HTTPS transport
OPC UA over HTTPS uses opc.https:// or https:// and three profiles. https-uabinary tunnels UA Binary secure-channel messages one chunk per HTTP POST and keeps the full UA security model. https-uajson and https-uajson-openapi carry JSON with no UA secure channel and must be advertised with MessageSecurityMode None, relying on TLS.
Request/response instead of a stream
HTTP is a poor fit for a protocol built around a long-lived channel and a long-polled Publish. The binary profile works by mapping one secure-channel chunk onto one POST body of type application/octet-stream, which preserves security but adds a request round trip per chunk. Subscriptions still function through Publish requests, but the overhead compared with a single opc.tcp socket is substantial.
The JSON profiles trade UA security for reach
https-uajson uses content type application/opcua+uajson and no UA secure channel at all. Authentication becomes Anonymous, Bearer JWT, HTTP Basic or mutual TLS - the web stack's mechanisms rather than OPC UA's. That is deliberate, since the audience is web and cloud clients, but it means the security review is a TLS and token review, not a certificate and policy one.
Support reality
Outside the .NET reference stack, HTTPS transport support is thin, and no mainstream PLC exposes it. If a project plan depends on OPC UA over HTTPS, verify support on both ends before committing; the interoperable answer for machine-to-machine traffic remains opc.tcp, with a gateway translating to HTTP where a web consumer needs it.
Example
The REST-style surface on the HTTPS profiles
POST https://server:4843/read
Content-Type: application/json; encoding=compact # or encoding=verbose
Body: the bare ReadRequest JSON - no {UaTypeId, UaBody} envelope at the HTTPS layer.
Binary profile instead:
POST https://server:4843/
Content-Type: application/octet-stream
Body: one UA Secure Conversation message chunk per POST.Defined in: Part 6 - Mappings, the HTTPS transport mappings and Annex G for the OpenAPI variant.
Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.