Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Bug]: OPC-UA driver 1.0.0 fails against a certificate-less server even with security-policy=NONE (regression vs 0.13.1)

Aperta
  • Qualcosa non va?
#2,830 0 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@splatch ci sta già lavorando.

Dal 22/10/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

What happened?

With PLC4J 1.0.0 the OPC-UA driver cannot connect to an OPC UA server that presents no certificate, even when security-policy=NONE is requested. The connection is torn down during session activation with:

org.apache.plc4x.java.api.exceptions.PlcRuntimeException: The peer sent no certificate where one was required

The same server connects with no parameters at all on 0.13.1, so this is a regression introduced by the 1.0.0 security hardening.

Server shape: a small Python test server built with asyncua (asyncua.Server), no certificate configured, publishing a single SecurityPolicy None endpoint. Per OPC UA, with a None-policy endpoint the server sends no serverCertificate in the CreateSessionResponse — "policy None + no server certificate" is a legal, spec-conformant combination, and connecting to such a server is exactly what the v1.0.0 release notes describe as still supported: "... or ask for security-policy=NONE to accept an unprotected channel as before."

Root cause (read off plc4j-driver-opcua-1.0.0.jar with javap): SecureChannel.onConnectActivateSessionRequest(CreateSessionResponse) feeds CreateSessionResponse.getServerCertificate() to getX509CertificateChain(byte[]) unconditionally — there is no guard for the policy-None case:

SecureChannel.onConnectActivateSessionRequest(CreateSessionResponse):
  19: invokevirtual CreateSessionResponse.getServerCertificate()
  22: invokevirtual PascalByteString.getStringValue():byte[]
  25: invokestatic  SecureChannel.getX509CertificateChain(byte[])   // straight-line, no null/empty guard

and getX509CertificateChain(byte[]) throws when the byte array is null or empty. The certificate is therefore required on the session-activation path regardless of the negotiated security policy. The existing escape hatches only relax validation of a certificate that must still be present: tls.verify=false skips chain/hostname checks, allow-insecure-credentials=true only affects credential transmission — neither helps when the server sends no certificate at all.

Connection strings attempted (all fail)
Connection string Result
opcua:tcp://127.0.0.1:14840 (bare) IllegalArgumentException: Could not find endpoint matching client configuration. Tested [opc.tcp://kubernetes.docker.internal:14840/]. Was looking for ... http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256 messageSecurityModeSignAndEncrypt — expected, this is the documented 1.0.0 default-policy flip and the server only offers None
opcua:tcp://127.0.0.1:14840?security-policy=NONE PlcRuntimeException: The peer sent no certificate where one was required
opcua:tcp://127.0.0.1:14840?security-policy=NONE&tls.verify=false same
opcua:tcp://127.0.0.1:14840?security-policy=NONE&tls.verify=false&allow-insecure-credentials=true same
opcua:tcp://127.0.0.1:14840?security-policy=NONE&discovery=false same

The four parameterized forms all fail at the same point, right after the client logs Received open channel response 1, parsing it.

How to reproduce
  1. Start a certificate-less server (Python asyncua; with no certificate configured it publishes a None-only endpoint):
import asyncio
from asyncua import Server

async def main():
    server = Server()
    await server.init()
    server.set_endpoint("opc.tcp://0.0.0.0:14840/")
    # no certificate configured -> asyncua exposes a SecurityPolicy#None endpoint only
    await server.start()
    await asyncio.Event().wait()

asyncio.run(main())
  1. With PLC4J 1.0.0, connect with opcua:tcp://127.0.0.1:14840?security-policy=NONE -> fails during session activation with the exception above.
  2. Same server, bare connection string, PLC4J 0.13.1 -> connects and reads.
Version
  • PLC4J 1.0.0 (org.apache.plc4x:plc4j-driver-opcua:1.0.0, Maven Central)
  • JDK: Eclipse Temurin 21.0.9, Windows 10 x64
  • Worked in: 0.13.1
Programming Languages

Java

Protocols

OPC-UA

Expected behaviour

Either the driver should not require a serverCertificate when the negotiated endpoint security policy is None (that channel is unauthenticated by definition and the user explicitly asked for it), or an explicit connection parameter should allow connecting to a certificate-less server. As it stands there is no supported client-side workaround, so upgrading 0.13.1 -> 1.0.0 removes connectivity to every certificate-less server.

Related 1.0.0 regression in the same policy-None code path: #2791.

Lingua principale
Java
Stelle
1.8k
Fork
512
Merge medio
2g 2h
PR unite (30g)
34

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di apache/plc4x

Tutte le issue di apache/plc4x

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.