Troubleshooting clinic
Fourteen broken configurations, diagnosed and fixed on camera, in the order a competent engineer would actually work. Certificates, endpoints, reverse connect through a layered network, namespace shifts, and reading an encrypted session in Wireshark.
| Lessons | 14 |
|---|---|
| Time | about 112 minutes |
| Prerequisites | A4; B3 for the certificate lessons |
| Cost | Free: written lessons open, video and labs need a free account |
What you will be able to do
- You can work a failed connection in diagnostic order instead of guessing.
- You can fix any of the common certificate failures from the status code alone.
- You can get through NAT and a Purdue-layered network with reverse connect.
- You can decrypt and read an OPC UA session in Wireshark.
- You can tell a server problem from a client problem from a network problem.
Syllabus
-
1
Work the diagnostic order8 min
TCP reachability, then GetEndpoints with security None, then inspect the EndpointDescriptions, then attempt a secure session. Skipping a step is why people guess.
Asset The four-step order run against a broken server, with the output of each step
-
2
Fix a rejected connection8 min
Port closed, wrong port, firewall, server not listening. Distinguishing them in one minute.
Asset nc, ss and a client attempt against four different failure modes, with each output
-
3
Fix an endpoint URL mismatch8 min
The server advertises the hostname it was configured with, not the one you dialled. What to change and where.
Asset A server advertising an unreachable internal hostname, with the returned EndpointDescription
-
4
Fix a trust failure, both directions9 min
The rejected-to-trusted workflow done completely rather than half. Most people fix one side.
Asset A first connection failing, and the two trust-list changes that fix it, screenshotted in UaExpert
-
5
Fix a hostname or URI mismatch in a certificate8 min
SAN entries, ApplicationUri, and why connecting by IP fails against an FQDN certificate.
Asset An openssl dump of the failing certificate next to the connection log
-
6
Fix a broken chain8 min
Missing intermediates, absent CRLs, and a corporate CA without keyCertSign and cRLSign.
Asset A chain validation failure traced through openssl to the missing key usage
-
7
Fix a clock problem6 min
Certificate time failures on perfectly valid certificates, and why NTP is a security control.
Asset A valid certificate rejected on a machine with 40 minutes of drift, then accepted after NTP
-
8
Get through NAT with reverse connect10 min
ReverseHello, the outbound-only pattern for a Purdue-layered network, and the non-obvious behaviour where the client must fetch the certificate, lose the channel, and wait for the next hello.
Asset A reverse-connect session established through NAT, with the full packet sequence
-
9
Diagnose a client that connects then drops8 min
Session timeout, keep-alive, a server aborting after an unsupported reverse connect, and certificate renegotiation. Four causes, one symptom.
Asset Four capture excerpts with the same visible symptom and four different root causes
-
10
Fix a namespace index shift8 min
A hardcoded ns= after a PLC download. The immediate fix and the permanent one.
Asset NamespaceArray before and after a program download, with the client code that broke and its fix
-
11
Find the data loss nobody reported8 min
Queue overflow reporting as Good. How to detect it after the fact and prove it happened.
Asset A dataset with a silent gap, and the overflow bit that shows where
-
12
Diagnose a slow server9 min
Sampling load, too many distinct intervals, diagnostics left on, connect storms, and how to tell which one it is before you start changing things.
Asset Server diagnostics from an overloaded server, with the one change that fixed it
-
13
Read OPC UA in Wireshark8 min
The built-in dissector, the opcua filter, and reading the handshake message by message.
Asset A full annotated capture of a connection, from Hello to the first Publish response
-
14
Read an encrypted session6 min
Dumping session keys and decoding a SignAndEncrypt channel: the only way to debug some problems.
Asset An encrypted capture decoded with dumped keys, showing the service calls inside
Lab
Free account required
Work through four deliberately broken client configurations. For each, name the status code, the root cause and the fix before looking at the answer.
Unlock the lab →Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.