Marc Schier
4757db13a0
Build 14591 (logs/482) failed on net48 with 2 test errors after the
corpus expansion in eba7fc64 added a new ECC CSR seed (request-ecc.der):
Failed FuzzGoodTestcases(AflfuzzPkcs10CertificationRequest, request-ecc.der)
Failed FuzzGoodTestcases(LibfuzzPkcs10CertificationRequest, request-ecc.der)
System.NotSupportedException : ECDSA certificate signing request
verification is not supported on this platform. Please use .NET 6.0
or later.
at Opc.Ua.Security.Certificates.Pkcs10CertificationRequest.VerifyEcdsaSignature
at Opc.Ua.Security.Certificates.Pkcs10CertificationRequest.Verify
at Opc.Ua.Fuzzing.FuzzableCode.FuzzPkcs10CertificationRequestCore
Root cause: Pkcs10CertificationRequest.VerifyEcdsaSignature throws
NotSupportedException on net48 / .NET Standard 2.x because the
implementation requires ECDsa.ImportSubjectPublicKeyInfo which is only
available on .NET 6.0+. The production code is explicit about this:
// For .NET Framework 4.8 and .NET Standard 2.x, ECDSA CSR
// verification is not supported. This is acceptable as the GDS
// Server primarily uses RSA certificates.
throw new NotSupportedException(...);
And Pkcs10CertificationRequest.Verify() likewise explicitly rethrows
NotSupportedException with a comment "Unsupported algorithm - rethrow
to inform caller".
Fix: extend the existing catch list in FuzzPkcs10CertificationRequestCore
to also swallow NotSupportedException. The fuzz harness's purpose is to
find parser bugs in the binding; platform/algorithm gaps that production
code already documents as intentional are not findings. An inline
comment records the reasoning so this stays correct under future
refactors.
Scope: only FuzzableCode.Pkcs10.cs is touched. No other Fuzz target hit
NotSupportedException in the CI run, and Pkcs10CertificationRequest.Verify
is the only production caller that intentionally rethrows it through any
of these fuzz code paths.
Verified locally:
- Certificates.Fuzz.Tests net48: 460 / 0 failed (previously 2 failed)
- Certificates.Fuzz.Tests net10: 460 / 0 failed
- Encoders.Fuzz.Tests net48: 4131 / 0 failed
- Encoders.Fuzz.Tests net10: 4131 / 0 failed
- Network.Fuzz.Tests net10: 330 / 0 failed
- Network.Fuzz.Tests net48: N/A (project targets net8.0/net9.0/net10.0 only)
Total 5381 tests, 0 failures across the affected TFM matrix.
OPC UA .NET Stack
Overview
This OPC UA reference implementation targets .NET Framework, .NET, and .NET Standard 2.1.
.NET allows to develop apps that run on all common platforms available today, including Linux, iOS, Android (via Xamarin) and Windows without requiring platform-specific modifications.
One of the reference implementations inside this project has been certified for compliance through an OPC Foundation Certification Test Lab to prove its high quality. Fixes and enhancements since the certification process have been tested and verified for compliance using the latest Compliance Test Tool (CTT).
For a comprehensive list of supported OPC UA Profiles and Facets, see the dedicated documentation.
More samples based on the official Nuget packages can be found in the OPC UA .NET Samples repository. For development there is also a preview Nuget feed available. For local testing a Docker container of the Reference Server is available for preview and release builds.
Features included
Core and Libraries
- Fully ported Core OPC UA Stack and Libraries (Client, Server, Configuration, Complex Types & GDS assemblies).
- Reference sample Server and Client.
- X.509 Certificate support for client and server authentication.
- SHA-2 support (up to SHA512) including security profile Basic256Sha256, Aes128Sha256RsaOaep and Aes256Sha256RsaPss for configurations with high security needs.
- ECC Security policies ECC_nistP256, ECC_nistP384, ECC_brainpoolP256r1 and ECC_brainpoolP384r1.
- Anonymous, username and X.509 certificate user authentication.
- UA-TCP & HTTPS transports (client and server).
- Reverse Connect for the UA-TCP transport (client and server).
- Folder & OS-level (X509Store) Certificate Stores with Global Discovery Server and Server Push support.
- Sessions and (durable) Subscriptions.
- A PubSub library with samples.
New in 2.0
- Type safe built in types
- Source generator generated code behind during build
- See MigrationGuide for details.
- New AsyncCustomNodeManager (successor of CustomNodeManager2) with improved Locking Strategy, see Server Async (TAP) Support
- In our Load Test the Server shows at least 2.5x higher throughput under load with 750 subscriptions totaling 450k Monitored items and write times for 600 items below 5 seconds were before > 10 seconds were needed. Also for event at least 3x faster event reporting was observed.
- Unified Dependency Injection surface —
services.AddOpcUa()with fluentAddServer()/AddClient()/AddComplexTypes()/AddAlarms()/AddGdsServer()/AddLdsServer()/AddWotConServer()extensions forMicrosoft.Extensions.DependencyInjectionand the .NET Generic Host (AOT compatible via theAction<TOptions>overloads).
New in 1.05.378
- Support for AsyncNodeManagers in the Server Library, see Server Async (TAP) Support
- Reworked Observability via
ITelemetryContextin preparation for better DI support. See documentation for breaking changes. - Fully async APIs. Deprecated all sync and APM API.
New in 1.05.376
- Support for Durable Subscriptions
New in 1.05.375
- Support for ECC Certificates.
New in 1.05.374
- CRL Support for the X509Store on Windows
New in 1.05.373
- 1.05 Nodeset
- Support for WellKnownRoles & RoleBasedUserManagement.
Key Features and Updates in OPC UA 1.05
- Thread Safety and Locking: Improved thread safety and reduced locking in secure channel operations.
- Audit and Redaction: New interfaces for auditing and redacting sensitive information.
- Security Enhancements: Improved encryption and authentication mechanisms.
- CRL Support: Added Certificate Revocation List support for X509Store on Windows.
- Performance Improvements: Faster binary encoding and decoding, reducing memory usage and latency.
- Role-Based Management: Support for WellKnownRoles and RoleBasedUserManagement WellKnownRoles & RoleBasedUserManagement.
- Improved Logging: Enhanced logging with
ILoggerandEventSource. - ECC Profiles: Support for NIST & Brainpool Security Profiles.
- Durable Subscriptions: Support for Durable Subscriptions Durable Subscriptions.
New in 1.04.368
- Improved support for Logging with
ILoggerandEventSource. - Support for custom certificate stores with refactored
ICertificateStoreandCertificateStoreTypeinterface. - Client and Server support for TransferSubscriptions.
- How to use Container support with reference server.
Samples and Nuget packages
- OPC UA Console Reference Server for .NET. A Linux Container of the latest builds is available. See also Container support.
- The OPC UA Reference Server has been certified for compliance through an OPC Foundation Certification Test Lab. Fixes and enhancements since the certification process have been tested and verified for compliance using the Compliance Test Tool (CTT). All releases are verified for compliance with the latest official Compliance Test Tool by the maintainers.
- OPC UA Console Reference Publisher and Console Reference Subscriber for .NET and .NET Framework.
- An official OPC UA Nuget package of the core, client, server and configuration libraries is available for integration in .NET projects. Note: The package has been split into Core, Client and Server packages to reduce the dependencies in projects where only client or server is needed. The https binding is now a seperate optional package.
- A preview Nuget feed is available from Azure Devops.
Getting Started
All the tools you need to build .NET libraries and application come with the .NET SDK. You need the .net 10 SDK to build the project. To run applications you need one of the target .NET runtimes installed. See Get started with .NET for what you need.
How to build and run the reference samples in Visual Studio on Windows
- Open the
UA.slnxsolution file using Visual Studio 2026. Ensure you have all target frameworks enabled, including .NET 4.8.x, .NET 8.0, 9.0, and 10.0 (LTS) but Visual Studio will prompt you to install what is missing. - Choose a project in the Solution Explorer and set it with a right click as
Startup Project. - Hit
F5to build and execute the sample.
How to build and run the console samples on Windows, Linux and iOS
This section describes how to run the ConsoleReferenceServer sample application.
Please follow instructions in this article to setup the .NET 10 SDK which provides the dotnet command that allows you to build and run the samples on your platform. Once the dotnet command is available, navigate to the root folder in your local copy of the repository and execute dotnet restore 'UA.slnx'. This command calls into NuGet to restore the tree of dependencies.
Start the server
- Open a command prompt.
- Navigate to the folder Applications/ConsoleReferenceServer.
- To run the server sample type
dotnet run --project ConsoleReferenceServer.csproj -a.- The server is now running and waiting for connections.
Contributing
We strongly encourage community participation and contribution to this project. First, please fork the repository and commit your changes there. Once happy with your changes you can generate a 'pull request'.
You must agree to the contributor license agreement (CLA) before we can accept your changes. The CLA and "I AGREE" button is automatically displayed when you perform the pull request.
Remarks
Self signed certificates for the sample applications
All required application certificates for OPC UA are created at the first start of each application in a directory or OS-level certificate store and remain in use until deleted from the store. Please read Certificates for more information about certificates and stores
Local Discovery Server
By default all sample applications are configured to register with a Local Discovery Server (LDS). A reference implementation of a LDS for Windows can be downloaded here. To setup trust with the LDS the certificates need to be exchanged or registration will fail.