OPC UA Driver should support client certificates

[ottlukas]

For an application we need to support Cert based Security in the OPC UA Driver.

Imported from Jira PLC4X-185. Original Jira may contain additional context.
Reported by: jfeinauer.

[marcoantigo]

Are there any estimates on when this will be implemented?

[ottlukas]

@hutcheb looked at it in 2021:

For 0.9, certificates for encryption is not supported.
For encryption, asymmetric encryption is used initially, the logic for this should work. It hasn't been tested for a while and may need some minor fixes. Once the session is established it switches to symmetric encryption. I had some trouble implementing this and couldn't get it to work properly.
For certificate based authentication, it hasn't been implemented, only anonymous and username profiles work. However it shouldn't be too difficult to implement as all of the certificate handling logic has been implemented.

This is the current state and for the time being no Developer is actively working on that. Our focus is currently on other protocols and topics. Maybe Ben can give an update.

[hutcheb]

Hi, Sorry, there has been no progress made since the last comment. If you are interested in working on it, I can help you get up to speed. Kind Regards Ben

…

On Wed, Jan 18, 2023 at 1:25 PM otluk ***@***.***> wrote: @hutcheb <https://github.com/hutcheb> looked at it in 2021: For 0.9, certificates for encryption is not supported. For encryption, asymmetric encryption is used initially, the logic for this should work. It hasn't been tested for a while and may need some minor fixes. Once the session is established it switches to symmetric encryption. I had some trouble implementing this and couldn't get it to work properly. For certificate based authentication, it hasn't been implemented, only anonymous and username profiles work. However it shouldn't be too difficult to implement as all of the certificate handling logic has been implemented. This is the current state and for the time beeing no Developer is activily working on that. Our focus is currently on other protocols and topics. but may be Ben can give an update. — Reply to this email directly, view it on GitHub <#595 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADXBWTGPCAJTJSLG6BNW4ZDWS7OM7ANCNFSM6AAAAAAR3IN7ZU> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[chrisdutz]

@hutcheb can you confirm this issue can now be closed?

[splatch]

I believe it can be closed with work done in #1007. It covers both symetric and asymmetric encryption with client certificate retrieved from keystore.

[splatch]

Completed via #1007.