7.10.5 UpdateCertificate

UpdateCertificate is used to update a Certificate.

There are the following two use cases for this Method:

The PrivateKey is already known to the Server (i.e. it was created with the CreateSigningRequest (see 7.10.10) or CreateSelfSignedCertificate (see 7.10.6) Method).

The PrivateKey was created outside the Server and is updated with this Method.

The Purpose of the associated CertificateGroup determines the validation rules for Certificate being updated. For ApplicationCertificateType, the Server shall verify the Certificate using the validation process defined in OPC 10000-4. All suppressible errors shall be ignored; however, they may be logged as warnings. If the validation fails, the appropriate StatusCode defined in OPC 10000-4 shall be reported. The validation process requires that the TrustList associated with the CertificateGroup already contains the IssuerCertificates. Revocation checks may be done with CRLs in the TrustList or using online CRL checks.

For Purposes other than ApplicationCertificateType, the validation rules are not defined by this specification.

This Method may be called within the context of an ApplicationConfiguration Object (see 7.10.14) which means the Certificate may be used by a Client or a non-OPC UA application.

The Server shall report an error if the PublicKey does not match the existing Certificate and the PrivateKey was not provided.

If a transaction is in progress (see 7.10.9) on another Session then the Server shall return Bad_TransactionPending.

If the SecureChannel is not authenticated the Server shall return Bad_SecurityModeInsufficient.

If the Server returns ApplyChangesRequired=FALSE then it is indicating that it is able to satisfy the requirements specified for the ApplyChanges Method.

This Method shall be called from an encrypted SecureChannel and from a Client that has access to the SecurityAdmin Role (see 7.2).

Signature

UpdateCertificate(
	[in]  NodeId CertificateGroupId
	[in]  NodeId CertificateTypeId
	[in]  ByteString Certificate
	[in]  ByteString[] IssuerCertificates
	[in]  String PrivateKeyFormat
	[in]  ByteString PrivateKey
	[out] Boolean ApplyChangesRequired
);

Method Result Codes (defined in Call Service)

Table 89 specifies the AddressSpace representation for the UpdateCertificate Method.