Can ua client accept the server certificate automatically?

[ghost]

For now, I must copy a .der file to the client\security\pki\trusted\certs manually. Does it doable to make the client accept the server certificate automatically?

[kevinherron]

You can configure the client's CertificateValidator as an instance of ClientCertificateValidator.InsecureValidator:

milo/opc-ua-stack/stack-client/src/main/java/org/eclipse/milo/opcua/stack/client/security/ClientCertificateValidator.java

Lines 29 to 52 in 3419235

	class InsecureValidator implements ClientCertificateValidator {
	private static final Logger LOGGER = LoggerFactory.getLogger(InsecureValidator.class);
	@Override
	public void validateCertificateChain(
	List<X509Certificate> certificateChain,
	String applicationUri,
	String... validHostNames
	) {
	X509Certificate certificate = certificateChain.get(0);
	LOGGER.warn("Skipping validation for certificate: {}", certificate.getSubjectX500Principal());
	}
	@Override
	public void validateCertificateChain(List<X509Certificate> certificateChain) {
	X509Certificate certificate = certificateChain.get(0);
	LOGGER.warn("Skipping validation for certificate: {}", certificate.getSubjectX500Principal());
	}
	}

It's not recommended that you do this for anything but testing. A production application should always require certificates are trusted.

[kevinherron]

Alternatively, when you get the server EndpointDescriptions, the certificate is available in that structure, and you can trust it by calling DefaultCertificateManager::addTrustedCertificate.

[ghost]

Alternatively, when you get the server EndpointDescriptions, the certificate is available in that structure, and you can trust it by calling DefaultCertificateManager::addTrustedCertificate.

Actually, I am a little confused about how to utilize EndPointDescription to get the server's certificate. Would you mind offer a demo?

[kevinherron]

The certificate bytes are available in the endpoint (EndpointDescription::getServerCertificate).

You can decode the bytes into a X509Certificate by doing something like:

X509Certificate certificate = CertificateUtil.decodeCertificate(endpoint.getServerCertificate().bytesOrEmpty());

[ghost]

Pretty thanks! I really appreciate for your demo!