Check server application Uri with the create session response

Libraries/Opc.Ua.Client/ReverseConnectManager.cs

@@ -152,18 +152,21 @@
             }
 
             /// <summary>
-            /// Register with the server certificate.
+            /// Register with the server certificate to extract the application Uri.
             /// </summary>
-            /// <param name="serverCertificate"></param>
-            /// <param name="endpointUrl"></param>
-            /// <param name="onConnectionWaiting"></param>
+            /// <remarks>
+            /// The first Uri in the subject alternate name field is considered the application Uri.
+            /// </remarks>
+            /// <param name="serverCertificate">The server certificate with the application Uri.</param>
+            /// <param name="endpointUrl">The endpoint Url of the server.</param>
+            /// <param name="onConnectionWaiting">The connection to use.</param>
             public Registration(
                 X509Certificate2 serverCertificate,
                 Uri endpointUrl,
                 EventHandler<ConnectionWaitingEventArgs> onConnectionWaiting) :
                 this(endpointUrl, onConnectionWaiting)
             {
-                ServerUri = X509Utils.GetApplicationUriFromCertificate(serverCertificate);
+                ServerUri = X509Utils.GetApplicationUrisFromCertificate(serverCertificate).FirstOrDefault();
             }
 
             private Registration(

Libraries/Opc.Ua.Client/Session/Session.cs

@@ -2338,7 +2338,6 @@
 
                 if (requireEncryption)
                 {
-                    ValidateServerCertificateApplicationUri(serverCertificate);
                     if (checkDomain)
                     {
                         m_configuration.CertificateValidator.Validate(serverCertificateChain, m_endpoint);
@@ -2417,24 +2416,24 @@
             if (!successCreateSession)
             {
                 base.CreateSession(
-                        null,
-                        clientDescription,
-                        m_endpoint.Description.Server.ApplicationUri,
-                        m_endpoint.EndpointUrl.ToString(),
-                        sessionName,
-                        clientNonce,
-                        clientCertificateChainData != null ? clientCertificateChainData : clientCertificateData,
-                        sessionTimeout,
-                        (uint)MessageContext.MaxMessageSize,
-                        out sessionId,
-                        out sessionCookie,
-                        out m_sessionTimeout,
-                        out serverNonce,
-                        out serverCertificateData,
-                        out serverEndpoints,
-                        out serverSoftwareCertificates,
-                        out serverSignature,
-                        out m_maxRequestMessageSize);
+                    null,
+                    clientDescription,
+                    m_endpoint.Description.Server.ApplicationUri,
+                    m_endpoint.EndpointUrl.ToString(),
+                    sessionName,
+                    clientNonce,
+                    clientCertificateChainData != null ? clientCertificateChainData : clientCertificateData,
+                    sessionTimeout,
+                    (uint)MessageContext.MaxMessageSize,
+                    out sessionId,
+                    out sessionCookie,
+                    out m_sessionTimeout,
+                    out serverNonce,
+                    out serverCertificateData,
+                    out serverEndpoints,
+                    out serverSoftwareCertificates,
+                    out serverSignature,
+                    out m_maxRequestMessageSize);
             }
 
             // save session id.
@@ -2456,6 +2455,8 @@
 
                 ValidateServerEndpoints(serverEndpoints);
 
+                ValidateServerCertificateApplicationUri(m_endpoint, serverCertificate);
+
                 ValidateServerSignature(serverCertificate, serverSignature, clientCertificateData, clientCertificateChainData, clientNonce);
 
                 HandleSignedSoftwareCertificates(serverSoftwareCertificates);
@@ -5352,26 +5353,53 @@
                     !String.IsNullOrEmpty(identityPolicy.SecurityPolicyUri);
             }
         }
+
         /// <summary>
-        /// Validates the ServerCertificate ApplicationUri to match the ApplicationUri of the Endpoint for an open call (Spec Part 4 5.4.1)
+        /// Validates the ServerCertificate ApplicationUri to match the ApplicationUri
+        /// of the Endpoint (Spec Part 4 5.4.1) returned by the CreateSessionResponse.
+        /// Ensure the endpoint was matched in <see cref="ValidateServerEndpoints"/>
+        /// with the applicationUri of the server description before the validation.
         /// </summary>
-        private void ValidateServerCertificateApplicationUri(
-            X509Certificate2 serverCertificate)
+        private static void ValidateServerCertificateApplicationUri(ConfiguredEndpoint endpoint, X509Certificate2 serverCertificate)
         {
-            var applicationUri = m_endpoint?.Description?.Server?.ApplicationUri;
-            //check is only neccessary if the ApplicatioUri is specified for the Endpoint
-            if (string.IsNullOrEmpty(applicationUri))
+            if (serverCertificate != null)
             {
-                throw ServiceResultException.Create(
-                    StatusCodes.BadSecurityChecksFailed,
-                    "No ApplicationUri is specified for the server in the EndpointDescription.");
-            }
-            string certificateApplicationUri = X509Utils.GetApplicationUriFromCertificate(serverCertificate);
-            if (!string.Equals(certificateApplicationUri, applicationUri, StringComparison.Ordinal))
-            {
-                throw ServiceResultException.Create(
-                    StatusCodes.BadSecurityChecksFailed,
-                    "Server did not return a Certificate matching the ApplicationUri specified in the EndpointDescription.");
+                var applicationUri = endpoint?.Description?.Server?.ApplicationUri;
+
+                // check that an ApplicatioUri is specified for the Endpoint
+                if (string.IsNullOrEmpty(applicationUri))
+                {
+                    throw ServiceResultException.Create(
+                        StatusCodes.BadCertificateUriInvalid,
+                        "Server did not return an ApplicationUri in the EndpointDescription.");
+                }
+
+                var certificateApplicationUris = X509Utils.GetApplicationUrisFromCertificate(serverCertificate);
+                if (certificateApplicationUris.Count == 0)
+                {
+                    throw ServiceResultException.Create(
+                            StatusCodes.BadCertificateUriInvalid,
+                            "The Server Certificate ({1}) does not contain an applicationUri.",
+                            serverCertificate.Subject);
+                }
+
+                bool noMatch = true;
+                foreach (var certificateApplicationUri in certificateApplicationUris)
+                {
+                    if (string.Equals(certificateApplicationUri, applicationUri, StringComparison.Ordinal))
+                    {
+                        noMatch = false;
+                        break;
+                    }
+                }
+
+                if (noMatch)
+                {
+                    throw ServiceResultException.Create(
+                        StatusCodes.BadCertificateUriInvalid,
+                        "The Application in the EndpointDescription ({0}) is not in the Server Certificate ({1}).",
+                        applicationUri, serverCertificate.Subject);
+                }
             }
         }
 
@@ -5538,7 +5566,7 @@
                 }
             }
 
-            // find the matching description (TBD - check domains against certificate).
+            // find the matching description (TBD - check domains and application URI against certificate).
             bool found = false;
 
             var foundDescription = FindMatchingDescription(serverEndpoints, m_endpoint.Description, true);

Libraries/Opc.Ua.Client/Session/SessionAsync.cs

@@ -93,7 +93,6 @@ public async Task OpenAsync(
 
                 if (requireEncryption)
                 {
-                    ValidateServerCertificateApplicationUri(serverCertificate);
                     if (checkDomain)
                     {
                         await m_configuration.CertificateValidator.ValidateAsync(serverCertificateChain, m_endpoint, ct).ConfigureAwait(false);
@@ -201,6 +200,8 @@ public async Task OpenAsync(
 
                 ValidateServerEndpoints(serverEndpoints);
 
+                ValidateServerCertificateApplicationUri(m_endpoint, serverCertificate);
+
                 ValidateServerSignature(serverCertificate, serverSignature, clientCertificateData, clientCertificateChainData, clientNonce);
 
                 HandleSignedSoftwareCertificates(serverSoftwareCertificates);

Libraries/Opc.Ua.Configuration/ApplicationInstance.cs

@@ -671,23 +671,38 @@
                 }
             }
 
-            // check uri.
-            string applicationUri = X509Utils.GetApplicationUriFromCertificate(certificate);
+            // default application uri
+            string applicationUri = configuration.ApplicationUri;
 
-            if (String.IsNullOrEmpty(applicationUri))
+            // check certificate Uri and find a match
+            var applicationUris = X509Utils.GetApplicationUrisFromCertificate(certificate);
+            bool foundMatch = false;
+            foreach (var appUri in applicationUris)
             {
-                string message = "The Application URI could not be read from the certificate. Use certificate anyway?";
-                if (!await ApplicationInstance.ApproveMessageAsync(message, silent).ConfigureAwait(false))
+                if (configuration.ApplicationUri.Equals(appUri, StringComparison.Ordinal))
                 {
-                    return false;
+                    foundMatch = true;
+                    break;
                 }
             }
-            else if (!configuration.ApplicationUri.Equals(applicationUri, StringComparison.Ordinal))
+
+            if (!foundMatch && applicationUris.Count > 0)
             {
-                Utils.LogInfo("Updated the ApplicationUri: {0} --> {1}", configuration.ApplicationUri, applicationUri);
+                foundMatch = true;
+                applicationUri = applicationUris[0];
+                Utils.LogInfo("Updating the ApplicationUri: {0} --> {1}", configuration.ApplicationUri, applicationUris[0]);
                 configuration.ApplicationUri = applicationUri;
             }
 
+            if (!foundMatch)
+            {
+                string message = "The Application URI could not be found in the certificate. Use certificate anyway?";
+                if (!await ApplicationInstance.ApproveMessageAsync(message, silent).ConfigureAwait(false))
+                {
+                    return false;
+                }
+            }
+
             Utils.LogInfo("Using the ApplicationUri: {0}", applicationUri);
 
             // update configuration.

Libraries/Opc.Ua.Gds.Client.Common/CertificateWrapper.cs

@@ -29,6 +29,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using System.Runtime.Serialization;
 using System.Security.Cryptography.X509Certificates;
 using Opc.Ua.Security.Certificates;
@@ -213,7 +214,7 @@
                 {
                     try
                     {
-                        return X509Utils.GetApplicationUriFromCertificate(Certificate);
+                        return X509Utils.GetApplicationUrisFromCertificate(Certificate).FirstOrDefault();
                     }
                     catch (Exception e)
                     {

Libraries/Opc.Ua.Security.Certificates/Extensions/X509SubjectAltNameExtension.cs

@@ -85,7 +85,7 @@
         /// Creates an extension from ASN.1 encoded data.
         /// </summary>
         public X509SubjectAltNameExtension(AsnEncodedData encodedExtension, bool critical)
             : this(encodedExtension.Oid, encodedExtension.RawData, critical)
         {
         }
 
@@ -113,12 +113,28 @@
         /// <param name="applicationUri">The application Uri</param>
         /// <param name="domainNames">The domain names. DNS Hostnames, IPv4 or IPv6 addresses</param>
         public X509SubjectAltNameExtension(
             string applicationUri,
             IEnumerable<string> domainNames)
         {
             Oid = new Oid(SubjectAltName2Oid, kFriendlyName);
             Critical = false;
-            Initialize(applicationUri, domainNames);
+            Initialize(new string[] { applicationUri }, domainNames);
+            RawData = Encode();
+            m_decoded = true;
+        }
+
+        /// <summary>
+        /// Build the Subject Alternative name extension (for OPC UA application certs).
+        /// </summary>
+        /// <param name="applicationUris">The application Uri</param>
+        /// <param name="domainNames">The domain names. DNS Hostnames, IPv4 or IPv6 addresses</param>
+        public X509SubjectAltNameExtension(
+            IEnumerable<string> applicationUris,
+            IEnumerable<string> domainNames)
+        {
+            Oid = new Oid(SubjectAltName2Oid, kFriendlyName);
+            Critical = false;
+            Initialize(applicationUris, domainNames);
             RawData = Encode();
             m_decoded = true;
         }
@@ -402,14 +418,17 @@
         /// <summary>
         /// Initialize the Subject Alternative name extension.
         /// </summary>
-        /// <param name="applicationUri">The application Uri</param>
+        /// <param name="applicationUris">The application Uris</param>
         /// <param name="generalNames">The general names. DNS Hostnames, IPv4 or IPv6 addresses</param>
-        private void Initialize(string applicationUri, IEnumerable<string> generalNames)
+        private void Initialize(IEnumerable<string> applicationUris, IEnumerable<string> generalNames)
         {
             var uris = new List<string>();
             var domainNames = new List<string>();
             var ipAddresses = new List<string>();
-            uris.Add(applicationUri);
+            foreach (string applicationUri in applicationUris)
+            {
+                uris.Add(applicationUri);
+            }
             foreach (string generalName in generalNames)
             {
                 switch (Uri.CheckHostName(generalName))

Libraries/Opc.Ua.Server/Server/StandardServer.cs

@@ -380,23 +380,34 @@
 
                         if (context.SecurityPolicyUri != SecurityPolicies.None)
                         {
-                            string certificateApplicationUri = X509Utils.GetApplicationUriFromCertificate(parsedClientCertificate);
-
-                            // verify if applicationUri from ApplicationDescription matches the applicationUri in the client certificate.
-                            if (!String.IsNullOrEmpty(certificateApplicationUri) &&
-                                !String.IsNullOrEmpty(clientDescription.ApplicationUri) &&
-                                certificateApplicationUri != clientDescription.ApplicationUri)
+                            // verify if applicationUri from ApplicationDescription matches the applicationUris in the client certificate.
+                            if (!String.IsNullOrEmpty(clientDescription.ApplicationUri))
                             {
-                                // report the AuditCertificateDataMismatch event for invalid uri
-                                ServerInternal?.ReportAuditCertificateDataMismatchEvent(parsedClientCertificate, null, clientDescription.ApplicationUri, StatusCodes.BadCertificateUriInvalid);
+                                bool noMatch = true;
+                                var certificateApplicationUris = X509Utils.GetApplicationUrisFromCertificate(parsedClientCertificate);
+                                foreach (var certificateApplicationUri in certificateApplicationUris)
+                                {
+                                    if (!String.IsNullOrEmpty(certificateApplicationUri) &&
+                                        certificateApplicationUri == clientDescription.ApplicationUri)
+                                    {
+                                        noMatch = false;
+                                        break;
+                                    }
+                                }
 
-                                throw ServiceResultException.Create(
-                                    StatusCodes.BadCertificateUriInvalid,
-                                    "The URI specified in the ApplicationDescription {0} does not match the URI in the Certificate: {1}.",
-                                    clientDescription.ApplicationUri, certificateApplicationUri);
-                            }
+                                if (noMatch)
+                                {
+                                    // report the AuditCertificateDataMismatch event for invalid uri
+                                    ServerInternal?.ReportAuditCertificateDataMismatchEvent(parsedClientCertificate, null, clientDescription.ApplicationUri, StatusCodes.BadCertificateUriInvalid);
+
+                                    throw ServiceResultException.Create(
+                                        StatusCodes.BadCertificateUriInvalid,
+                                        "The URI specified in the ApplicationDescription {0} does not match the URIs in the Certificate.",
+                                        clientDescription.ApplicationUri);
+                                }
 
-                            CertificateValidator.Validate(clientCertificateChain);
+                                CertificateValidator.Validate(clientCertificateChain);
+                            }
                         }
                     }
                     catch (Exception e)
@@ -2327,7 +2338,7 @@
                                 {
                                     client.RegisterServer(requestHeader, m_registrationInfo);
                                 }
-                                
+
                                 m_registeredWithDiscoveryServer = m_registrationInfo.IsOnline;
                                 return true;
                             }
@@ -3082,7 +3093,7 @@
             // attempt graceful shutdown the server.
             try
             {
-                
+
                 if (m_maxRegistrationInterval > 0 && m_registeredWithDiscoveryServer)
                 {
                     // unregister from Discovery Server if registered before

Stack/Opc.Ua.Core/Security/Certificates/CertificateFactory.cs

@@ -319,10 +319,10 @@ public static byte[] CreateSigningRequest(
                 }
             }
 
-            string applicationUri = X509Utils.GetApplicationUriFromCertificate(certificate);
+            var applicationUris = X509Utils.GetApplicationUrisFromCertificate(certificate);
 
             // Subject Alternative Name
-            var subjectAltName = new X509SubjectAltNameExtension(applicationUri, domainNames);
+            var subjectAltName = new X509SubjectAltNameExtension(applicationUris, domainNames);
             request.CertificateExtensions.Add(new X509Extension(subjectAltName, false));
 
             using (RSA rsa = certificate.GetRSAPrivateKey())