3bec159cb9
Merge remote-tracking branch 'origin/1.4' into merge_14_master_25
2025-01-25 19:06:56 +01:00
403f4628c4
fix(plugin): Convert PEM to DER for rsa policies
2025-01-20 16:02:26 +01:00
373986fbf1
fix(plugin): Reset only the specified part of the trust list when setting it
2025-01-15 14:15:29 +01:00
f29a7f3f30
fix(plugin): Extend CertificateUtils to support CRL for the thumbprint and subject name functions
2025-01-15 14:15:29 +01:00
41f7dc4f87
refactor(plugins): Improve the logging of mismatching ApplicationURI in openssl/certificategroup.c
2024-12-10 08:28:30 +01:00
9f6b89b4cb
feat(plugins): Use the application's logger in UA_CertificateUtils_verifyApplicationURI
2024-12-10 08:28:30 +01:00
9e17e1b4f9
fix(plugins): Don't use the server log category for generic certificategroup functionality
2024-12-10 08:28:30 +01:00
a5344503dd
fix(plugins): Certificate verification must not depend on an absolute memory location of the CertificateGroup
2024-11-29 21:50:05 +01:00
3785ed5c4d
Merge remote-tracking branch 'origin/1.4' into merge_14_master_24
2024-11-29 21:50:04 +01:00
9e59f1abe2
refactor(plugins): Remove comparison of authorityKeyIdentifier / subjectKeyIdentifier not supported by CTT
...
The CTT example Security User X509/001.js expects that an issuer is
selected where the authorityKeyIdentifier / subjectKeyIdentifier do not
match. No longer use X509_check_issued, but rather manually check if the
issuer name and subject name match -- with no other checks beyond that.
2024-11-25 18:48:59 +01:00
b6961b23ae
Merge remote-tracking branch 'origin/1.3' into merge_13_14_21
2024-11-24 23:45:19 +01:00
68142484a3
feat(plugins): Disable revocation lists checks in ua_pki_openssl.c if zero crl are loaded
...
Avoid breakage for users of the 1.3 release family but still log a warning.
2024-11-23 21:57:36 +01:00
80bbdd4170
fix(plugins): Return detailed status codes for revocation checks in ua_pki_openssl.c
2024-11-23 21:57:36 +01:00
486a65ee10
fix(plugins): Also consider the trustlist to find issuers in ua_pki_openssl.c
2024-11-23 21:57:36 +01:00
2b445aecf6
Merge remote-tracking branch 'origin/1.4' into merge_14_master_23
2024-11-05 17:19:45 +01:00
805c1ab17a
fix(plugins): Reenable writing rejected certificates to a reject folder
2024-11-05 00:38:08 +01:00
ffb74325c2
refactor(plugin): improvement of memory management in ECC policy
...
* Place UA_ByteString on the stack instead of heap
* Use UA_calloc to automatically initialize memory with zero
* Additional minor improvements based on PR feedback
2024-11-04 12:44:46 +01:00
308d8e2759
feat(plugin): add OpenSSL plugin for ECC P-256
...
Add http://opcfoundation.org/UA/SecurityPolicy#ECC_nistP256
policy support in OpenSSL plugin.
2024-11-04 12:44:46 +01:00
d92c4221c2
refactor(plugin): reuse bio in decoding of DER/PEM
2024-10-31 16:39:49 +01:00
380c58f109
refactor(plugin): avoid magic numbers in detection of DER encoding
...
Replace the detection of DER encoding using magic numbers by
OpenSSL functions trying to decode the input as DER first and if
not successful as PEM afterwards. This approach is less error
prone and more flexible, as it supports Elliptic Curve keys and
certificates as well.
2024-10-31 16:39:49 +01:00
4a7168817a
feat(plugins): Add CertificateUtils function to validate if a certificate is a CA certificate
2024-10-29 01:17:05 +01:00
584f40bfa4
refactor(plugins): Simplify CertificateGroup utilities functions
2024-10-29 01:17:05 +01:00
5f1a600c46
fix(plugins): Fix typo in the name of a certificate utility function
2024-10-29 01:17:05 +01:00
a75fed6389
Merge remote-tracking branch 'origin/1.3' into merge_13_14_20
2024-10-22 23:53:01 +02:00
db91b23259
fix(plugins): Manually classify certificates as CA for OpenSSL
...
Replace the builtin method with manual classification. We now require
the KU_CRL_SIGN flag to detect a CA. Before we rejected the leaf
certificates generated by some vendors.
2024-10-22 23:50:15 +02:00
fc744936d3
feat(plugin): Add CertificateGroup function to retrieve all CRLs associated with a certificate.
2024-10-16 08:15:47 +02:00
b75eac4454
feat(plugin): Add helper functions for loading certificates and CRLs
2024-10-16 08:15:47 +02:00
ff24a547d4
Merge remote-tracking branch 'origin/1.4' into merge_14_master_22
2024-10-07 22:23:25 +02:00
712cce9bb7
Merge remote-tracking branch 'origin/1.3' into merge_13_14_19
2024-10-05 22:11:22 +02:00
0a48591990
fix(plugins): Disable the Basic128Rsa15 and Basic256 SecurityPolicy
2024-10-03 13:47:11 +02:00
43e2b04a26
Merge remote-tracking branch 'origin/1.4' into merge_14_master_22
2024-10-03 10:33:56 +02:00
f9d4c16310
fix(plugins): More thorough validation that the issuer is a valid CA
2024-10-02 18:01:34 +02:00
ba22a98523
fix(plugins): More thorough validation that the issuer is a valid CA
2024-10-02 13:56:09 +02:00
dccdfe629c
feat(plugin): Check which privateKey should be used if no key is specified
2024-10-01 23:47:35 +02:00
94dfc4f8c6
feat(plugin): Add CertificateUtils function to verify key pair
2024-10-01 23:47:35 +02:00
1b7629ca4e
feat(plugin): Add CertificateUtils function to compare public keys for equality
2024-10-01 23:47:35 +02:00
2008fc2676
Merge remote-tracking branch 'origin/1.3' into merge_13_14_17
2024-09-27 22:35:01 +02:00
c63520c407
refactor(plugins): Use the same certificate verification logic for mbedTLS and OpenSSL
...
Walk the tree to find a complete chain of unrevoked and current
certificates. The chain must end in a self-signed certificate.
Then, on the "way down", check that at least one certificate
in the chain is trusted.
2024-09-27 21:18:38 +02:00
19ecf3e562
refactor(plugin): Manual OpenSSL certificate verification steps
...
The previous certificate verification relied on many OpenSSL internals
and a forest of feature-flags. The new code is about the same size and
makes the certificate verification steps explicit.
The only downside is that we no longer auto-retrieve revocation lists if
a distribution point is defined in a CA certificate. But revocation is
handled by a GDS in OPC UA. And we don't want our certificate
verification to do synchronous HTTP calls in the background.
2024-09-22 23:49:24 +02:00
af1abb2e83
refactor(plugins): Better cleanup of the OpenSSL CertificateVerification plugin
2024-09-22 23:49:24 +02:00
7acfe56053
fix(sec): avoid memmory read access errors
...
Check for null pointer befor passing then into a openssl function.
2024-09-22 11:03:18 +02:00
f4af493b57
fix(core): LibreSSL 3.5
...
(cherry picked from commit 35939a5b68
2024-09-16 17:27:51 +02:00
166d03c351
refactor(core): Substitute tabs by spaces in source code
2024-09-14 02:33:22 +02:00
2368ec2cbe
Merge remote-tracking branch 'origin/1.4' into merge_14_master_21
2024-09-11 15:33:39 +02:00
48afbff739
Merge remote-tracking branch 'origin/1.3' into merge_13_14_15
2024-09-11 12:41:16 +02:00
9b6848a7e8
fix(plugin): Proper error handling when checking all CRLs
...
If a chain of Certificate Authorities (CAs) longer than one is present,
all CRL checks on the additional CAs were bypassed. This resulted in the
potential acceptance of certificates that have been revoked or have
expired CRLs.
2024-09-11 10:25:57 +02:00
317819b7d3
fix(plugin): Avoid memmory read access errors ( #6688 )
...
Check for null pointer befor passing then into a openssl function.
2024-09-10 09:07:58 +02:00
d4534a9704
refactor(plugin): Consistently name the OpenSSL plugin files
2024-07-20 11:42:05 +02:00
c63b43dd2b
refactor(plugin): Fold the ua_openssl_version_abstraction.h into _common.h
2024-07-20 11:42:05 +02:00
33327a85a9
Merge remote-tracking branch 'origin/1.4' into merge_14_master_17
2024-07-08 10:56:48 +02:00
Julius Pfrommer