%" -au "urn:%COMPUTERNAME%:UA:Quickstarts:ReferenceServer" -set CERTSTORE= - - diff --git a/SampleApplications/Workshop/Reference/ConsoleReferenceServer/Program.cs b/SampleApplications/Workshop/Reference/ConsoleReferenceServer/Program.cs index 47bbf64d99..e538d2ac51 100644 --- a/SampleApplications/Workshop/Reference/ConsoleReferenceServer/Program.cs +++ b/SampleApplications/Workshop/Reference/ConsoleReferenceServer/Program.cs @@ -131,7 +131,7 @@ namespace Quickstarts.ReferenceServer ApplicationConfiguration config = await application.LoadApplicationConfiguration(false); // check the application certificate. - bool haveAppCertificate = await application.CheckApplicationInstanceCertificate(false, 0); + bool haveAppCertificate = await application.CheckApplicationInstanceCertificate(false, CertificateFactory.defaultKeySize); if (!haveAppCertificate) { throw new Exception("Application instance certificate invalid!"); diff --git a/SampleApplications/Workshop/Reference/ConsoleReferenceServer/Quickstarts.ReferenceServer.Config.xml b/SampleApplications/Workshop/Reference/ConsoleReferenceServer/Quickstarts.ReferenceServer.Config.xml index 40ad5e9dd0..9da804e869 100644 --- a/SampleApplications/Workshop/Reference/ConsoleReferenceServer/Quickstarts.ReferenceServer.Config.xml +++ b/SampleApplications/Workshop/Reference/ConsoleReferenceServer/Quickstarts.ReferenceServer.Config.xml @@ -172,7 +172,7 @@ - Logs/Quickstarts.ReferenceServer.log.txt + ./Logs/Quickstarts.ReferenceServer.log.txt true diff --git a/SampleApplications/Workshop/Reference/ConsoleReferenceServer/createcert.sh b/SampleApplications/Workshop/Reference/ConsoleReferenceServer/createcert.sh deleted file mode 100644 index 34e71f84f5..0000000000 --- a/SampleApplications/Workshop/Reference/ConsoleReferenceServer/createcert.sh +++ /dev/null @@ -1,17 +0,0 @@ -#!/bin/bash -# Create a cert -# -MYHOSTNAME=`echo $HOSTNAME | cut -f1 -d. ` -echo Create certificate $MYHOSTNAME for UA Sample Server -openssl req -newkey rsa:1024 -out cert.crt -keyout cert.key -subj "/DC=$MYHOSTNAME/CN=Quickstart Reference Server" -nodes -openssl x509 -days 365 -req -in cert.crt -signkey cert.key -out cert.pem -sha1 -extfile sampleserver.ext -openssl pkcs12 -export -in cert.pem -inkey cert.key -out $MYHOSTNAME.pfx -nodes -passout pass: -openssl x509 -in cert.pem -out $MYHOSTNAME.der -outform DER -openssl x509 -in $MYHOSTNAME.der -inform DER -text -rm cert.* -rm -rf "./OPC Foundation" -mkdir -p "./OPC Foundation/CertificateStores/MachineDefault/certs" -mkdir -p "./OPC Foundation/CertificateStores/MachineDefault/private" -mv $MYHOSTNAME.der "./OPC Foundation/CertificateStores/MachineDefault/certs" -mv $MYHOSTNAME.pfx "./OPC Foundation/CertificateStores/MachineDefault/private" - diff --git a/SampleApplications/Workshop/Reference/ConsoleReferenceServer/sampleserver.ext b/SampleApplications/Workshop/Reference/ConsoleReferenceServer/sampleserver.ext deleted file mode 100644 index d63cc3fcf9..0000000000 --- a/SampleApplications/Workshop/Reference/ConsoleReferenceServer/sampleserver.ext +++ /dev/null @@ -1,8 +0,0 @@ -# Extensions to add to a certificate request - -subjectKeyIdentifier=hash -subjectAltName=URI:urn:localhost:UA:Quickstarts:ReferenceServer -authorityKeyIdentifier=critical,keyid,issuer:always -basicConstraints = critical, CA:FALSE -keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign -extendedKeyUsage = critical, serverAuth, clientAuth diff --git a/SampleApplications/Workshop/Reference/Server/CreateCert.cmd b/SampleApplications/Workshop/Reference/Server/CreateCert.cmd deleted file mode 100644 index fa723b8f5f..0000000000 --- a/SampleApplications/Workshop/Reference/Server/CreateCert.cmd +++ /dev/null @@ -1,10 +0,0 @@ -@echo off -REM create the app certificate -cd /D %~dp0 -set CERTSTORE=".\OPC Foundation\CertificateStores\MachineDefault" -rd /S/Q %CERTSTORE% -md %CERTSTORE% -..\..\..\..\Opc.Ua.CertificateGenerator.exe -cmd issue -sp %CERTSTORE% -ks 2048 -an "Quickstart Reference Server" -dn %COMPUTERNAME% -sn "CN=Quickstart Reference Server/DC=%COMPUTERNAME%" -au "urn:%COMPUTERNAME%:UA:Quickstarts:ReferenceServer" -set CERTSTORE= - - diff --git a/SampleApplications/Workshop/Reference/Server/Quickstarts.ReferenceServer.Config.xml b/SampleApplications/Workshop/Reference/Server/Quickstarts.ReferenceServer.Config.xml index 81127c91a8..3c0e1e7c12 100644 --- a/SampleApplications/Workshop/Reference/Server/Quickstarts.ReferenceServer.Config.xml +++ b/SampleApplications/Workshop/Reference/Server/Quickstarts.ReferenceServer.Config.xml @@ -62,7 +62,7 @@ SignAndEncrypt_3 http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15 - 3 + 4 Sign_2 @@ -82,7 +82,17 @@ SignAndEncrypt_3 http://opcfoundation.org/UA/SecurityPolicy#Basic256 - 4 + 5 + + + Sign_2 + http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256 + 3 + + + SignAndEncrypt_3 + http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256 + 6 @@ -122,7 +132,7 @@ 600000 100 3600000 - 100 + 50 3600000 100 100 diff --git a/SampleApplications/Workshop/Reference/Server/Reference Server.csproj b/SampleApplications/Workshop/Reference/Server/Reference Server.csproj index d02b060e44..7f2dfef9ce 100644 --- a/SampleApplications/Workshop/Reference/Server/Reference Server.csproj +++ b/SampleApplications/Workshop/Reference/Server/Reference Server.csproj @@ -161,8 +161,7 @@ - rmdir /s/q "$(TargetDir)OPC Foundation\CertificateStores\MachineDefault" -mkdir "$(ProjectDir)OPC Foundation" + mkdir "$(ProjectDir)OPC Foundation" xcopy "$(ProjectDir)OPC Foundation\*.*" "$(TargetDir)OPC Foundation" /I/E/R/Y