Unable to connect to KEPServerEX with Encryption, Username, and Password

[JamesTann]

I am new to opcua-asyncio and am trying to connect to a local KEPServerEX instance.

Here is my configuration:

I also created a user to use with a password called "UAExpert":

Using this configuration, I can connect with UA Expert (after trusting the client cert):

Now I want to connect with Python. I generated a client cert using openssl to use with opcua-asyncio, and imported it as a trusted client certificate into KEPServerEX. This is the file I used to generate the cert:

[ req ]
default_bits        = 2048
default_keyfile     = server-key.pem
distinguished_name  = subject
req_extensions      = req_ext
x509_extensions     = x509_ext
string_mask         = utf8only

[ subject ]
countryName         = Country Name (2 letter code)
countryName_default     = US
stateOrProvinceName     = State or Province Name (full name)
stateOrProvinceName_default = NY
localityName            = Locality Name (eg, city)
localityName_default        = New York
organizationName         = Organization Name (eg, company)
organizationName_default    = Example, LLC
commonName          = Common Name (e.g. server FQDN or YOUR name)
commonName_default      = Example LLC
emailAddress            = Email Address
emailAddress_default        = [email protected]

[ x509_ext ]
subjectAltName = @alt_names

[ req_ext ]
subjectAltName = @alt_names

[ alt_names ]
DNS.1   = jt_xps
URI.1   = urn:freeopcua:client

And these are the commands I ran:

openssl req -x509 -nodes -sha256 -days 365 -newkey rsa:2048 -keyout key.pem -out cert.pem -config ./certs/openssl.cnf
openssl x509 -outform der -in cert.pem -out certificate.cer

Finally, this is the code I tried:

cert = "certificate.cer"
private_key = "key.pem"
await client.set_security(
    policy=SecurityPolicyBasic256Sha256,
    certificate=cert,
    private_key=private_key,
)

await client.load_client_certificate(cert)
await client.load_private_key(Path(private_key))

client.set_user("UAExpert")
client.set_password("mypassword12345")

But when I call client.activate_session(), I get this strange error:

Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "C:\Users\jdt10\Documents\Github\integrations\app\main.py", line 106, in <module>
    asyncio.run(main())
  File "C:\Users\jdt10\.conda\envs\integrations\Lib\asyncio\runners.py", line 194, in run
    return runner.run(main)
           ^^^^^^^^^^^^^^^^
  File "C:\Users\jdt10\.conda\envs\integrations\Lib\asyncio\runners.py", line 118, in run
    return self._loop.run_until_complete(task)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\jdt10\.conda\envs\integrations\Lib\asyncio\base_events.py", line 684, in run_until_complete
    return future.result()
           ^^^^^^^^^^^^^^^
  File "C:\Users\jdt10\Documents\Github\integrations\app\main.py", line 72, in main
    await client.activate_session()
  File "C:\Users\jdt10\.conda\envs\integrations\Lib\site-packages\asyncua\client\client.py", line 631, in activate_session  
    return await self.uaclient.activate_session(params)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\jdt10\.conda\envs\integrations\Lib\site-packages\asyncua\client\ua_client.py", line 346, in activate_session
    data = await self.protocol.send_request(request)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\jdt10\.conda\envs\integrations\Lib\site-packages\asyncua\client\ua_client.py", line 167, in send_request   
    data = await asyncio.wait_for(self._send_request(request, timeout, message_type), timeout if timeout else None)
                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\jdt10\.conda\envs\integrations\Lib\site-packages\asyncua\client\ua_client.py", line 150, in _send_request  
    msg = self._connection.message_to_binary(binreq, message_type=message_type, request_id=self._request_id)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\jdt10\.conda\envs\integrations\Lib\site-packages\asyncua\common\connection.py", line 322, in message_to_binary
    chunks = MessageChunk.message_to_chunks(
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\jdt10\.conda\envs\integrations\Lib\site-packages\asyncua\common\connection.py", line 180, in message_to_chunks
    max_size = MessageChunk.max_body_size(crypto, max_chunk_size)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\jdt10\.conda\envs\integrations\Lib\site-packages\asyncua\common\connection.py", line 155, in max_body_size 
    max_plain_size = (max_encrypted_size // crypto.encrypted_block_size()) * crypto.plain_block_size()
                                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\jdt10\.conda\envs\integrations\Lib\site-packages\asyncua\crypto\security_policies.py", line 144, in encrypted_block_size
    return self.Encryptor.encrypted_block_size()
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute 'encrypted_block_size'

I am sure I am making a novice mistake somewhere, but I am struggling to find it. Maybe someone else has gone through this in the past?

[JamesTann]

I was able to eventually figure out my issue through some trial and error. This was my result:

    # paths to certificate and private key
    cert_base = Path(__file__).parent.parent / "certs"
    cert = Path(cert_base / "public" / "cert.der")
    private_key = Path(cert_base / "private" / "key.pem")

    # configure the client
    client = Client(url=settings.opcua_url)
    client.set_user(settings.opcua_username)
    client.set_password(settings.opcua_password)
    client.application_uri = CLIENT_APP_URI
    await client.set_security(
        SecurityPolicyBasic256Sha256,
        certificate=str(cert),
        private_key=str(private_key),
    )

    # load the trust store
    trust_store = TrustStore([Path(__file__).parent / "certs"], [])
    await trust_store.load()
    validator = CertificateValidator(
        CertificateValidatorOptions.BASIC_VALIDATION,
        trust_store,
    )
    client.certificate_validator = validator