OPC UA Driver Setting - Geo SCADA 2021 Rel. Feb 2022

[justinoj]

Hi Experts,

I'm new to OPC UA in Geo SCADA, trying to establish comms with a OPC UA Server (Kepware) for testing.

Test set up has both OPC Server (Kepware) and OPC client (Geo SCADA) in same network running on different PCs. I've tested the comms with Matrikon OPC UA on the client PC (where GeoSCADA installed) and works perfectly fine. This proves OPC Server is good. Please advise from the below snapshot what could be wrong with OPC UA Server setting, I'm receiving an API error as shown in below snapshot.

[justinoj · Accepted solution]

Hi Experts, 

I discovered that I did not have discovery server configured. Posting below the snapshots of the working sample. 

Added discovery server and entered the OPC UA Endpoint URL here.

Browse the discovery server from Server URL field.. Then browse the endpoint URL which has security access options such as None, Basic128Rsa15, Basic 256 etc..

Thanks,

Justin

[DJO74]

Does is it also work with certificates? We cannot get it working.

[Abed]

That is true. I cannot get it working with Endpoint rather than None - None.

I already opened a case with support team.

[DJO74]

Could you keep me posted, because I raised a support question also but have not yet found the solution.

[MarkPitout]

I am also curious about using certificates with the OPC-UA driver in Geo SCADA. I have no problem connecting Geo SCADA to an M580 BMENUA0100 server, without security. But, when I enable security and need to use certificates, I cannot get it working.

[MarkPitout]

With the help of a colleague in the UK, I managed to get Geo SCADA talking to my M580 BMENUA OPC-UA server, using certificates and with user authentication. 

The certificate used by Geo SCADA has to be crafted in a very way for it to work. I will summarize the steps it takes to make it work and post it here - perhaps the same steps will help other users. 

[Abed]

Hi,

Good to hear that. We’re in a very critical situation with the customer and we need to get it work with certificate and user authentication.

I’ll be waiting your summarized steps may it solve our issue with the customer.

Thanks in Advance!

[MarkPitout · Accepted solution]

Right, I have certificates in Geo SCADA working with Kepware OPC-UA as well. I will eventually put together a document describing the full process, but in the meantime I think the major sticking point is generating the certificate and key used by Geo SCADA correctly. so I will briefly explain that process here.

Side note: I've tested with three different OPC-UA servers: EcoStruxure OPC-UA Server Expert, the BMENUA0100 coms card of the M580 ePAC and now Kepware. Of the three, Kepware is the strictest in evaluating the certificates - it requires not only that the certificates match, but also that the OPC-UA application uri declared by the client and the hostname of the computer hosting the client are accurately declared in the certificate. It appears that both the BMENUA0100 card and EcoStruxure OPC-UA Server Expert software don't impose this extra burden, and simply validates that the certificate received matches one in their trusted certificates stores.

How to make a certificate and key for Geo SCADA that is acceptable by Kepware:

1. Have OpenSSL installed. A Windows installer can be found at this site: https://slproweb.com/products/Win32OpenSSL.html !!! Note: this is a third party installer of OpenSSL. I take no responsibility for it !!!  

2. Have the bin folder of OpenSSL declared in the PATH environment variable of your user account. In my case the path is "C:\Program Files\OpenSSL-Win64\bin"

3. Create a folder somewhere that you can reach easily in a command prompt. Say, for example: "C:\Certficate"

4. Create a new text file in that folder and rename it to "openssl.cnf".

5. Edit "openssl.cnf" in notepad, and paste the following text in it:

[ req ]
default_bits = 2048
default_keyfile = key.pem
distinguished_name = subject
req_extensions = req_ext
x509_extensions = x509_ext
string_mask = utf8only
prompt = no

[ subject ]
countryName = <your country>
localityName = <your city>
organizationName = <your company name>
organizationalUnitName = <your organizational unit name>
domainComponent = SchneiderElectric:ClearSCADA
commonName = GeoSCADA

[ x509_ext ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment, nonRepudiation
subjectAltName = @alternate_names
nsComment = "OpenSSL Generated Certificate"
extendedKeyUsage = serverAuth,clientAuth

[ req_ext ]
# Nothing in this section...

[ alternate_names ]
DNS.1 = <host name of the Geo SCADA server>
URI.1 = urn:GeoSCADA:SchneiderElectric:ClearSCADA

#Obviously edit this text to suite your scenario (eg. your country, city, etc.), but specifically the Hostname of the Geo SCADA server is important.

6. Open a command prompt and change the working directory to the folder where you placed "openssl.cnf" and run the following three commands:

openssl req -x509 -newkey RSA:4096 -days 3650 -keyout key.pem -out cert.pem -sha256 -config openssl.cnf
openssl x509 -inform pem -in cert.pem -outform der -out cert.der
openssl rsa -inform pem -in key.pem -outform der -out key.der

#You will be asked for a password for the key.pem file - choose any four characters. It does not matter what the password is.

7. Upload the files "cert.der" and "key.der" into the SSL Certificate and Key object referenced by the the OPC-UA server object, in your Geo SCADA database. Also ensure that the Common Name configured in the OPC-UA Server object is "GeoSCADA".

8. Dissable and re-enable the OPC-UA server object. After it connects to Kepware, use the OPC-UA Configuration tool of Kepware to trust the certificate it received. Wait a few second and the connection should become healthy. 

[MarkPitout]

@Abed If you like, you can contact me on teams: mark.pitout@se.com

[sbeadle]

Thank you Mark.

The product test team are validating this - they have successfully got it to work with Kepware.

Expect an update to documentation.

[MarkPitout]

Note:

In the openssl.cnf file

After feedback from @Abed , remove this line

DNS.1 = <host name of the Geo SCADA server>

from the section [ alternate_names ].

This is required so that a pair (or trio) of redundant servers can all use the same certificate.

Alternatively, I think it could also be possible to put the following under the section [ alternate_names ]:

DNS.1 = <host name of the Geo SCADA server 1>

DNS.2 = <host name of the Geo SCADA server 2>

DNS.3 = <host name of the Geo SCADA server 3>

@sbeadle It would be nice if the product test team take a view on this.

[sbeadle]

Thanks Mark, we will review.

[Killultagh]

Can Schneider please provide documentation relating to Geo SCADA to OPC-UA connectivity (to Kepware)?

[pradipkate]

Hi sir, have you got such document? If yes then can you please provide , because Im facing same issue.

[sbeadle]

See this parent page: https://community.se.com/t5/Geo-SCADA-Knowledge-Base/OPC-UA-Driver-and-Server/ba-p/469566