Skip to content

Allowed to deactivate certificate validation #1254

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 3 commits into
base: master
Choose a base branch
from
+28 −13
Draft

Allowed to deactivate certificate validation #1254

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
91f6592
Allowed to deactivate certificate validation
codepitbull Oct 30, 2025
c1c6c74
Nullability
codepitbull Oct 30, 2025
edf47eb
Add noChecks option
codepitbull Nov 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 11 additions & 5 deletions ...q-edge-module-opcua/src/main/java/com/hivemq/edge/adapters/opcua/client/ParsedConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ public static Result<ParsedConfig, String> fromConfig(final OpcUaSpecificAdapter
CertificateValidator certValidator = null;
if (tlsEnabled) {
final var truststore = adapterConfig.getTls().truststore();
final var certOptional = getTrustedCerts(truststore).map(ParsedConfig::createServerCertificateValidator);
final var certOptional = getTrustedCerts(truststore).map(trustedCerts -> createServerCertificateValidator(trustedCerts, adapterConfig.getTls().noChecks()));
if (certOptional.isEmpty()) {
return Failure.of("Failed to create certificate validator, check truststore configuration");
}
Expand Down Expand Up @@ -124,10 +124,16 @@ public static Result<ParsedConfig, String> fromConfig(final OpcUaSpecificAdapter
return Optional.of(KeystoreUtil.getCertificatesFromDefaultTruststore());
}

private static @NotNull CertificateValidator createServerCertificateValidator(final @NotNull List<X509Certificate> trustedCerts) {
return new DefaultClientCertificateValidator(new CertificateTrustListManager(trustedCerts),
Set.of(ValidationCheck.VALIDITY, ValidationCheck.REVOCATION, ValidationCheck.REVOCATION_LISTS),
new MemoryCertificateQuarantine());
private static @NotNull CertificateValidator createServerCertificateValidator(final @NotNull List<X509Certificate> trustedCerts, final boolean noChecks) {
if(noChecks) {
return new DefaultClientCertificateValidator(new CertificateTrustListManager(trustedCerts),
Set.of(),
new MemoryCertificateQuarantine());
} else {
return new DefaultClientCertificateValidator(new CertificateTrustListManager(trustedCerts),
Set.of(ValidationCheck.VALIDITY, ValidationCheck.REVOCATION, ValidationCheck.REVOCATION_LISTS),
new MemoryCertificateQuarantine());
}
}

private static @NotNull Optional<KeystoreUtil.KeyPairWithChain> getKeyPairWithChain(final @NotNull Keystore keystore) {
Expand Down
4 changes: 3 additions & 1 deletion ...opcua/src/main/java/com/hivemq/edge/adapters/opcua/config/OpcUaSpecificAdapterConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,7 @@ public OpcUaSpecificAdapterConfig(
this.overrideUri = requireNonNullElse(overrideUri, false);
this.applicationUri = (applicationUri != null && !applicationUri.isBlank()) ? applicationUri : null;
this.auth = auth;
this.tls = requireNonNullElse(tls, new Tls(false, null, null));
this.tls = requireNonNullElse(tls, new Tls(false, false, null, null));
this.opcuaToMqttConfig =
Objects.requireNonNullElseGet(opcuaToMqttConfig, () -> new OpcUaToMqttConfig(1, 1000));
this.security = requireNonNullElse(security, new Security(Constants.DEFAULT_SECURITY_POLICY));
Expand Down Expand Up @@ -125,6 +125,8 @@ public OpcUaSpecificAdapterConfig(
return applicationUri;
}



@Override
public boolean equals(final @Nullable Object o) {
if (o == null || getClass() != o.getClass()) {
Expand Down
21 changes: 21 additions & 0 deletions ...les/hivemq-edge-module-opcua/src/main/java/com/hivemq/edge/adapters/opcua/config/Tls.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,12 @@ public record Tls (@JsonProperty("enabled")
defaultValue = "false")
boolean enabled,

@JsonProperty("noChecks")
@ModuleConfigField(title = "Disable certificate validation",
description = "Allows to disable the validation of a certificate",
defaultValue = "false")
@Nullable Boolean noChecks,

@JsonProperty("keystore")
@JsonInclude(NON_NULL)
@ModuleConfigField(title = "Keystore",
Expand All @@ -46,4 +52,19 @@ public record Tls (@JsonProperty("enabled")
@JsonCreator
public Tls{
}

@Override
public boolean equals(final Object o) {
if (o == null || getClass() != o.getClass()) return false;
final Tls tls = (Tls) o;
return enabled() == tls.enabled() &&
noChecks() == tls.noChecks() &&
Objects.equals(keystore(), tls.keystore()) &&
Objects.equals(truststore(), tls.truststore());
}

@Override
public int hashCode() {
return Objects.hash(enabled(), noChecks(), keystore(), truststore());
}
}
8 changes: 4 additions & 4 deletions ...ge-module-opcua/src/test/java/com/hivemq/edge/adapters/opcua/OpcUaEndpointFilterTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ public void whenSingleEndpointConfigSet_thenPickCorrectEndpoint() {
false,
null,
null,
new Tls(true, new Keystore("path", null, null), null),
new Tls(true, false, new Keystore("path", null, null), null),
null,
null);

Expand Down Expand Up @@ -115,7 +115,7 @@ public void whenMessageSecurityModeSpecified_thenFilterByMode() {
false,
null,
null,
new Tls(true, new Keystore("path", null, null), null),
new Tls(true, false, new Keystore("path", null, null), null),
null,
null);

Expand Down Expand Up @@ -152,7 +152,7 @@ public void whenNoMessageSecurityModeSpecified_thenAcceptAnyMode() {
false,
null,
null,
new Tls(true, new Keystore("path", null, null), null),
new Tls(true, false, new Keystore("path", null, null), null),
null,
null);

Expand Down Expand Up @@ -181,7 +181,7 @@ public void whenWrongMessageSecurityMode_thenNoEndpointSelected() {
false,
null,
null,
new Tls(true, new Keystore("path", null, null), null),
new Tls(true, false, new Keystore("path", null, null), null),
null,
null);

Expand Down
4 changes: 2 additions & 2 deletions ...dule-opcua/src/test/java/com/hivemq/edge/adapters/opcua/OpcUaProtocolAdapterAuthTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,7 +145,7 @@ public void whenBasicAuthAndNoSubscriptions_thenConnectSuccessfully() {
@Timeout(30)
public void whenTlsAndNoSubscriptions_thenConnectSuccessfully() {
final Security security = new Security(SecPolicy.NONE);
final Tls tls = new Tls(true, null, null);
final Tls tls = new Tls(true, false, null, null);
final OpcUaSpecificAdapterConfig config = new OpcUaSpecificAdapterConfig(
opcUaServerExtension.getServerUri(),
false,
Expand Down Expand Up @@ -174,7 +174,7 @@ public void whenCertAuthAndNoSubscriptions_thenConnectSuccessfully() throws Exce
final KeyChain root = KeyChain.createKeyChain("root");

final var keystore = root.wrapInKeyStoreWithPrivateKey("keystore", "root", "password", "password");
final Tls tls = new Tls(true, new Keystore(keystore.getAbsolutePath(), "password", "password"), null);
final Tls tls = new Tls(true, false, new Keystore(keystore.getAbsolutePath(), "password", "password"), null);
final OpcUaSpecificAdapterConfig config = new OpcUaSpecificAdapterConfig(
opcUaServerExtension.getServerUri(),
false,
Expand Down
2 changes: 1 addition & 1 deletion ...ge-module-opcua/src/test/java/com/hivemq/edge/adapters/opcua/client/ParsedConfigTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -357,7 +357,7 @@ private OpcUaSpecificAdapterConfig createAdapterConfig(
? new Truststore(truststorePath, KEYSTORE_PASSWORD)
: null;

final Tls tls = new Tls(tlsEnabled, keystore, truststore);
final Tls tls = new Tls(tlsEnabled, false, keystore, truststore);
final Security security = new Security(SecPolicy.NONE);
final OpcUaToMqttConfig opcUaToMqttConfig = new OpcUaToMqttConfig(1, 1000);

Expand Down
1 change: 1 addition & 0 deletions ...a/src/test/java/com/hivemq/edge/adapters/opcua/config/OpcUaProtocolAdapterConfigTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,6 +180,7 @@ public void unconvertConfigObject_full_valid() {
null,
new Auth(new BasicAuth("my-username", "my-password"), new X509Auth(true)),
new Tls(true,
false,
new Keystore("my/keystore/path", "keystore-password", "private-key-password"),
new Truststore("my/truststore/path", "truststore-password")),
new OpcUaToMqttConfig(1, 1000),
Expand Down
Loading