Search code examples
opc-uamilo

How many number of times application instance certificates are to be validated in OPC UA?

Requesting a clarification on the number of times application instance certificates (both client/server) are validated from opening a SecureChannel to activating a Session in OPC UA security architecture ?

  • From the book, 'OPC Unified Architecture' by Mahnke, Leitner, Damm, the following image is seen where the application instance certificates are seen validated. (Figure 7.4 in page no. 214) Creating an OPC UA Secure Channel
  • According to the specification Part 4 Services, section 6.1.5 - figure 22 shows that the application instance certificates are validated again during the session creation.

Why is this difference between the standard and the concept described in the book ? Is it really necessary to validate the application instance certificate again during session creation ? I notice that the Milo examples validate only once while opening a SecureChannel if I am not wrong.

Solution

  • I think that diagram is incorrect or out of date.

    Validation and verification of trust has to happen the first time client/server see the certificate, which is when the channels are established.

    In Create/Activate Session service possession of the certificates is proved using the signatures exchanged in the requests/responses.

    edit: to summarize the comments, validation needs to occur during session creation only if the transport layer being used doesn't validate it there, but in Milo's case it's always the binary TCP transport so validation during session creation is redundant.