Certificate problems

Most failed secure connections come down to certificates. The error texts on this page come from real runs of the SDK example (opcua_client). Security lists the certificate requirements, and PKI and trust setup shows how to create certificates.

Check these first

Look at the certificate’s subject, alternative names, key usage and validity:

openssl x509 -in server.cert.pem -noout -subject -dates -ext subjectAltName,keyUsage,extendedKeyUsage

For a DER file, add -inform DER. The error text tells you which side refused:

Error text	Refused by
OPC UA security <name>	This client, while checking the server certificate or its own certificate
OPC UA status: 0x80130000	The server, which refused the client certificate without saying why

Untrusted certificates

Error: connect failed (SDK status 5): OPC UA security CertificateUntrusted

The server certificate you gave the client to trust (TRUSTED_SERVER_DER, trusted_server_der) isn’t the one the server actually uses. If you recreated the server certificate, update the client’s file as well; pass the DER file the server uses.

Error: connect failed (SDK status 5): OPC UA status: 0x80130000

The server doesn’t trust the client certificate (BadSecurityChecksFailed). Put the client’s DER certificate into the server’s trusted client certificate (trusted_client_der, or server.trust in the simulator) and restart the server.

Host name rules

A PDComm client compares the host in the endpoint URL with the subjectAltName of the server certificate:

• A host name is compared with the DNS: entries and an IP address with the IP: entries. The subject’s CN isn’t used.
• Wildcards match a whole label only: *.example.com matches plc.example.com, but partial wildcards aren’t used.
• The name compared is the host of the URL you pass, not the URL the server announced in GetEndpoints.

When the server certificate lacks the name you connected with, you get:

Error: connect failed (SDK status 5): OPC UA security CertificateHostInvalid

This error came from connecting to opc.tcp://localhost:4840/pdcomm with a server certificate that contained only DNS:plc-01.example.invalid. Put every name and address clients use into the server certificate:

subjectAltName = URI:urn:pdcomm:opcua:server, DNS:localhost, DNS:my-pc, DNS:my-pc.plant.example, IP:127.0.0.1, IP:192.168.10.20

The Windows computer name

Some Windows clients replace localhost in the endpoint URL with the computer’s name before they connect, and check the server certificate’s host name against that name. If the server certificate has only localhost, such clients report a host name error (BadCertificateHostNameInvalid) or show a warning, even on the same computer. The same happens when the server announces a localhost URL in GetEndpoints.

• Put the computer name into the server certificate. On Windows, the hostname command shows it. For a computer in a domain, add the fully qualified name too.
• If clients connect from other computers, also add the names or IP addresses they use.
• The identity the PDComm simulator creates without certificate files contains DNS:localhost, the listen IP address (unless it’s 0.0.0.0) and server.advertised_host. If clients connect by the computer name, set advertised_host to that name. When you need several names, give the simulator a certificate through server.certificate and server.private_key.

The announced endpoint URL

A GetEndpoints response carries the endpoint URL the server announces:

• The SDK in-memory server announces the endpoint of pdcomm_opcua_server_options unchanged, so set it to the name clients actually use.
• By default, the simulator’s server returns the host and port from the URL the client put in its GetEndpoints, FindServers or CreateSession request. A client that discovers through opc.tcp://192.168.10.20:4841/pdcomm/simulator gets endpoints with that same address. Set server.advertised_host (--advertised-host for the headless and MCP programs) to always return one name, for example a public name behind NAT that the server can’t know.

PDComm servers check only the path of the URL in the Hello message, so a different host with the same path is accepted.

ApplicationUri rules

The certificate’s subjectAltName must have exactly one URI: entry, equal to the application’s ApplicationUri.

Error: connect failed (SDK status 5): OPC UA security CertificateUriInvalid

This error came from passing the server certificate (URI:urn:pdcomm:opcua:server) as the client identity; the client checks its own certificate before connecting. The ApplicationUri defaults to urn:pdcomm:opcua:client for clients and urn:pdcomm:opcua:server for servers. To use another value, change both the certificate’s URI and the application_uri option.

Validity period

An expired or not yet valid certificate gives:

Error: connect failed (SDK status 5): OPC UA security CertificateTimeInvalid

With an expired server certificate, the server doesn’t start:

Error: create failed (SDK status 5): OPC UA security CertificateTimeInvalid

Create a new certificate and update the peer’s trust settings to it. Also check that both computers’ clocks are right.

Private keys

Error: connect failed (SDK status 5): OPC UA security InvalidKey

The private key doesn’t belong to the certificate. Pass the *.key.pem created together with the certificate; RSA keys must be 2048 to 4096 bits.

Error: cannot read the certificate, private key or trusted server certificate

The example couldn’t read a file. Check the path, the permissions and the size (not empty, at most 64 KiB).

Creating certificates on Windows

Windows doesn’t ship OpenSSL. Install OpenSSL 3 and use the same templates and commands; in PowerShell, write each command on one line instead of continuing lines with \. Restrict the private key files with NTFS permissions so only the account that runs the application can read them.