Using OpcCmd Utility for OPC UA Administration

Under construction: Parts are missing.

How to: Make a rejected certificate trusted

If you do not set up the trust between the OPC UA applications (client and server) upfront, you often end up with other party's application certificate being rejected (for example, the OPC UA client will reject the OPC UA server's certificate when you try to connect securely to a new server). As a convenience, the actual certificate provided by the other party is stored into the so-called Rejected certificate store. If you know that this certificate, in fact, should be trusted, you can move it to the Trusted peers certificate store. Next time, it will not be rejected.

There are multiple ways to move the certificate, and the procedures differ depending on the type of certificate store involved (platform-specific, or a directory). The steps described below work with the default configuration of OPC UA applications that target .NET Framework (or COM applications). Such applications share a common group of certificate stores, located in a dedicated directory in the file system. Any file manipulation tool can be used for move and copy operations with the certificates, but it might be somewhat difficult to find the right directory and navigate between the sub-directories of the directory certificate stores. With the OpcCmd Utility,you can make the rejected certificate trusted in just a few steps.

1. At the OpcCmd> prompt, enter uaAdministration pki applicationStoreGroup --kind LegacyDirectoryCommon, or shortened: uaa pki asg -k LegacyDirectoryCommon. This command tells the utility that from now on, we will be accessing the common group of PKI stores for the OPC UA applications written for .NET Framework with the use of OPC Foundation's UA stack and SDK. The program responds with a confirmation of the command.
   
   All following commands are entered at the pkiApplicationStoreGroup> prompt. You can enter -?, -h or --help (possibly preceded by the command name) at any time to obtain help for this prompt (or its commands).
   
   
2. Enter store Instance.Rejected certificates?, or shortened: s Instance.Rejected c?.

Result (sequence):
╒══╤══════════════╤════════════════════════════════════════════════╤════════════════════════╤══════════╤══════════╤════════════════════╤═══════╕
│[]│Signature     │Subject Simple Name                             │Issuer Simple Name      │Not Before│Not After │Thumbprint          │Has    │
│  │Algorithm Name│                                                │                        │          │          │                    │Private│
│  ├──────────────┼────────────────────────────────────────────────┼────────────────────────┤          │          │                    │Key    │
│  │Public Key    │Subject DNS Name                                │Serial Number           │          │          │                    │       │
│  │Size          │                                                │                        │          │          │                    │       │
│  ├──────────────┼────────────────────────────────────────────────┤                        │          │          │                    │       │
│  │CA            │Subject URL Name                                │                        │          │          │                    │       │
╞══╪══════════════╪════════════════════════════════════════════════╪════════════════════════╪══════════╪══════════╪════════════════════╪═══════╡
│ 0│sha256RSA     │Global Discovery Server                         │Global Discovery Server │9/12/2020 │9/12/2021 │86A2C4D0A9FD07D1A85F│False  │
│  │          2048│demo-5                                          │1EBFEB858386FC19        │1:21:52 PM│1:21:52 PM│84090A88A5B3CA4F1DA5│       │
│  │False         │urn:demo-5:somecompany.com:GlobalDiscoveryServer│                        │          │          │                    │       │
├──┼──────────────┼────────────────────────────────────────────────┼────────────────────────┼──────────┼──────────┼────────────────────┼───────┤
│ 1│sha256RSA     │UaServerCpp@PC-ZBYNEKZ-4                        │UaServerCpp@PC-ZBYNEKZ-4│3/16/2021 │3/15/2026 │CA0C65DB312C5458D21A│False  │
│  │          2048│PC-ZBYNEKZ-4                                    │6050A511                │1:31:13 PM│1:31:13 PM│54D6AB02C5497DBCEC33│       │
│  │True          │urn:PC-ZBYNEKZ-4:UnifiedAutomation:UaServerCpp  │                        │          │          │                    │       │
╘══╧══════════════╧════════════════════════════════════════════════╧════════════════════════╧══════════╧══════════╧════════════════════╧═══════╛
Command finished (0.2 seconds).