Security and PKI

What you will be able to do

• You can choose a security policy and mode and justify both.
• You can generate a certificate that actually validates, SAN entries included.
• You can run the rejected-to-trusted workflow on both sides of a connection.
• You can tell a suppressible validation error from a fatal one.
• You can explain OPC UA security to an IEC 62443 auditor.

Syllabus

1. 1
   Choose a security policy

   What the policies actually specify, which are deprecated, and the modern ECC options in the current reference stack.

   Asset The policy list from three servers' endpoints, with the deprecated ones marked

   8 min
2. 2
   Choose Sign or SignAndEncrypt

   Integrity versus confidentiality, what each costs, and why None on a flat OT network is a decision someone should have to sign for.

   Asset The same session in None, Sign and SignAndEncrypt, captured in Wireshark

   7 min
3. 3
   Take an application instance certificate apart

   Subject, validity, key usage, and the SAN: including the URI entry that must match ApplicationUri exactly, which is the single most common certificate failure.

   Asset An openssl dump of a working certificate with every field that matters annotated

   10 min
4. 4
   Generate a certificate that validates

   The openssl invocation with the right extensions, and the same thing done by each SDK's helper.

   Asset A working openssl config and command, with the resulting certificate accepted by a real server

   9 min
5. 5
   Learn the four PKI stores

   trusted, issuer, rejected and crl. What belongs in each, and why the rejected store exists.

   Asset The PKI folder layout of a real client, with a certificate moved from rejected to trusted

   8 min
6. 6
   Run the trust workflow on both sides

   The step almost everyone half-does: the server trusts the client and the client trusts the server. Doing only one is why it still fails.

   Asset A first connection failing, then succeeding after both trust lists are updated

   8 min
7. 7
   Handle a CA-issued certificate

   Chains, intermediates in the issuer store, CRLs, and the corporate-CA failure where the CA lacks keyCertSign and cRLSign.

   Asset A chain validation failure traced to a missing key usage, with the openssl proof

   9 min
8. 8
   Separate suppressible from fatal errors

   Which validation failures a client may choose to accept, which it must not, and why 'accept all certificates' in production is not a configuration but a decision to have no security.

   Asset A validation matrix of ten certificate failures, marked suppressible or fatal

   8 min
9. 9
   Authenticate the user, not just the machine

   Anonymous, username and certificate identity tokens, and the difference between authenticating an application and a person.

   Asset Three identity tokens against the Milo demo server, with the accepted and rejected results

   7 min
10. 10
    Apply Part 18 roles

    Roles, role permissions and the well-known TrustedApplication role. Restricting what an authenticated client may actually do.

    Asset A server with two roles configured, and the same read succeeding and failing by role

    8 min
11. 11
    Manage certificates at scale with a GDS

    Push and pull certificate management, and why manual trust lists stop working somewhere around the thirtieth machine.

    Asset A certificate pushed to a server through GDS, with the before and after trust list

    7 min
12. 12
    Answer an IEC 62443 question

    Mapping OPC UA's mechanisms onto the questions a security audit actually asks, and where OPC UA is silent.

    Asset An eight-question audit extract with the OPC UA mechanism that answers each, and two it cannot

    7 min

Lab

Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.