dohertj2/lmxopcua
1
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects Releases Wiki Activity

OPC UA client sessions: confirm whether server-certificate hostname is validated (driver + AdminUI browser) #816

New Issue
Closed
opened 2026-11-11 00:05:56 -05:00 by dohertj2 · 1 comment
dohertj2 commented 2026-11-11 00:05:56 -05:00
Owner
Copy Link
Copy Source

Seen during #813: with the NAT opc-plc fixture's certificate trusted, a secure browse succeeded although the certificate is issued for otopcua-opc-plc-nat-private.invalid and the client connected by IP (10.100.0.35:50010). Determine whether the SDK checks the certificate's host name for the OpcUaClient driver, the AdminUI browser and Client.Shared sessions, decide the intended policy (NAT deployments make strict hostname checks hard), and document/test it.

Seen during #813: with the NAT opc-plc fixture's certificate trusted, a secure browse succeeded although the certificate is issued for `otopcua-opc-plc-nat-private.invalid` and the client connected by IP (10.100.0.35:50010). Determine whether the SDK checks the certificate's host name for the OpcUaClient driver, the AdminUI browser and Client.Shared sessions, decide the intended policy (NAT deployments make strict hostname checks hard), and document/test it.
dohertj2 added the driver/opcuaclienttype:followuppriority:p2 labels 2026-11-11 00:05:56 -05:00
dohertj2 commented 2026-11-11 05:24:29 -05:00
Author
Owner
Copy Link
Copy Source

Done (598c6681). Pushed to master in d1b6cad2. The OpcUaClient driver and AdminUI browser now have a "Server host-name check" option (default unset = current behaviour), round-tripped through the modal on the docker-dev gate. The default is an owner decision: #837.

Done (`598c6681`). Pushed to master in `d1b6cad2`. The OpcUaClient driver and AdminUI browser now have a "Server host-name check" option (default unset = current behaviour), round-tripped through the modal on the docker-dev gate. The default is an owner decision: #837.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
auto-managed
queue management
 blocked
Blocked by dependency or external hold
 cross-driver
queue management
 cross-repo
Needs coordinated change in another family repo (wire contract etc.)
 driver/abcip
queue management
 driver/ablegacy
queue management
 driver/focas
queue management
 driver/mqtt
MQTT / Sparkplug B broker-subscribe driver
 driver/opcuaclient
queue management
 driver/s7
queue management
 driver/twincat
queue management
 migrated
Migrated from a markdown backlog (2026-11 standardization)
 phase/1
queue management
 phase/2
queue management
 phase/3
queue management
 phase/4
queue management
 phase/5
queue management
 phase/6
queue management
 priority:p0
Must-have / blocking
 priority:p1
High priority
 priority:p2
Normal priority
 priority:p3
Low priority / nice to have
 queue/blocked
queue management
 queue/done
queue management
 queue/failed
queue management
 queue/in-progress
queue management
 queue/queued
queue management
 type:bug
Defect in shipped behaviour
 type:debt
Technical debt / hygiene
 type:deploy-gate
Rollout/deploy/migration step not yet done on an environment
 type:docs
Documentation work
 type:feature
Feature implementation
 type:followup
Follow-up deferred from a plan, PR or gate
 type:infra
Infrastructure and scaffolding
 type:review-finding
Unfixed finding from an architecture/code review
 type:test
Test work
No Label driver/opcuaclient priority:p2 type:followup
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dohertj2 (dohertj2)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#816
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?