OPC UA standardizes security by design: channel encryption, certificate-based mutual authentication and user authorization are part of the protocol, not add-ons. So who decides which settings a field connection uses? The answer is the pair of SecurityPolicy and certificate management; this article covers both from a practical angle.
Two Security Layers
The OPC UA security model answers two separate questions:
- Who is talking? The application layer: client and server authenticate each other with application certificates.
- Which user? The session layer: the identity of the person opening the session is carried by a user token.
These layers are independent; correct configuration means getting both right.
SecurityPolicy: Channel Security
The SecurityPolicy determines which encryption and signing algorithms protect the messages. During endpoint discovery (GetEndpoints) the server lists the policies it supports and the client picks one. What matters in practice:
- None: Open channel, no encryption or signing. Meaningful only on isolated test networks; do not use in production.
- Basic256Sha256: The widely supported, safe choice. The legacy Basic128Rsa15 and Basic256 policies rely on SHA-1 based primitives and are no longer recommended.
- Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss: the current OPC UA policy family; preferred for new designs.
Along with the policy you choose the MessageSecurityMode: None, Sign, or SignAndEncrypt. For production connections the target combination is certificate validation plus SignAndEncrypt.
Certificates and the Trust List
Every OPC UA application holds an Application Instance Certificate. Client and server inspect each other's certificates; if the peer certificate is not on the local trust list, the connection is rejected. Practical rules:
- At small scale you can add each application's certificate directly to the peer's trust list; as the deployment grows, running your own CA and issuing certificates from it makes management far easier.
- Track certificate validity periods: an expired certificate is the classic cause of connections that drop without an obvious reason.
- For centralized certificate management, the Global Discovery Server (GDS) part of the OPC UA specification defines services that model the certificate life cycle.
User Authentication
Once the channel is up, the session opens with a user token: Anonymous, UserName (username + password) or Certificate. Two principles dominate field practice: keep anonymous access only where it is truly required, and constrain user rights by role — separating read from write/control permissions across distinct accounts is the most common best practice.
Production Checklist
- Remove endpoints with SecurityPolicy None from the production network.
- Use SignAndEncrypt as the MessageSecurityMode.
- Manage the trust list deliberately: which certificate is on it, who added it, when does it expire?
- Put certificate expiry dates under monitoring; renew before they lapse.
- Define user accounts by role; keep write rights on separate accounts.
- Constrain OPC UA traffic with OT/IT segmentation and firewall rules; the standard's default TCP port is 4840, while Kepware Server installs default to 49320.
For support with OPC UA security configuration, contact us; for common questions see our knowledge base.
