How to find key.pem in order to connect to my server

[AlexKolydas]

Hello. I am new to this so forgive me if it's something simple.
So i want to connect to my UPS1600 machine with OPCUA and check it's status. I am using this code:

async def main():
    client = opcua.Client("opc.tcp://<IP_UPS>:4840", timeout=60)
    client.set_security_string("Basic256Sha256,SignAndEncrypt,certificate_that_uaexpert_uses.der ,key.pem")
    client.application_uri = "urn:<uri>:UPS1600" 
    await client.connect()

I checked which certificate the UAExpert uses and i am using the same in my python script. But where can i find the key.pem file?
If i run my current code i got this:

Received an error: MessageAbort(error:StatusCode(BadCertificateInvalid), reason:None) Received an error: MessageAbort(error:StatusCode(BadCertificateInvalid), reason:None) Protocol Error Traceback (most recent call last): ... File "C:\Program Files\Python39\lib\site-packages\opcua\client\ua_client.py", line 129, in _call_callback raise ua.UaError( opcua.ua.uaerrors._base.UaError: No future object found for request: 0, callbacks in list are dict_keys([1]) exception calling callback for <Future at 0x1ee61977550 state=cancelled> Traceback (most recent call last): ... concurrent.futures._base.TimeoutError

UAExpert connects normally. No issues

[AndreasHeine]

currently you try to travel with a stolen passport... ^^

each opc ua application needs a own pkey and certificate which matches the client settings (application uri, ip...) so the other side of the connection can check if you are who you claim to be!
you need to create your own self signed x509v3 cert with openssl!

ref: https://github.com/FreeOpcUa/python-opcua/blob/master/examples/generate_certificate.sh

[AlexKolydas]

Ok so probably the issue is because i don't have the key.pem file (?). Is there any way to create just the key from this certificate? Is the generate_certificate.sh applicable somehow?

[AndreasHeine]

private-key.pem comes first! and with that p-key you create the cert.pem! not the other way around...

in order to make it work you need create both!
you can use the generate_certificate.sh
or
there is an very old repo of me:
https://github.com/AndreasHeine/SecurePythonOpcUaClient/tree/master/x509v3

Generate your own Certificate
Step 1: Change ssl.conf (subjectAltname, country, organizationName, ...)
Step 2: openssl genrsa -out key.pem 2048
Step 3: openssl req -x509 -days 365 -new -out certificate.pem -key key.pem -config ssl.conf

[AlexKolydas]

Could you please help me with generate_certificate.sh? I'm really sorry but not sure how to work with it.

• What settings should i change?
• What the file will look like?
• Do i just double click on it and it will generate .der and .pem files?

Here are the settings from Softing OPC UA app

Is this correct?

And then i double click on it? How to generate the files?
I'm deeply sorry for asking so many questions

[AndreasHeine]

<will_add_urn_from_uaexpert> thats not ok because it does not match your opcua client urn/uri...

for the generation you need to install openssl on your pc!
so you will have the openssl-cli available!

if you are on linux you can use the .sh file!

on windows you need to:
open command promt, cd to the location where the ssl.conf is
then
type openssl genrsa -out key.pem 2048 hit enter -> this should create the key
then
type openssl req -x509 -days 365 -new -out certificate.pem -key key.pem -config ssl.conf hit enter -> this should create a certificate which is valid for 365 days

use both files in you client and setup the clients application uri accroding to the uri in the cert!

[AlexKolydas]

oh thank you so much! I created them and i am able to connect to my device !!! Thank you so much for your time :)

My code looks like this now:

async def main():
    client = opcua.Client("opc.tcp://<ip>:4840", timeout=60)
    client.application_uri = "urn:<ip>:UPS1600"  # Should match in your certificate
    client.set_user("admin")
    client.set_password("admin")
    client.set_security_string("Basic256Sha256,SignAndEncrypt,files\\certificate.pem,files\\key.pem")
    client.connect()
    struct = client.get_node("ns=3;i=100191")
    before = struct.get_value()
    print(before)
    print("connected")


if __name__ == '__main__':
    asyncio.run(main())