BadCertificateUriInvalid. The URI specified in the ApplicationDescription does not match the URI in the certificate

[Candiglez]

Hi Guys,

I am testing the asyncua library with a client code connecting to a productive OPC UA Server with certificates, Basic256SHA256 and Sign & Encrypt .
I can connect perfectly to the server with UA Extpert. I have pointed the users and server certificate to the files used by the UAExpert (which work, and user certificated are already acepted at the server.

But the server certificate is not acepted by the client in py. I always get the error:
Exception has occurred: BadCertificateUriInvalid
"The URI specified in the ApplicationDescription does not match the URI in the certificate."(BadCertificateUriInvalid)

I have try not using any server certifficate and letting the libray to download from the server, but I got the same error. The certificated is downloaded from the server and we can see in the terminal :

INFO:asyncua.client.client:find_endpoint [EndpointDescription(EndpointUrl='opc.tcp://aymojs.slinco.local:7560/System1OPCUAServer', Server=ApplicationDescription(ApplicationUri='urn:AYMOJ.slinco.local:BentlyNevada:System1OpcUaServer', ProductUri='https://www.industrial.ai/bently-nevada/services-bently-nevada/system-1', ApplicationName=LocalizedText(Locale='en-US', Text='System1OPCUAServer')

I can not change the server certificate. Is there any how to disable the server certificate validation?

My code is just the client-with-encryption.py example included with the library:

import asyncio
import logging
from sqlite3 import connect
import sys
sys.path.insert(0, "..")
from asyncua import Client, Node, ua
from asyncua.crypto.security_policies import SecurityPolicyBasic256Sha256

logging.basicConfig(level=logging.INFO)
_logger = logging.getLogger("asyncua")

cert = "certificates/uaexpert.der"
private_key = "certificates/uaexpert_key.pem"

async def task(loop):
url = "opc.tcp://aymojs.slinco.local:7560/System1OPCUAServer"
client = Client(url=url, timeout=60)
await client.set_security(
SecurityPolicyBasic256Sha256,
certificate=cert,
private_key=private_key,
server_certificate="certificates/System1OPCUAServer [40B43BD6208593C51A6575B3ACC4BDF30DEF0F3D].der"
)
async with client:
objects = client.nodes.objects
child = await objects.get_child(['0:MyObject', '0:MyVariable'])
print(await child.get_value())
await child.set_value(42)
print(await child.get_value())

def main():
loop = asyncio.get_event_loop()
loop.set_debug(True)
loop.run_until_complete(task(loop))
loop.close()

if name == "main":
main()

[AndreasHeine]

why not change your client description according to your certificate? you never set them!

edit:
guess this one https://github.com/FreeOpcUa/opcua-asyncio/blob/master/asyncua/client/client.py#L63

[Candiglez]

Thanks Andreas,

Not sure if I understood. The certificated that does not pass the verification phase is the server certificate, because it include inside an application description URI that does not match with the EndPoint URL.

But the client certificate are not causing any exception.

With that set of certificates, UA Expert connect perfectly.

Not sure if there is any way of disabling that server certificate validation.

The exception is raised at the async def connect(self) funtiion in client.py, just after returning from async def create_session(self) funtion

File "c:\Users\CGG\source\System1.venv\lib\site-packages\asyncua\client\client.py", line 266, in connect
self.close_secure_channel()