This interface contains methods to communicate with the OPC UA Global Discovery Server (GDS) using its information model for certificate management, making the work of assembling the proper OPC UA method parameters and retrieving the results. The methods allow getting certificate groups, requesting key pairs or certificate signing and obtaining the results, retrieving trust lists, and more.

In the OPC UA specifications, the functionality covered by this type is described in Part 12: Discovery and Global Services, in the section Certificate Management Overview.

You can obtain this interface e.g.:

• By calling the OpcLabs.EasyOpc.UA.IEasyUAClientExtension.AsCertificateManagementClient extension method on an OpcLabs.EasyOpc.UA.IEasyUAClient.
• By instantiating the EasyUACertificateManagementClientCore component.

Before deciding to use methods provided by this specialized client, it is recommended that you have a look at the OpcLabs.EasyOpc.UA.Application.IEasyUAClientServerApplication service, available from System.IServiceProvider.GetService(System.Type) method from the OpcLabs.EasyOpc.UA.IEasyUAClient interface. The client application service works on higher level, and conveniently combines several methods together to achieve the typically needed functionality related to GDS and certificate management in OPC UA.

The OPC UA Certificate Management Client is a specialized OPC UA client object providing access to certificate management (CM) information model of an OPC UA Global Discovery Server (GDS). In the OPC UA specifications, the functionality covered by this type is described in Part 12: Discovery and Global Services, in the section Certificate Management Overview.

This specialized client object can be derived from IEasyUAClient Interface using the AsCertificateManagementClient Extension Method, or it can be created standalone as EasyUACertificateManagementClient Component.

This interface contains methods to communicate with the OPC UA Global Discovery Server (GDS) using its information model for certificate management, making the work of assembling the proper OPC UA method parameters and retrieving the results. The methods allow getting certificate groups, requesting key pairs or certificate signing and obtaining the results, retrieving trust lists, and more.

Available methods are:

• BrowseCertificateGroups Method. Browses the certificate groups available in the Certificate Management information model.
• BrowseCertificateTypeTree Method. Browses the certificate types available in the Certificate Manager.
• FinishRequest Method. Finishes a certificate request started with a call to StartNewKeyPairRequest Method or StartSigningRequest Method.
• GetCertificateGroupElement Method. Returns the certificate group element for a given certificate group Id.
• GetCertificateGroupIds Method. Returns Ids of the certificate groups assigned to application.
• GetCertificateStatus Method. Checks if an application needs to update its certificate.
• GetTrustList Method. Retrieves the node ID of a trust list assigned to an application.
• StartNewKeyPairRequest Method. Starts a request for a new certificate and private key. The certificate and private key are returned in the FinishRequest response.
• StartSigningRequest Method.  Initiates a request to create a certificate which uses the private key which the caller currently has. The new certificate is returned in the FinishRequest response.

There are also helper classes are available that relate to certificate management:

• UACertificateGroupIds Class. A class that declares constants for certificate group Ids.
• UACertificateTypeIds Class. A class that declares constants for certificate type Ids.

.NET

COM

// Shows how to check if an application needs to update its certificate.

using System;
using OpcLabs.EasyOpc.UA;
using OpcLabs.EasyOpc.UA.AddressSpace;
using OpcLabs.EasyOpc.UA.Application;
using OpcLabs.EasyOpc.UA.Extensions;
using OpcLabs.EasyOpc.UA.Gds;
using OpcLabs.EasyOpc.UA.OperationModel;

namespace UADocExamples.Gds._EasyUACertificateManagementClient
{
    class GetCertificateStatus
    {
        public static void Main1()
        {
            // Define which GDS we will work with.
            UAEndpointDescriptor gdsEndpointDescriptor = 
                ((UAEndpointDescriptor)"opc.tcp://opcua.demo-this.com:58810/GlobalDiscoveryServer")
                .WithUserNameIdentity("appadmin", "demo");

            // Register our client application with the GDS, so that we obtain an application ID that we need later.
            // Obtain the application interface.
            EasyUAApplication application = EasyUAApplication.Instance;
            UANodeId applicationId;
            try
            {
                applicationId = application.RegisterToGds(gdsEndpointDescriptor);
            }
            catch (UAException uaException)
            {
                Console.WriteLine("*** Failure: {0}", uaException.GetBaseException().Message);
                return;
            }
            Console.WriteLine("Application ID: {0}", applicationId);

            // Instantiate the certificate management client object
            var certificateManagementClient = new EasyUACertificateManagementClient();

            // Check if the application needs to update its certificate.
            bool updateRequired;
            try
            {
                updateRequired = certificateManagementClient.GetCertificateStatus(gdsEndpointDescriptor, applicationId,
                    UANodeId.Null, UANodeId.Null);
            }
            catch (UAException uaException)
            {
                Console.WriteLine("*** Failure: {0}", uaException.GetBaseException().Message);
                return;
            }

            // Display results
            Console.WriteLine("Update required: {0}", updateRequired);
        }


        // Example output:
        //Application ID: nsu=http://opcfoundation.org/UA/GDS/applications/ ;ns=2;g=aec94459-f513-4979-8619-8383555fca61
        //Update required: False
    }
}

# Shows how to check if an application needs to update its certificate.

# The QuickOPC package is needed. Install it using "pip install opclabs_quickopc".
import opclabs_quickopc

# Import .NET namespaces.
from OpcLabs.EasyOpc.UA import *
from OpcLabs.EasyOpc.UA.AddressSpace import *
from OpcLabs.EasyOpc.UA.Application import *
from OpcLabs.EasyOpc.UA.Extensions import *
from OpcLabs.EasyOpc.UA.Gds import *
from OpcLabs.EasyOpc.UA.OperationModel import *


# Define which GDS we will work with.
gdsEndpointDescriptor = UAEndpointDescriptor('opc.tcp://opcua.demo-this.com:58810/GlobalDiscoveryServer')
gdsEndpointDescriptor = UAEndpointDescriptorExtension.WithUserNameIdentity(gdsEndpointDescriptor,
                                                                           'appadmin', 'demo')

# Register our client application with the GDS, so that we obtain an application ID that we need later.
# Obtain the application interface.
application = EasyUAApplication.Instance
try:
    print('Registering to GDS...')
    applicationId = application.RegisterToGds(gdsEndpointDescriptor)
except UAException as uaException:
    print('*** Failure: ' + uaException.GetBaseException().Message)
    exit()
print('Application ID: ', applicationId, sep='')

# Instantiate the certificate management client object.
certificateManagementClient = EasyUACertificateManagementClient()

# Check if the application needs to update its certificate.
try:
    updateRequired = certificateManagementClient.GetCertificateStatus(gdsEndpointDescriptor,
                                                                      applicationId,
                                                                      UANodeId.Null,    # certificateGroupId
                                                                      UANodeId.Null)    # certificateTypeId
except UAException as uaException:
    print('*** Failure: ' + uaException.GetBaseException().Message)
    exit()

# Display results.
print('Update required: ', updateRequired, sep='')

print()
print('Finished.')

' Shows how to check if an application needs to update its certificate.

Imports Microsoft.Extensions.DependencyInjection
Imports OpcLabs.EasyOpc.UA
Imports OpcLabs.EasyOpc.UA.AddressSpace
Imports OpcLabs.EasyOpc.UA.Application
Imports OpcLabs.EasyOpc.UA.Application.ComTypes
Imports OpcLabs.EasyOpc.UA.Extensions
Imports OpcLabs.EasyOpc.UA.Gds
Imports OpcLabs.EasyOpc.UA.OperationModel

Namespace Gds._EasyUACertificateManagementClient
    Friend Class GetCertificateStatus
        Public Shared Sub Main1()

            ' Define which GDS we will work with.
            Dim gdsEndpointDescriptor As UAEndpointDescriptor =
                New UAEndpointDescriptor("opc.tcp://opcua.demo-this.com:58810/GlobalDiscoveryServer") _
                .WithUserNameIdentity("appadmin", "demo")

            ' Register our client application with the GDS, so that we obtain an application ID that we need later.
            ' Obtain the application interface.
            Dim application = EasyUAApplication.Instance

            ' Create an application registration in the GDS, assigning it a new application ID.
            Dim applicationId As UANodeId
            Try
                applicationId = application.RegisterToGds(gdsEndpointDescriptor)
            Catch uaException As UAException
                Console.WriteLine("*** Failure: {0}", uaException.GetBaseException.Message)
                Exit Sub
            End Try

            ' Instantiate the certificate management client object
            Dim certificateManagementClient = New EasyUACertificateManagementClient()

            ' Check if the application needs to update its certificate.
            Dim updateRequired As Boolean
            Try
                updateRequired = certificateManagementClient.GetCertificateStatus(gdsEndpointDescriptor, applicationId,
                    UANodeId.Null, UANodeId.Null)
            Catch uaException As UAException
                Console.WriteLine("*** Failure: {0}", uaException.GetBaseException.Message)
                Exit Sub
            End Try

            ' Display results
            Console.WriteLine("Update required: {0}", updateRequired)
        End Sub
    End Class
End Namespace

// Shows how to check if an application needs to update its certificate.

class procedure GetCertificateStatus.Main;
var
  Application: TEasyUAApplication;
  ApplicationId: _UANodeId;
  CertificateManagementClient: OpcLabs_EasyOpcUA_TLB._EasyUACertificateManagementClient;
  GdsEndpointDescriptor: _UAEndpointDescriptor;
  NullNodeId: _UANodeId;
  UpdateRequired: boolean;
begin
  // Define which GDS we will work with.
  GdsEndpointDescriptor := CoUAEndpointDescriptor.Create;
  GdsEndpointDescriptor.UrlString := 'opc.tcp://opcua.demo-this.com:58810/GlobalDiscoveryServer';
  GdsEndpointDescriptor.UserIdentity.UserNameTokenInfo.UserName := 'appadmin';
  GdsEndpointDescriptor.UserIdentity.UserNameTokenInfo.Password := 'demo';

  // Register our client application with the GDS, so that we obtain an application ID that we need later.
  // Obtain the application interface.
  Application := TEasyUAApplication.Create(nil);

  // Create an application registration in the GDS, assigning it a new application ID.
  try
    ApplicationId := Application.RegisterToGds(GdsEndpointDescriptor);
  except
    on E: EOleException do
    begin
      WriteLn(Format('*** Failure: %s', [E.GetBaseException.Message]));
    end;
  end;

  WriteLn('Application ID: ', ApplicationId.ToString);

  // Instantiate the certificate management client object
  CertificateManagementClient := CoEasyUACertificateManagementClient.Create;

  // Check if the application needs to update its certificate.
  NullNodeId := CoUANodeId.Create;
  UpdateRequired := false;
  try
    UpdateRequired := CertificateManagementClient.GetCertificateStatus(GdsEndpointDescriptor, ApplicationId, NullNodeId, NullNodeId);
  except
    on E: EOleException do
    begin
      WriteLn(Format('*** Failure: %s', [E.GetBaseException.Message]));
    end;
  end;

  // Display results
  WriteLn('Update required: ', UpdateRequired);

  // Example output:
  //Application ID: nsu=http://opcfoundation.org/UA/GDS/applications/ ;ns=2;g=aec94459-f513-4979-8619-8383555fca61
  //Update required: FALSE

end;

Rem Shows how to check if an application needs to update its certificate.

Private Sub EasyUACertificateManagementClient_GetCertificateStatus_Main_Command_Click()
    OutputText = ""
        
    ' Define which GDS we will work with.
    Dim gdsEndpointDescriptor As New UAEndpointDescriptor
    gdsEndpointDescriptor.UrlString = "opc.tcp://opcua.demo-this.com:58810/GlobalDiscoveryServer"
    gdsEndpointDescriptor.UserIdentity.UserNameTokenInfo.UserName = "appadmin"
    gdsEndpointDescriptor.UserIdentity.UserNameTokenInfo.Password = "demo"
    
    ' Register our client application with the GDS, so that we obtain an application ID that we need later.
    ' Obtain the application interface
    Dim Application As New EasyUAApplication
    
    ' Create an application registration in the GDS, assigning it a new application ID.
    On Error Resume Next
    Dim applicationId As UANodeId
    Set applicationId = Application.RegisterToGds(gdsEndpointDescriptor)
    If Err.Number <> 0 Then
        OutputText = OutputText & "*** Failure: " & Err.Source & ": " & Err.Description & vbCrLf
        Exit Sub
    End If
    On Error GoTo 0

    OutputText = OutputText & "Application ID: " & applicationId & vbCrLf

    ' Instantiate the certificate management client object
    Dim certificateManagementClient As New EasyUACertificateManagementClient
    
    ' Check if the application needs to update its certificate.
    Dim nullNodeId As New UANodeId
    Dim updateRequired As Boolean: updateRequired = False
    On Error Resume Next
    updateRequired = certificateManagementClient.GetCertificateStatus(gdsEndpointDescriptor, applicationId, nullNodeId, nullNodeId)
    If Err.Number <> 0 Then
        OutputText = OutputText & "*** Failure: " & Err.Source & ": " & Err.Description & vbCrLf
        Exit Sub
    End If
    On Error GoTo 0

    ' Display results
    OutputText = OutputText & "Update required: " & updateRequired & vbCrLf

    ' Example output:
    'Application ID: nsu=http://opcfoundation.org/UA/GDS/applications/ ;ns=2;g=aec94459-f513-4979-8619-8383555fca61
    'Update required: FALSE
End Sub

Rem Shows how to check if an application needs to update its certificate.

Option Explicit

' Define which GDS we will work with.
Dim GdsEndpointDescriptor: Set GdsEndpointDescriptor = CreateObject("OpcLabs.EasyOpc.UA.UAEndpointDescriptor")
GdsEndpointDescriptor.UrlString = "opc.tcp://opcua.demo-this.com:58810/GlobalDiscoveryServer"
GdsEndpointDescriptor.UserIdentity.UserNameTokenInfo.UserName = "appadmin"
GdsEndpointDescriptor.UserIdentity.UserNameTokenInfo.Password = "demo"

' Register our client application with the GDS, so that we obtain an application ID that we need later.
' Obtain the application interface.
Dim Application: Set Application = CreateObject("OpcLabs.EasyOpc.UA.Application.EasyUAApplication")
On Error Resume Next
Dim ApplicationId: Set ApplicationId = Application.RegisterToGds(GdsEndpointDescriptor)
If Err.Number <> 0 Then
    WScript.Echo "*** Failure: " & Err.Source & ": " & Err.Description
    WScript.Quit
End If
On Error Goto 0
WScript.Echo "Application ID: " & ApplicationId

' Instantiate the certificate management client object
Dim CertificateManagementClient: Set CertificateManagementClient = _
    CreateObject("OpcLabs.EasyOpc.UA.Gds.EasyUACertificateManagementClient")

' Check if the application needs to update its certificate.
Dim NullNodeId: Set NullNodeId = CreateObject("OpcLabs.EasyOpc.UA.AddressSpace.UANodeId")
On Error Resume Next
Dim UpdateRequired: UpdateRequired = CertificateManagementClient.GetCertificateStatus( _
    GdsEndpointDescriptor, ApplicationId, NullNodeId, NullNodeId)
If Err.Number <> 0 Then
    WScript.Echo "*** Failure: " & Err.Source & ": " & Err.Description
    WScript.Quit
End If
On Error Goto 0

' Display results
WScript.Echo "Update required: " & UpdateRequired


' Example output:
'Application ID: nsu=http://opcfoundation.org/UA/GDS/applications/ ;ns=2;g=aec94459-f513-4979-8619-8383555fca61
'Update required: False

Target Platforms: .NET Framework: Windows 10 (selected versions), Windows 11 (selected versions), Windows Server 2016, Windows Server 2022; .NET: Linux, macOS, Microsoft Windows