Unstable client connection to a Sign&Encrypt server

[danmoser]

Hi! I have a asyncua server using ua.SecurityPolicyType.Basic256Sha256_SignAndEncrypt. The certificate was generated as in the example.

The problem I'm facing is the following: if an open62541 client losses connection to that server (eg., due to an unstable network connection), it triggers "BadConnectionClosed" and "BadSecurityChecksFailes" errors, and the client dies. A "Basic" security policy doesn't trigger the errors.

I'm not sure if this is related, but every time I connect to the server with UaExpert, I get two warnings (as below): "BadCertificateUseNotAllowed" and "BadCertificateUriInvalid". After ignoring the two warnings, a connection is established. I noticed that during the network glitches, UaExpert also triggers "BadConnectionClosed" and "BadSessionIdInvalid" errors in its log. The two warnings are shown again, and after ignoring them the connection is usually re-established. Sometimes it's not, and I need to manually disconnect and reconnect to resume communicating with the server.

Do you have any recommendations on how to make the client connection more robust against the glitches?
Thanks in advance

[schroeder-]

Did you change your application uri? Because the uri must match urn:opcua:python:server or you must change the alternate name uri parameter in the script.

[danmoser]

Yes, it is. And the problem also happens using an open62541 client -- but I haven't experienced that (yet) with an asyncua client.

[AndreasHeine]

have you checked whats in the keyusage field of the cert?

[schroeder-]

Maybe there is missing some extension on the certificate:

keyUsage	keyUsage	Specifies how the Certificate key may be used.Shall include digitalSignature, nonRepudiation, keyEncipherment and dataEncipherment.Other key uses are allowed.
extendedKeyUsage	keyUsage	Specifies additional key uses for the Certificate.Shall specify ‘serverAuth and/or clientAuth.Other key uses are allowed.

[AndreasHeine]

i wrote a how to in 2020:

Generate your own x509v3 Certificate
Step 1: Change ssl.conf (subjectAltname, country, organizationName, ...)
ssl.conf:

[ req ]
default_bits = 2048
default_md = sha256
distinguished_name = subject
req_extensions = req_ext
x509_extensions = req_ext
string_mask = utf8only
prompt = no
[ req_ext ]
basicConstraints = CA:FALSE
nsCertType = client, server
keyUsage = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign
extendedKeyUsage= serverAuth, clientAuth
nsComment = "OpenSSL Generated Certificat"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
subjectAltName = URI:urn:opcua:python:server,IP: 127.0.0.1
[ subject ]
countryName = DE
stateOrProvinceName = HE
localityName = HE
organizationName = AndreasHeine
commonName = PythonOpcUaServer

Step 2: openssl genrsa -out key.pem 2048
Step 3: openssl req -x509 -days 365 -new -out certificate.pem -key key.pem -config ssl.conf
this way is proved with Siemens OPC UA Client/Server!

[danmoser]

I believe using the ssl.conf file solved it! Thank you!!!!!