Connection with Prosys OPC UA Simulator Problem - Requested Application Instance Certificate is not found in the server

[gustavoschewinski]

Hello,

I am trying to connect to the Prosys OPC UA simulator but am encountering the following issue. I believe the problem is not related to the server, as the client certificate is present and recognized as trusted. I am using both client and server certificates.

WARNING:asyncua.uaprotocol:Received an error: ErrorMessage(Error=StatusCode(value=2148728832), Reason='Bad_SecurityChecksFailed (code=0x80130000, description="Requested Application Instance Certificate is not found in the server")')

This is my code, which I based on the example provided in this repository. Could you please let me know if there's something missing or incorrect that I might have overlooked?

import asyncio
import logging
import socket
from pathlib import Path
from asyncua import Client, ua
from asyncua.crypto.security_policies import SecurityPolicyBasic256Sha256
from asyncua.crypto.validator import CertificateValidator, CertificateValidatorOptions
from asyncua.crypto.truststore import TrustStore

logging.basicConfig(level=logging.INFO)
_logger = logging.getLogger(__name__)

USE_TRUST_STORE = False

cert_base = Path(__file__).parent
cert = cert_base / "bruce1.der"
private_key = cert_base / "bruce1_key_nopass.pem"
server_cert = cert_base / "SimulationServer@Yoshi_2048.der"
print(server_cert)

async def task():
    client_app_uri = f"urn:opcua:user:bruce"
    url = "opc.tcp://Yoshi.lab.mtu-digilab.io:53530/OPCUA/SimulationServer/"

    client = Client(url=url)
    client.application_uri = client_app_uri
    client.set_user("admin")
    client.set_password("admin")

    await client.set_security(
        SecurityPolicyBasic256Sha256,
        certificate=str(cert),
        private_key=str(private_key),
        server_certificate=str(server_cert),
        mode=ua.MessageSecurityMode.SignAndEncrypt,
    )

    if USE_TRUST_STORE:
        trust_store = TrustStore([Path('examples') / 'certificates' / 'trusted' / 'certs'], [])
        await trust_store.load()
        validator = CertificateValidator(CertificateValidatorOptions.TRUSTED_VALIDATION | CertificateValidatorOptions.PEER_SERVER, trust_store)
    else:
        validator = CertificateValidator(CertificateValidatorOptions.EXT_VALIDATION | CertificateValidatorOptions.PEER_SERVER)
    client.certificate_validator = validator

    try:
        async with client:
            node = client.get_node("ns=3;i=1003")
            value = await node.get_value()
            print(f"Value of NodeId ns=3;i=1003: {value}")
    except ua.UaError as exp:
        _logger.error(exp)

def main():
    asyncio.run(task())

if __name__ == "__main__":
    main()

Thanks for your help!

Best regards,
Gustavo.

[AndreasHeine]

is your client certificate in the trusted list of prosys server?

[gustavoschewinski]

Hey Andreas, thanks for the quick response.

It does work with the previous setup where we only consider client certificates (https://github.com/AndreasHeine/SecurePythonOpcUaClient/blob/master/x509v3%2Fclient_x509v3.py).

For instance, in this scenario, it works:

from opcua import Client, ua
from pathlib import Path

url = "opc.tcp://Yoshi.lab.mtu-digilab.io:53530/OPCUA/SimulationServer/"
client = Client(url)

cert_base = Path(__file__).parent
cert = cert_base / "bruce1.pem"
private_key = cert_base / "bruce1_key_nopass.pem"
server_cert = cert_base / "SimulationServer@Yoshi_2048.der"

client.set_user("admin")
client.set_password("admin")
client.set_security_string(f"Basic256Sha256,SignAndEncrypt,{cert},{private_key}")
client.application_uri = "urn:opcua:user:bruce"

client.connect()
print(f"Connected to: {url}")

servicelevel_node = client.get_node("ns=3;i=1003")

servicelevel_node_value = servicelevel_node.get_value()
print(servicelevel_node_value)

client.disconnect()

However, when switching to the version that also incorporates server certificates, it doesn't seem to work, likely due to that issue.

So, my suspicion is that it might be related to this client or possibly something concerning the server certificate.

The server certificate I'm obtaining from

prosys-opc-ua-simulation-server\PKI\CA\private

—is this correct?

[gustavoschewinski]

Hello @AndreasHeine,

The issue was with the Prosys Simulator. The code is now working normally after recreating the server certificates.

Recommendation to everyone: If Prosys Simulator is not accepting the certificates, try reinstalling it or recreating its certificates.

Thanks again for your help!

Best regards,
Gustavo