mirror of
https://github.com/OPCFoundation/UA-.NETStandard.git
synced 2026-10-20 16:52:07 +08:00
Suciu Mircea Adrian
f001eabcc8
- Port support for ECC NIST/Brainpool profiles from prototyping_ecc branch - Implement CertProvider to load certs per connection / profile - Backward compatibility of configuration for existing apps - SecurityConfiguration specifies app cert types for each profile - Autodetect the ECC support for brainpool/nist based on platform (mac OS 10 doesn't support brainpool) - ECC supported on net48 / net5.0 / net 6.0 / netstandard2.1 - ECC supported on windows / linux / macOS (brainpool not < macOS11) - Self signed certs for each profile are created on start similar to RSA - RSA only profiles are supported on .NET standard 2.0 Co-authored-by: Martin Regen <mregen@microsoft.com>
373 lines
17 KiB
XML
373 lines
17 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<ApplicationConfiguration
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xmlns:ua="http://opcfoundation.org/UA/2008/02/Types.xsd"
|
|
xmlns="http://opcfoundation.org/UA/SDK/Configuration.xsd"
|
|
>
|
|
<!-- xsi:schemaLocation="http://opcfoundation.org/UA/SDK/Configuration.xsd ./Configuration.xsd" -->
|
|
<ApplicationName>Quickstart Reference Server</ApplicationName>
|
|
<ApplicationUri>urn:localhost:UA:Quickstarts:ReferenceServer</ApplicationUri>
|
|
<ProductUri>uri:opcfoundation.org:Quickstarts:ReferenceServer</ProductUri>
|
|
<ApplicationType>Server_0</ApplicationType>
|
|
|
|
<SecurityConfiguration>
|
|
<!-- Which certificate types are supported -->
|
|
<ApplicationCertificates>
|
|
<CertificateIdentifier>
|
|
<StoreType>Directory</StoreType>
|
|
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
|
|
<SubjectName>CN=Quickstart Reference Server, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
|
|
<CertificateTypeString>RsaSha256</CertificateTypeString>
|
|
</CertificateIdentifier>
|
|
<CertificateIdentifier>
|
|
<!-- <TypeId>NistP256</TypeId> -->
|
|
<StoreType>Directory</StoreType>
|
|
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
|
|
<SubjectName>CN=Quickstart Reference Server, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
|
|
<CertificateTypeString>NistP256</CertificateTypeString>
|
|
</CertificateIdentifier>
|
|
<CertificateIdentifier>
|
|
<!-- <TypeId>NistP384</TypeId> -->
|
|
<StoreType>Directory</StoreType>
|
|
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
|
|
<SubjectName>CN=Quickstart Reference Server, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
|
|
<CertificateTypeString>NistP384</CertificateTypeString>
|
|
</CertificateIdentifier>
|
|
<CertificateIdentifier>
|
|
<!-- <TypeId>BrainpoolP256r1</TypeId> -->
|
|
<StoreType>Directory</StoreType>
|
|
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
|
|
<SubjectName>CN=Quickstart Reference Server, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
|
|
<CertificateTypeString>BrainpoolP256r1</CertificateTypeString>
|
|
</CertificateIdentifier>
|
|
<CertificateIdentifier>
|
|
<!-- <TypeId>BrainpoolP384r1</TypeId> -->
|
|
<StoreType>Directory</StoreType>
|
|
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
|
|
<SubjectName>CN=Quickstart Reference Server, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
|
|
<CertificateTypeString>BrainpoolP384r1</CertificateTypeString>
|
|
</CertificateIdentifier>
|
|
</ApplicationCertificates>
|
|
|
|
<!-- Where the other application certificates are stored -->
|
|
|
|
<!-- Where the issuer certificate are stored (certificate authorities) -->
|
|
<TrustedIssuerCertificates>
|
|
<StoreType>Directory</StoreType>
|
|
<StorePath>%LocalApplicationData%/OPC Foundation/pki/issuer</StorePath>
|
|
</TrustedIssuerCertificates>
|
|
|
|
<!-- Where the trust list is stored -->
|
|
<TrustedPeerCertificates>
|
|
<StoreType>Directory</StoreType>
|
|
<StorePath>%LocalApplicationData%/OPC Foundation/pki/trusted</StorePath>
|
|
</TrustedPeerCertificates>
|
|
|
|
<!-- The directory used to store invalid certificates for later review by the administrator. -->
|
|
<RejectedCertificateStore>
|
|
<StoreType>Directory</StoreType>
|
|
<StorePath>%LocalApplicationData%/OPC Foundation/pki/rejected</StorePath>
|
|
</RejectedCertificateStore>
|
|
<MaxRejectedCertificates>5</MaxRejectedCertificates>
|
|
|
|
<!-- WARNING: The following setting (to automatically accept untrusted certificates) should be used
|
|
for easy debugging purposes ONLY and turned off for production deployments! -->
|
|
<AutoAcceptUntrustedCertificates>false</AutoAcceptUntrustedCertificates>
|
|
|
|
<!-- WARNING: SHA1 signed certificates are by default rejected and should be phased out.
|
|
only nano and embedded profiles are allowed to use sha1 signed certificates. -->
|
|
<RejectSHA1SignedCertificates>true</RejectSHA1SignedCertificates>
|
|
<RejectUnknownRevocationStatus>true</RejectUnknownRevocationStatus>
|
|
<MinimumCertificateKeySize>2048</MinimumCertificateKeySize>
|
|
<AddAppCertToTrustedStore>false</AddAppCertToTrustedStore>
|
|
<SendCertificateChain>true</SendCertificateChain>
|
|
|
|
<!-- Where the User issuer certificates are stored -->
|
|
<UserIssuerCertificates>
|
|
<StoreType>Directory</StoreType>
|
|
<StorePath>%LocalApplicationData%/OPC Foundation/pki/issuerUser</StorePath>
|
|
</UserIssuerCertificates>
|
|
|
|
<!-- Where the User trust list is stored-->
|
|
<TrustedUserCertificates>
|
|
<StoreType>Directory</StoreType>
|
|
<StorePath>%LocalApplicationData%/OPC Foundation/pki/trustedUser</StorePath>
|
|
</TrustedUserCertificates>
|
|
</SecurityConfiguration>
|
|
|
|
<TransportConfigurations></TransportConfigurations>
|
|
<TransportQuotas>
|
|
<OperationTimeout>120000</OperationTimeout>
|
|
<MaxStringLength>1048576</MaxStringLength>
|
|
<MaxByteStringLength>1048576</MaxByteStringLength>
|
|
<MaxArrayLength>65535</MaxArrayLength>
|
|
<MaxMessageSize>4194304</MaxMessageSize>
|
|
<MaxBufferSize>65535</MaxBufferSize>
|
|
<ChannelLifetime>30000</ChannelLifetime>
|
|
<SecurityTokenLifetime>3600000</SecurityTokenLifetime>
|
|
</TransportQuotas>
|
|
<ServerConfiguration>
|
|
<BaseAddresses>
|
|
<ua:String>opc.https://localhost:62540/Quickstarts/ReferenceServer</ua:String>
|
|
<ua:String>opc.tcp://localhost:62541/Quickstarts/ReferenceServer</ua:String>
|
|
<!--<ua:String>https://localhost:62542/Quickstarts/ReferenceServer</ua:String>-->
|
|
</BaseAddresses>
|
|
<!--
|
|
These list the alternate addresses (via firewalls, multiple NICs etc.) that can be
|
|
used to communicate with the server. The URL used by the client when calling
|
|
FindServers/GetEndpoints or CreateSession will be used to filter the list of
|
|
endpoints returned by checking for alternate base addresses that have a domain
|
|
that matches the domain in the url provided by the client.
|
|
|
|
Note that any additional domains should be listed in the server's certificate. If they
|
|
are left out the client make refuse to connect because it has no way to know if the
|
|
alternate domain was authorized by the server administrator.
|
|
-->
|
|
<!--
|
|
<AlternateBaseAddresses>
|
|
<ua:String>opc.tcp://AlternateHostName/Quickstarts/ReferenceServer</ua:String>
|
|
<ua:String>opc.tcp://10.10.103.150/Quickstarts/ReferenceServer</ua:String>
|
|
<ua:String>opc.tcp://[2a01::626d]/Quickstarts/ReferenceServer</ua:String>
|
|
</AlternateBaseAddresses>
|
|
-->
|
|
<SecurityPolicies>
|
|
<!-- the first policy is used for the https endpoint -->
|
|
<ServerSecurityPolicy>
|
|
<SecurityMode>SignAndEncrypt_3</SecurityMode>
|
|
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</SecurityPolicyUri>
|
|
</ServerSecurityPolicy>
|
|
<ServerSecurityPolicy>
|
|
<SecurityMode>Sign_2</SecurityMode>
|
|
<SecurityPolicyUri></SecurityPolicyUri>
|
|
</ServerSecurityPolicy>
|
|
<ServerSecurityPolicy>
|
|
<SecurityMode>SignAndEncrypt_3</SecurityMode>
|
|
<SecurityPolicyUri></SecurityPolicyUri>
|
|
</ServerSecurityPolicy>
|
|
<ServerSecurityPolicy>
|
|
<SecurityMode>Sign_2</SecurityMode>
|
|
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_nistP256</SecurityPolicyUri>
|
|
</ServerSecurityPolicy>
|
|
<ServerSecurityPolicy>
|
|
<SecurityMode>Sign_2</SecurityMode>
|
|
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_nistP384</SecurityPolicyUri>
|
|
</ServerSecurityPolicy>
|
|
<ServerSecurityPolicy>
|
|
<SecurityMode>Sign_2</SecurityMode>
|
|
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_brainpoolP256r1</SecurityPolicyUri>
|
|
</ServerSecurityPolicy>
|
|
<ServerSecurityPolicy>
|
|
<SecurityMode>Sign_2</SecurityMode>
|
|
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_brainpoolP384r1</SecurityPolicyUri>
|
|
</ServerSecurityPolicy>
|
|
<ServerSecurityPolicy>
|
|
<SecurityMode>SignAndEncrypt_3</SecurityMode>
|
|
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_nistP256</SecurityPolicyUri>
|
|
</ServerSecurityPolicy>
|
|
<ServerSecurityPolicy>
|
|
<SecurityMode>SignAndEncrypt_3</SecurityMode>
|
|
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_nistP384</SecurityPolicyUri>
|
|
</ServerSecurityPolicy>
|
|
<ServerSecurityPolicy>
|
|
<SecurityMode>SignAndEncrypt_3</SecurityMode>
|
|
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_brainpoolP256r1</SecurityPolicyUri>
|
|
</ServerSecurityPolicy>
|
|
<ServerSecurityPolicy>
|
|
<SecurityMode>SignAndEncrypt_3</SecurityMode>
|
|
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_brainpoolP384r1</SecurityPolicyUri>
|
|
</ServerSecurityPolicy>
|
|
<ServerSecurityPolicy>
|
|
<SecurityMode>None_1</SecurityMode>
|
|
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#None</SecurityPolicyUri>
|
|
</ServerSecurityPolicy>
|
|
<!-- deprecated security policies for reference only
|
|
<ServerSecurityPolicy>
|
|
<SecurityMode>Sign_2</SecurityMode>
|
|
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256</SecurityPolicyUri>
|
|
</ServerSecurityPolicy>
|
|
<ServerSecurityPolicy>
|
|
<SecurityMode>SignAndEncrypt_3</SecurityMode>
|
|
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256</SecurityPolicyUri>
|
|
</ServerSecurityPolicy>
|
|
-->
|
|
</SecurityPolicies>
|
|
|
|
<MinRequestThreadCount>5</MinRequestThreadCount>
|
|
<MaxRequestThreadCount>100</MaxRequestThreadCount>
|
|
<MaxQueuedRequestCount>2000</MaxQueuedRequestCount>
|
|
|
|
<!-- The SDK expects the server to support the same set of user tokens for every endpoint. -->
|
|
<UserTokenPolicies>
|
|
<!-- Allows anonymous users -->
|
|
<ua:UserTokenPolicy>
|
|
<ua:TokenType>Anonymous_0</ua:TokenType>
|
|
<!-- <ua:SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#None</ua:SecurityPolicyUri> -->
|
|
</ua:UserTokenPolicy>
|
|
|
|
<!-- Allows username/password -->
|
|
<ua:UserTokenPolicy>
|
|
<ua:TokenType>UserName_1</ua:TokenType>
|
|
<!-- passwords must be encrypted - this specifies what algorithm to use -->
|
|
<!-- if no algorithm is specified, the active security policy is used -->
|
|
<!-- <ua:SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</ua:SecurityPolicyUri> -->
|
|
</ua:UserTokenPolicy>
|
|
|
|
<!-- Allows user certificates -->
|
|
<ua:UserTokenPolicy>
|
|
<ua:TokenType>Certificate_2</ua:TokenType>
|
|
<!-- certificate possession must be proven with a digital signature - this specifies what algorithm to use -->
|
|
<!-- if no algorithm is specified, the active security policy is used -->
|
|
<!-- <ua:SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</ua:SecurityPolicyUri> -->
|
|
</ua:UserTokenPolicy>
|
|
</UserTokenPolicies>
|
|
<DiagnosticsEnabled>true</DiagnosticsEnabled>
|
|
<!-- Settings for CTT testing -->
|
|
<MaxSessionCount>75</MaxSessionCount>
|
|
<MaxChannelCount>1000</MaxChannelCount>
|
|
<MinSessionTimeout>10000</MinSessionTimeout>
|
|
<MaxSessionTimeout>3600000</MaxSessionTimeout>
|
|
<MaxBrowseContinuationPoints>10</MaxBrowseContinuationPoints>
|
|
<MaxQueryContinuationPoints>10</MaxQueryContinuationPoints>
|
|
<MaxHistoryContinuationPoints>100</MaxHistoryContinuationPoints>
|
|
<MaxRequestAge>600000</MaxRequestAge>
|
|
<MinPublishingInterval>50</MinPublishingInterval>
|
|
<MaxPublishingInterval>3600000</MaxPublishingInterval>
|
|
<PublishingResolution>50</PublishingResolution>
|
|
<MaxSubscriptionLifetime>3600000</MaxSubscriptionLifetime>
|
|
<MaxMessageQueueSize>100</MaxMessageQueueSize>
|
|
<MaxNotificationQueueSize>100</MaxNotificationQueueSize>
|
|
<MaxNotificationsPerPublish>1000</MaxNotificationsPerPublish>
|
|
<MinMetadataSamplingInterval>1000</MinMetadataSamplingInterval>
|
|
<AvailableSamplingRates>
|
|
<SamplingRateGroup>
|
|
<Start>5</Start>
|
|
<Increment>5</Increment>
|
|
<Count>20</Count>
|
|
</SamplingRateGroup>
|
|
<SamplingRateGroup>
|
|
<Start>100</Start>
|
|
<Increment>100</Increment>
|
|
<Count>4</Count>
|
|
</SamplingRateGroup>
|
|
<SamplingRateGroup>
|
|
<Start>500</Start>
|
|
<Increment>250</Increment>
|
|
<Count>2</Count>
|
|
</SamplingRateGroup>
|
|
<SamplingRateGroup>
|
|
<Start>1000</Start>
|
|
<Increment>500</Increment>
|
|
<Count>20</Count>
|
|
</SamplingRateGroup>
|
|
</AvailableSamplingRates>
|
|
|
|
<RegistrationEndpoint>
|
|
<ua:EndpointUrl>opc.tcp://localhost:4840</ua:EndpointUrl>
|
|
<ua:Server>
|
|
<ua:ApplicationUri>opc.tcp://localhost:4840</ua:ApplicationUri>
|
|
<ua:ApplicationType>DiscoveryServer_3</ua:ApplicationType>
|
|
<ua:DiscoveryUrls>
|
|
<ua:String>opc.tcp://localhost:4840</ua:String>
|
|
</ua:DiscoveryUrls>
|
|
</ua:Server>
|
|
<ua:SecurityMode>SignAndEncrypt_3</ua:SecurityMode>
|
|
<ua:SecurityPolicyUri />
|
|
<ua:UserIdentityTokens />
|
|
</RegistrationEndpoint>
|
|
|
|
<MaxRegistrationInterval>0</MaxRegistrationInterval>
|
|
<NodeManagerSaveFile>Quickstarts.ReferenceServer.nodes.xml</NodeManagerSaveFile>
|
|
<MinSubscriptionLifetime>10000</MinSubscriptionLifetime>
|
|
<MaxPublishRequestCount>20</MaxPublishRequestCount>
|
|
<MaxSubscriptionCount>100</MaxSubscriptionCount>
|
|
<MaxEventQueueSize>10000</MaxEventQueueSize>
|
|
|
|
<!-- see https://opcfoundation-onlineapplications.org/profilereporting/ for list of available profiles -->
|
|
<ServerProfileArray>
|
|
<ua:String>http://opcfoundation.org/UA-Profile/Server/StandardUA2017</ua:String>
|
|
<ua:String>http://opcfoundation.org/UA-Profile/Server/DataAccess</ua:String>
|
|
<ua:String>http://opcfoundation.org/UA-Profile/Server/Methods</ua:String>
|
|
<ua:String>http://opcfoundation.org/UA-Profile/Server/ReverseConnect</ua:String>
|
|
<ua:String>http://opcfoundation.org/UA-Profile/Server/ClientRedundancy</ua:String>
|
|
</ServerProfileArray>
|
|
|
|
<ShutdownDelay>5</ShutdownDelay>
|
|
<ServerCapabilities>
|
|
<ua:String>DA</ua:String>
|
|
</ServerCapabilities>
|
|
<SupportedPrivateKeyFormats>
|
|
<ua:String>PFX</ua:String>
|
|
<ua:String>PEM</ua:String>
|
|
</SupportedPrivateKeyFormats>
|
|
<MaxTrustListSize>0</MaxTrustListSize>
|
|
<MultiCastDnsEnabled>false</MultiCastDnsEnabled>
|
|
|
|
<!-- Reverse connection parameters for aggregation server sample -->
|
|
<!--
|
|
<ReverseConnect>
|
|
<Clients>
|
|
<ReverseConnectClient>
|
|
<EndpointUrl>opc.tcp://localhost:65300</EndpointUrl>
|
|
<MaxSessionCount>0</MaxSessionCount>
|
|
<Enabled>true</Enabled>
|
|
</ReverseConnectClient>
|
|
</Clients>
|
|
<ConnectInterval>15000</ConnectInterval>
|
|
<ConnectTimeout>30000</ConnectTimeout>
|
|
<RejectTimeout>60000</RejectTimeout>
|
|
</ReverseConnect>
|
|
-->
|
|
|
|
<OperationLimits>
|
|
<MaxNodesPerRead>2500</MaxNodesPerRead>
|
|
<MaxNodesPerHistoryReadData>1000</MaxNodesPerHistoryReadData>
|
|
<MaxNodesPerWrite>2500</MaxNodesPerWrite>
|
|
<MaxNodesPerMethodCall>2500</MaxNodesPerMethodCall>
|
|
<MaxNodesPerBrowse>2500</MaxNodesPerBrowse>
|
|
<MaxNodesPerRegisterNodes>2500</MaxNodesPerRegisterNodes>
|
|
<MaxNodesPerTranslateBrowsePathsToNodeIds>2500</MaxNodesPerTranslateBrowsePathsToNodeIds>
|
|
<MaxNodesPerNodeManagement>2500</MaxNodesPerNodeManagement>
|
|
<MaxMonitoredItemsPerCall>2500</MaxMonitoredItemsPerCall>
|
|
</OperationLimits>
|
|
|
|
<AuditingEnabled>true</AuditingEnabled>
|
|
</ServerConfiguration>
|
|
|
|
<Extensions>
|
|
<ua:XmlElement>
|
|
<MemoryBufferConfiguration xmlns="http://samples.org/UA/MemoryBuffer">
|
|
<Buffers>
|
|
<MemoryBufferInstance>
|
|
<Name>UInt32</Name>
|
|
<TagCount>100</TagCount>
|
|
<DataType>UInt32</DataType>
|
|
</MemoryBufferInstance>
|
|
<MemoryBufferInstance>
|
|
<Name>Double</Name>
|
|
<TagCount>100</TagCount>
|
|
<DataType>Double</DataType>
|
|
</MemoryBufferInstance>
|
|
</Buffers>
|
|
</MemoryBufferConfiguration>
|
|
</ua:XmlElement>
|
|
</Extensions>
|
|
|
|
<TraceConfiguration>
|
|
<OutputFilePath>%LocalApplicationData%/OPC Foundation/Logs/Quickstarts.ReferenceServer.log.txt</OutputFilePath>
|
|
<DeleteOnLoad>true</DeleteOnLoad>
|
|
<!-- Show Only Errors -->
|
|
<!-- <TraceMasks>1</TraceMasks> -->
|
|
<!-- Show Only Security and Errors -->
|
|
<!-- <TraceMasks>513</TraceMasks> -->
|
|
<!-- Show Only Security, Errors and Trace -->
|
|
<!-- <TraceMasks>515</TraceMasks> -->
|
|
<!-- Show Only Security, COM Calls, Errors and Trace -->
|
|
<!-- <TraceMasks>771</TraceMasks> -->
|
|
<!-- Show Only Security, Service Calls, Errors and Trace -->
|
|
<!-- <TraceMasks>523</TraceMasks> -->
|
|
<!-- Show Only Security, ServiceResultExceptions, Errors and Trace -->
|
|
<TraceMasks>519</TraceMasks>
|
|
</TraceConfiguration>
|
|
|
|
</ApplicationConfiguration>
|