Issue with Certificates

[RajuGujjalapati]

I have created a certificate using openssl ( I have followed your steps ). My Python server and client is working fine with two .pem files(certificate.pem and key.pem).
But when i tried to connect with uaExpert client it is throwing the error like below.

[swamper123]

Does your uaExpert know the certificate?

[AndreasHeine]

What is your Server configuration?
Message Security:
Sign or Sign&Encrypt or None???
Authentification:
Username/Password or Certificate or None???

can you provide/post the cert and key?

like @swamper123 mentioned if you first time connect with UaExpert to a new Server (new Certificate) you need to Trust them (On connect there should open a Popup for that)

[RajuGujjalapati]

My code:
`endpoint = "opc.tcp://127.0.0.1:5600"
server.set_endpoint(endpoint)

servername = "Python-OPC-UA"
server.set_server_name(servername)
address_space = server.register_namespace("test application")

uri = "URI:urn:opcua:python:server"
server.set_application_uri(uri)

server.load_certificate("certificate.pem")
server.load_private_key("key.pem")
server.set_security_policy([
    # ua.SecurityPolicyType.NoSecurity,
    
    ua.SecurityPolicyType.Basic256Sha256_SignAndEncrypt
])
idx = server.register_namespace(uri)`

In the uaExpert client when i uploaded it didn't showed any popup!.
It is just throwing that error.

[AndreasHeine]

So you use ->
Message Security: Basic256Sha256_SignAndEncrypt
Authentification: None (Anonymus)

with these settings you should be able to connect!!!

[AndreasHeine]

UaExpert -> Settings -> Manage Certificates make sure your Servers Cert is in Trusted!

also make sure UaExpert has the rights to access your onedrive....

[RajuGujjalapati]

Yes, I have tried what you have shown, but the same issue.

But i have a doubt why we are creating two .pem files here, how to create .der file?
uaExpert issue:

[RajuGujjalapati]

Yes its working now.

[AndreasHeine]

But i have a doubt why we are creating two .pem files here, how to create .der file?

.der and .pem are different encoded types of certificates!
for opc ua the SubjAltname extension is important to Validate Application URI and IP-Address

[RajuGujjalapati]

But why this?
How it knows whether server has certificate or not?

[RajuGujjalapati]

Thanks for yr help!!!!!!!!!!!!!!!!
Why these errors?

Is that fine to create two .pem files?
why not .der file?
How to create and use .der file?
For production how we have to apply these?
How client knows about these certificates?

These are the row of doubts i have as of now?😂

[AndreasHeine]

https://reference.opcfoundation.org/v104/
you need to learn more about opc ua and its security stuff aswell as open ssl!

please remember this is an OpenSourceProject and no one gets payed for that and your questions are way to general and not really related to python-opcua!

your questions are all easy google searches... 🙏

[RajuGujjalapati]

Thank you for your response and yes i knew very less about all these.