Trouble using SSL to authenticate and secure my Client/Server connection

[dufrtss]

Hi there,

I'm getting this error: my certificate does not contain the application URI (urn:{host_name}:freeopcua:python:server) even though it is registered as my subject alt name.

Here is the error that is displayed.

Here is the server that I'm using.

Here is the subject alt name registered on my certificate.

[dufrtss]

The client is not recognizing it either even though they both have the subject alt name registered, what am I doing wrong?

[schroeder-]

The uri must be the first parameter in the altname. This written in the spec. So some server will enforce it.

[dufrtss]

Thank you. I appreciate you helping me out. I'll look into this more.

[dufrtss]

Upon analysis, it seems my load_certificate is being called twice, and it gets the key on the second call, is my interpretation of the load_certificate incorrect?

In the first call it seems to assign the certificate to itself properly, but then it is called again passing the private key, and it breaks.

Code is meant to help you visualize the output on the terminal I got from printing my way through this:

Here is the asyncua/server/server.py load_certificate function:

    async def load_certificate(self, path_or_content: Union[str, bytes], format: str = None):
        """
        load server certificate from file, either pem or der
        """
        print(path_or_content)
        self.certificate = await uacrypto.load_certificate(path_or_content, format)
        print(self.certificate)

Here is the asyncua/crypto/uacrypto.py load_certificate function:

async def load_certificate(path_or_content: Union[bytes, str, Path], extension: Optional[str] = None):
    if isinstance(path_or_content, str):
        ext = Path(path_or_content).suffix
    elif isinstance(path_or_content, Path):
        ext = path_or_content.suffix
    else:
        ext = ''
    
    print(ext)
    print(path_or_content)
    content = await get_content(path_or_content)
    if ext == ".pem" or extension == 'pem' or extension == 'PEM':
        return x509.load_pem_x509_certificate(content, default_backend())
    else:
        return x509.load_der_x509_certificate(content, default_backend())

FInally, the output I get is this, from which I got to these conclusions:

/home/eduardo.freitas/dev/projects/opcua-asyncio/certificates/server/server_cert.der // The path_or_content received by the asyncua server
.der // The suffix of the certificate (so far so good) inside the uacrypto func
/home/eduardo.freitas/dev/projects/opcua-asyncio/certificates/server/server_cert.der // The path_or_content inside the uacrypto func
<Certificate(subject=<Name(C=BR,ST=SC,L=Joinville,O=galax.ia,CN=OPC-UA Server)>, ...)> // Certificate is assigned to self correctly!
.pem // Then it loads again and gets the suffix for my private key?
certificates/server/server_private_key.pem // Path seems to be in the same format it is passed in the moment of creation of the certificate via openssl cmd

I looked up any documentations on this but couldn't find anything helpful, which is why I'm recurring to this discussion, if there are any ways I can pursue this on my own, I'd appreciate if you could let me know so I can stop disturbing.

[dufrtss]

Still struggling with this.

[schroeder-]

It looks like one certificate in the truststore you specify is some how invalid. Try to clean the truststore, that it only contains public certificates of the clients, that are allowed to connect.

[dufrtss]

Hey, this worked out as well, I had to isolate my certs in a trusted folder, found some other issues but it seems to be working now. I'll do some testing tomorrow and if it works out I'll consider it solved and close this discussion. Thank you so much!