MessageSecurityMode
In OPC UA, MessageSecurityMode is the per-endpoint setting that says what is done to every message on a secure channel: None, Sign, or SignAndEncrypt. It is orthogonal to the security policy, which supplies the algorithms. Both appear in every EndpointDescription, and a client must match both to connect.
Three values, and what each one buys
None means no channel-level protection and no mutual certificate authentication. Sign means every message carries a signature, so both applications are authenticated by certificate and tampering is detected, but the payload is readable on the wire. SignAndEncrypt adds confidentiality on top. There is deliberately no encrypt-without-sign option, because encryption without authentication is a security hole rather than a trade-off.
Mode and policy are separate axes
A server typically publishes several endpoints on the same URL: None with policy None, Sign with Basic256Sha256, SignAndEncrypt with Basic256Sha256, perhaps the same pair again with Aes256_Sha256_RsaPss. The mode says how much protection, the policy says with which algorithms. A client that has the right policy and the wrong mode gets BadSecurityModeRejected; the reverse gets BadSecurityPolicyRejected. Read both fields out of GetEndpoints before you start guessing.
It gates the user token too
The mode is not only about telemetry. A UserName identity token is encrypted with the active security policy, so a username and password sent over an endpoint with mode None crosses the network in clear - and this is the single most common real-world OPC UA credential leak. If you require user authentication, you have already required at least Sign, and in practice SignAndEncrypt.
Enforcing a minimum
Servers can require a minimum mode per node or per role through AccessRestrictions, which is how you allow anonymous browsing over Sign but require SignAndEncrypt before a Write or a Method call. The status code for that refusal is BadSecurityModeInsufficient, and it is a design decision surfacing correctly rather than a fault. Do not ship a server whose only endpoint is None, and do not ship a client that will accept one.
Example
A typical endpoint list from GetEndpoints - the mode and policy pair is what you pin
opc.tcp://plc01:4840 None SecurityPolicy#None <- bench only
opc.tcp://plc01:4840 Sign SecurityPolicy#Basic256Sha256
opc.tcp://plc01:4840 SignAndEncrypt SecurityPolicy#Basic256Sha256 <- pin this
opc.tcp://plc01:4840 SignAndEncrypt SecurityPolicy#Aes256_Sha256_RsaPss
UserIdentityTokens on the None endpoint: Anonymous, UserName
-> a UserName token here is sent unprotectedDefined in: Part 4 - Services, EndpointDescription; Part 2 - Security Model.
Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.