Check server application Uri with the create session response

Libraries/Opc.Ua.Client/ReverseConnectManager.cs

@@ -163,7 +163,7 @@
                 EventHandler<ConnectionWaitingEventArgs> onConnectionWaiting) :
                 this(endpointUrl, onConnectionWaiting)
             {
-                ServerUri = X509Utils.GetApplicationUriFromCertificate(serverCertificate);
+                ServerUri = X509Utils.GetApplicationUrisFromCertificate(serverCertificate).FirstOrDefault();
             }
 
             private Registration(

Libraries/Opc.Ua.Client/Session/Session.cs

@@ -2338,7 +2338,6 @@
 
                 if (requireEncryption)
                 {
-                    ValidateServerCertificateApplicationUri(serverCertificate);
                     if (checkDomain)
                     {
                         m_configuration.CertificateValidator.Validate(serverCertificateChain, m_endpoint);
@@ -2417,24 +2416,24 @@
             if (!successCreateSession)
             {
                 base.CreateSession(
-                        null,
-                        clientDescription,
-                        m_endpoint.Description.Server.ApplicationUri,
-                        m_endpoint.EndpointUrl.ToString(),
-                        sessionName,
-                        clientNonce,
-                        clientCertificateChainData != null ? clientCertificateChainData : clientCertificateData,
-                        sessionTimeout,
-                        (uint)MessageContext.MaxMessageSize,
-                        out sessionId,
-                        out sessionCookie,
-                        out m_sessionTimeout,
-                        out serverNonce,
-                        out serverCertificateData,
-                        out serverEndpoints,
-                        out serverSoftwareCertificates,
-                        out serverSignature,
-                        out m_maxRequestMessageSize);
+                    null,
+                    clientDescription,
+                    m_endpoint.Description.Server.ApplicationUri,
+                    m_endpoint.EndpointUrl.ToString(),
+                    sessionName,
+                    clientNonce,
+                    clientCertificateChainData != null ? clientCertificateChainData : clientCertificateData,
+                    sessionTimeout,
+                    (uint)MessageContext.MaxMessageSize,
+                    out sessionId,
+                    out sessionCookie,
+                    out m_sessionTimeout,
+                    out serverNonce,
+                    out serverCertificateData,
+                    out serverEndpoints,
+                    out serverSoftwareCertificates,
+                    out serverSignature,
+                    out m_maxRequestMessageSize);
             }
 
             // save session id.
@@ -2456,6 +2455,8 @@
 
                 ValidateServerEndpoints(serverEndpoints);
 
+                ValidateServerCertificateApplicationUri(m_endpoint, serverCertificate);
+
                 ValidateServerSignature(serverCertificate, serverSignature, clientCertificateData, clientCertificateChainData, clientNonce);
 
                 HandleSignedSoftwareCertificates(serverSoftwareCertificates);
@@ -5352,26 +5353,44 @@
                     !String.IsNullOrEmpty(identityPolicy.SecurityPolicyUri);
             }
         }
+
         /// <summary>
-        /// Validates the ServerCertificate ApplicationUri to match the ApplicationUri of the Endpoint for an open call (Spec Part 4 5.4.1)
+        /// Validates the ServerCertificate ApplicationUri to match the ApplicationUri
+        /// of the Endpoint (Spec Part 4 5.4.1) returned by the CreateSessionResponse.
+        /// Ensure the endpoint was matched in <see cref="ValidateServerEndpoints"/>
+        /// with the applicationUri of the server description before the validation.
         /// </summary>
-        private void ValidateServerCertificateApplicationUri(
-            X509Certificate2 serverCertificate)
+        private static void ValidateServerCertificateApplicationUri(ConfiguredEndpoint endpoint, X509Certificate2 serverCertificate)
         {
-            var applicationUri = m_endpoint?.Description?.Server?.ApplicationUri;
-            //check is only neccessary if the ApplicatioUri is specified for the Endpoint
-            if (string.IsNullOrEmpty(applicationUri))
+            if (serverCertificate != null)
             {
-                throw ServiceResultException.Create(
-                    StatusCodes.BadSecurityChecksFailed,
-                    "No ApplicationUri is specified for the server in the EndpointDescription.");
-            }
-            string certificateApplicationUri = X509Utils.GetApplicationUriFromCertificate(serverCertificate);
-            if (!string.Equals(certificateApplicationUri, applicationUri, StringComparison.Ordinal))
-            {
-                throw ServiceResultException.Create(
-                    StatusCodes.BadSecurityChecksFailed,
-                    "Server did not return a Certificate matching the ApplicationUri specified in the EndpointDescription.");
+                var applicationUri = endpoint?.Description?.Server?.ApplicationUri;
+
+                // check that an ApplicatioUri is specified for the Endpoint
+                if (string.IsNullOrEmpty(applicationUri))
+                {
+                    throw ServiceResultException.Create(
+                        StatusCodes.BadSecurityChecksFailed,
+                        "Server did not return an ApplicationUri in the EndpointDescription.");
+                }
+
+                bool noMatch = true;
+                var certificateApplicationUris = X509Utils.GetApplicationUrisFromCertificate(serverCertificate);
+                foreach (var certificateApplicationUri in certificateApplicationUris)
+                {
+                    if (string.Equals(certificateApplicationUri, applicationUri, StringComparison.Ordinal))
+                    {
+                        noMatch = false;
+                        break;
+                    }
+                }
+
+                if (noMatch)
+                {
+                    throw ServiceResultException.Create(
+                        StatusCodes.BadSecurityChecksFailed,
+                        "Server did not return the ApplicationUri in the EndpointDescription that is used in the server certificate.");
+                }
             }
         }
 
@@ -5538,7 +5557,7 @@
                 }
             }
 
-            // find the matching description (TBD - check domains against certificate).
+            // find the matching description (TBD - check domains and application URI against certificate).
             bool found = false;
 
             var foundDescription = FindMatchingDescription(serverEndpoints, m_endpoint.Description, true);

Libraries/Opc.Ua.Client/Session/SessionAsync.cs

@@ -93,7 +93,6 @@ public async Task OpenAsync(
 
                 if (requireEncryption)
                 {
-                    ValidateServerCertificateApplicationUri(serverCertificate);
                     if (checkDomain)
                     {
                         await m_configuration.CertificateValidator.ValidateAsync(serverCertificateChain, m_endpoint, ct).ConfigureAwait(false);
@@ -201,6 +200,8 @@ public async Task OpenAsync(
 
                 ValidateServerEndpoints(serverEndpoints);
 
+                ValidateServerCertificateApplicationUri(m_endpoint, serverCertificate);
+
                 ValidateServerSignature(serverCertificate, serverSignature, clientCertificateData, clientCertificateChainData, clientNonce);
 
                 HandleSignedSoftwareCertificates(serverSoftwareCertificates);

Libraries/Opc.Ua.Configuration/ApplicationInstance.cs

@@ -672,7 +672,7 @@ private async Task<bool> CheckApplicationInstanceCertificateAsync(
             }
 
             // check uri.
-            string applicationUri = X509Utils.GetApplicationUriFromCertificate(certificate);
+            string applicationUri = X509Utils.GetApplicationUrisFromCertificate(certificate).FirstOrDefault();
 
             if (String.IsNullOrEmpty(applicationUri))
             {

Libraries/Opc.Ua.Gds.Client.Common/CertificateWrapper.cs

@@ -29,6 +29,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using System.Runtime.Serialization;
 using System.Security.Cryptography.X509Certificates;
 using Opc.Ua.Security.Certificates;
@@ -213,7 +214,7 @@
                 {
                     try
                     {
-                        return X509Utils.GetApplicationUriFromCertificate(Certificate);
+                        return X509Utils.GetApplicationUrisFromCertificate(Certificate).FirstOrDefault();
                     }
                     catch (Exception e)
                     {

Libraries/Opc.Ua.Security.Certificates/Extensions/X509SubjectAltNameExtension.cs

@@ -85,7 +85,7 @@
         /// Creates an extension from ASN.1 encoded data.
         /// </summary>
         public X509SubjectAltNameExtension(AsnEncodedData encodedExtension, bool critical)
             : this(encodedExtension.Oid, encodedExtension.RawData, critical)
         {
         }
 
@@ -113,12 +113,28 @@
         /// <param name="applicationUri">The application Uri</param>
         /// <param name="domainNames">The domain names. DNS Hostnames, IPv4 or IPv6 addresses</param>
         public X509SubjectAltNameExtension(
             string applicationUri,
             IEnumerable<string> domainNames)
         {
             Oid = new Oid(SubjectAltName2Oid, kFriendlyName);
             Critical = false;
-            Initialize(applicationUri, domainNames);
+            Initialize(new string[] { applicationUri }, domainNames);
+            RawData = Encode();
+            m_decoded = true;
+        }
+
+        /// <summary>
+        /// Build the Subject Alternative name extension (for OPC UA application certs).
+        /// </summary>
+        /// <param name="applicationUris">The application Uri</param>
+        /// <param name="domainNames">The domain names. DNS Hostnames, IPv4 or IPv6 addresses</param>
+        public X509SubjectAltNameExtension(
+            IEnumerable<string> applicationUris,
+            IEnumerable<string> domainNames)
+        {
+            Oid = new Oid(SubjectAltName2Oid, kFriendlyName);
+            Critical = false;
+            Initialize(applicationUris, domainNames);
             RawData = Encode();
             m_decoded = true;
         }
@@ -402,14 +418,17 @@
         /// <summary>
         /// Initialize the Subject Alternative name extension.
         /// </summary>
-        /// <param name="applicationUri">The application Uri</param>
+        /// <param name="applicationUris">The application Uris</param>
         /// <param name="generalNames">The general names. DNS Hostnames, IPv4 or IPv6 addresses</param>
-        private void Initialize(string applicationUri, IEnumerable<string> generalNames)
+        private void Initialize(IEnumerable<string> applicationUris, IEnumerable<string> generalNames)
         {
             var uris = new List<string>();
             var domainNames = new List<string>();
             var ipAddresses = new List<string>();
-            uris.Add(applicationUri);
+            foreach (string applicationUri in applicationUris)
+            {
+                uris.Add(applicationUri);
+            }
             foreach (string generalName in generalNames)
             {
                 switch (Uri.CheckHostName(generalName))

Libraries/Opc.Ua.Server/Server/StandardServer.cs

@@ -380,23 +380,33 @@
 
                         if (context.SecurityPolicyUri != SecurityPolicies.None)
                         {
-                            string certificateApplicationUri = X509Utils.GetApplicationUriFromCertificate(parsedClientCertificate);
-
-                            // verify if applicationUri from ApplicationDescription matches the applicationUri in the client certificate.
-                            if (!String.IsNullOrEmpty(certificateApplicationUri) &&
-                                !String.IsNullOrEmpty(clientDescription.ApplicationUri) &&
-                                certificateApplicationUri != clientDescription.ApplicationUri)
+                            // verify if applicationUri from ApplicationDescription matches the applicationUris in the client certificate.
+                            if (!String.IsNullOrEmpty(clientDescription.ApplicationUri))
                             {
-                                // report the AuditCertificateDataMismatch event for invalid uri
-                                ServerInternal?.ReportAuditCertificateDataMismatchEvent(parsedClientCertificate, null, clientDescription.ApplicationUri, StatusCodes.BadCertificateUriInvalid);
+                                bool noMatch = true;
+                                var certificateApplicationUris = X509Utils.GetApplicationUrisFromCertificate(parsedClientCertificate);
+                                foreach (var certificateApplicationUri in certificateApplicationUris)
+                                {
+                                    if (!String.IsNullOrEmpty(certificateApplicationUri) && certificateApplicationUri == clientDescription.ApplicationUri)
+                                    {
+                                        noMatch = false;
+                                        break;
+                                    }
+                                }
 
-                                throw ServiceResultException.Create(
-                                    StatusCodes.BadCertificateUriInvalid,
-                                    "The URI specified in the ApplicationDescription {0} does not match the URI in the Certificate: {1}.",
-                                    clientDescription.ApplicationUri, certificateApplicationUri);
-                            }
+                                if (noMatch)
+                                {
+                                    // report the AuditCertificateDataMismatch event for invalid uri
+                                    ServerInternal?.ReportAuditCertificateDataMismatchEvent(parsedClientCertificate, null, clientDescription.ApplicationUri, StatusCodes.BadCertificateUriInvalid);
+
+                                    throw ServiceResultException.Create(
+                                        StatusCodes.BadCertificateUriInvalid,
+                                        "The URI specified in the ApplicationDescription {0} does not match the URIs in the Certificate.",
+                                        clientDescription.ApplicationUri);
+                                }
 
-                            CertificateValidator.Validate(clientCertificateChain);
+                                CertificateValidator.Validate(clientCertificateChain);
+                            }
                         }
                     }
                     catch (Exception e)
@@ -2327,7 +2337,7 @@
                                 {
                                     client.RegisterServer(requestHeader, m_registrationInfo);
                                 }
-                                
+
                                 m_registeredWithDiscoveryServer = m_registrationInfo.IsOnline;
                                 return true;
                             }
@@ -3082,7 +3092,7 @@
             // attempt graceful shutdown the server.
             try
             {
-                
+
                 if (m_maxRegistrationInterval > 0 && m_registeredWithDiscoveryServer)
                 {
                     // unregister from Discovery Server if registered before

Stack/Opc.Ua.Core/Security/Certificates/CertificateFactory.cs

@@ -319,10 +319,10 @@ public static byte[] CreateSigningRequest(
                 }
             }
 
-            string applicationUri = X509Utils.GetApplicationUriFromCertificate(certificate);
+            var applicationUris = X509Utils.GetApplicationUrisFromCertificate(certificate);
 
             // Subject Alternative Name
-            var subjectAltName = new X509SubjectAltNameExtension(applicationUri, domainNames);
+            var subjectAltName = new X509SubjectAltNameExtension(applicationUris, domainNames);
             request.CertificateExtensions.Add(new X509Extension(subjectAltName, false));
 
             using (RSA rsa = certificate.GetRSAPrivateKey())

Stack/Opc.Ua.Core/Security/Certificates/X509Utils.cs

@@ -126,6 +126,7 @@
         /// </summary>
         /// <param name="certificate">The certificate.</param>
         /// <returns>The application URI.</returns>
+        [Obsolete("Use GetApplicationUrisFromCertificate instead. The certificate may contain more than one Uri.")]
         public static string GetApplicationUriFromCertificate(X509Certificate2 certificate)
         {
             // extract the alternate domains from the subject alternate name extension.
@@ -140,6 +141,25 @@
             return string.Empty;
         }
 
+        /// <summary>
+        /// Extracts the application URIs specified in the certificate.
+        /// </summary>
+        /// <param name="certificate">The certificate.</param>
+        /// <returns>The application URIs.</returns>
+        public static IReadOnlyList<string> GetApplicationUrisFromCertificate(X509Certificate2 certificate)
+        {
+            // extract the alternate domains from the subject alternate name extension.
+            X509SubjectAltNameExtension alternateName = X509Extensions.FindExtension<X509SubjectAltNameExtension>(certificate);
+
+            // get the application uris.
+            if (alternateName != null && alternateName.Uris != null)
+            {
+                return alternateName.Uris;
+            }
+
+            return new List<string>();
+        }
+
         /// <summary>
         /// Check if certificate has an application urn.
         /// </summary>

Stack/Opc.Ua.Core/Stack/Server/ServerBase.cs

@@ -1405,7 +1405,7 @@
             // assign a unique identifier if none specified.
             if (String.IsNullOrEmpty(configuration.ApplicationUri))
             {
-                configuration.ApplicationUri = X509Utils.GetApplicationUriFromCertificate(InstanceCertificate);
+                configuration.ApplicationUri = X509Utils.GetApplicationUrisFromCertificate(InstanceCertificate).FirstOrDefault();
 
                 if (String.IsNullOrEmpty(configuration.ApplicationUri))
                 {

Tests/Opc.Ua.Gds.Tests/X509TestUtils.cs

@@ -156,7 +156,7 @@ public static void VerifySignedApplicationCert(ApplicationTestData testApp, byte
                 Assert.True(domainNames.Contains(domainName, StringComparer.OrdinalIgnoreCase));
             }
             Assert.True(subjectAlternateName.Uris.Count == 1);
-            var applicationUri = X509Utils.GetApplicationUriFromCertificate(signedCert);
+            var applicationUri = X509Utils.GetApplicationUrisFromCertificate(signedCert).FirstOrDefault();
             Assert.True(testApp.ApplicationRecord.ApplicationUri == applicationUri);
         }
     }