Hey all,
CPU 1516F-3 PN/DP, TIA V17, OPC UA server switched on at the CPU, and Node-RED on a small edge box with the node-red-contrib-opcua client node. With the policy set to None the client connects and reads fine. Soon as I set Basic256Sha256 with Sign and Encrypt it drops out with BadSecurityChecksFailed in the Node-RED debug, and the CPU diagnostics buffer has a line about a rejected client certificate. I'll copy that out tomorrow.
So I regenerated the client certificate in the node, no change, then checked the CPU's own server certificate in the OPC UA settings and it's there and valid. Smallest test I could think of after that was UaExpert off my laptop with the same policy, and it fails the same way, so it's the CPU side and not Node-RED.
What's it rejecting? Is there a trust list on the CPU side that the client certificate has to go into before it'll stop rejecting it?
Two things I'd check. Does the CPU have the OPC UA runtime licence, the SIMATIC OPC UA S7-1500 one? I've read it isn't enforced technically but I'm not sure of that.
And is 4840 reachable from where the client sits? In V17 the server port is on the same OPC UA page. The firewall you opened is on the client, so that shouldn't matter.
Licence is bought, and None works, so the server's up and serving. 4840 is the CPU's listening port and there's nothing in front of it.
Buffer line from this morning, roughly: "OPC UA server: client certificate rejected, not trusted", with the client's name after it. So it's trust, not policy.