Skip to content
This repository was archived by the owner on Apr 2, 2026. It is now read-only.

Security: php-opcua/opcua-test-suite

Security

docs/security.md

Security & Certificates

Security Policies

OPC UA security policies define the cryptographic algorithms used for signing and encryption.

Policy OPC UA URI Suffix Status Key Size
None #None Current N/A
Basic128Rsa15 #Basic128Rsa15 Deprecated 1024-2048 bit
Basic256 #Basic256 Deprecated 1024-2048 bit
Basic256Sha256 #Basic256Sha256 Current 2048-4096 bit
Aes128_Sha256_RsaOaep #Aes128_Sha256_RsaOaep Current 2048-4096 bit
Aes256_Sha256_RsaPss #Aes256_Sha256_RsaPss Current 2048-4096 bit

Security Modes

Mode Description
None No signing, no encryption. Messages sent in plaintext.
Sign Messages are signed (integrity) but not encrypted. Content is readable on the wire.
SignAndEncrypt Messages are both signed and encrypted. Full confidentiality and integrity.

Policy + Mode Combinations

Not all combinations are valid:

None Sign SignAndEncrypt
None Valid (no security) Invalid Invalid
Basic128Rsa15 Invalid Valid Valid
Basic256 Invalid Valid Valid
Basic256Sha256 Invalid Valid Valid
Aes128_Sha256_RsaOaep Invalid Valid Valid
Aes256_Sha256_RsaPss Invalid Valid Valid

None/None is the only valid combination with None policy. All other policies require Sign or SignAndEncrypt.

Certificate Infrastructure

All certificates are generated automatically by the certs-generator Docker container on first startup. They are stored in a shared Docker volume (certs-volume) mounted at /app/certs/ inside each container.

Certificate Authority (CA)

File Description
certs/ca/ca-cert.pem Root CA certificate (PEM format)
certs/ca/ca-key.pem Root CA private key

The CA signs the server and client certificates, establishing a trust chain.

Server Certificate

File Description
certs/server/cert.pem Server certificate (PEM) — signed by CA
certs/server/key.pem Server private key (PEM)
certs/server/cert.der Server certificate (DER binary format)
certs/server/key.der Server private key (DER binary format)

Subject Alternative Names (SAN):

URI:  urn:opcua:test-server:OPCUATestServer
DNS:  localhost
      opcua-no-security
      opcua-userpass
      opcua-certificate
      opcua-all-security
      opcua-discovery
      opcua-auto-accept
      opcua-sign-only
      opcua-legacy-security
IP:   127.0.0.1
      0.0.0.0

The SAN includes all Docker service names so that certificate validation succeeds both from the host (via localhost) and between containers (via service names).

Client Certificate (Trusted)

Use these when testing certificate-based authentication:

File Description
certs/client/cert.pem Client certificate (PEM) — signed by CA, trusted by server
certs/client/key.pem Client private key (PEM)
certs/client/cert.der Client certificate (DER format)
certs/client/key.der Client private key (DER format)

Self-Signed Certificate (Untrusted)

Use this to test certificate rejection:

File Description
certs/self-signed/cert.pem Self-signed certificate — NOT signed by the CA
certs/self-signed/key.pem Corresponding private key

Connecting with this certificate should be rejected by servers that validate certificates (all except opcua-auto-accept).

Expired Certificate

Use this to test expiration validation:

File Description
certs/expired/cert.pem Certificate with past expiration date
certs/expired/key.pem Corresponding private key

Connecting with this certificate should be rejected with a BadCertificateTimeInvalid error.

Trust Directories

Path Description
certs/trusted/ Client certificates that the server trusts. The CA-signed client cert is copied here at startup.
certs/rejected/ Certificates that were rejected. Servers may move unknown certs here for manual review.

Certificate Trust Flow

CA (ca-cert.pem)
├── signs ──► Server cert (server/cert.pem)    ✓ Trusted
├── signs ──► Client cert (client/cert.pem)    ✓ Trusted
│
├── self-signed/cert.pem                       ✗ NOT trusted (different issuer)
└── expired/cert.pem                           ✗ NOT trusted (expired)

Testing Security

Discovering endpoints

Connect to any server → call GetEndpoints()
Each endpoint descriptor contains:
  - endpointUrl
  - securityPolicyUri
  - securityMode
  - userIdentityTokens (list of accepted auth methods)

Testing all policies on one server

Use opcua-all-security (port 4843) which has all 6 policies and all 3 modes enabled. This generates 11 endpoint combinations (6 policies × 2 secure modes + 1 None/None).

Testing deprecated policies

Use opcua-legacy-security (port 4847) which only offers Basic128Rsa15 and Basic256. Your client should ideally log a warning when using these.

Testing Sign vs SignAndEncrypt

  • opcua-sign-only (4846): only Sign mode — messages are signed but readable
  • opcua-userpass (4841): only SignAndEncrypt — messages are fully encrypted
  • Compare behavior and verify your client handles both correctly

Auto-accept behavior

opcua-auto-accept (port 4845) has autoAcceptCerts=true. Any client certificate is accepted, even unknown ones. Use this for quick testing without certificate setup.

There aren't any published security advisories