319ea88726 [Server/Client] Support RSAEncryptedSecret format and unify EncryptedSecret RSA/ECC API with legacy .NET and test compatibility (#3678)
* Initial plan

* feat(server): support RSAEncryptedSecret username token decryption

Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/f79e2eec-5b14-4ffb-8ee0-2906a95e56fd

Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>

* test: add RSAEncryptedSecret username token coverage and harden parsing

Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/f79e2eec-5b14-4ffb-8ee0-2906a95e56fd

Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>

* feat(client): use RSAEncryptedSecret for long username passwords

Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/4b5a3cbb-9110-4fe5-907d-7b8ffccf2a16

Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>

* fix(core): add framework-compatible zeroing and SHA1 hash helpers

Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/732365b9-45fe-4c20-bfa9-b6b7dc9ad4e4

Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>

* fix(core): tighten crypto helper compatibility guards

Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/732365b9-45fe-4c20-bfa9-b6b7dc9ad4e4

Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>

* chore(core): simplify zero-memory preprocessor guard

Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/732365b9-45fe-4c20-bfa9-b6b7dc9ad4e4

Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>

* test(core): add legacy-framework crypto polyfills in username token tests

Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/87851fe9-59ab-453b-a0a7-7cb3134e4e0d

Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>

* chore(test): rename RNG local for readability

Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/87851fe9-59ab-453b-a0a7-7cb3134e4e0d

Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>

* refactor(core): move RSAEncryptedSecret handling into EncryptedSecret

Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/1a47ef6e-03ba-413c-8aee-1c03f870d3fe

Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>

* chore(core): polish EncryptedSecret RSA refactor review items

Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/1a47ef6e-03ba-413c-8aee-1c03f870d3fe

Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>

* refactor(core): add RSA EncryptedSecret factory and clarify timestamp guard

Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/1a47ef6e-03ba-413c-8aee-1c03f870d3fe

Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>

* refactor(core): unify EncryptedSecret API for RSA and ECC

Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/09578bca-fa2d-4916-8bd3-8d68470e91e1

Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>

* refactor(core): add unified TryDecrypt handling and ECC failure test

Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/09578bca-fa2d-4916-8bd3-8d68470e91e1

Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>

* chore(core): refine unified TryDecrypt exception handling

Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/09578bca-fa2d-4916-8bd3-8d68470e91e1

Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>

* docs(core): clarify unified EncryptedSecret API behavior

Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/09578bca-fa2d-4916-8bd3-8d68470e91e1

Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>

* chore(core): improve ECC decrypt diagnostics and docs

Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/09578bca-fa2d-4916-8bd3-8d68470e91e1

Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>

* chore(core): polish unified API wording and ECC test naming

Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/09578bca-fa2d-4916-8bd3-8d68470e91e1

Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>

* chore(core): remove TryDecrypt magic number and simplify ECC error text

Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/09578bca-fa2d-4916-8bd3-8d68470e91e1

Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>

* chore(core): consolidate TryDecrypt catches with exception filter

Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/09578bca-fa2d-4916-8bd3-8d68470e91e1

Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
2026-04-21 05:03:00 +02:00
2020-05-15 19:41:55 +02:00
2021-07-26 10:06:51 +03:00

OPC UA .NET Stack

Github top language Github stars Github forks Github size Github release Nuget Downloads Azure DevOps Github Actions Tests CodeQL Coverage Status Connection Stability

Overview

This OPC UA reference implementation targets .NET Framework, .NET, and .NET Standard 2.1.

.NET allows to develop apps that run on all common platforms available today, including Linux, iOS, Android (via Xamarin) and Windows without requiring platform-specific modifications.

One of the reference implementations inside this project has been certified for compliance through an OPC Foundation Certification Test Lab to prove its high quality. Fixes and enhancements since the certification process have been tested and verified for compliance using the latest Compliance Test Tool (CTT).

For a comprehensive list of supported OPC UA Profiles and Facets, see the dedicated documentation.

More samples based on the official Nuget packages can be found in the OPC UA .NET Samples repository. For development there is also a preview Nuget feed available. For local testing a Docker container of the Reference Server is available for preview and release builds.

Features included

Core and Libraries

  • Fully ported Core OPC UA Stack and Libraries (Client, Server, Configuration, Complex Types & GDS assemblies).
  • Reference sample Server and Client.
  • X.509 Certificate support for client and server authentication.
  • SHA-2 support (up to SHA512) including security profile Basic256Sha256, Aes128Sha256RsaOaep and Aes256Sha256RsaPss for configurations with high security needs.
  • ECC Security policies ECC_nistP256, ECC_nistP384, ECC_brainpoolP256r1 and ECC_brainpoolP384r1.
  • Anonymous, username and X.509 certificate user authentication.
  • UA-TCP & HTTPS transports (client and server).
  • Reverse Connect for the UA-TCP transport (client and server).
  • Folder & OS-level (X509Store) Certificate Stores with Global Discovery Server and Server Push support.
  • Sessions and (durable) Subscriptions.
  • A PubSub library with samples.

New in 1.6

  • Type safe built in types
  • Source generator generated code behind during build
  • See MigrationGuide for details.
  • New AsyncCustomNodeManager (successor of CustomNodeManager2) with improved Locking Strategy, see Server Async (TAP) Support
  • In our Load Test the Server shows at least 2.5x higher throughput under load with 750 subscriptions totaling 450k Monitored items and write times for 600 items below 5 seconds were before > 10 seconds were needed. Also for event at least 3x faster event reporting was observed.

New in 1.05.378

  • Support for AsyncNodeManagers in the Server Library, see Server Async (TAP) Support
  • Reworked Observability via ITelemetryContext in preparation for better DI support. See documentation for breaking changes.
  • Fully async APIs. Deprecated all sync and APM API.

New in 1.05.376

New in 1.05.375

New in 1.05.374

  • CRL Support for the X509Store on Windows

New in 1.05.373

Key Features and Updates in OPC UA 1.05

  • Thread Safety and Locking: Improved thread safety and reduced locking in secure channel operations.
  • Audit and Redaction: New interfaces for auditing and redacting sensitive information.
  • Security Enhancements: Improved encryption and authentication mechanisms.
  • CRL Support: Added Certificate Revocation List support for X509Store on Windows.
  • Performance Improvements: Faster binary encoding and decoding, reducing memory usage and latency.
  • Role-Based Management: Support for WellKnownRoles and RoleBasedUserManagement WellKnownRoles & RoleBasedUserManagement.
  • Improved Logging: Enhanced logging with ILogger and EventSource.
  • ECC Profiles: Support for NIST & Brainpool Security Profiles.
  • Durable Subscriptions: Support for Durable Subscriptions Durable Subscriptions.

New in 1.04.368

  • Improved support for Logging with ILogger and EventSource.
  • Support for custom certificate stores with refactored ICertificateStore and CertificateStoreType interface.
  • Client and Server support for TransferSubscriptions.
  • How to use Container support with reference server.

Samples and Nuget packages

Getting Started

All the tools you need to build .NET libraries and application come with the .NET SDK. You need the .net 10 SDK to build the project. To run applications you need one of the target .NET runtimes installed. See Get started with .NET for what you need.

How to build and run the reference samples in Visual Studio on Windows

  1. Open the UA.slnx solution file using Visual Studio 2026. Ensure you have all target frameworks enabled, including .NET 4.8.x, .NET 8.0, 9.0, and 10.0 (LTS) but Visual Studio will prompt you to install what is missing.
  2. Choose a project in the Solution Explorer and set it with a right click as Startup Project.
  3. Hit F5 to build and execute the sample.

How to build and run the console samples on Windows, Linux and iOS

This section describes how to run the ConsoleReferenceServer sample application.

Please follow instructions in this article to setup the .NET 10 SDK which provides the dotnet command that allows you to build and run the samples on your platform. Once the dotnet command is available, navigate to the root folder in your local copy of the repository and execute dotnet restore 'UA.slnx'. This command calls into NuGet to restore the tree of dependencies.

Start the server

  1. Open a command prompt.
  2. Navigate to the folder Applications/ConsoleReferenceServer.
  3. To run the server sample type dotnet run --project ConsoleReferenceServer.csproj -a.
    • The server is now running and waiting for connections.

Contributing

We strongly encourage community participation and contribution to this project. First, please fork the repository and commit your changes there. Once happy with your changes you can generate a 'pull request'.

You must agree to the contributor license agreement (CLA) before we can accept your changes. The CLA and "I AGREE" button is automatically displayed when you perform the pull request.

Remarks

Self signed certificates for the sample applications

All required application certificates for OPC UA are created at the first start of each application in a directory or OS-level certificate store and remain in use until deleted from the store. Please read Certificates for more information about certificates and stores

Local Discovery Server

By default all sample applications are configured to register with a Local Discovery Server (LDS). A reference implementation of a LDS for Windows can be downloaded here. To setup trust with the LDS the certificates need to be exchanged or registration will fail.

S
Description
OPC Unified Architecture .NET Standard
Readme
296 MiB
Languages
C# 99.4%
PowerShell 0.2%