OpcUaClient UserCertificatePath can name any PFX on the node (possible signing oracle — unverified) #836
Assignees
dohertj2 (dohertj2)
Clear assignees
dohertj2 (dohertj2)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: dohertj2/lmxopcua#836
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Residual from #815's review. The OpcUaClient driver's user-certificate identity takes a file path; a Designer can point it at any PFX readable by the service account and an endpoint they control. A hostile server could then obtain signatures made with that key (ActivateSession user-token signature over server-chosen nonce/cert). Not verified end to end. Options: restrict to a configured certificate directory/store, or to
secret:opcuaclient/…references, and refuse at save/deploy/Test Connect like the #815 credential fields.Fixed (
63331b04, review fixes271b96a6). Pushed to master ind1b6cad2.UserCertificatePathmust be a relative path of plain segments insideDrivers:OpcUaClient:UserCertificateDirectory(default<LocalAppData>/OtOpcUa/pki/user-certificates; relative settings resolve against the app directory). Absolute/UNC/drive/../ADS forms are refused at save/deploy/Test Connect/browse; at load the path must stay inside the directory with links resolved. Checked only when AuthType is Certificate; the deploy gate also checks the merged driver+device config. Running drivers with an old absolute path keep loading it with a WARN +credential-compat:UserCertificatePath.Upgrade note: OpcUaClient drivers using certificate auth must move the PFX under the directory (driver and admin nodes) and switch to the relative path before their next deploy. Follow-up: #850.