[Bug]: OPC-UA driver 1.0.0 fails against a certificate-less server even with security-policy=NONE (regression vs 0.13.1)

Abierto
  • ¿Algo no está bien?
#2,830 0 comentarios 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 1 día

@splatch ya está trabajando en esto.

Desde el 22/10/2026.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

What happened?

With PLC4J 1.0.0 the OPC-UA driver cannot connect to an OPC UA server that presents no certificate, even when security-policy=NONE is requested. The connection is torn down during session activation with:

org.apache.plc4x.java.api.exceptions.PlcRuntimeException: The peer sent no certificate where one was required

The same server connects with no parameters at all on 0.13.1, so this is a regression introduced by the 1.0.0 security hardening.

Server shape: a small Python test server built with asyncua (asyncua.Server), no certificate configured, publishing a single SecurityPolicy None endpoint. Per OPC UA, with a None-policy endpoint the server sends no serverCertificate in the CreateSessionResponse — "policy None + no server certificate" is a legal, spec-conformant combination, and connecting to such a server is exactly what the v1.0.0 release notes describe as still supported: "... or ask for security-policy=NONE to accept an unprotected channel as before."

Root cause (read off plc4j-driver-opcua-1.0.0.jar with javap): SecureChannel.onConnectActivateSessionRequest(CreateSessionResponse) feeds CreateSessionResponse.getServerCertificate() to getX509CertificateChain(byte[]) unconditionally — there is no guard for the policy-None case:

SecureChannel.onConnectActivateSessionRequest(CreateSessionResponse):
  19: invokevirtual CreateSessionResponse.getServerCertificate()
  22: invokevirtual PascalByteString.getStringValue():byte[]
  25: invokestatic  SecureChannel.getX509CertificateChain(byte[])   // straight-line, no null/empty guard

and getX509CertificateChain(byte[]) throws when the byte array is null or empty. The certificate is therefore required on the session-activation path regardless of the negotiated security policy. The existing escape hatches only relax validation of a certificate that must still be present: tls.verify=false skips chain/hostname checks, allow-insecure-credentials=true only affects credential transmission — neither helps when the server sends no certificate at all.

Connection strings attempted (all fail)
Connection string Result
opcua:tcp://127.0.0.1:14840 (bare) IllegalArgumentException: Could not find endpoint matching client configuration. Tested [opc.tcp://kubernetes.docker.internal:14840/]. Was looking for ... http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256 messageSecurityModeSignAndEncrypt — expected, this is the documented 1.0.0 default-policy flip and the server only offers None
opcua:tcp://127.0.0.1:14840?security-policy=NONE PlcRuntimeException: The peer sent no certificate where one was required
opcua:tcp://127.0.0.1:14840?security-policy=NONE&tls.verify=false same
opcua:tcp://127.0.0.1:14840?security-policy=NONE&tls.verify=false&allow-insecure-credentials=true same
opcua:tcp://127.0.0.1:14840?security-policy=NONE&discovery=false same

The four parameterized forms all fail at the same point, right after the client logs Received open channel response 1, parsing it.

How to reproduce
  1. Start a certificate-less server (Python asyncua; with no certificate configured it publishes a None-only endpoint):
import asyncio
from asyncua import Server

async def main():
    server = Server()
    await server.init()
    server.set_endpoint("opc.tcp://0.0.0.0:14840/")
    # no certificate configured -> asyncua exposes a SecurityPolicy#None endpoint only
    await server.start()
    await asyncio.Event().wait()

asyncio.run(main())
  1. With PLC4J 1.0.0, connect with opcua:tcp://127.0.0.1:14840?security-policy=NONE -> fails during session activation with the exception above.
  2. Same server, bare connection string, PLC4J 0.13.1 -> connects and reads.
Version
  • PLC4J 1.0.0 (org.apache.plc4x:plc4j-driver-opcua:1.0.0, Maven Central)
  • JDK: Eclipse Temurin 21.0.9, Windows 10 x64
  • Worked in: 0.13.1
Programming Languages

Java

Protocols

OPC-UA

Expected behaviour

Either the driver should not require a serverCertificate when the negotiated endpoint security policy is None (that channel is unauthenticated by definition and the user explicitly asked for it), or an explicit connection parameter should allow connecting to a certificate-less server. As it stands there is no supported client-side workaround, so upgrading 0.13.1 -> 1.0.0 removes connectivity to every certificate-less server.

Related 1.0.0 regression in the same policy-None code path: #2791.

Lenguaje dominante
Java
Estrellas
1.8k
Forks
514
Merge medio
2 d 2 h
PR fusionados (30 d)
34

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de apache/plc4x

Todos los issues de apache/plc4x

Issues similares

Más issues de Java

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.