RE: OPCUA SSL problem

[Majer Karel via Tech-talk <tech-talk at aps.anl.gov>]

Hi Ralph,

 

Many thanks for your help, I finally got the IOC working with the binary distribution. I had additional trouble with the client certificate, because the server turned out to be quite picky regarding extension fields of the certificate, but it runs now.

 

We still don’t know what was the issue with open62541 client. I think it dislikes the OpenSecureChannelResponse from this server for some reason.

 

Best regards,

 

Karel

 

From: Tech-talk <tech-talk-bounces at aps.anl.gov> On Behalf Of Ralph Lange via Tech-talk
Sent: Tuesday, October 8, 2024 9:59 AM
To: EPICS Tech Talk <tech-talk at aps.anl.gov>
Subject: Re: OPCUA SSL problem

 

Hi Karel,

 

As I wrote earlier, if you want to use the binary distribution with OPC UA security, you need to use a container with an older Linux version. My UA SDK license is for version 1.7.4, which only works against OpenSSLv1. I had to switch OPC UA Security off to get it to compile on the newer systems.

 

Cheers,
~Ralph

 

 

On Tue, 8 Oct 2024 at 09:33, Majer Karel via Tech-talk <tech-talk at aps.anl.gov> wrote:

Hi Ralph,

 

I have some fairly good news. I built the IOC with the binary distribution and it connects to the server. I cannot read data though, because the IOC ignores security setup and the server is configured in a way that it requires encryption. But I hope that using the full UA SDK will work.

 

So it seems that the problem is some incompatibility of open62541 client and the server used. I have dumped also working communication of open62541 and B&R OPCUA server and noticed differences in OpenSecureChannelResponse of the two servers. The problematic server does not send Nonce field in the response, but I don’t understand the OPCUA protocol well enough to be able to tell how much of a problem it its.

 

Best regards,

 

Karel

 

From: Tech-talk <tech-talk-bounces at aps.anl.gov> On Behalf Of Ralph Lange via Tech-talk
Sent: Monday, October 7, 2024 12:02 PM
To: EPICS Tech Talk <tech-talk at aps.anl.gov>
Subject: Re: OPCUA SSL problem

 

On Mon, 7 Oct 2024 at 11:04, Majer Karel via Tech-talk <tech-talk at aps.anl.gov> wrote:

 

I built the device support with UASdk, but the IOC crashes on startup with Segmentation fault:

 

#!../../bin/linux-x86_64/opcua

[...]

OPC UA Client Device Support 0.10.0-dev (-); using Unified Automation C++ Client SDK v1.8.4-632

iocRun: All initialization complete

OPC UA: Autoconnecting sessions

[...] 

Segmentation fault (core dumped)

 

That fits exactly the other reports I have received. "Compiles but crashes."

 

 I could download only evaluation version 1.8.4 of UASdk and noticed that the device support should work up to version 1.7. Is there anything I can try to get this running?

 

Try the UASDK-based binary distribution tar from GitHub that matches your version of Base (exact match required) and distribution.

 

Good luck!
~Ralph