OPC UA certificate: BadCertificateUriInvalid

[raphael.wittwer]

Hello forum

I created a certificate with the OPC UA toolkit by NI. Unfortunately when connecting to the server with UAexpert I get the error BadCertificateUriInvalid. I suspect this is because of the space in National Instruments in the URI:

Does anyone know a workaround for this? In the VI to create the certificate I cannot open the block diagram since it is password protected and changing this value does not seem to work with a tool like XCA after certificate creation.

Thanks,

Raphael

[raphael.wittwer]

I actually had two issues, the first one was about the hostname:

This seems to come from the hostname in the certificate not being fully qualified, since I added the IP and the fully qualified hostname manually to the certificate this error has disappeared.

Settings in the client

This same error is thrown by another OPC UA client.

Unfortunately I do not have access to the OPCUA specification, but it seems that spaces in URI are not allowed. In the created certificate however there is a space in “National Instruments”:

This seems to be the case (second point about whitespace):

Second source:

Does anyone have access to the OPCUA standard and can confirm that whitespace is not allowed?

[raphael.wittwer]

I have recreated the key without the whitespace in the URI in XCA, unforunately this is not the problem. I have tried with adding the fully qualified hostname (leads to the bad certificate hostname invalid) and without, same result concerning the bad URI error.

[Martin_Henz]

some ideas:

- check, that the certificates are at the correct place and check the server configuration

- create the certificates with uaexpert

[raphael.wittwer · Accepted solution]

Thank you Martin for your ideas!

It finally worked, XCA needs to be configured so that a certificate with the expected field URI can be created by appending this string to the dn.txt: domainComponent

The original issue is that the server sends a different URI than the certificate (made with the NI certificate vi) defines, and the DNS is missing for the fully qualified name it usually responds with.

[Walker34]

Hello Raphael

I have the same issue with UaExpert and the server created by LabView...

I finally found how to solve this problem, it is in fact very simple. Just use the same name for the server and the certificate :

[Martin_Henz]

He used XCA (https://hohnstaedt.de/xca/ ) which is very flexible, but not easy to understand. Uaexpert can also create certificates and has some more options. Its primary for it's own usage, but those certificate files can also used for other OPC UA connections.

[raphael.wittwer]

If this works for you that is very good, I could not get the certificate to use the same name as the Server was sending. It was not in the part that I can define but a space in "National Instruments" sent from the server but not present in the certificate or vice versa.

[Walker34]

Those Certificate tools are cryptic for me, if it works with that simple VI, I will not look deeper or my brain will burn.

Yes now I understand that your issue was due to something else, Raphael. I posted my solution because someone else will maybe get the same problem and will come here, because it is a first result in google search.

Thank you both for answering.