How to trust a server certificate?

[disc0very]

Hello all!
I'm new to java and to programming so i apology if my question may be trivial.
I'm trying to write an opcua client using milo sdk.
Using the same structure of the examples I successfully managed to connect to an opcua server with anonymous login and no certificate and adding SecurityPolicy.None.
Another server i'm trying to connect to uses username and password and require to trust a provided self signed certificate.
I setted up IdentityProvider in the ClientExample.java interface to provide my username and password and I readed about trustListManager.addTrustedCertificate to add the server certificate to the trust list, but i actually didn't understand how to use this...

In the console i get the following error:

[milo-shared-thread-pool-0] WARN o.e.m.o.s.c.s.ClientCertificateValidator$InsecureValidator - Skipping validation for certificate: CN=OpcUaServer@HMI-801b, OU=Unit, O=Organization, L=LocationName, C=DE, DC=HMI-801b
[main] ERROR OPCUA_Client.ClientRunner - Error running client example: UaServiceFaultException: status=Bad_IdentityTokenInvalid, message=The user identity token is not valid.

Can you give me your help?
Thanks

[kevinherron]

This error means the server doesn't like something about the username/password you provided. You'll have to share some code, and verify you have the correct credentials.

[disc0very]

Ops! I double checked the code and i found out my mistake...
Now it seems it can connect to the server but what i get from it is an endpoint with an hostname (HMI-801b) that i can not (and i dont want) resolve with my DNS.

16:59:35.298 [main] ERROR OPCUA_Client.ClientRunner - Error running client example: java.net.UnknownHostException: HMI-801b
java.util.concurrent.ExecutionException: java.net.UnknownHostException: HMI-801b

I guess the problem is the same described here .
Can you point me on how to use the EndpointUtil.updateUrl in a way that it just force the endpoint returned to have the same ip and port of the server i'm connecting to?
Thank you

[disc0very]

I think i've found a way.
I'm still using the same structure as the examples.
So editing the ClientRunner I found this code working for my needs:

public ClientRunner(Client clientExample) throws Exception {
        this.clientExample = clientExample;
    }
       
    private OpcUaClient createClient() throws Exception {
        Path securityTempDir = Paths.get(System.getProperty("java.io.tmpdir"), "client", "security");
        Files.createDirectories(securityTempDir);
        if (!Files.exists(securityTempDir)) {
            throw new Exception("unable to create security dir: " + securityTempDir);
        }

        File pkiDir = securityTempDir.resolve("pki").toFile();

        LoggerFactory.getLogger(getClass())
            .info("security dir: {}", securityTempDir.toAbsolutePath());
        LoggerFactory.getLogger(getClass())
            .info("security pki dir: {}", pkiDir.getAbsolutePath());

        KeyStoreLoader loader = new KeyStoreLoader().load(securityTempDir);

        trustListManager = new DefaultTrustListManager(pkiDir);

        DefaultClientCertificateValidator certificateValidator =
            new DefaultClientCertificateValidator(trustListManager);

        String serverIpAddress = clientExample.getEndpointUrl().substring("opc.tcp://".length());
        String[] parts = serverIpAddress.split(":");
        String ipAddress = parts[0];
        int port = Integer.parseInt(parts[1]);

        return OpcUaClient.create(
            clientExample.getEndpointUrl(),
            endpoints -> 
                 endpoints.stream()
                .filter(clientExample.endpointFilter())
                .filter(e -> e.getSecurityPolicyUri().equals(SecurityPolicy.None.getUri()))
                .findFirst()
                .map(endpoint -> {
                    // Update the URL of the first endpoint with the server's IP address obtained by the split of the getEndpointUrl() from Client interface
                   EndpointDescription updatedEndpoint = EndpointUtil.updateUrl(endpoint, ipAddress, port);
                   return updatedEndpoint;
                }),          

It works! Can you confirm this is a correct way to do it?
Thanks you again

[kevinherron]

This is fine. You can also break this out into steps where you only replace it if necessary.

Use DiscoveryClient.getEndpoints to retrieve a list of endpoints. Pick the endpoint you want out of that list, check to see if the hostname needs replacing or not, then create your OpcUaClient with that endpoint. The OpcUaClient.create method you're using is kind of doing this all for you based on the predicates you supply, minus updating the hostname.

[disc0very]

Thank you for the feedback! I found your suggestion working in the following way:

public class ClientRunner {

    private final Logger logger = LoggerFactory.getLogger(ClientRunner.class);

    private final CompletableFuture<OpcUaClient> future = new CompletableFuture<>();

    private DefaultTrustListManager trustListManager;

    private final Client clientExample;

    public ClientRunner(Client clientExample) throws Exception {
        this.clientExample = clientExample;
    }
       
    private static class EndpointWrapper {
        EndpointDescription endpoint;

        public void setEndpoint(EndpointDescription endpoint) {
            this.endpoint = endpoint;
        }

        public EndpointDescription getEndpoint() {
            return endpoint;
        }
    }
 private OpcUaClient createClient() throws Exception {
        Path securityTempDir = Paths.get(System.getProperty("java.io.tmpdir"), "client", "security");
        Files.createDirectories(securityTempDir);
        if (!Files.exists(securityTempDir)) {
            throw new Exception("Unable to create security dir: " + securityTempDir);
        }

        File pkiDir = securityTempDir.resolve("pki").toFile();

        logger.info("Security dir: {}", securityTempDir.toAbsolutePath());
        logger.info("Security pki dir: {}", pkiDir.getAbsolutePath());

        KeyStoreLoader loader = new KeyStoreLoader().load(securityTempDir);

        trustListManager = new DefaultTrustListManager(pkiDir);

        DefaultClientCertificateValidator certificateValidator =
            new DefaultClientCertificateValidator(trustListManager);
              
        // Obtain the server IP address from the endpoint URL
        String serverIpAddress = clientExample.getEndpointUrl().substring("opc.tcp://".length());

        // Endpoint URL format is "opc.tcp://<IP>:<Port>"
        String[] parts = serverIpAddress.split(":");
        String ipAddress = parts[0];
        int port = Integer.parseInt(parts[1]); // Parse the port string to integer
        
        EndpointWrapper endpointWrapper = new EndpointWrapper(); // Wrapper for selected endpoint

        try {
            List<EndpointDescription> endpoints = DiscoveryClient.getEndpoints(clientExample.getEndpointUrl()).get();

            Optional<EndpointDescription> selected = endpoints.stream()
                    .filter(clientExample.endpointFilter())
                    .filter(e -> e.getSecurityPolicyUri().equals(SecurityPolicy.None.getUri()))
                    .filter(endpoint -> {
                        try {
                            URI uri = new URI(endpoint.getEndpointUrl());
                            if (DNSResolver.isResolvable(uri.getHost())) { // Check if the hostname is resolvable via DNS
                                endpointWrapper.setEndpoint(endpoint); // Assign the endpoint directly
                                return true;
                            } else {
                                // Update the URL if the hostname doesn't resolve via DNS
                                endpointWrapper.setEndpoint(EndpointUtil.updateUrl(endpoint, ipAddress, port));
                                return true; // Trust the endpoint if updated
                            }
                        } catch (URISyntaxException e) {
                            return false;
                        }
                    })
                    .findFirst(); // Find the first selected endpoint
                    
            // If an endpoint was not found, throw an exception
            if (!selected.isPresent()) {
                throw new Exception("No suitable endpoint found.");
            }
        } catch (InterruptedException | ExecutionException e) {
            logger.error("Error getting endpoints: {}", e.getMessage(), e);
            throw new Exception("Error getting endpoints: " + e.getMessage(), e);
        }

        EndpointDescription selectedEndpoint = endpointWrapper.getEndpoint(); // Retrieve the selected endpoint

        // Return the created OpcUaClient instance
        return OpcUaClient.create(
            clientExample.getEndpointUrl(),
            ignored -> Optional.ofNullable(selectedEndpoint), // Use the selected endpoint
            configBuilder ->
                configBuilder
                .setApplicationName(LocalizedText.english("eclipse milo opc-ua client"))
                    .setApplicationUri("urn:eclipse:milo:client")
                    .setKeyPair(loader.getClientKeyPair())
                    .setCertificate(loader.getClientCertificate())
                    .setCertificateChain(loader.getClientCertificateChain())
                    .setCertificateValidator(certificateValidator)
                    .setIdentityProvider(clientExample.getIdentityProvider())
                    .setRequestTimeout(uint(1000))
                    .build()
        );
    }

I had to create a DNSResolver class to check if the endpoint hostname is resolvable via DNS.
Do you have a better way to do this? I used this criteria to select the endpoint...

I also find the results of my application to come a bit slowly, is there any way to improve the client speed?

Thanks again!

[kevinherron]

Do you have a better way to do this?

Another way is to update the hostname if none of the endpoints return use a hostname that is the same as the one used for discovery.

I also find the results of my application to come a bit slowly, is there any way to improve the client speed?

This isn't specific enough to offer any advice. Start a new topic with more info.