I set up a python opcua server with security string "Basic256Sha256,SignAndEncrypt,cert.pem,key.pem". If I take InformationObject OPC client I can connect to the server by given the following information: Endpoint url, Trnsport Protocol (opc.tcp),Message Encoding (Binary), Security Mode (Sign _Encript), Security Policy (Basic256Sha256), User: Anonymous but I don't give any cert or key pem path. How is this possible? Is there a handshake where the server share cert and key to the client? How is possible to implement this kind of behavior in a Client made by Python opcua?
1 Answers
You need a certificate when using an Security Policy other then None. See for https://reference.opcfoundation.org/v104/Core/docs/Part7/6.6.165/ it states that you need a pki infracstructure. In the client context you need to provide a application certificate (DER public key, PEM private key).
The reason is to block clients with untrusted certificates from connecting to a server. With out pki anybody can start a ManInTheMiddle attack and would defeat any encryption.
To generate a certificate use the example script provided by python opcua https://github.com/FreeOpcUa/python-opcua/blob/master/examples/generate_certificate.sh.
Related