Expected Milo behavior when server certificate changes at runtime?

[fritzz-98]

Hi,

I have another question regarding certificates. While our client is connected to the server, it may happen that the certificate on the PLC (i.e., the OPC UA server) gets changed or renewed. In that case, we currently handle it by closing the session and re-establishing the connection.

I have two questions about this scenario:

1. How can the client best detect that the certificate has changed?
   At the moment, the onSessionInactive hook is triggered. When I try to access the client session there, it throws a Bad_CertificateInvalid UaException. By checking this exception I can tell that the certificate is invalid. Is this the correct approach?

2. Why do error messages keep appearing after certificate renewal?
   After the server certificate is updated, the onSessionInactive hook is called, but I still see the following error message every 15–20 seconds:

o.e.m.o.s.t.c.u.UascClientMessageHandler : [remote=/xxx.xx.xx.xxx:xxxx] errorMessage=ErrorMessage{error=StatusCode[name=Bad_CertificateInvalid, value=0x80120000, quality=bad], reason=null}

Is Milo attempting to reconnect automatically here? I assumed that once onSessionInactive is called, this would not happen. Could it also be caused by our client still trying to access subscriptions info of the client, which then triggers the error? Any insights on the best way to handle this would be very helpful.

[kevinherron]

o.e.m.o.s.t.c.u.UascClientMessageHandler : [remote=/xxx.xx.xx.xxx:xxxx] errorMessage=ErrorMessage{error=StatusCode[name=Bad_CertificateInvalid, value=0x80120000, quality=bad], reason=null}

This is an error from the Server indicating it thinks your Client certificate is invalid for some reason... you might want to figure out what's going on here before trying to troubleshoot this broader scenario.

[fritzz-98]

This is an error from the Server indicating it thinks your Client certificate is invalid

yes, the server certificate was purposefully changed while the client was connected so this message is expected I guess. Our client is required to be able to handle this scenario and properly reestablish a connection with the server and its new certificate. By simply disconnecting and connecting again everything works as its supposed to. I'm trying to figure out what the best way is for the client to know when its certificate is not valid anymore - by checking some state or maybe some isAlive boolean - but for now the best way I see is just to try to interact with the server in some way and catch the UaException..

[kevinherron]

It doesn't make sense that changing the Server certificate alone would result in the Server suddenly rejecting the Client certificate. Something else has to be going on here...

[kevinherron]

anyway, changing the Server certificate so significantly that the Client would no longer trust it is a significant configuration change that will require user intervention to trust the new certificate. You can avoid this by using a common CA certificate and issuing/renewing the Server certificate from the same CA, in which case a Client trusting the CA would also trust the new Server certificate.

I would expect once you resolve whatever is going on above you see a failure with a StatusCode like Bad_SecurityChecksFailed, though I'm not sure yet how you might know as a Client other than getting notified your Session is no longer active.

Maybe try adding a ServiceFaultListener via OpcUaClient::addFaultListener?