The global certificate acceptance policy does not appear to be honored in v.
:
EasyUAClientCore.SharedParameters.EngineParameters.CertificateAcceptancePolicy.AcceptAnyCertificate = true
The server certificate is indeed missing the endpoint URI, however, this is tolerated in v. 5.83.477
We get the following error from the QuickOPC library in v. 5.84.192
PollItems: endpoint opc.tcp://xxxx, item yyy failed. Error: OpcLabs.UAEngine=1 UA SDK error (Opc.UA.ServiceResult=0x80170000) in 'static Session.Create'. OPC UA service result - {BadCertificateUriInvalid}. The Application in the EndpointDescription (urn:vmscada:zzz) is not in the Server Certificate (xxx). [80170000] 'The Application in the EndpointDescription (urn:vmscada:yyy) is not in the Server Certificate (zzz).'
+ Connection attempt #1; last connected at 1/1/0001 12:00:00 AM (local); unconnected for 00:00:00.0320000.
+ This error can be reported by the OPC-UA server if the client application URI has changed but an old application instance certificate was kept. Try to remove and recreate the application instance certificate.
at OpcLabs.BaseLib.Reflection.Extensions.MethodBaseExtension.FoldedInvoke(MethodBase methodBase, Object obj, Object[] parameters) at OpcLabs.EasyOpc.UA.Sdk.Shims.SessionShim.ValidateServerCertificateApplicationUri(X509Certificate2 serverCertificate, ConfiguredEndpoint endpoint) at OpcLabs.EasyOpc.UA.Sdk.Shims.SessionShim.Open2(String sessionName, UInt32 sessionTimeout, IUserIdentity identity, IList`1 preferredLocales, Boolean checkDomain, Boolean closeChannel) at OpcLabs.EasyOpc.UA.Sdk.Shims.SessionShim.Create(ApplicationConfiguration configuration, ConfiguredEndpoint endpoint, Boolean updateBeforeConnect, Boolean checkDomain, String sessionName, UInt32 millisecondsSessionTimeout, Func`2 identityFunction, IList`1 preferredLocales, Action`2 domainCheckError, Action`1 setupSession, Action`2 setupTransportChannel, CertificateIdentifier applicationCertificate, ICertificatePasswordProvider certificatePasswordProvider) at OpcLabs.EasyOpc.UA.Toolkit.Sdk.ToolkitSession.Create(ApplicationConfiguration configuration, ConfiguredEndpoint endpoint, Boolean updateBeforeConnect, Boolean checkDomain, String sessionName, UInt32 millisecondsSessionTimeout, Func`2 identityFunction, IList`1 preferredLocales, Action`2 domainCheckError, Action`1 setupSession, Action`2 setupTransportChannel, CertificateIdentifier applicationCertificate, ICertificatePasswordProvider certificatePasswordProvider, UAClientSessionBase clientSession)
Following (17) events were gathered during the action on activity ID [15], in the order of first occurrence:
SDK trace: 09/07/2026 15:53:25.116 Imported the PFX private key for [zzz] (with Private Key).
2*[44] Exception: {Opc.Ua.ServiceResultException} [801A0000] 'Certificate is not trusted.'
[44] SDK trace: 09/07/2026 15:53:25.358 Validation errors suppressed: [xxx],
We did multiple attempts to suppress the validation, including:
- setting per-endpoint certificate acceptance policy:
Code:
_endpointDescriptor = new UAEndpointDescriptor(settings.EndpointUrl);
var policy = new UACertificateAcceptancePolicy()
{
AcceptAnyCertificate = settings.AcceptAnyCertificate,
AllowUserAcceptCertificate = false,
};
policy.TrustEndpointUrlString(_endpointDescriptor.UrlString);
policy.TrustEndpointUrlString("urn:vmscada:xxx");
_endpointDescriptor.CertificateAcceptancePolicy = policy;
- using test policy:
None of the above suppress the validation.
Code:
policy = UACertificateAcceptancePolicy.TestingInsecure;
None of the above suppress the validation.
Questions:
- how we can suppress the validation error?
- why AcceptAnyCertificate property does not have the expected effect?
- if we’re using isolated client, does it make sense to configure global EasyUAClientCore.SharedParameters.EngineParameters.CertificateAcceptancePolicy, or should we set policy per endpoint?
