View Issue Details

IDProjectCategoryView StatusLast Update
000466610000-004: ServicesSpecpublic2020-12-06 14:37
Reporterrandyarmstrong Assigned ToMatthias Damm  
PrioritynormalSeveritymajorReproducibilityalways
Status closedResolutionfixed 
Summary0004666: 6.1.3 Determining if a Certificate is Trusted is not consistent with Part 12
Description

The first paragraph should end with:

There are two separate lists: a list of trusted Certificates and a list of Certificate Authorities (CAs). The list of trusted Certificates may contain a Certificate issued to another Application or it may be a Certificate Authorities (CAs). If an application is not directly trusted (i.e. its Certificate is not in the list of trusted Certificates) then the application shall build a chain of Certificates back to a CA that has its Certificate in the list of trusted Certificates.

TagsNo tags attached.
Commit Version
Fix Due Date

Relationships

has duplicate 0006279 closedMatthias Damm Unclear certificate validation requirements 

Activities

randyarmstrong

2019-03-14 13:45

administrator   ~0010052

Added updates to: OPC UA Part 4 - Services Draft 1.05.02 Specification - ECC Updates-Mantis4666.docx

Matthias Damm

2020-03-04 21:38

developer   ~0011668

Updated text with the following:

6.1.3 Determining if a Certificate is trusted
Applications shall never communicate with another application that they do not trust. An Application decides if another application is trusted by checking whether the Application Instance Certificate for the other application is trusted. A Certificate is only trusted if its chain can be validated.
Applications shall rely on lists of Certificates provided by the Administrator to determine trust. There are two separate lists: a list of trusted Certificates and a list of issuer Certificates (i.e. CAs). The list of trusted Certificates may contain a Certificate issued to another Application or it may be a Certificate belonging to a CA. The list of issuer Certificates contains CA Certificates needed for chain validation that are not in the list of trusted Certificates.
When building a chain each Certificate in the chain shall be validated back to a CA with a self-signed Certificate (a.k.a. a root CA). If any validation error occurs then the trust check fails. Some validation errors are non-critical which means they can be suppressed by a user of an Application with the appropriate privileges. Suppressed validation errors are always reported via auditing (i.e. an appropriate Audit event is raised).
Determining trust requires access to all Certificates in the chain. These Certificates may be stored locally or they may be provided with the application Certificate. Processing fails with Bad_SecurityChecksFailed if an element in the chain cannot be found. A Certificate is trusted if the Certificate or at least one of the Certificates in the chain are in the list of trusted Certificates for the Application and the chain is valid.

Jim Luth

2020-03-04 22:03

administrator   ~0011671

Agreed to changes in Dallas meeting.

randyarmstrong

2020-07-07 12:21

administrator   ~0012556

Need 1.04 errata.

Matthias Damm

2020-09-15 17:56

developer   ~0012835

Added errata to 1.04.8

Jim Luth

2020-09-16 14:43

administrator   ~0012858

Agreed to changes in Virtual F2F.

Issue History

Date Modified Username Field Change
2019-03-09 03:20 randyarmstrong New Issue
2019-03-14 13:45 randyarmstrong Note Added: 0010052
2019-03-14 13:45 randyarmstrong Assigned To => Matthias Damm
2019-03-14 13:45 randyarmstrong Status new => assigned
2020-03-04 21:38 Matthias Damm Status assigned => resolved
2020-03-04 21:38 Matthias Damm Resolution open => fixed
2020-03-04 21:38 Matthias Damm Note Added: 0011668
2020-03-04 22:03 Jim Luth Status resolved => closed
2020-03-04 22:03 Jim Luth Fixed in Version => 1.05
2020-03-04 22:03 Jim Luth Note Added: 0011671
2020-07-07 12:21 randyarmstrong Status closed => assigned
2020-07-07 12:21 randyarmstrong Note Added: 0012556
2020-09-15 17:56 Matthias Damm Status assigned => resolved
2020-09-15 17:56 Matthias Damm Note Added: 0012835
2020-09-16 14:43 Jim Luth Status resolved => closed
2020-09-16 14:43 Jim Luth Note Added: 0012858
2020-12-06 14:37 Matthias Damm Relationship added has duplicate 0006279