View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
000938310000-012: DiscoverySpecpublic2024-01-31 14:232024-05-07 15:35
ReporterUwe Stadelmann Assigned ToRandy Armstrong  
PrioritynormalSeverityminorReproducibilityhave not tried
Status closedResolutionfixed 
Product Version1.05.02 
Fixed in Version1.05.04 RC1 
Summary0009383: OPC 10000 12 Missing closing of a secure channel after trust list update
Description

Section 7.8.2.3 CloseAndUpdate:
"When the TrustList changes the Server shall re-evaluate the Certificate associated with any
open Sessions. Sessions with an untrusted or revoked Certificate shall be closed."

There is nothing mentioned about the secure channels which are established already and now using an untrusted or revoked certificate.
If the secure channel is not closed, too, a client may use the CreateSession service to create a session using a untrusted or revoked certificate as the certificate itself is verified only during the OpenSecureChannel procedure. It shall only be made sure that the same certificate is used in the OpenSecureChannel and the CreateSession services. During the CreateSession procedure it is not verified again.

Conclusion: The secure channel must be closed in addition to the already mentioned session if the certificate is no longer valid.

TagsNo tags attached.
Commit Version1.05.04 RC
Fix Due Date

Activities

Randy Armstrong

2024-03-03 03:37

administrator   ~0020889

When the TrustList changes the Server shall re-evaluate the Certificate associated with any open Sessions and SecureChannels. Sessions or SecureChannels with an untrusted or revoked Certificate shall be closed.

Jim Luth

2024-05-07 15:35

administrator   ~0021166

Agreed to changes in web meeting

Issue History

Date Modified Username Field Change
2024-01-31 14:23 Uwe Stadelmann New Issue
2024-02-27 17:23 Jim Luth Assigned To => Randy Armstrong
2024-02-27 17:23 Jim Luth Status new => assigned
2024-03-03 03:37 Randy Armstrong Status assigned => resolved
2024-03-03 03:37 Randy Armstrong Resolution open => fixed
2024-03-03 03:37 Randy Armstrong Note Added: 0020889
2024-05-07 15:35 Jim Luth Status resolved => closed
2024-05-07 15:35 Jim Luth Fixed in Version => 1.05.04 RC1
2024-05-07 15:35 Jim Luth Commit Version => 1.05.04 RC
2024-05-07 15:35 Jim Luth Note Added: 0021166