Can ua client accept the server certificate automatically?

[ghost]

For now, I must copy a .der file to the client\security\pki\trusted\certs manually. Does it doable to make the client accept the server certificate automatically?

[kevinherron]

You can configure the client's CertificateValidator as an instance of ClientCertificateValidator.InsecureValidator:

https://github.com/eclipse/milo/blob/3419235853491ac89f3391bffd337c8200522522/opc-ua-stack/stack-client/src/main/java/org/eclipse/milo/opcua/stack/client/security/ClientCertificateValidator.java#L29-L52

It's not recommended that you do this for anything but testing. A production application should always require certificates are trusted.

[kevinherron]

Alternatively, when you get the server EndpointDescriptions, the certificate is available in that structure, and you can trust it by calling DefaultCertificateManager::addTrustedCertificate.

[ghost]

Alternatively, when you get the server EndpointDescriptions, the certificate is available in that structure, and you can trust it by calling DefaultCertificateManager::addTrustedCertificate.

Actually, I am a little confused about how to utilize EndPointDescription to get the server's certificate. Would you mind offer a demo?

[kevinherron]

The certificate bytes are available in the endpoint (EndpointDescription::getServerCertificate).

You can decode the bytes into a X509Certificate by doing something like:

X509Certificate certificate = CertificateUtil.decodeCertificate(endpoint.getServerCertificate().bytesOrEmpty());

[ghost]

Pretty thanks! I really appreciate for your demo!