Security: https channel always create endpoint with Non securityMode about ua-.net-legacy HOT 2 OPEN

Hi @ccasteyde ,

The Server library from this repository exposes indeed the HTTPS endpoints with security None.
In case the application authentication is required in a specific implementation, the option is to implement an override for StandardServer.CreateSesion() and validate the "clientCertificate" parameter of the method.
And this is possible without changes in the library.

For the client side the ApplicationInstance.SetUaValidationForHttps() call can be used in order to validate the server certificates with the same validator (trust list) of the application.

e.g.

   ApplicationInstance.SetUaValidationForHttps(application.ApplicationConfiguration.CertificateValidator);

I will check also the related entries reported for the .NET Standard repository.
Please note that this repository is not further updated by OPC Foundation and the official OPC UA .NET Stack provided and maintained by OPC Foundation is UA-.NET Standard

from ua-.net-legacy.

Hello

1. First, as the whole discussion is about https client authentication which is also addressed in reports in UA .Net Standard, I propose to discuss more thoroughly this subject in .Net standard environment then see if something should be done in .Net Legacy.
2. I'm agree development is now focussed on .NET Standard, ** but** security updates are done in .NET Legacy, and this is really a security issue.
3. Overriding CreateSession is not an option, since with binding None the client has the option to not even send any certificate. Moreover, its not realistic to tell every user to modify its application in order to not fix a security flaw in this implementation of the stack.
4. The norm says Sign should be exposed unless security level 0 is selected, in which case None can be used. The behaviour therefore depends on the bindings proposed by the application. The strongest securitymode should be used (till Sign since Encrypt is transfered to the TLS layer).

from ua-.net-legacy.