Certificate security plugin: Difference between revisions
From OPC Labs Knowledge Base
No edit summary |
No edit summary |
||
| Line 1: | Line 1: | ||
[[Category:Plugins]] | [[Category:Plugins]] | ||
{{Warning|The Certificate security plugin is not used with OPC UA Client-Server certificates, because of the special needs of OPC UA. Its use is for other purposes, such as secured MQTT communications.}} | |||
== Certificate security providers == | |||
=== Composed === | |||
| Line 24: | Line 32: | ||
| | | | ||
|} | |} | ||
{| class="wikitable" | {| class="wikitable" | ||
| Line 55: | Line 59: | ||
|The remote certificate is accepted if it complies with the {{Style=Identifier|StaticCertificateSecurityParameters}}.{{Style=Identifier|RemoteCertificateAcceptancePolicy}} setting. Otherwise, the user is allowed to accept or reject the remote certificate. | |The remote certificate is accepted if it complies with the {{Style=Identifier|StaticCertificateSecurityParameters}}.{{Style=Identifier|RemoteCertificateAcceptancePolicy}} setting. Otherwise, the user is allowed to accept or reject the remote certificate. | ||
|} | |} | ||
=== Static === | |||
=== Handler === | |||
=== Interactive === | |||
== Usage == | |||
=== In command-line tools === | |||
<pre> | |||
-x-cs-ai|--X-CertificateSecurity-AllowInteraction <bool> Certificate security: Allow interaction (default True) | |||
-x-cs-as|--X-CertificateSecurity-AllowStatic <bool> Certificate security: Allow static (default True) | |||
-x-cs-lcfn|--X-CertificateSecurity-LocalCertsFileName <string> Certificate security: Local certs: File name (*) | |||
-x-cs-lcfv|--X-CertificateSecurity-LocalCertsFindValue <string> Certificate security: Local certs: Find value | |||
-x-cs-lcsl|--X-CertificateSecurity-LocalCertsStoreLocation <storeLocation> Certificate security: Local certs: Store location (default CurrentUser) | |||
-x-cs-lcsn|--X-CertificateSecurity-LocalCertsStoreName <storeName> Certificate security: Local certs: Store name (default My) | |||
-x-cs-lcft|--X-CertificateSecurity-LocalCertsFindType <findType> Certificate security: Local certs: Find type (default FindByThumbprint) | |||
-x-cs-lcst|--X-CertificateSecurity-LocalCertsSourceTypes <sourceTypes> Certificate security: Local certs: Source types | |||
-x-cs-rpaa|--X-CertificateSecurity-RemotePolicyAcceptAny <bool> Certificate security: Remote policy: Accept any certificate | |||
</pre> | |||
Revision as of 20:11, 23 December 2019
Warning: The Certificate security plugin is not used with OPC UA Client-Server certificates, because of the special needs of OPC UA. Its use is for other purposes, such as secured MQTT communications.
Certificate security providers
Composed
| Order | Enabled by | Parameterized by | Description |
|---|---|---|---|
| 1 | AllowStatic | StaticCertificateSecurityParameters | |
| 2 | AllowHandler | ||
| 3 | AllowInteractive |
| AllowStatic setting | AllowInteractive setting | Get local certificates | Validate remote certificate |
|---|---|---|---|
| False | False | The consumer will use its default behavior for obtaining local certificates. | The consumer will use its default behavior for validating the remote certificate. |
| False | True | The user is allowed to supply the local certificates (depending on the capabilities of the interaction provider), or use the provided defaults. The default local certificates for the interaction are given by the StaticCertificateSecurityParameters.LocalCertificatesQuery setting (even though AllowStatic is set False). | The user is allowed to accept or reject the remote certificate. |
| True | False | Local certificates are obtained according to StaticCertificateSecurityParameters.LocalCertificatesQuery setting (can be read from certificate files, and/or found in certificate store). | The remote certificate is accepted if it complies with the StaticCertificateSecurityParameters.RemoteCertificateAcceptancePolicy setting. |
| True | True | Local certificates are obtained according to StaticCertificateSecurityParameters.LocalCertificatesQuery setting (can be read from certificate files, and/or found in certificate store). | The remote certificate is accepted if it complies with the StaticCertificateSecurityParameters.RemoteCertificateAcceptancePolicy setting. Otherwise, the user is allowed to accept or reject the remote certificate. |
Static
Handler
Interactive
Usage
In command-line tools
-x-cs-ai|--X-CertificateSecurity-AllowInteraction <bool> Certificate security: Allow interaction (default True) -x-cs-as|--X-CertificateSecurity-AllowStatic <bool> Certificate security: Allow static (default True) -x-cs-lcfn|--X-CertificateSecurity-LocalCertsFileName <string> Certificate security: Local certs: File name (*) -x-cs-lcfv|--X-CertificateSecurity-LocalCertsFindValue <string> Certificate security: Local certs: Find value -x-cs-lcsl|--X-CertificateSecurity-LocalCertsStoreLocation <storeLocation> Certificate security: Local certs: Store location (default CurrentUser) -x-cs-lcsn|--X-CertificateSecurity-LocalCertsStoreName <storeName> Certificate security: Local certs: Store name (default My) -x-cs-lcft|--X-CertificateSecurity-LocalCertsFindType <findType> Certificate security: Local certs: Find type (default FindByThumbprint) -x-cs-lcst|--X-CertificateSecurity-LocalCertsSourceTypes <sourceTypes> Certificate security: Local certs: Source types -x-cs-rpaa|--X-CertificateSecurity-RemotePolicyAcceptAny <bool> Certificate security: Remote policy: Accept any certificate
