OPC Publisher: Failed to decode the CRL

While connection the OPC Publisher in a project I need to add the whole Client Certificate chain including the CRLs for die Client Certificate of the OPC Server. Reading the CRL of the Root-CA is not possible and I’ll get the following error Message:

[ERR] Error while trying to read information from trusted issuer store.
System.Security.Cryptography.CryptographicException: Failed to decode the CRL.
---> System.Formats.Asn1.AsnContentException: The provided data is tagged with 'Universal' class value '24', but it should have been 'ContextSpecific' class value '0'.
   at System.Formats.Asn1.AsnDecoder.CheckExpectedTag(Asn1Tag tag, Asn1Tag expectedTag, UniversalTagNumber tagNumber)
   at System.Formats.Asn1.AsnDecoder.ReadSequence(ReadOnlySpan`1 source, AsnEncodingRules ruleSet, Int32& contentOffset, Int32& contentLength, Int32& bytesConsumed, Nullable`1 expectedTag)
   at System.Formats.Asn1.AsnReader.ReadSequence(Nullable`1 expectedTag)
   at Opc.Ua.Security.Certificates.X509CRL.DecodeCrl(Byte[] tbs)
   --- End of inner exception stack trace ---
   at Opc.Ua.Security.Certificates.X509CRL.DecodeCrl(Byte[] tbs)
   at Opc.Ua.Security.Certificates.X509CRL.Decode(Byte[] crl)
   at Microsoft.Azure.IIoT.OpcUa.Protocol.OpcConfigEx.ShowCertificateStoreInformationAsync(ApplicationConfiguration appConfig, ILogger logger)

The CRL is in DER-Format with and .crl-Ending I’m also using the --aa flag in the OPC Publisher Create Container Options, but it seems to be ignored.

The certificates are required as soon as I enable UsernamePassword Authentication (UseSecurity-Flag is set to false)

Expected behavior The CRL should be loaded without any error message and the connection between the Publisher and the OPC Server should be successful.

Container Create Options

{
  "Hostname": "OPCPublisher",
  "Cmd": [
    "--pf=/appdata/telemetrynodes.json",
    "--lf=/appdata/logs/telemetry.log",
    "--PkiRootPath=/appdata/pki",
    "--aa",
    "--tm",
    "--di=60",
    "--MessagingMode=PubSub",
    "--BatchSize=1",
    "--loglevel=verbose"
  ],
  "HostConfig": {
    "Binds": ["/iiotedge:/appdata"]
  }
}

Desktop

• OS: Red Hat Enterprise Linux
• Publisher-Version: latest

[CONeal]

Hi @mregen,

no, the CRL is in DER-Format.

Edit: Removed CRL File due to customers’ request

[marcschier]

Preview 2 is now out with latest OPC UA stack.