Search

Scope: Core (OPC-10000-*) All specs

21 result(s) for ApplicationInstance Certificates

OPC-10000-2 – OPC Unified Architecture - Part 2: Security Model

3.1.4 ApplicationInstanceCertificate

ApplicationInstance Note 1 to entry: Different installations of one software product would have different ApplicationInstanceCertificates . The use of an ApplicationInstanceCertificate for uses outside of what is described in the specification
OPC-10000-2 – OPC Unified Architecture - Part 2: Security Model

5.1.10 Rogue Server or Publisher

threat. OPC UA Client applications counter the use of rogue Servers by validating Server ApplicationInstanceCertificates . There would still be the possibility that a rogue Server provides a Certificate from
OPC-10000-2 – OPC Unified Architecture - Part 2: Security Model

9.1 Overview

Overview OPC UA Applications typically have ApplicationInstanceCertificates to provide application-level security. They are used for establishing a secure connection using Asymmetric Cryptography. These ApplicationInstanceCertificates are Certificates which are X.509
OPC-10000-4 – OPC Unified Architecture - Part 4: Services

5.6.2.1 Description

securityPolicyUri is not None. If the protocol defined in OPC 10000-6 requires that ApplicationInstanceCertificates are used in the OpenSecureChannel Service , then Clients and Servers shall verify that the same
OPC-10000-4 – OPC Unified Architecture - Part 4: Services

5.7.2.1 Description

Depending upon on the SecurityPolicy and the SecurityMode of the SecureChannel, the exchange of ApplicationInstanceCertificates and Nonces may be optional and the signatures may be empty
OPC-10000-4 – OPC Unified Architecture - Part 4: Services

6.1.2 Obtaining and installing an ApplicationInstanceCertificate

application instance; The validFrom and validTo date for the Certificate . ApplicationInstanceCertificates issued by a Certificate Authority (CA) shall contain the following additional information: The name of the Certificate Authority that ... after the installation process. Every OPC UA Application shall allow the Administrators to replace ApplicationInstanceCertificates with Certificates that meet their requirements. When the Administrator requests a new Certificate from
OPC-10000-4 – OPC Unified Architecture - Part 4: Services

6.1.3 Determining if a Certificate is trusted

types of Certificates . Some steps are skipped if the Certificate is not an ApplicationInstanceCertificate. ApplicationInstanceCertificates shall not be used in a Client or Server until they have been evaluated ... SecurityChecksFailed shall be reported back to the Client . This check is applied for ApplicationInstanceCertificates and may not apply for all other Certificate types. Validity Period Bad_CertificateTimeInvalid Bad_CertificateIssuerTimeInvalid AuditCertificateExpiredEventType
OPC-10000-4 – OPC Unified Architecture - Part 4: Services

6.1.4 Creating a SecureChannel

access to Certificates that can be used to encrypt and sign Messages exchange. The ApplicationInstanceCertificates installed by following the process described in 6.1.2 may be used for this purpose ... trusted Certificates may be Certificates for Certificate Authorities or they may be OPC UA ApplicationInstanceCertificates . OPC UA Applications shall be configured to reject connections with applications that do not have
OPC-10000-4 – OPC Unified Architecture - Part 4: Services

6.1.5 Creating a Session

Certificate Authority (CA) and an identity provider. The CA is responsible for issuing the ApplicationInstanceCertificates . If the Client or Server does not have online access to the CA, then they ... shall validate the ApplicationInstanceCertificates using the CA public key that the administrator shall install on the local machine. The identity provider may be a central database that can verify that
OPC-10000-4 – OPC Unified Architecture - Part 4: Services

6.1.7 Continuous security checks

Continuous security checks ApplicationInstanceCertificates or UserIdentityTokens may expire, get invalid or may be rejected on Client or Server side. ApplicationInstanceCertificates verification shall be executed every time the SecurityToken is renewed ... TrustList is updated from a GDS. If the SecureChannel does not use ApplicationInstanceCertificates , the OPC UA Application should execute ApplicationInstanceCertificate checks for the Session at a rate used for SecureChannel
OPC-10000-12 – OPC Unified Architecture - Part 12: Discovery and Global Services

7.8.3.1 CertificateGroupType

assigned to an application. This ObjectType allows an application which has multiple TrustLists and/or ApplicationInstance Certificates to express them in its AddressSpace . A CertificateManager can have many CertificateGroups which manage ... NodeId RsaSha256ApplicationCertificate (see 7.8.4.9 ) specified allows an OPC UA Application to have one ApplicationInstance Certificates for each type. If this list is empty then the CertificateGroup does not allow Certificates
OPC-10000-12 – OPC Unified Architecture - Part 12: Discovery and Global Services

7.8.3.3 CertificateGroupFolderType

peers: For OPC UA Applications and CertificateManagers these CertificateTypes specify what is allowed for ApplicationInstance Certificates . They shall specify one or more subtypes of ApplicationCertificateType (see 7.8.4.2 ). For NonUaApplications, these
OPC-10000-12 – OPC Unified Architecture - Part 12: Discovery and Global Services

7.9.3 StartSigningRequest

CertificateManager . The CertificateManager uses values that are appropriate and compliant with requirements defined for ApplicationInstance Certificates in OPC 10000-6 . For Servers , the list of domain names shall be specified
OPC-10000-12 – OPC Unified Architecture - Part 12: Discovery and Global Services

7.10.6 CreateSelfSignedCertificate

CertificateGroup specifies what the Certificate is used for. For example, a CertificateGroup that contains ApplicationInstance Certificates would only contain Certificates that are valid ApplicationInstance Certificates as defined
OPC-10000-12 – OPC Unified Architecture - Part 12: Discovery and Global Services

8.6.7 UpdateCredential

used to encrypt the secret. For RSA SecurityPolicies this shall be one of the ApplicationInstance Certificates assigned to the Server . For ECC or RSA-DH SecurityPolicies this field
OPC-10000-18 – OPC Unified Architecture - Part 18: Role-Based Security

4.4.1 RoleType definition

ApplicationsExclude Property is not provided or has a value of FALSE then only ApplicationInstance Certificates included in the Applications Property shall be included in this Role . All other ApplicationInstance Certificates ... this Role . If the ApplicationsExclude Property has a value of TRUE then all ApplicationInstance Certificates included in the Applications Property shall be excluded from this Role . All other ApplicationInstance Certificates
OPC-10000-21 – OPC Unified Architecture - Part 21: Device Onboarding

6.3 Authentication

first connected the DCA is configured to use any of its DeviceIdentity Certificates as its Application Instance Certificate . Note that DeviceIdentity Certificates will not have a DNS name ... updated, the Registrar can issue an Application Instance Certificate to the DCA. Application Instance Certificates issued to a DCA shall not be used for communication with any application other than
OPC-10000-21 – OPC Unified Architecture - Part 21: Device Onboarding

7.2 Pull Management

trusts the first Registrar that provides an Application Instance Certificate . Once connected to a Registrar the Device provides all of its DeviceIdentity Certificates to the Registrar which then attempts ... untrusted Registrar once it has a TrustList . The process for requesting Application Instance Certificates is shown in Figure 5 . Figure 5 - Requesting Certificates using Pull Management The DCA registers
OPC-10000-21 – OPC Unified Architecture - Part 21: Device Onboarding

7.3 Push Management

Once the Device has updated software the CertificateManager will be able to push Application Instance Certificates and TrustLists for all Applications exposed via an ApplicationConfiguration Object (see Figure ... Figure 7 - Updating Certificates using Push Management If multiple Registrars are on the network, the DCA shall accept the first one to provide an Application Instance Certificate and a TrustList
OPC-10000-21 – OPC Unified Architecture - Part 21: Device Onboarding

7.4.1 Overview

used and it is responsibility of the alternate mechanism to issue and renew Application Instance Certificates to all Applications running on the Device and to maintain their Trust Lists ... mechanism described in this specification takes over and manages the life cycle of Application Instance Certificates and the Trust Lists. This pull management version of this case is illustrated
OPC-30300 – Using Generic Trust Anchor (GTA) API with OPC UA - Part 1: Generic Trust Anchor (GTA) API Profile for OPC UA

4.1 OPC UA Security Object Model

This ObjectType allows an Application which has multiple TrustLists and/or ApplicationInstance Certificates to express them in its AddressSpace . Figure 1 depicts the OPC UA security object model. Figure