Secure channel
A secure channel is the transport-level security context between a client and a server, created by OpenSecureChannel. The asymmetric handshake authenticates both certificates, exchanges nonces and derives the symmetric keys used for all later messages, then issues a security token with a lifetime that must be renewed. Sessions ride on channels but have independent lifetimes.
How it is established
Connection establishment is four staged: the OS accepts the TCP socket; OpenSecureChannel performs the asymmetric RSA handshake, verifying signatures with the peer certificate and generating nonces; CreateSession applies admission checks and returns a signed server nonce; ActivateSession verifies the client signature and the user identity token. Stages two to four are CPU-bound on RSA and chain validation, which is why connect storms hurt servers so badly.
Tokens expire and are renewed
The channel's security token has a finite lifetime - commonly an hour - and the client renews it with a further OpenSecureChannel request before it expires, deriving fresh keys. A client that sleeps through the renewal, or whose clock has drifted, comes back to BadSecureChannelTokenUnknown or BadSecureChannelIdInvalid. These are not session errors: the session may still exist server-side, waiting for a new channel.
Channel and session are deliberately decoupled
This separation is what makes reconnection work. On a network break the client opens a fresh secure channel and re-activates the existing session on it, keeping its subscriptions, registered nodes and continuation points. Reconnect handlers in the reference stacks are built entirely on this property, and it is the precondition for TransferSubscriptions being worth attempting at all.
Example
The four stages, and what fails at each
1 TCP accept firewall / wrong port -> BadConnectionRejected
2 OpenSecureChannel certificate or policy -> BadCertificateUntrusted, BadSecurityPolicyRejected
3 CreateSession server limits -> BadTooManySessions, BadServerTooBusy
4 ActivateSession user identity -> BadIdentityTokenRejected, BadUserAccessDenied
Steady state: channel token renewed periodically; session kept alive;
one or more Publish requests left outstanding.Defined in: Part 4 - Services for OpenSecureChannel and the session services; Part 6 - Mappings for the UA Secure Conversation protocol; Part 2 - Security Model for the key derivation.
Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.