Self-signed certificate
In OPC UA, a self-signed certificate is an application instance certificate that signs itself instead of being issued by a CA. It authenticates a peer perfectly well once explicitly trusted, which is why almost every product generates one on first start, but it provides no revocation path and does not scale past a handful of applications.
Why they are everywhere
An OPC UA application cannot open a Sign or SignAndEncrypt channel without a certificate, so every stack generates one on first start rather than refusing to run. That certificate is real and cryptographically sound: promote it into the peer's trusted store and mutual authentication works exactly as designed. The rejected-store promotion workflow exists precisely to make this safe, so there is no need for auto-accept even on day one.
Where they stop working
Trust is pairwise, so n applications that all talk to each other need up to n times n minus one trust operations, each on a different machine. There is no revocation: withdrawing a compromised certificate means editing every peer's trust list by hand. And validity dates are usually set once and forgotten, so a fleet commissioned in the same week all expires in the same week, typically a year or two later with no warning and no renewal process.
The honest guidance
Self-signed is right for a bench, a lab, a demo and a two-device machine. It is the wrong default for a plant, and vendor documentation is increasingly blunt about it - the position taken in the reference tooling's own docs is that self-signed certificates provide no trust value and are not recommended for production. Above roughly ten applications, a small internal CA plus the issuer store, or provisioning through a Global Discovery Server, costs less than the trust-list maintenance it replaces.
If you do ship self-signed, do these things
Get the SAN right first time, with the ApplicationUri as a URI: entry and every DNS name and IP a peer will use, because reissuing means re-trusting everywhere. Set a long but deliberate validity and record the expiry date somewhere that raises a ticket. Never copy a certificate and its private key to a second machine - both instances then share one identity, and audit trails become meaningless. And keep the pki directory on persistent storage, or a container restart quietly issues a new identity.
Example
Telling a self-signed certificate from a CA-issued one
openssl x509 -in cert.der -inform der -noout -subject -issuer
subject= /CN=MyUaServer/O=Contoso # subject and issuer identical
issuer= /CN=MyUaServer/O=Contoso # -> self-signed, no CA, no CRL
# CA-issued looks like this instead:
subject= /CN=MyUaServer/O=Contoso
issuer= /CN=PlantSubCA_Line3/O=Contoso # -> needs the CA in issuer/ and its CRL in issuer/crl/Defined in: Part 2 - Security Model; Part 6 - Mappings for the certificate requirements.
Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.