Support mutual TLS on server https endpoints (#2849)

A new configuration variable 
    <HttpsMutualTls>true</HttpsMutualTls>
enables the mutual TLS authentication support. The behavior of the TLS endpoint changes as the following:

HttpsMutualTls is true:
The server checks the trust on the certificate which is used by the client for TLS authentication. It must be a valid OPC UA application certificate which is trusted.
A client can still connect without providing a client certificate, but then it is only able to call discovery services.
In order to create a session, the client must use the same application certificate that was used for the TLS channel.

HttpsMutualTls is false:
- There is no application authentication. The server endpoint uses security None and there is no client application authentication.
Instead, only user authentication is used to secure the server, anonymous user authentication is disabled.
Discovery service calls are supported.

Co-authored-by: Martin Regen <[email protected]>

Author: mrsuciu

Applications/ConsoleReferenceServer/Quickstarts.ReferenceServer.Config.xml

@@ -154,6 +154,7 @@
         <!-- <ua:SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</ua:SecurityPolicyUri> -->
       </ua:UserTokenPolicy>
     </UserTokenPolicies>
+    
     <DiagnosticsEnabled>true</DiagnosticsEnabled>
     <!-- Settings for CTT testing -->
     <MaxSessionCount>75</MaxSessionCount>
@@ -265,6 +266,7 @@
     </OperationLimits>
 
     <AuditingEnabled>true</AuditingEnabled>
+    <HttpsMutualTls>true</HttpsMutualTls>
   </ServerConfiguration>
 
   <Extensions>

Applications/Quickstarts.Servers/ReferenceServer/ReferenceServer.cs

@@ -53,6 +53,7 @@ public partial class ReferenceServer : ReverseConnectServer
         public ITokenValidator TokenValidator { get; set; }
 
         #endregion
+
         #region Overridden Methods
         /// <summary>
         /// Creates the node managers for the server.
@@ -247,7 +248,7 @@ private void SessionManager_ImpersonateUser(Session session, ImpersonateEventArg
             {
                 VerifyUserTokenCertificate(x509Token.Certificate);
                 // set AuthenticatedUser role for accepted certificate authentication
-                args.Identity =  new RoleBasedIdentity(new UserIdentity(x509Token),
+                args.Identity = new RoleBasedIdentity(new UserIdentity(x509Token),
                     new List<Role>() { Role.AuthenticatedUser });
                 Utils.LogInfo(Utils.TraceMasks.Security, "X509 Token Accepted: {0}", args.Identity?.DisplayName);
 
@@ -325,7 +326,7 @@ private IUserIdentity VerifyPassword(UserNameIdentityToken userNameToken)
                     new LocalizedText(info)));
             }
             return new RoleBasedIdentity(new UserIdentity(userNameToken),
-                   new List<Role>() { Role.AuthenticatedUser});
+                   new List<Role>() { Role.AuthenticatedUser });
         }
 
         /// <summary>

Libraries/Opc.Ua.Client/CoreClientUtils.cs

@@ -307,7 +307,7 @@ public static EndpointDescription SelectEndpoint(
         public static Uri GetDiscoveryUrl(string discoveryUrl)
         {
             // needs to add the '/discovery' back onto non-UA TCP URLs.
-            if (discoveryUrl.StartsWith(Utils.UriSchemeHttp, StringComparison.Ordinal))
+            if (Utils.IsUriHttpRelatedScheme(discoveryUrl))
             {
                 if (!discoveryUrl.EndsWith(ConfiguredEndpoint.DiscoverySuffix, StringComparison.OrdinalIgnoreCase))
                 {

Libraries/Opc.Ua.Configuration/ApplicationConfigurationBuilder.cs

@@ -779,6 +779,13 @@ public IApplicationConfigurationBuilderServerOptions SetAuditingEnabled(bool aud
             return this;
         }
 
+        /// <inheritdoc/>
+        public IApplicationConfigurationBuilderServerOptions SetHttpsMutualTls(bool mutualTlsEnabeld)
+        {
+            ApplicationConfiguration.ServerConfiguration.HttpsMutualTls = mutualTlsEnabeld;
+            return this;
+        }
+
         /// <inheritdoc/>
         public IApplicationConfigurationBuilderClientOptions SetDefaultSessionTimeout(int defaultSessionTimeout)
         {

Libraries/Opc.Ua.Configuration/IApplicationConfigurationBuilder.cs

@@ -265,6 +265,9 @@ public interface IApplicationConfigurationBuilderServerOptions :
 
         /// <inheritdoc cref="ServerConfiguration.AuditingEnabled"/>
         IApplicationConfigurationBuilderServerOptions SetAuditingEnabled(bool auditingEnabled);
+
+        /// <inheritdoc cref="ServerConfiguration.HttpsMutualTls"/>
+        IApplicationConfigurationBuilderServerOptions SetHttpsMutualTls(bool mTlsEnabled);
     }
 
     /// <summary>

Stack/Opc.Ua.Bindings.Https/Stack/Https/HttpsServiceHost.cs

@@ -13,6 +13,7 @@ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using System.Security.Cryptography.X509Certificates;
 
 
@@ -92,30 +93,44 @@ X509Certificate2Collection instanceCertificateChain
 
                 uris.Add(uri.Uri);
 
-                // Only support one policy with HTTPS
-                // So pick the first policy with security mode sign and encrypt
                 ServerSecurityPolicy bestPolicy = null;
-                foreach (ServerSecurityPolicy policy in securityPolicies)
+                bool httpsMutualTls = configuration.ServerConfiguration.HttpsMutualTls;
+                if (!httpsMutualTls)
                 {
-                    if (policy.SecurityMode != MessageSecurityMode.SignAndEncrypt)
+                    // Only use security None without mutual TLS authentication!
+                    // When the mutual TLS authentication is not used, anonymous access is disabled
+                    // Then the only protection against unauthorized access is user authorization
+                    bestPolicy = new ServerSecurityPolicy() {
+                        SecurityMode = MessageSecurityMode.None,
+                        SecurityPolicyUri = SecurityPolicies.None
+                    };
+                }
+                else
+                {
+                    // Only support one secure policy with HTTPS and mutual authentication
+                    // So pick the first policy with security mode sign and encrypt
+                    foreach (ServerSecurityPolicy policy in securityPolicies)
                     {
-                        continue;
-                    }
+                        if (policy.SecurityMode != MessageSecurityMode.SignAndEncrypt)
+                        {
+                            continue;
+                        }
 
-                    bestPolicy = policy;
-                    break;
-                }
+                        bestPolicy = policy;
+                        break;
+                    }
 
-                // Pick the first policy from the list if no policies with sign and encrypt defined
-                if (bestPolicy == null)
-                {
-                    bestPolicy = securityPolicies[0];
+                    // Pick the first policy from the list if no policies with sign and encrypt defined
+                    if (bestPolicy == null)
+                    {
+                        bestPolicy = securityPolicies[0];
+                    }
                 }
 
-                EndpointDescription description = new EndpointDescription();
-
-                description.EndpointUrl = uri.ToString();
-                description.Server = serverDescription;
+                var description = new EndpointDescription {
+                    EndpointUrl = uri.ToString(),
+                    Server = serverDescription
+                };
 
                 if (instanceCertificate != null)
                 {
@@ -142,6 +157,12 @@ X509Certificate2Collection instanceCertificateChain
                 description.UserIdentityTokens = serverBase.GetUserTokenPolicies(configuration, description);
                 description.TransportProfileUri = Profiles.HttpsBinaryTransport;
 
+                // if no mutual TLS authentication is used, anonymous user tokens are not allowed
+                if (!httpsMutualTls)
+                {
+                    description.UserIdentityTokens = new UserTokenPolicyCollection(description.UserIdentityTokens.Where(token => token.TokenType != UserTokenType.Anonymous));
+                }
+
                 ITransportListener listener = Create();
                 if (listener != null)
                 {

Stack/Opc.Ua.Bindings.Https/Stack/Https/HttpsTransportListener.cs

@@ -14,6 +14,7 @@ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 using System.Collections.Generic;
 using System.IO;
 using System.Net;
+using System.Net.Security;
 using System.Security.Authentication;
 using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;
@@ -24,6 +25,7 @@ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Server.Kestrel.Https;
 using Microsoft.Extensions.Hosting;
+using Opc.Ua.Security.Certificates;
 
 
 namespace Opc.Ua.Bindings
@@ -174,6 +176,7 @@ public void Open(
             m_listenerId = Guid.NewGuid().ToString();
 
             m_uri = baseAddress;
+            m_discovery = m_uri.AbsolutePath?.TrimEnd('/') + ConfiguredEndpoint.DiscoverySuffix;
             m_descriptions = settings.Descriptions;
             var configuration = settings.Configuration;
 
@@ -205,6 +208,7 @@ public void Open(
             m_serverCertificate = settings.ServerCertificate;
             m_serverCertificateChain = settings.ServerCertificateChain;
 
+            m_mutualTlsEnabled = settings.HttpsMutualTls;
             // start the listener
             Start();
         }
@@ -283,9 +287,10 @@ public void Start()
 
             var httpsOptions = new HttpsConnectionAdapterOptions() {
                 CheckCertificateRevocation = false,
-                ClientCertificateMode = ClientCertificateMode.NoCertificate,
+                ClientCertificateMode = m_mutualTlsEnabled ? ClientCertificateMode.AllowCertificate : ClientCertificateMode.NoCertificate,
                 // note: this is the TLS certificate!
                 ServerCertificate = serverCertificate,
+                ClientCertificateValidation = ValidateClientCertificate,
             };
 
 #if NET462
@@ -370,6 +375,21 @@ public async Task SendAsync(HttpContext context)
 
                 IServiceRequest input = (IServiceRequest)BinaryDecoder.DecodeMessage(buffer, null, m_quotas.MessageContext);
 
+                if (m_mutualTlsEnabled && input.TypeId == DataTypeIds.CreateSessionRequest)
+                {
+                    // Match tls client certificate against client application certificate provided in CreateSessionRequest
+                    byte[] tlsClientCertificate = context.Connection.ClientCertificate?.RawData;
+                    byte[] opcUaClientCertificate = ((CreateSessionRequest)input).ClientCertificate;
+
+                    if (tlsClientCertificate == null || !Utils.IsEqual(tlsClientCertificate, opcUaClientCertificate))
+                    {
+                        message = "Client TLS certificate does not match with ClientCertificate provided in CreateSessionRequest";
+                        Utils.LogError(message);
+                        await WriteResponseAsync(context.Response, message, HttpStatusCode.Unauthorized).ConfigureAwait(false);
+                        return;
+                    }
+                }
+
                 // extract the JWT token from the HTTP headers.
                 if (input.RequestHeader == null)
                 {
@@ -463,6 +483,8 @@ public async Task SendAsync(HttpContext context)
             await WriteResponseAsync(context.Response, message, HttpStatusCode.InternalServerError).ConfigureAwait(false);
         }
 
+
+
         /// <summary>
         /// Called when a UpdateCertificate event occured.
         /// </summary>
@@ -524,11 +546,41 @@ private static async Task<byte[]> ReadBodyAsync(HttpRequest req)
                 return memory.ToArray();
             }
         }
+
+        /// <summary>
+        /// Validate TLS client certificate at TLS handshake.
+        /// </summary>
+        /// <param name="clientCertificate">Client certificate</param>
+        /// <param name="chain">Certificate chain</param>
+        /// <param name="sslPolicyErrors">SSl policy errors</param>
+        private bool ValidateClientCertificate(
+            X509Certificate2 clientCertificate,
+            X509Chain chain,
+            SslPolicyErrors sslPolicyErrors)
+        {
+            if (sslPolicyErrors == SslPolicyErrors.None)
+            {
+                // certificate is valid
+                return true;
+            }
+
+            try
+            {
+                m_quotas.CertificateValidator.Validate(clientCertificate);
+            }
+            catch (Exception)
+            {
+                return false;
+            }
+
+            return true;
+        }
         #endregion
 
         #region Private Fields
         private string m_listenerId;
         private Uri m_uri;
+        private string m_discovery;
         private readonly string m_uriScheme;
         private EndpointDescriptionCollection m_descriptions;
         private ChannelQuotas m_quotas;
@@ -537,6 +589,7 @@ private static async Task<byte[]> ReadBodyAsync(HttpRequest req)
         private IWebHost m_host;
         private X509Certificate2 m_serverCertificate;
         private X509Certificate2Collection m_serverCertificateChain;
+        private bool m_mutualTlsEnabled;
         #endregion
     }
 }

Stack/Opc.Ua.Core/Schema/ApplicationConfiguration.cs

@@ -1509,6 +1509,7 @@ private void Initialize()
             m_maxTrustListSize = 0;
             m_multicastDnsEnabled = false;
             m_auditingEnabled = false;
+            m_httpsMutualTls = true;
         }
 
         /// <summary>
@@ -1942,6 +1943,17 @@ public bool AuditingEnabled
             get { return m_auditingEnabled; }
             set { m_auditingEnabled = value; }
         }
+
+        /// <summary>
+        /// Whether mTLS is required/enforced by the HttpsTransportListener
+        /// </summary>
+        /// <value><c>true</c> if mutual TLS is enabled; otherwise, <c>false</c>.</value>
+        [DataMember(IsRequired = false, Order = 38)]
+        public bool HttpsMutualTls
+        {
+            get { return m_httpsMutualTls; }
+            set { m_httpsMutualTls = value; }
+        }
         #endregion
 
         #region Private Members
@@ -1980,6 +1992,7 @@ public bool AuditingEnabled
         private ReverseConnectServerConfiguration m_reverseConnect;
         private OperationLimits m_operationLimits;
         private bool m_auditingEnabled;
+        private bool m_httpsMutualTls;
         #endregion
     }
     #endregion

Stack/Opc.Ua.Core/Schema/ApplicationConfiguration.xsd

@@ -168,6 +168,7 @@
           <xs:element name="ReverseConnect" type="ReverseConnectServerConfiguration" minOccurs="0" />
           <xs:element name="OperationLimits" type="OperationLimits" minOccurs="0" />
           <xs:element name="AuditingEnabled" type="xs:boolean" minOccurs="0" />
+          <xs:element name="HttpsMutualTls" type="xs:boolean" minOccurs="0" />
         </xs:sequence>
       </xs:extension>
     </xs:complexContent>

Stack/Opc.Ua.Core/Stack/Configuration/ConfiguredEndpoints.cs

@@ -15,6 +15,7 @@ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 using System.Globalization;
 using System.IO;
 using System.Runtime.Serialization;
+using System.Security.Cryptography.X509Certificates;
 using System.Threading;
 using System.Threading.Tasks;
 using System.Xml;
@@ -130,7 +131,7 @@ public static ConfiguredEndpointCollection Load(string filePath)
                 {
                     string discoveryUrl = endpoint.Description.EndpointUrl;
 
-                    if (discoveryUrl.StartsWith(Utils.UriSchemeHttp, StringComparison.Ordinal))
+                    if (Utils.IsUriHttpRelatedScheme(discoveryUrl))
                     {
                         discoveryUrl += ConfiguredEndpoint.DiscoverySuffix;
                     }
@@ -530,7 +531,7 @@ public void SetApplicationDescription(string serverUri, ApplicationDescription s
                 }
 
                 if (endpointUrl != null &&
-                    endpointUrl.StartsWith(Utils.UriSchemeHttp, StringComparison.Ordinal) &&
+                    Utils.IsUriHttpRelatedScheme(endpointUrl) &&
                     endpointUrl.EndsWith(ConfiguredEndpoint.DiscoverySuffix, StringComparison.OrdinalIgnoreCase))
                 {
                     endpointUrl = endpointUrl.Substring(0, endpointUrl.Length - ConfiguredEndpoint.DiscoverySuffix.Length);
@@ -815,7 +816,7 @@ public ConfiguredEndpoint(
 
                 if (baseUrl != null)
                 {
-                    if (baseUrl.StartsWith(Utils.UriSchemeHttp, StringComparison.Ordinal) &&
+                    if (Utils.IsUriHttpRelatedScheme(baseUrl) &&
                         baseUrl.EndsWith(DiscoverySuffix, StringComparison.Ordinal))
                     {
                         baseUrl = baseUrl.Substring(0, baseUrl.Length - DiscoverySuffix.Length);
@@ -1208,7 +1209,7 @@ public Uri GetDiscoveryUrl(Uri endpointUrl)
             // attempt to construct a discovery url by appending 'discovery' to the endpoint.
             if (discoveryUrls == null || discoveryUrls.Count == 0)
             {
-                if (endpointUrl.Scheme.StartsWith(Utils.UriSchemeHttp, StringComparison.Ordinal))
+                if (Utils.IsUriHttpRelatedScheme(endpointUrl.Scheme))
                 {
                     return new Uri(Utils.Format("{0}{1}", endpointUrl, DiscoverySuffix));
                 }