[BUG ?] force-resync delete opcua client certificats trusted on backup

Ignition 8.1.23
@Kevin.Herron
When we execute the command Force Re-Sync a backup node,
opcua client certificates (Ignition\data\opcua\client\security\pki\trusted\certs) of the backup node seems to be delete and copied from the master node.

The certificate for an opcua client connection on the backup node which has been approved on the backup node is not present on the master and then the trust is lost on the backup !
Is it an intentionnal behavior ?

As a workaround we copy all the opcua client cert on the master node.

Is it the same behaviors for other cert (HTTPS and Gateway Networks) ?

Some clarification about opcua, Https, gan ssl certificate Sync rules between master and backup node will be welcome...

Sorry I never came back and updated this. It turns out that force re-sync is basically equivalent to making a gateway backup and restoring it to the backup node, which includes the entire data folder.

This... is a fundamentally broken situation for any module that stores things in the data folder assuming it won't be replicated wholesale to the backup.

I don't know what the plan to fix this is or when it will happen.

I would say it isn't broken. All config is supposed to be maintained on both servers, so the driver's device folder should have both files.

Or rather, that lack of both files is the breakage.

Forget about drivers for a second.

Consider the OPC UA module, for example, which stores its client and server certficate/keypair as well as a .uuid that uniquely identifies the application. The only designated storage place for modules right now is the data folder.

While this is data you would want to come along in a gateway backup intended to be restored to a primary, it's not data you want synced to a node in the backup role.

That implies it is impossible to backup a backup node. Backup nodes are supposed to have only the redundancy XML file differ.

Oooo! To be consistent, the entire data hierarchy should be monitored and changes replicated to the backup as they occur. I don't think that is currently happening. ??

doubt it

It's Friday afternoon. You've just nerd-sniped me for the weekend. /:

I should pretend I haven't seen this topic.

1 Like

Sorry about your weekend, but I'm quite good at discovering some corner case...:face_with_peeking_eye:

2 Likes