https://www.umh.app logo
Join Discord
Powered by
Phoenix Contacts PLCNext OPCUA Browser
# umh-support
t
Phoenix Contacts PLCNext OPCUA Browser Not Working?
Note, yes I know that the security policy can only be Basic256Sha256, I was just trying to see if anything is different if I change it....the error is the same...
It will read a variable with these settings...but still won't browse...
j
what ahppens if you dont select any secuirtymode? it should be able to auto-negotiate
@janikkn for you tomorrow as well 🙂
sorry for the time delay between US and Europe, the team just left an hour ago or something, and I'll do a grind night on umh core
t
I'll try
Input Validation didn't work without setting the security mode and policy....and neither did the browser....
j
ok, this is something for @janikkn to check tomorrow
haha, and I see you guys start to udnerstand our gorilla emoji 🦍
j
Can you try to Save & Deploy -> Save anyway and then check whether data is coming from tag browser ?
Oh an btw most important, you will need to check logs after deployment -> there will be a snippet sth like:
Copy code
securityPolicy: Basic256Sha256
securityMode: SignAndEncrypt
clientCertificate: <long base64-string>
`
if the server is not set to auto-approve client-certificates you will need to switch over to the server and trust this specific certificate
t
I can save and deploy...and it reads data....just doesn't browse...no matter if I do it while creating it initially, or after I save it.
d
can you browse the opcua server with another tool? (uaexpert)
i once used a tool that only browsed in ns=2; could it be that something like this is the issue? You have ns=6; That's something i personally have not seen before
t
Yes
Root i=84 Objects i=85 PLCNext nx=6;s=G:
j
ok meaning tags appear perfectly fine in tag-browser but not in opcua-browser before deploying, then i at least somehow know where this should come from. This is a bug we need to fix
t
Um, not sure I understand the question, the opcua browser never works for me with this controller....
But when I put in the tags to read using yaml, it reads them and I'm historiziing them fine.
They show up in the tag browser.
j
Does it work with any controller where you use encryption ?
t
um...good question...
j
so the securityPolicy
t
let me see...
actually it seems like the issue is user authentication.....I tried browsing my Omron NX102, allowing ananymous and "None" for security policy, and it works....but as soon as I prohibit Anonymous......even though my username is entered in the UMH web console....I get the errors... I went back and set security policy to none, and disabled user management on the PLCNext...and now it browses...
j
but the user credentials are definitely set up in the plc right ? I just want to make sure that this has either nothing to do with the securityPolicy or it's only that, now the question would be, what happens if you try anonymous connection with e.g. 
Basic256Sha256
t
ua expert requires the credentials....and yes they are setup....but when I turn off user authentication...and security policy none...it works
testing
I can't disable the PLCNext "None" policy with user authentication disabled...but in umh console, I set in yaml...and everything works...but I don't know for sure that it's using Basic256Sha256
Ok, so different issue with OmronNX102, everytime I go to browse, it submits a new certificate....I can't auto accept certificates.....so I go into the user interface and move it to "trusted"....but each time I re-attempt to browse.....it creates a new cert... https://cdn.discordapp.com/attachments/1366469856563826698/1366802768286978179/image.png?ex=681245c5&is=6810f445&hm=137e328f715d4556f24d05826bd488e95b8bdc399a7e01f7fde896bfc4b54056&
so I'm stuck chasing my tail...trying to trust certs....but it's always creating a new one...
NX102, works fine when I allow None and Anonymous...but it's not enforcing the certs.....
Oh my above issue is when I have it set for Anonymous : Permit and SecurityPolicy: Basic256Sha256
j
for this there is the option to fix a certificate, the logs should theoretically tell you how you can do that
j
that's exactly what @jermuk said here, if you go over to logs, you will find a snippet which contains the clientCertifiacte option, which you have to copy/paste to reuse this cert
t
What log are we referring to? The action log at deployment?
j
Nope, after deployment you can view the logs of the protocol converter
that's the 1 we're talking about
t
I think I did it right...it is now submitting the same cert...but it keeps getting rejected.... You can see in the images that the suffix of the cert is the same..but it keeps ending up in the rejected list..even though it's in the trusted list... https://cdn.discordapp.com/attachments/1366469856563826698/1366852797357752551/image.png?ex=6812745d&is=681122dd&hm=dd6aba7245a015f22c87266fa07fa2a6c52b26d14e604b11ea0276ed763b7258& https://cdn.discordapp.com/attachments/1366469856563826698/1366852797772992573/image.png?ex=6812745d&is=681122dd&hm=7ea07e818e4fa66817ba9f5b9983edbd40b425d4f7c7a69a02b8f8471c242bf4& https://cdn.discordapp.com/attachments/1366469856563826698/1366852798079172699/data-flow-component-logs-c567f2c2-b169-450a-bc7c-106f7a4282ac.txt?ex=6812745d&is=681122dd&hm=4f20ab24ff7ded26fa24631d359ec9670e3f3990a141a2d9c1997b75361430f4&
j
maybe i can try to reproduce it tomorrow, but it doesn't look like an certificate issue from benthos itself
did you remove it also from the rejected list ?
t
Yea, I tried deleting all certs....and starting over....it just keeps adding the cert to the rejected....then I trust it....and then it comes up in rejected again....so it's in both trusted and rejected....infinite loop....For now I am just bypassing all security and things work....but I'm sure it would be nice to have this work properly. Let me know if you need more info tmorrow.
j
Can you see what happens with the certificate whenever you connect via e.g. UAExpert ?
t
Starts in the rejected list...UaExpert doesn't connect....then I move to trusted, and it connects...you can see in the logs there are a few errors, but I'm able to connect and browse after trusting the cert. Each time I disconnect and reconnect, If I check....there's no new certs in the rejected list... https://cdn.discordapp.com/attachments/1366469856563826698/1367099651622441050/image.png?ex=68135a44&is=681208c4&hm=964a1a3a5d34be72ae5c5d500525b3a3d9d1c9e6f8b1156ca8bc17fc6f6a6f3e& https://cdn.discordapp.com/attachments/1366469856563826698/1367099652033220638/image.png?ex=68135a44&is=681208c4&hm=a4cedd87f127b335a34a876e902a072151071f5fd5acc34f321e1259c79eef63& https://cdn.discordapp.com/attachments/1366469856563826698/1367099652419354624/image.png?ex=68135a44&is=681208c4&hm=b37dc1b36633fe47725524b3733e266506dee1f27fb70a360480b01fa4984efc&
j
ok, so as i can see you removed everything else from the trusted right? What happens if you now also move this benthos-cert to trusted (so it's not anymore in the rejected list) and try to connect again ?
The behaviour is a bit weird to me, since we tried that with many different software-types. What is the exact software you're using there?
t
The gray is Omron Sysmac Studio....it's for programming Omron NX/NJ controllers.
j
so you moved it to trusted, didn't connect with benthos but then it automatically gets added to rejected, is this correct ?
t
I have a connection and protocol converter established....using a "static cert".......and before I ever open the console, it's already added what looks to be an identical cert to the rejected list
j
Ah okay, maybe as a last resort you should try to start over again? So basically deleting the Protocol Converter, Start over with the config only with securityMode and securityPolicy set. Then get the options from the logs and trust the cert in Omron-Software. After this re-deploy and see if it works. If not this seems to be some weird bug due to the software, that's why i asked because i cannot reproduce it with our current setup
t
I'll give it a shot.... Reminder....this was only one wierd issue...the major issue was that user authentication does not connect to either Omron NX102, or Phoenix Contacts PLCNext
j
yeah this is also weird, since user auth should def. work as well
t
What controllers have you guys tested?
Siemens?
j
Siemens, Wago, Kepware, Prosys
dataFeed
t
Embeded controllers though....Siemens and Wago....well I have a S7-1200, and wago cc-100....
j
Siemens S7-1200, WAGO PFC
at the very bottom is a test list
with the exact model numbers
(because WAGO switched their OPC UA srver like 3 timesi n the past 8 years)
we are always happy to buy new PLCs and add them to our testing rack, we typically only struggle in setting up the PLC in the first place
t
PFC with codesys 3.5
Yea, that's an industry issue...you have to be an "expert" in each one....to set them up
This came after I did save and deploy once....used the log to get the serverCertificateFingerprint and clientCertificate......
j
give me 1 sec
t
note "illegal base64 data at input byte 3988"
j
yea right now you dont specifically have to provide the serverCertFingerprint, so let it out for now
but this error seems like somethings wrong with your config -> clientCertificate
maybe sth like not correctly copy/pasted, some line break or sth like that
t
I copied it from the log...
j
can you remove the ' at the end of the certifiacte? doens't look right
t
ah...maybe that's it
That fixed the illegal data at input byte error
j
that's also what happend in the fingerprint, the logline is wrongly setup for that
t
let me go back through this...
everytime I open the OPCUA browser, I get a new cert, even though I'm defining the clientCertificate in the yaml
j
yeah seems like the browser is buggy, therefore you would neet to deploy
t
I did save and deploy...but it get's errors....
with the client cert defined...
j
this one here was a new created cert - not the one from yesterday right?
t
I just deleted the protocol converter....and re-created it with securityMode: SignAndEncrypt securityPolicy: Basic256Sha256 I also put in a valid node id..... I went to log and copied the client cert from the action log, and paste it into the yaml...checking to be sure the ' is not there. Still get errors but I save anyway, and to back to connections... It appears that it is reading the valid node id as I'm getting msg throughput... However, the OPCUA browser still gets an error, and creates a new cert each time I open it
top cert was what I first trusted...and seems to be the one that allows it to read data... the 2 in the rejected list are there because I opened the opcua browser 2 times https://cdn.discordapp.com/attachments/1366469856563826698/1367130215448445058/image.png?ex=681376bb&is=6812253b&hm=51f9065d35942975927acfa5762998cb9a56cb32705e85a63a4ee257d3a062d7&
j
So one thing, if you switch from securityMode: Sign to SignAndEncrypt you cannot reuse the certificate, because the server typically would reject this. Not sure if this happened here, but your config above shows Sign and now it shows SignAndEncrypt
t
i've gone back and forth trying both sign and signandencrypt
current config attached
j
The browser thing is seemingly creating new certificates and not using the predefined, which i have to investigate why that keeps happening
t
I gotta run for a bit.....let me know what else I can test....but it looks like it's reading data with encryption and certs
j
Yeah but when switching from Sign to SignAndEncrypt you will need to delete the clientCertificate from your config and get the new one from logs, otherwise you will have it appearing with the same name in the server but getting rejected
Now this makes sense
Then there's this user-authentication stuff left right ? But to test user-authentication best way would to use no securityPolicy or securityMode at all. Depends on if you're willing to test this or just using this datapoints right now
t
Yes the user authentication doesn't seem to work on either PLCNext or NX102.....even with security policy as none.
j
Okay this is something i have to reproduce or try to reproduce, can you post logs for this, so i can later on check this? would be very helpful
t
Ok, so I tested with Omron NX102, user authentication works to read the data, but doesn't for the OPCUA browser... If I allow anonymous on the server then it works to browse, after I save and deploy, and return to the protocol converter screen. It acts as if it's going to work before I save and deploy...but never populates the list... So, this is strictly an issue with the opcua browser not using the login credentials properly....and it re-creates certs when it shouldn't. Attached is the log, where I'm currently connected using None, None, with Username and Password. But it wouldn't browse. https://cdn.discordapp.com/attachments/1366469856563826698/1367227964055621682/message.txt?ex=6813d1c4&is=68128044&hm=303e6f254984b29054d3136c1973ecf3b6b9938cd8fc2c7e32dab792fe469b57&
j
yeah those 2 might be related to the browser, which would make sense at all, since it works after deployment
t
It's the same issue with the PLCNext, it will do encrypted with authentication reading data. But the Browser only works when I disable authentication.
j
but after deployment it works then ?
t
For both NX102 and PLCNext, if user authentication is used.....the OPCUA browser doesn't work....before deploy or after...no matter...same result, no browsing. However, for both of them if user authentication is enabled....it will read data.
j
yeah that's what i meant, okay then i'll know where to investigate
but at least you're getting data then
t
Ok, Here's What works... Omron NX102 Reading Data - User Authentication or No Authentication - SignAndEncrypt or None - Basic256Sha256 or None - Static clientCertificate, if using certs, but must trust the cert in controller.. Browsing - No Authentication - No Encryption - No Certificates PLCNext Reading Data - User Authentication or No Authentication - SignAndEncrypt or None - Basic256Sha256 or None - Static clientCertificate NOT REQUIRED Browsing - No Authentication - SignAndEncrypt or None - Basic256Sha256 or None What Doesn't work Omron NX102 - Browsing doesn't work with user authentication - Creates new certs with Browser, so I can't set to "trust" in the controller. PLCNext - Browsing doesn't work with user authentication
2 Views
PreviousNext
Powered by