Unable to find the right connection settings

[ts4iot]

I try to login to an OPC-UA server with the following connection parameter (see attached picture with UAExpert settings), but I find no way to configure the asyncua client that it works.

The connection with UAExpert works only with this connection settings. No other combination is possible.

Has anyone experience with this setting combination and can help me to configure asyncua client in the right way.

Thanks

[AndreasHeine]

maybe post your simplified client code?

[ts4iot]

this is one of my attempts:

import asyncio
from asyncua import Client, ua
from asyncua.crypto.security_policies import SecurityPolicyBasic256Sha256

async def task(loop):
    url = "opc.tcp://192.168.0.3:4862"
    client = Client(url=url)
    await client.set_security(
        SecurityPolicyBasic256Sha256,
        mode=ua.MessageSecurityMode.SignAndEncrypt,
        certificate="",
        private_key="",
        server_certificate="dml-002_cert.der")
    await client.connect()
    async with client:
        root = await client.get_root_node()
        print(root)
        await asyncio.sleep(1)
   
def main():
	loop = asyncio.get_event_loop()
	loop.set_debug(True)
	loop.run_until_complete(task(loop))
	loop.close()


if __name__ == "__main__":
	main()

The error in this example is that the set_security expects certificate and key, but I don't have one. How can I combine SecurityPolicyBasic256Sha256, SignAndEncrypt and Anonymous?

[schroeder-]

You need certificates to use any ScruityPolicy other than None.
Check the example:
https://github.com/FreeOpcUa/opcua-asyncio/blob/master/examples/client-with-encryption.py

[ts4iot]

But how does UAexpert works without certificates. Is this a missing configuration combination of asyncua?

[schroeder-]

UAexpert always creates a certificate....

[ts4iot]

Here the log of UAexpert:

10:36:22.566 | Server Node        | Emerson                        | Endpoint: 'opc.tcp://192.168.0.3:4862/UA/CM'
10:36:22.566 | Server Node        | Emerson                        | Security policy: 'http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256'
10:36:22.566 | Server Node        | Emerson                        | ApplicationUri: 'urn:emerson.ConditionMonitoring'
10:36:24.790 | Server Node        | Emerson                        | Used UserTokenType: Anonymous
10:36:25.495 | AddressSpaceModel  | Emerson                        | Registered for ModelChangeEvents
10:36:25.495 | Server Node        | Emerson                        | Connection status of server 'Emerson' changed to 'Connected'.
10:36:25.496 | Server Node        | Emerson                        | Revised values: SessionTimeout=1200000, SecureChannelLifetime=600000
10:36:25.554 | AddressSpaceModel  | Emerson                        | Browse on node 'i=84' succeeded.
10:36:25.944 | AddressSpaceModel  | Emerson                        | Browse on node 'i=85' succeeded.
11:32:16.579 | AddressSpaceModel  | Emerson                        | Unregister for ModelChangeEvents returned Good
11:32:16.663 | Server Node        | Emerson                        | Connection status of server 'Emerson' changed to 'Disconnected'.
11:32:16.663 | Server Node        | Emerson                        | Disconnect succeeded.

Maybe this helps to find the required settings in asyncua.

[ts4iot]

No it works. I found the used certificate and key of UAexpert in the following folder of my Windows machine: C:\Users\{username}\AppData\Roaming\unifiedautomation\uaexpert\PKI\own.

It is important that the application_uri fits to a subjectAltName entry of the certificate

import asyncio
from asyncua import Client, ua
from asyncua.crypto.security_policies import SecurityPolicyBasic256Sha256, SecurityPolicyNone

async def task(loop):
    url = "opc.tcp://192.168.0.3:4862"
    client = Client(url=url)
    client.application_uri = "urn:{hostname}:UnifiedAutomation:UaExpert"
    await client.set_security(
        SecurityPolicyBasic256Sha256,
        mode=ua.MessageSecurityMode.SignAndEncrypt,
        certificate="uaexpert.der",
        private_key="uaexpert_key.pem")
    await client.connect()
    async with client:
        while True:
            root = client.get_root_node()
            print(root)
            await asyncio.sleep(1)
   
def main():
	loop = asyncio.get_event_loop()
	loop.set_debug(True)
	loop.run_until_complete(task(loop))
	loop.close()


if __name__ == "__main__":
	main()

It is also possible to create a new certificate and key with openssl on the client which runs the script, but I don't find the right command to create a certficate with all required fields. If someone has the right command, please extend.

Thank you for the support.

[schroeder-]

You can create a matching certificate with asyncua, see example:
https://github.com/FreeOpcUa/opcua-asyncio/blob/master/examples/client-with-encryption.py