Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

[Bug]: OPC-UA driver 1.0.0 fails against a certificate-less server even with security-policy=NONE (regression vs 0.13.1)

オープン
  • 何か問題がありますか？
#2,830 コメント 0 件 リアクション 0 件 担当者 1 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@splatch がすでに取り組んでいます。

2026年10月22日 から。

評価

この issue はまだ評価されていません。

説明

What happened?

With PLC4J 1.0.0 the OPC-UA driver cannot connect to an OPC UA server that presents no certificate, even when security-policy=NONE is requested. The connection is torn down during session activation with:

org.apache.plc4x.java.api.exceptions.PlcRuntimeException: The peer sent no certificate where one was required

The same server connects with no parameters at all on 0.13.1, so this is a regression introduced by the 1.0.0 security hardening.

Server shape: a small Python test server built with asyncua (asyncua.Server), no certificate configured, publishing a single SecurityPolicy None endpoint. Per OPC UA, with a None-policy endpoint the server sends no serverCertificate in the CreateSessionResponse — "policy None + no server certificate" is a legal, spec-conformant combination, and connecting to such a server is exactly what the v1.0.0 release notes describe as still supported: "... or ask for security-policy=NONE to accept an unprotected channel as before."

Root cause (read off plc4j-driver-opcua-1.0.0.jar with javap): SecureChannel.onConnectActivateSessionRequest(CreateSessionResponse) feeds CreateSessionResponse.getServerCertificate() to getX509CertificateChain(byte[]) unconditionally — there is no guard for the policy-None case:

SecureChannel.onConnectActivateSessionRequest(CreateSessionResponse):
  19: invokevirtual CreateSessionResponse.getServerCertificate()
  22: invokevirtual PascalByteString.getStringValue():byte[]
  25: invokestatic  SecureChannel.getX509CertificateChain(byte[])   // straight-line, no null/empty guard

and getX509CertificateChain(byte[]) throws when the byte array is null or empty. The certificate is therefore required on the session-activation path regardless of the negotiated security policy. The existing escape hatches only relax validation of a certificate that must still be present: tls.verify=false skips chain/hostname checks, allow-insecure-credentials=true only affects credential transmission — neither helps when the server sends no certificate at all.

Connection strings attempted (all fail)
Connection string Result
opcua:tcp://127.0.0.1:14840 (bare) IllegalArgumentException: Could not find endpoint matching client configuration. Tested [opc.tcp://kubernetes.docker.internal:14840/]. Was looking for ... http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256 messageSecurityModeSignAndEncrypt — expected, this is the documented 1.0.0 default-policy flip and the server only offers None
opcua:tcp://127.0.0.1:14840?security-policy=NONE PlcRuntimeException: The peer sent no certificate where one was required
opcua:tcp://127.0.0.1:14840?security-policy=NONE&tls.verify=false same
opcua:tcp://127.0.0.1:14840?security-policy=NONE&tls.verify=false&allow-insecure-credentials=true same
opcua:tcp://127.0.0.1:14840?security-policy=NONE&discovery=false same

The four parameterized forms all fail at the same point, right after the client logs Received open channel response 1, parsing it.

How to reproduce
  1. Start a certificate-less server (Python asyncua; with no certificate configured it publishes a None-only endpoint):
import asyncio
from asyncua import Server

async def main():
    server = Server()
    await server.init()
    server.set_endpoint("opc.tcp://0.0.0.0:14840/")
    # no certificate configured -> asyncua exposes a SecurityPolicy#None endpoint only
    await server.start()
    await asyncio.Event().wait()

asyncio.run(main())
  1. With PLC4J 1.0.0, connect with opcua:tcp://127.0.0.1:14840?security-policy=NONE -> fails during session activation with the exception above.
  2. Same server, bare connection string, PLC4J 0.13.1 -> connects and reads.
Version
  • PLC4J 1.0.0 (org.apache.plc4x:plc4j-driver-opcua:1.0.0, Maven Central)
  • JDK: Eclipse Temurin 21.0.9, Windows 10 x64
  • Worked in: 0.13.1
Programming Languages

Java

Protocols

OPC-UA

Expected behaviour

Either the driver should not require a serverCertificate when the negotiated endpoint security policy is None (that channel is unauthenticated by definition and the user explicitly asked for it), or an explicit connection parameter should allow connecting to a certificate-less server. As it stands there is no supported client-side workaround, so upgrading 0.13.1 -> 1.0.0 removes connectivity to every certificate-less server.

Related 1.0.0 regression in the same policy-None code path: #2791.

主要言語
Java
スター
1.8k
フォーク
514
平均マージ
2日 2時間
マージ済み PR（30日）
34

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

apache/plc4x のほかの issue

apache/plc4x の issue をすべて見る

似ている issue

Java の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。