GetEndpoints
GetEndpoints is the service that asks a server which endpoints it publishes. It runs on the discovery endpoint without a session and, by convention, over a security None channel, returning an array of EndpointDescriptions including the server certificate. It is the second step of every OPC UA connection diagnosis, right after proving TCP reachability.
No session, no security, no trust required
GetEndpoints and FindServers are the two services a server answers before any session exists. The client opens a secure channel with SecurityPolicy None, issues the request and closes. Nothing is authenticated, which is the point: you cannot validate a certificate you have not yet been given. Everything after this step depends on what the server said here.
The diagnostic order that saves hours
Prove TCP reachability first - nc -vz plc01 4840 or an equivalent. Then call GetEndpoints with security None. Then read the returned EndpointDescriptions: check the URLs, the policies, the modes and the identity tokens. Only then attempt a secure session. Skipping straight to a secure connect conflates four different failures - routing, protocol, configuration and certificates - into one unhelpful timeout.
What the answer tells you
An empty list means the server is running but publishes nothing for your transport. A list with only None endpoints means security was never configured. Endpoint URLs with a hostname you cannot resolve explain reconnect failures. The identity token list tells you before you try whether Anonymous will be accepted. And the returned certificate is the one your trust decision is about.
Example
Discovery result and the trust decision that follows
$ nc -vz opcua.umati.app 4840
Connection to opcua.umati.app 4840 port [tcp/*] succeeded!
GetEndpoints (SecurityPolicy None, no session)
-> 4 EndpointDescriptions
-> ServerCertificate present on each secured endpoint
Next step: validate that certificate against your trusted store.
If it lands in ./pki/rejected/certs/ instead, that is BadCertificateUntrusted,
not a network problem - and the server is demonstrably reachable and healthy.Defined in: Part 4 - Services, the Discovery Service Set; Part 12 - Discovery and Global Services for the discovery architecture.
Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.