Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

[Bug]: OPC-UA driver 1.0.0 fails against a certificate-less server even with security-policy=NONE (regression vs 0.13.1)

未关闭
  • 哪里不对？
#2,830 0 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

维护者通常 1 天内回复

@splatch 已经在做这个了。

开始于 2026年10月22日。

评估

这个 Issue 还没有评估数据。

描述

What happened?

With PLC4J 1.0.0 the OPC-UA driver cannot connect to an OPC UA server that presents no certificate, even when security-policy=NONE is requested. The connection is torn down during session activation with:

org.apache.plc4x.java.api.exceptions.PlcRuntimeException: The peer sent no certificate where one was required

The same server connects with no parameters at all on 0.13.1, so this is a regression introduced by the 1.0.0 security hardening.

Server shape: a small Python test server built with asyncua (asyncua.Server), no certificate configured, publishing a single SecurityPolicy None endpoint. Per OPC UA, with a None-policy endpoint the server sends no serverCertificate in the CreateSessionResponse — "policy None + no server certificate" is a legal, spec-conformant combination, and connecting to such a server is exactly what the v1.0.0 release notes describe as still supported: "... or ask for security-policy=NONE to accept an unprotected channel as before."

Root cause (read off plc4j-driver-opcua-1.0.0.jar with javap): SecureChannel.onConnectActivateSessionRequest(CreateSessionResponse) feeds CreateSessionResponse.getServerCertificate() to getX509CertificateChain(byte[]) unconditionally — there is no guard for the policy-None case:

SecureChannel.onConnectActivateSessionRequest(CreateSessionResponse):
  19: invokevirtual CreateSessionResponse.getServerCertificate()
  22: invokevirtual PascalByteString.getStringValue():byte[]
  25: invokestatic  SecureChannel.getX509CertificateChain(byte[])   // straight-line, no null/empty guard

and getX509CertificateChain(byte[]) throws when the byte array is null or empty. The certificate is therefore required on the session-activation path regardless of the negotiated security policy. The existing escape hatches only relax validation of a certificate that must still be present: tls.verify=false skips chain/hostname checks, allow-insecure-credentials=true only affects credential transmission — neither helps when the server sends no certificate at all.

Connection strings attempted (all fail)
Connection string Result
opcua:tcp://127.0.0.1:14840 (bare) IllegalArgumentException: Could not find endpoint matching client configuration. Tested [opc.tcp://kubernetes.docker.internal:14840/]. Was looking for ... http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256 messageSecurityModeSignAndEncrypt — expected, this is the documented 1.0.0 default-policy flip and the server only offers None
opcua:tcp://127.0.0.1:14840?security-policy=NONE PlcRuntimeException: The peer sent no certificate where one was required
opcua:tcp://127.0.0.1:14840?security-policy=NONE&tls.verify=false same
opcua:tcp://127.0.0.1:14840?security-policy=NONE&tls.verify=false&allow-insecure-credentials=true same
opcua:tcp://127.0.0.1:14840?security-policy=NONE&discovery=false same

The four parameterized forms all fail at the same point, right after the client logs Received open channel response 1, parsing it.

How to reproduce
  1. Start a certificate-less server (Python asyncua; with no certificate configured it publishes a None-only endpoint):
import asyncio
from asyncua import Server

async def main():
    server = Server()
    await server.init()
    server.set_endpoint("opc.tcp://0.0.0.0:14840/")
    # no certificate configured -> asyncua exposes a SecurityPolicy#None endpoint only
    await server.start()
    await asyncio.Event().wait()

asyncio.run(main())
  1. With PLC4J 1.0.0, connect with opcua:tcp://127.0.0.1:14840?security-policy=NONE -> fails during session activation with the exception above.
  2. Same server, bare connection string, PLC4J 0.13.1 -> connects and reads.
Version
  • PLC4J 1.0.0 (org.apache.plc4x:plc4j-driver-opcua:1.0.0, Maven Central)
  • JDK: Eclipse Temurin 21.0.9, Windows 10 x64
  • Worked in: 0.13.1
Programming Languages

Java

Protocols

OPC-UA

Expected behaviour

Either the driver should not require a serverCertificate when the negotiated endpoint security policy is None (that channel is unauthenticated by definition and the user explicitly asked for it), or an explicit connection parameter should allow connecting to a certificate-less server. As it stands there is no supported client-side workaround, so upgrading 0.13.1 -> 1.0.0 removes connectivity to every certificate-less server.

Related 1.0.0 regression in the same policy-None code path: #2791.

主要语言
Java
星标
1.8k
派生
514
平均合并
2 天 2 小时
30 天内合并 PR
34

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

apache/plc4x 的其他 Issue

查看 apache/plc4x 的全部 Issue

相似的 Issue

更多 Java Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。