7.10 Information Model for Push Certificate Management

7.10.1 Overview

If a Server supports PushManagement it is required to support an information model as part of its AddressSpace. It shall support the ServerConfiguration Object shown in Figure 23.

The ServerConfiguration Object is used to manage the Server. The ManagedApplications Folder collects ApplicationConfiguration Objects for other applications which the Server is able to manage. For example, a Server may have associated Client applications that do not support PushManagement so the Server can become a proxy for these Clients.

7.10.2 Transaction Lifecycle

The CertificateGroups and TrustLists used by a Server may be updated as part of a transaction where multiple Methods are invoked, however, no changes will have any effect until ApplyChanges is called (see 7.10.9). These transactions are created automatically and the Server returns ApplyChangesRequired =TRUE in a Method response to tell the Client that a transaction is active. Servers that do not support transactions return ApplyChangesRequired =FALSE and apply any changes before returning a Method response.

If a Method called within a transaction fails (e.g. a parameter was invalid) the transaction state shall not change and all previous changes are applied when ApplyChanges is called.

Once a transaction is created, a Server shall queue the changes in the order that they were requested within the current Session. When ApplyChanges is called the Server verifies that all the changes are consistent and can be applied without errors. If any errors are found then all changes are discarded. If no errors are found, the Server applies all changes.

Using the ApplicationConfigurationFileType to update the configuration blocks the creation of new transactions. Methods that would normally create a new transaction shall return Bad_TransactionPending if a configuration update via a file is in progress (see 7.10.20).

If errors occur, they are reported in the TransactionDiagnostics Object (see 7.10.3).

The life cycle of a transaction is shown in Figure 24.

Servers that implement the transaction model shall support the CancelChanges Method and always set ApplyChangesRequired to TRUE.

Servers that support the transaction model are expected to support exactly one active transaction. Once a transaction has started in Session all other Sessions will not be able to modify TrustLists or Certificates. Transactions are automatically cancelled when the Session that created it is closed or when the CancelChanges Method is called.

If the transaction model is not supported and ApplyChangesRequired is TRUE then the behaviour of the Server for multiple changes is undefined.

If ApplyChangesRequired is FALSE then any changes are applied before the Method response is sent.

7.10.3 ServerConfigurationType

This type defines a concrete ObjectType which represents the configuration of the local Server that supports PushManagement. The ServerConfiguration Object (see 7.10.4) is the single instance of this Object that appears in the Server AddressSpace.

Its components are defined in Table 87.

The ApplicationUri Property specifies the ApplicationUri assigned to the application.

The ProductUri Property specifies the ProductUri for the application that appears in the ApplicationDescription.

The ApplicationType Property specifies whether the application is a Client, a Server or both. Applications which do not support OPC UA specify an ApplicationType of Client. Note that non-OPC UA applications often have network endpoints, however, from the perspective of the CertificateManager, the applications are not Servers.

The ApplicationNames Property is a list of localized names for the application that may be used to when registering with a GDS.

The ServerCapabilities Property specifies the Capabilities from Annex D which the Server supports. The value is the same as the value reported to the LocalDiscoveryServer when the Server calls the RegisterServer2 Service.

The SupportedPrivateKeyFormats specifies the PrivateKey formats supported by the Server. Possible values include “PEM” (see RFC 5958), “PFX” (see PKCS #12) or “PKCS8” (see PKCS #8). The array is empty if the Server does not allow external Clients to update the PrivateKey.

The MaxTrustListSize is the maximum size of the TrustList in bytes. 0 means no limit. The default is 65 535 bytes.

If MulticastDnsEnabled is TRUE then the application announces itself using multicast DNS. It can be changed by writing to the Variable.

If HasSecureElement is TRUE then the application has access to hardware based secure storage for the PrivateKeys associated with its Certificates.

If the SupportsTransactions Property is TRUE, the Server supports the transaction lifecyle defined in 7.10.2. If it is FALSE or not present, the Server only supports delaying application of changes until ApplyChanges is called.

If the InApplicationSetup Property is TRUE then the application is in the application setup state described in G.2.

The UpdateCertificate Method is used to update a Certificate.

The CreateSelfSignedCertificate Method creates a new self-signed Certificate assigned to a CertificateType in a CertificateGroup.

The DeleteCertificate Method deletes Certificate that is currently assigned to a CertificateType in a CertificateGroup.

The GetCertificates Method returns the Certificates assigned to each of the CertificateTypes in a CertificateGroup.

The ApplyChanges Method is used complete changes made to CertificateGroups and/or TrustLists within the context of a transaction.

The CancelChanges Method is used to cancel an existing transaction.

The CreateSigningRequest Method asks the Server to create a PKCS #10 encoded Certificate Request that is signed with the Server’s private key.

The GetRejectedList Method returns the list of Certificates which have been rejected by the Server. It can be used to track activity or allow administrators to move a rejected Certificate into the TrustList. This Method is the a shortcut for the GetRejectedList Method (see 7.8.3.2) on the DefaultApplicationGroup CertificateGroup (see 7.8.3.3).

The ResetToServerDefaults Method is used reset the application security configuration to a default state.

The CertificateGroups Object organizes the CertificateGroups supported by the application. It is described in 7.8.4.10. All applications shall support the DefaultApplicationGroup and may support the DefaultHttpsGroup or the DefaultUserTokenGroup. Applications may support additional CertificateGroups depending on their requirements. For example, a Server with two network interfaces should have a different TrustList for each interface. The second TrustList would be represented as a new CertificateGroupType Object organized by CertificateGroups Folder.

The TransactionDiagnostics Object reports detailed error information for the current or most recently completed transaction. The TransactionDiagnostics Object is only visible to Clients with access to the SecurityAdmin Role.

The ConfigurationFile Object allows the current configuration to be read and updated.

7.10.4 ServerConfiguration

This Object allows access to the Server’s configuration and it is the target of an HasComponent reference from the Server Object defined in OPC 10000-5.

This Object and its immediate children shall be visible (i.e. browse access is available) to users who can access the Server Object. The children of the CertificateGroups Object should only be visible to Clients with access to the SecurityAdmin Role.

Its representation in the AddressSpace is formally defined in Table 88.

7.10.5 UpdateCertificate

UpdateCertificate is used to update a Certificate.

There are the following two use cases for this Method:

The PrivateKey is already known to the Server (i.e. it was created with the CreateSigningRequest (see 7.10.10) or CreateSelfSignedCertificate (see 7.10.6) Method).

The PrivateKey was created outside the Server and is updated with this Method.

The Purpose of the associated CertificateGroup determines the validation rules for Certificate being updated. For ApplicationCertificateType, the Server shall verify the Certificate using the validation process defined in OPC 10000-4. All suppressible errors shall be ignored; however, they may be logged as warnings. If the validation fails, the appropriate StatusCode defined in OPC 10000-4 shall be reported. The validation process requires that the TrustList associated with the CertificateGroup already contains the IssuerCertificates. Revocation checks may be done with CRLs in the TrustList or using online CRL checks.

For Purposes other than ApplicationCertificateType, the validation rules are not defined by this specification.

This Method may be called within the context of an ApplicationConfiguration Object (see 7.10.14) which means the Certificate may be used by a Client or a non-OPC UA application.

The Server shall report an error if the PublicKey does not match the existing Certificate and the PrivateKey was not provided.

If a transaction is in progress (see 7.10.9) on another Session then the Server shall return Bad_TransactionPending.

If the SecureChannel is not authenticated the Server shall return Bad_SecurityModeInsufficient.

If the Server returns ApplyChangesRequired=FALSE then it is indicating that it is able to satisfy the requirements specified for the ApplyChanges Method.

This Method shall be called from an encrypted SecureChannel and from a Client that has access to the SecurityAdmin Role (see 7.2).

Signature

UpdateCertificate(
	[in]  NodeId CertificateGroupId
	[in]  NodeId CertificateTypeId
	[in]  ByteString Certificate
	[in]  ByteString[] IssuerCertificates
	[in]  String PrivateKeyFormat
	[in]  ByteString PrivateKey
	[out] Boolean ApplyChangesRequired
);

Method Result Codes (defined in Call Service)

Table 89 specifies the AddressSpace representation for the UpdateCertificate Method.

7.10.6 CreateSelfSignedCertificate

CreateSelfSignedCertificate Method creates a new self-signed Certificate and associates it with a CertificateGroup.

This Method allows an administration Client to create a Certificate used by the Server. The Purpose of the CertificateGroup specifies what the Certificate is used for. For example, a CertificateGroup that contains ApplicationInstance Certificates would only contain Certificates that are valid ApplicationInstance Certificates as defined in OPC 10000-6.The new Certificate shall be an instance of the CertificateTypeId.

If a Certificate is already assigned to the CertificateType slot then a Bad_InvalidState error is returned.

If a transaction is in progress (see 7.10.9) on another Session then the Server shall return Bad_TransactionPending. If the SecureChannel is not authenticated the Server shall return Bad_SecurityModeInsufficient.

The Server shall continue an existing transaction or create a new transaction if an existing transaction does not exist.

The Server may use an existing PrivateKey or create a new PrivateKey. If a Server cannot generate PrivateKeys for the specified CertificateType then the Server shall return Bad_NotSupported.

This Method shall be called from an authenticated SecureChannel and from a Client that has access to the SecurityAdmin Role (see 7.2).

Signature

CreateSelfSignedCertificate (
	[in]  NodeId CertificateGroupId
	[in]  NodeId CertificateTypeId
	[in]  String SubjectName
	[in]  String[] dnsNames
	[in]  String[] ipAddresses
	[in]  UInt16 lifetimeInDays
	[in]  UInt16 keySizeInBits
	[out] ByteString certificate
);

Method Result Codes (defined in Call Service)

Table 42 specifies the AddressSpace representation for the CreateSelfSignedCertificate Method.

7.10.7 DeleteCertificate

DeleteCertificate Method a Certificate that is associated with a CertificateGroup.

If no Certificate is assigned to the CertificateType slot then a Bad_InvalidState error is returned.

If a transaction is in progress (see 7.10.9) on another Session then the Server shall return Bad_TransactionPending. If the SecureChannel is not authenticated the Server shall return Bad_SecurityModeInsufficient.

The Server shall continue an existing transaction or create a new transaction if a transaction does not exist.

Certificates that are referenced by EndpointDescriptions shall not be deleted. This determination happens when ApplyChanges is called. ApplyChanges is always required when this Method is called.

The Server is responsible for managing the lifetime of the PrivateKeys associated with the Certificate. When the Certificate is deleted, the Server should delete the associated PrivateKey if no longer needed.

This Method shall be called from an authenticated SecureChannel and from a Client that has access to the SecurityAdmin Role (see 7.2).

Signature

DeleteCertificate(
	[in] NodeId CertificateGroupId
	[in] NodeId CertificateTypeId
);

Method Result Codes (defined in Call Service)

Table 42 specifies the AddressSpace representation for the DeleteCertificate Method.

7.10.8 GetCertificates

The GetCertificates Method returns the Certificates assigned to CertificateTypes associated with a CertificateGroup.

This Method shall be called from an authenticated SecureChannel and from a Client that has access to the SecurityAdmin Role (see 7.2).

Signature

GetCertificates(
	[in]  NodeId CertificateGroupId
	[out] NodeId[] CertificateTypeIds
	[out] ByteString[] Certificates
);

Method Result Codes (defined in Call Service)

Table 92 specifies the AddressSpace representation for the GetCertificates Method.

7.10.9 ApplyChanges

The ApplyChanges Method is used to apply pending Certificate and TrustList updates and to complete a transaction as described in 7.10.2.

ApplyChanges returns Bad_InvalidState if any TrustList is still open for writing. No changes are applied and ApplyChanges can be called again after the TrustList is closed.

If a Session is closed or abandoned then the transaction is closed and all pending changes are discarded.

If ApplyChanges is called and there is no active transaction then the Server returns Bad_NothingToDo. If there is an active transaction, however, no changes are pending the result is Good and the transaction is closed.

When a Server Certificate or TrustList changes active SecureChannels are not immediately affected. This ensures the caller of ApplyChanges can get a response to the Method call. Once the Method response is returned the Server shall force existing SecureChannels affected by the changes to renegotiate and use the new Server Certificate and/or TrustLists.

Servers may close SecureChannels without discarding any Sessions or Subscriptions. This will seem like a network interruption from the perspective of the Client and the Client reconnect logic (see OPC 10000-4) allows them to recover their Session and Subscriptions. Note that some Clients may not be able to reconnect because they are no longer trusted.

Other Servers do a complete shutdown. In this case, the Server shall advertise its intent to interrupt connections by setting the SecondsTillShutdown and ShutdownReason Properties in the ServerStatus Variable.

If a TrustList change only affects UserIdentity associated with a Session then Servers shall re-evaluate the UserIdentity and if it is no longer valid the Session and associated Subscriptions are closed.

This Method shall be called from an authenticated SecureChannel and from the Session that created the transaction and has access to the SecurityAdmin Role (see 7.2).

Signature

ApplyChanges();

Method Result Codes (defined in Call Service)

Table 93 specifies the AddressSpace representation for the ApplyChanges Method.

7.10.10 CreateSigningRequest

CreateSigningRequest Method asks the Server to create a PKCS #10 DER encoded Certificate Request that is signed with the Server’s private key. The Certificate Request can be then used to request a Certificate from a CA.

Servers shall support a least one active and one new key pair for each combination of CertificateGroupId and CertificateTypeId. If this Method is called multiple times with the same CertificateGroupId and CertificateTypeId then any previously generated new key pair, that has not been made active, is discarded. If a key pair is made active by a call to UpdateCertificate then the previously active key pair is deleted if it is no longer used.

If Certificate associated with the CertificateGroupId and CertificateTypeId is deleted or replaced via CreateSelfSignedCertificate (see 7.10.6) or DeleteCertificate (see 7.10.7) then the new key pair is discarded.

The new key pair created with CreateSigningRequest shall be persisted and shall be available for UpdateCertificate even if it is called from a different Session.

This Method shall be called from an encrypted SecureChannel and from a Client that has access to the SecurityAdmin Role (see 7.2).

Signature

CreateSigningRequest(
	[in]  NodeId CertificateGroupId
	[in]  NodeId CertificateTypeId
	[in]  String SubjectName
	[in]  Boolean RegeneratePrivateKey
	[in]  ByteString Nonce
	[out] ByteString CertificateRequest
);

Method Result Codes (defined in Call Service)

Table 94 specifies the AddressSpace representation for the CreateSigningRequest Method.

7.10.11 CancelChanges

The CancelChanges Method is used to tell the Server to discard changes to the TrustLists or Certificates which were waiting for the Client to ApplyChanges.

This Method shall be called from an authenticated SecureChannel and from the Session that created the transaction and has access to the SecurityAdmin Role (see 7.2).

Signature

CancelChanges();

Method Result Codes (defined in Call Service)

Table 93 specifies the AddressSpace representation for the CancelChanges Method.

7.10.12 GetRejectedList

GetRejectedList Method returns the list of Certificates that have been rejected by the Server.

No rules are defined for how the Server updates this list or how long a Certificate is kept in the list. It is recommended that every valid but untrusted Certificate be added to the rejected list as long as storage is available. Servers should omit older entries from the list returned if the maximum message size is not large enough to allow the entire list to be returned.

This Method shall be called from an authenticated SecureChannel and from a Client that has access to the SecurityAdmin Role (see 7.2).

Signature

GetRejectedList(
	[out] ByteString[] Certificates
);

Method Result Codes (defined in Call Service)

Table 96 specifies the AddressSpace representation for the GetRejectedList Method.

7.10.13 ResetToServerDefaults

The ResetToServerDefaults Method resets an application configuration to its default settings.

If the application is running on a Device that supports OPC 10000-21, the Device is placed in a state where the Onboarding process has to restart. If the Device does not support OPC 10000-21, the Server repeats the Application Setup process described in Annex G.

If the application is a Server, after this Method completes the Server shall set the ServerState to SHUTDOWN and the shutdownReason to a localized message that warns Clients that their credentials may not work when the Server restarts. The Server should set the secondsTillShutdown to a time that gives the Client a chance to receive the response to this Method.

Note that the default configuration for a application is set by configuration and is not necessarily the “factory default”. For example, a machine builder could update the default configuration to ensure that the application can still communicate with other applications within the machine after the reset.

The mechanisms for setting the default configuration are vendor specific.

This Method shall be called from an authenticated SecureChannel and from a Client that has access to the SecurityAdmin Role (see 7.2).

Signature

ResetToServerDefaults ();

Method Result Codes (defined in Call Service)

Table 97 specifies the AddressSpace representation for the ResetToServerDefaults Method.

7.10.14 ApplicationConfigurationType

The ApplicationConfigurationType ObjectType defines a model which represents the configuration of another application. A Server acting as a proxy will add the Objects that represent the application it manages to the ManagedApplications Object (see 7.10.16).

The Enabled Property indicates whether the application is enabled. If FALSE the application will not run. If TRUE the application runs.

The KeyCredentials Folder that contains credentials assigned to the application. It is described in 8.6.

The AuthorizationServices Folder contains the AuthorizationServiceConfiguration Objects which the application supports. It is described in 9.7.

If ApplicationType is Client then the ApplicationsNames Property shall not be present and the ServerCapabilities shall be “NA” or “RCP”.

If ApplicationType is Server or ClientAndServer then the ApplicationsNames Property shall be present and the ServerCapabilities shall be set”.

If ApplicationType is DiscoveryServer then the ApplicationsNames Property shall not be present and the ServerCapabilities shall be “LDS”.

For NonUaApplications, the ApplicationType shall be Client, the ApplicationsNames shall not be present, the ServerCapabilities shall be “NA” and MulticastDnsEnabled shall be FALSE.

The IsNonUaApplication Property indicates that the application is a NonUaApplication.

Additional requirements for some components inherited from ServerConfigurationType are specified in Table 99.

The application may require software updates. In this case, the software update model described in OPC 10000-100 specifies an instance of the SoftwareUpdateType that may be added to the ApplicationConfiguration instance.

7.10.15 ApplicationConfigurationFolderType

A Folder for ApplicationConfiguration Objects which a Server exposes in its AddressSpace.

7.10.16 ManagedApplications

This Object allows access to the application configurations and it is the target of an Organizes reference from the Resources Object defined in OPC 10000-22.

Its representation in the AddressSpace is formally defined in Table 101.

7.10.17 TransactionDiagnosticsType

This type defines an ObjectType which represents the diagnostics for the last transaction (see 7.10.1. If no transaction has started the values of all Variables have a status of Bad_OutOfService. All existing results are discarded when a new transaction starts.

The StartTime Property indicates when transaction started. It has a status of Bad_OutOfService if a transaction has not started

The EndTime Property indicates when transaction ended. It has a value of DateTime.MinValue if the transaction has not completed.

The Result Property indicates the overall transaction result. It has a status of Bad_InvalidState if a transaction has started but not completed. If the transaction has completed the status is Good and the value is the StatusCode that was returned from the ApplyChanges Method. If the CancelChanges Method was called the value is Bad_RequestCancelledByClient.

The AffectedTrustLists Property specifies the NodeIds of the TrustLists that are included in the transaction. It is updated each time as soon as a TrustList is added to the transaction.

The AffectedCertificateGroups Property specifies the NodeIds of the CertificateGroups are included in the transaction. It is updated each time as soon as a CertificateGroup is added to the transaction.The Errors Property has a list of errors that occurred when the changes were applied. Empty if no errors occurred. The TransactionErrorType is defined in 7.10.18.

7.10.18 TransactionErrorType

This type defines a DataType which stores an error that occurred when processing a transaction. Its values are defined in Table 103.

Its representation in the AddressSpace is defined in Table 104.

7.10.19 ApplicationConfigurationDataType

This is the DataType used to serialize application configurations. It is defined in Table 105.

The fields that are used depend on the ApplicationType.

Each ServerEndpoint has a unique combination of NetworkName and Port. Each ClientEndpoint has a unique combination of NetworkName and Port.

At least one CertificateGroup linked to a ServerEndpoint (see 7.10.23) shall have a CertificateType slot compatible with the Server Certificate used for the current Session. If no such slot exists the configuration update is rejected. The TrustList associated with that CertificateGroup shall trust the Client Certificate used for the current Session.

Updates to the configuration are applied in the following order:

ApplicationIdentity

CertificateGroups

UserTokenSettings

SecuritySettings

ServerEndpoints

ClientEndpoints

AuthorizationServices

While processing a single record type updates are applied in the order they appear in the array.

Client shall put updates in this order: Delete => Insert => Replace.

For Insert/Replace operations, a record name shall never appear more than once.

References to other records by name are only verified after all records have been processed.

Its representation in the AddressSpace is defined in Table 106.

7.10.20 ApplicationConfigurationFileType

A File Object that supports the reading and writing of an ApplicationConfiguration defined in 7.10.19.

If a transaction is in progress (see 7.10.9) on another Session then the Server shall return Bad_TransactionPending if Open is called with Write Mode bit set.

Open is called with Write Mode bit set then new transactions (see 7.10.2) cannot be started. The block on new transactions lasts until the update was applied or rolled back. This may occur when ConfirmUpdate is called.

Methods that update the configuration shall be called from an authenticated SecureChannel and from a Client that has access to the SecurityAdmin Role (see 7.2).

The AvailableNetworks Property specifies the valid values for NetworkName for an Endpoint (see 7.10.22).

The AvailablePorts Property the range of ports that may be specified for an Endpoint. If it is empty then all Ports are valid.

The SecurityPolicyUris Property is a list of URIs that may be used in a SecuritySettings (see 7.10.24). If empty then all URIs are supported.

The UserTokenTypes Property is the list of UserTokenTypes that may be used in a UserTokenSetting (see 7.10.24). If empty then all UserTokenTypes are supported. The PolicyId, IssuerEndpointUrl and SecurityPolicyUrl fields in the UserTokenPolicy Structure are not used and are always ignored. There may only be one combination of TokenType and IssuedTokenType in the list.

The CertificateTypes Property is a list of CertificateTypeIds that may be used in a CertificateGroup (see 7.8.3.4). It shall have at least one element specified.

The CertificateGroupPurposes Property is a list of Purposes that may be used in a CertificateGroup (see 7.8.3.4). It shall have at least one element specified.

The MaxEndpoints Property specifies the maximum total number of Endpoints (Client plus Server) that may be defined. 0 means no limit.

The MaxCertificateGroups Property specifies the maximum number of CertificateGroups that may be defined. 0 means no limit.

7.10.21 ApplicationIdentityDataType

This type is used to serialize the ApplicationIdentity configuration. It is defined in Table 108.

The ApplicationIdentity affects Certificates, CertificateRequests and ApplicationDescriptions created by a Client or Server. When the ApplicationIdentity is changed, existing Certificates are not affected, however, they may no longer be valid for use by the application because the ApplicationUri does not match the ApplicationUri in the Certificate. Applications shall continue to use the invalid Certificates which allows the configuration Client, which is aware of the mismatch, to complete the process needed to update Certificates. The new ApplicationUri shall be used in any subsequent signing requests.

Its representation in the AddressSpace is defined in Table 109.

7.10.22 EndpointDataType

This type is used to serialize a single Endpoint configuration. It is defined in Table 110.

The DiscoveryUrls associated with the Endpoint. They are reported as part of the ApplicationDescription returned by FindServers (see OPC 10000-4) and by QueryApplications (6.5.10). If multiple Endpoints are specified the DiscoveryUrls from each Endpoint are collected into a single list with any duplicates removed. If this list is empty the Endpoint is not included in the ApplicationDescription returned by FindServers or QueryApplications.

The DiscoveryUrls returned to Clients includes one of the URLs in the DiscoveryUrls list based on the EndpointUrl filter provided in the FindServers Request. If the filter provided is not one of the DiscoveryUrls then the first entry in the DiscoveryUrls list is returned.

NetworkName and Port specify the information the application needs listen for incoming connections. Only one Endpoint may be specified for each combination of NetworkName and Port.

Its representation in the AddressSpace is defined in Table 111.

7.10.23 ServerEndpointDataType

This type is used to serialize a single Endpoint configuration for a Server. It is defined in Table 112.

The information in the Endpoint is used to generate a list of EndpointDescriptions that could be returned by the Server when GetEndpoints is called. The basic algorithm generates an EndpointDescription for each valid combination of SecurityPolicyUri, SecurityMode and Certificate (specified in the SecuritySettings). The EndpointDescription returned to Clients includes one of the URLs in the EndpointUrls list based on the EndpointUrl filter provided in the GetEndpoints Request. If the filter provided is not one of the EndpointUrls then the first entry in the EndpointUrls list is returned.

The complete set of EndpointDescriptions is built by repeating the process for all enabled Endpoints.

The UserTokenSettings array may specify a UserTokenPolicy with a SecurityPolicyUri. Any UserTokenSetting that is not valid for ServerCertificate associated with a generated EndpointDescription is rejected.

The Server chooses unique values for PolicyIds in UserTokenPolicies when building the EndpointDescriptions.

The ReverseConnectUrls are the URLs that the Server connects to and sends a ReverseHello. The EndpointDescriptions generated from the ServerEndpoint are available to Clients connecting via the socket.

Its representation in the AddressSpace is defined in Table 113.

7.10.24 SecuritySettingsDataType

This type is used to specify the SecuritySettings for a Server Endpoint. It is defined in Table 114.

The CertificateGroup specifies one or more Certificates that are assigned to a Server. When generating EndpointDescriptions any SecurityPolicyUris (other than None) that are not valid for one of the Certificates associated with the CertificateGroup are ignored.

If a SecurityPolicyUri is valid for more than one Certificate in the CertificateGroup, then an EndpointDescription is generated for each Certificate.

EndpointDescriptions generated with a None SecurityMode only use the SecurityPolicyUris and the CertificateGroupName to restrict the SecurityPolicies that may be used in the UserTokenPolicies.

Its representation in the AddressSpace is defined in Table 115.

7.10.25 UserTokenSettingsDataType

This type is used to serialize the configuration for a UserTokenPolicy. It is defined in Table 116.

The UserTokenSettingsDataType in the is used to configure how to validate UserIdentityTokens.

If a CertificateGroup is specified it refers to the TrustList used to verify credentials by either verifying that an X509IdentityToken is trusted or by using a Certificate in the TrustList to verify the Signature on an IssuedIdentityToken. The CertificateGroup is not specified for UserName or Anonymous TokenTypes.

The KeyCredentialName is only specified for IssuedIdentityTokens and refers to a KeyCredential needed to access network resources used to validate IssuedIdentityTokens.

Its representation in the AddressSpace is defined in Table 117.

7.10.26 CertificateUpdateRequestedAuditEventType

This event is raised when the UpdateCertificate Method is called.

If a PrivateKey was one of the InputArguments then that argument is set to NULL before generating this Event.

Its representation in the AddressSpace is formally defined in Table 118.

This EventType inherits all Properties of the AuditUpdateMethodEventType. Their semantic is defined in OPC 10000-5.

7.10.27 CertificateUpdatedAuditEventType

This event is raised when a Certificate is actually changed as a result of a Method call.

This is the result of a successful call to UpdateCertificate or ApplyChanges on a ServerConfigurationType Object. No Event is raised if the Method call fails. If ApplyChanges affects multiple Certificates then this Event is raised for each changed Certificate.

Its representation in the AddressSpace is formally defined in Table 119.

This EventType inherits all Properties of the AuditUpdateMethodEventType. Their semantic is defined in OPC 10000-5.

The SourceNode Property for Events of this type shall be assigned to the NodeId of the Object with the Method that triggered the Event.

The CertificateGroup Property specifies the CertificateGroup that was affected by the update.

The CertificateType Property specifies the type of Certificate that was updated.