ApplicationUri
The ApplicationUri is the globally unique identity of one OPC UA application instance, such as urn:edge01:Contoso:Publisher. It appears in the ApplicationDescription and must also appear in the application instance certificate's Subject Alternative Name as a URI: entry. A mismatch between the two is rejected with BadCertificateUriInvalid.
Instance identity, not product identity
ApplicationUri identifies this installation of this application on this machine; ProductUri identifies the software. The conventional form is urn:<hostname>:<vendor>:<product>, and stacks generate it from the local hostname at first start. Two running applications must never share an ApplicationUri, because discovery registers by it, audit events record it, and trust decisions are keyed to it.
The certificate binding is enforced
Certificate validation includes an explicit ApplicationUri check against the SAN, alongside the hostname check. The URI must match exactly - case, scheme and all - between the ApplicationDescription the peer sends and the URI: entry in the certificate it presents. This is why regenerating a certificate with a tool that omits the URI SAN entry breaks connections that were working, with a certificate error rather than an identity error.
What silently changes it
Renaming a host, moving a configuration file between machines, cloning a VM, or rebuilding a container with a new generated hostname all change either the ApplicationUri or the certificate, and any drift between them is fatal. In containers the classic failure is a non-persistent pki volume: each restart mints a new certificate and a new hostname-derived URI, so the peer's trust list goes stale on every deployment.
Example
Checking the URI SAN entry in an application instance certificate
openssl x509 -in pki/own/certs/client.der -inform der -noout -text | grep -A3 "Subject Alternative Name"
X509v3 Subject Alternative Name:
URI:urn:edge01:Contoso:Publisher, DNS:edge01.plant.local, IP Address:10.20.4.11
The URI: entry must equal the ApplicationUri in the ApplicationDescription, exactly.Defined in: Part 4 - Services for the ApplicationDescription; Part 12 - Discovery and Global Services and Part 6 for the certificate requirements.
Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.