dohertj2/lmxopcua
1
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects Releases Wiki Activity

Owner decision: turn on OPC UA server-certificate host-name validation by default? #837

New Issue
Closed
opened 2026-11-11 03:27:27 -05:00 by dohertj2 · 2 comments
dohertj2 commented 2026-11-11 03:27:27 -05:00
Owner
Copy Link
Copy Source

From #816. certificateValidation.validateServerHostName (and CLI --validate-host-name) is opt-in and unset = off, preserving behaviour for NAT/IP-addressed deployments. It only applies to Sign/SignAndEncrypt sessions. Decide whether new configs (or all) should default to on, and whether the AdminUI should surface it more prominently. Known caveats documented in docs/drivers/OpcUaClient.md: IPv6 zone ids, loose first-label matching in the SDK.

From #816. `certificateValidation.validateServerHostName` (and CLI `--validate-host-name`) is opt-in and unset = off, preserving behaviour for NAT/IP-addressed deployments. It only applies to Sign/SignAndEncrypt sessions. Decide whether new configs (or all) should default to on, and whether the AdminUI should surface it more prominently. Known caveats documented in docs/drivers/OpcUaClient.md: IPv6 zone ids, loose first-label matching in the SDK.
dohertj2 added the driver/opcuaclienttype:followuppriority:p3blocked labels 2026-11-11 03:27:27 -05:00
dohertj2 commented 2026-11-11 11:47:52 -05:00
Author
Owner
Copy Link
Copy Source

Owner decision 2026-11-11: keep opt-in. validateServerHostName stays off when unset for both new and existing configs. Remaining work is docs/AdminUI only: show the toggle and its NAT/IPv6 caveats prominently. Then close.

Owner decision 2026-11-11: **keep opt-in.** `validateServerHostName` stays off when unset for both new and existing configs. Remaining work is docs/AdminUI only: show the toggle and its NAT/IPv6 caveats prominently. Then close.
dohertj2 commented 2026-11-11 14:53:52 -05:00
Author
Owner
Copy Link
Copy Source

Done (owner decision: keep opt-in). The host-name check toggle moved to the Security panel with help text covering the NAT/IP, IPv6-zone and loose-match caveats. docs/drivers/OpcUaClient.md records the decision. Pushed to master in e857135e..7a27ef1f; full suite green (20 projects, 0 failures, 0 warnings).

Done (owner decision: keep opt-in). The host-name check toggle moved to the Security panel with help text covering the NAT/IP, IPv6-zone and loose-match caveats. docs/drivers/OpcUaClient.md records the decision. Pushed to master in `e857135e..7a27ef1f`; full suite green (20 projects, 0 failures, 0 warnings).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
auto-managed
queue management
 blocked
Blocked by dependency or external hold
 cross-driver
queue management
 cross-repo
Needs coordinated change in another family repo (wire contract etc.)
 driver/abcip
queue management
 driver/ablegacy
queue management
 driver/focas
queue management
 driver/mqtt
MQTT / Sparkplug B broker-subscribe driver
 driver/opcuaclient
queue management
 driver/s7
queue management
 driver/twincat
queue management
 migrated
Migrated from a markdown backlog (2026-11 standardization)
 phase/1
queue management
 phase/2
queue management
 phase/3
queue management
 phase/4
queue management
 phase/5
queue management
 phase/6
queue management
 priority:p0
Must-have / blocking
 priority:p1
High priority
 priority:p2
Normal priority
 priority:p3
Low priority / nice to have
 queue/blocked
queue management
 queue/done
queue management
 queue/failed
queue management
 queue/in-progress
queue management
 queue/queued
queue management
 type:bug
Defect in shipped behaviour
 type:debt
Technical debt / hygiene
 type:deploy-gate
Rollout/deploy/migration step not yet done on an environment
 type:docs
Documentation work
 type:feature
Feature implementation
 type:followup
Follow-up deferred from a plan, PR or gate
 type:infra
Infrastructure and scaffolding
 type:review-finding
Unfixed finding from an architecture/code review
 type:test
Test work
No Label blocked driver/opcuaclient priority:p3 type:followup
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dohertj2 (dohertj2)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#837
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?