I am trying to use telegraf (1.27.3) and Beckhoff OPC UA server (4.4.69.0).
I am able to setup a connection between both if I am using Security policy as “None”.
In my case I would like to use it with:
security_policy = “Basic256Sha256”
security_mode = “SignAndEncrypt”
This is my telegraf config file:
Today what I already Tried:
Use beckhoff OPC Server automatically trust new certificate ( Not working EOF)
Get back from /tmp/scs# the certificated generated by telegraf and copy & past into /etc/telegraf (Not Working EOF, and even if the certificat has been generated & Trusted beckhoff rejected it)
Generate my own certificat and update telegraf conf (Not Working EOF, and even if the certificat has been generated & Trusted beckhoff rejected it). I can see that it is one from the generated cert because my company name appear
I am lost now, where should I start ?
Someone already setup a connection between Beckhoof OPCUA & telegraf ?
Hi @Loic_Winkelmann,
Correct my expectation would be it would be rejected due to the fact it’s a self-signed certificate. if you move it to accepted within the trusted store and restart Telegraf does this change the output?
hmm have you got a beckoff specification to hand? It sounds like an odd configuration. I could understand why it would happen if you let Telegraf recreate its own certificates as they keep changing but these should be static.
hmm so you could build build the certificate based upon an organization that is accepted by beckoff. Are you using beckoff V3? Also for my own clarity in that screenshot are you deleting the certificate in rejected once you move it?
Also did you connect to Beckoff using UA expert and Kepware via Certficate authentication or Username and password?
hmm so you could build build the certificate based upon an organization that is accepted by beckoff. Are you using beckoff V3? Also for my own clarity in that screenshot are you deleting the certificate in rejected once you move it?
Also did you connect to Beckoff using UA expert and Kepware via Certficate authentication or Username and password?
hmm can you remove all versions of the certificate from the trust store please both from trusted and rejected. Completely stop telegraf before you do this. Instead of using auto could you do the following:
#
## The interval at which the server should at least update its monitored items
#subscription_interval = "100ms"
#
## Security policy, one of "None", "Basic128Rsa15", "Basic256",
## "Basic256Sha256", or "auto"
security_policy = "Basic256Sha256"
#
## Security mode, one of "None", "Sign", "SignAndEncrypt", or "auto"
security_mode = "SignAndEncrypt"
#
## Path to cert.pem. Required when security mode or policy isn't "None".
## If cert path is not supplied, self-signed cert and key will be generated.
certificate = "/etc/telegraf/public.pem"
#
## Path to private key.pem. Required when security mode or policy isn't "None".
## If key path is not supplied, self-signed cert and key will be generated.
private_key = "/etc/telegraf/default_pk.pem"
#
## Authentication Method, one of "Certificate", "UserName", or "Anonymous". To
## authenticate using a specific ID, select 'Certificate' or 'UserName'
auth_method = "UserName"
I don’t belive auto works particularly well with self-included certificates
