Skip to content

Allow non OPC-UA conform SubjectName values to AddSecurityConfigurationStores #3229

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 13 commits into
base: master
Choose a base branch
from
+850 −12
Open

Allow non OPC-UA conform SubjectName values to AddSecurityConfigurationStores #3229

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
db47165
Replace fuzzy search with SimpleName search if comparing Distinguishe…
mrsuciu Sep 23, 2025
80a00a0
Added mandatory Organization Name attribute to SetSuitableDefaults().
mrsuciu Sep 26, 2025
4f8d333
Added missing O attribute to CompareDistinguishedName call
mrsuciu Sep 26, 2025
dc476b5
Merge latest master into branch
mrsuciu Sep 26, 2025
7f2a031
Update test
mrsuciu Oct 2, 2025
1893081
CertificateIdentifier.Find will pick the certificate with the longest…
mrsuciu Oct 6, 2025
ae9759d
Find only valid certificates.
mrsuciu Oct 7, 2025
48ebf5c
Prioritizes CA-signed certificates over self-signed certificates
mrsuciu Oct 10, 2025
d93e3d0
Update Tests/Opc.Ua.Configuration.Tests/ApplicationInstanceTests.cs
romanett Oct 12, 2025
2d813c4
Select longest remaining validity if valid, or least expired if all e…
mrsuciu Oct 13, 2025
3bf9924
Renamings
mrsuciu Oct 14, 2025
a8f75a9
Improved comments, improved algo clarity and taken into account more …
mrsuciu Oct 17, 2025
7b41e85
Comment corrected
mrsuciu Oct 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 9 additions & 6 deletions Stack/Opc.Ua.Core/Security/Certificates/CertificateIdentifier.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -371,13 +371,16 @@ private static string GetDisplayName(X509Certificate2 certificate)
/// </summary>
/// <param name="collection"></param>
/// <returns></returns>
static X509Certificate2 PickLongestDuration(X509Certificate2Collection collection)
static X509Certificate2 PickLongestDurationValidCerts(X509Certificate2Collection collection)
{
X509Certificate2 bestMatch = null;
TimeSpan bestAvailability = TimeSpan.MinValue;
DateTime bestNotAfter = DateTime.MinValue;

foreach (X509Certificate2 certificate in collection)
// Filter Valid certificates by time
X509Certificate2Collection validCertificates = collection.Find(X509FindType.FindByTimeValid, DateTime.Now, false);

foreach (X509Certificate2 certificate in validCertificates)
{
TimeSpan availability = certificate.NotAfter - certificate.NotBefore;

Expand Down Expand Up @@ -456,7 +459,7 @@ public static X509Certificate2 Find(
}
if (matchesOnCriteria?.Count > 0)
{
return PickLongestDuration(matchesOnCriteria);
return PickLongestDurationValidCerts(matchesOnCriteria);
}

bool hasCommonName = subjectName.IndexOf("CN=", StringComparison.OrdinalIgnoreCase) >= 0;
Expand Down Expand Up @@ -485,7 +488,7 @@ public static X509Certificate2 Find(
}
if (matchesOnCriteria?.Count > 0)
{
return PickLongestDuration(matchesOnCriteria);
return PickLongestDurationValidCerts(matchesOnCriteria);
}
}
}
Expand All @@ -505,7 +508,7 @@ public static X509Certificate2 Find(
}
if (matchesOnCriteria?.Count > 0)
{
return PickLongestDuration(matchesOnCriteria);
return PickLongestDurationValidCerts(matchesOnCriteria);
}
}
}
Expand All @@ -524,7 +527,7 @@ public static X509Certificate2 Find(
}
if (matchesOnCriteria?.Count > 0)
{
return PickLongestDuration(matchesOnCriteria);
return PickLongestDurationValidCerts(matchesOnCriteria);
}
}

Expand Down
19 changes: 13 additions & 6 deletions Tests/Opc.Ua.Core.Tests/Security/Certificates/CertificateStoreTest.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -649,26 +649,33 @@ public void FindInCollectionTest()
"CN=Opc.Ua.Core.Tests",
"urn:localhost:UA:Opc.Ua.Core.Tests",
validityMonths: 36);
X509Certificate2 certLongestDurationLatestNotAfter = CreateDuplicateCertificate(
X509Certificate2 certLongestDurationLatestNotAfterValid = CreateDuplicateCertificate(
"CN=Opc.Ua.Core.Tests",
"urn:localhost:UA:Opc.Ua.Core.Tests",
validityMonths: 36,
startingFromDays: -1);
X509Certificate2 certLongestDurationLatestNotAfterInValid = CreateDuplicateCertificate(
"CN=Opc.Ua.Core.Tests",
"urn:localhost:UA:Opc.Ua.Core.Tests",
validityMonths: 42,
startingFromDays: 1);


var testCertificatesCollection = new[]
{
certSubjectSubstring,
certSubjectWithCnDuplicate,
certSubjectWithoutCnDuplicate,
certApplicationUriDuplicate,
certLongestDuration,
certLongestDurationLatestNotAfter
certLongestDurationLatestNotAfterValid,
certLongestDurationLatestNotAfterInValid, // Never to be picked, just poisoned value
};

X509Certificate2 CreateDuplicateCertificate(string subjectName,
string applicationUri,
int validityMonths = 2,
int startingFromDays = -1)
int startingFromDays = -2)
{
var certificateFactory = CertificateFactory.CreateCertificate(subjectName)
.SetNotBefore(startCreation.AddDays(startingFromDays))
Expand Down Expand Up @@ -740,7 +747,7 @@ X509Certificate2 CreateDuplicateCertificate(string subjectName,
null,
false);
Assert.NotNull(resultSubjectWithCnDuplicate);
Assert.AreEqual(certLongestDurationLatestNotAfter.Thumbprint,
Assert.AreEqual(certLongestDurationLatestNotAfterValid.Thumbprint,
resultSubjectWithCnDuplicate.Thumbprint);

// Test that longest duration certificate is selected when multiple matches exist
Expand All @@ -753,7 +760,7 @@ X509Certificate2 CreateDuplicateCertificate(string subjectName,
null,
false);
Assert.NotNull(resultLongestDuration);
Assert.AreEqual(certLongestDurationLatestNotAfter.Thumbprint,
Assert.AreEqual(certLongestDurationLatestNotAfterValid.Thumbprint,
resultLongestDuration.Thumbprint);

// Test search by applicationUri works for single match
Expand All @@ -776,7 +783,7 @@ X509Certificate2 CreateDuplicateCertificate(string subjectName,
null,
false);
Assert.NotNull(resultApplicationUriDuplicate);
Assert.AreEqual(certLongestDurationLatestNotAfter.Thumbprint,
Assert.AreEqual(certLongestDurationLatestNotAfterValid.Thumbprint,
resultApplicationUriDuplicate.Thumbprint);
}

Expand Down
Loading