// Copyright (C) 2019 The Qt Company Ltd.
// SPDX-License-Identifier: LicenseRef-Qt-Commercial OR GFDL-1.3-no-invariants-only

/*!
    \page qtopcua-security.html
    \title Creating OPC UA Clients with security support
    \brief Instructions how to create OPC UA Clients with security support

    One of the core features of OPC UA is the support for security,
    which means we get cryptographically encrypted and signed protocol,
    user authentication and authorization support.

    To make this work, each application instances (installation of a program)
    needs to have its own \c {Application Instance Certificate} and the according private key.

    The applications can either generate self-signed certificates on their own (see \l {Qt OPC UA X509 Support}),
    get some from a certificate authority using OPC UA GDS, or simply can be configured with certificates which
    haven been created manually by the user.

    \section2 Configuring the UA Application

    To enable the client to use secure connections, it is important to

    \list
        \li Configure the correct Application Identity
          \snippet ../../examples/opcua/opcuaviewer/mainwindow.cpp Application Identity
        \li Configure PKI locations so that the SDK can find the certificate, private key, trust list etc.

          See, for example, the code from the
          \l {Qt OPC UA Viewer} {Qt OPC UA Viewer Example}:
          \snippet ../../examples/opcua/opcuaviewer/mainwindow.cpp PKI Configuration

          In the example, we extract pre-configured own and trusted certificates
          from the Qt resource system to a writable location in the file system.
          The remaining directories for issuer (revocation) lists are created
          manually.
    \endlist

    \section2 First connection

    When connecting for the first time, the client needs to trust the server certificate.

    The client should display a certificate warning (with cert details) and offer the possibility to save the certificate in its trust list.
    For an example, see \l {Qt OPC UA Viewer} {Qt OPC UA Viewer Example}.

    When the client has accepted the server certificate, you can try to connect again. Now the server may reject the client's certificate.
    This is indicated by the generic error code \c BadSecurityChecksFailed. Servers normally store rejected certificates in a special \c rejected folder.
    Administrator can move these into the trust list to trust clients. This avoids manually copying the client certificate to the server machine.

    As soon as the server has trusted the client, you should be able to connect with security.
*/
