Set up OPC UA certificates in Node.js

The code

const {
  OPCUAClient, MessageSecurityMode, SecurityPolicy,
  OPCUACertificateManager,
} = require("node-opcua");

(async () => {
  const certificateManager = new OPCUACertificateManager({
    rootFolder: "./pki",        // MUST be a persistent volume in a container
    automaticallyAcceptUnknownCertificate: false,
  });
  await certificateManager.initialize();

  const client = OPCUAClient.create({
    applicationUri: "urn:example:my-opcua-client",   // must match the SAN URI entry
    clientCertificateManager: certificateManager,
    securityMode: MessageSecurityMode.SignAndEncrypt,
    securityPolicy: SecurityPolicy.Basic256Sha256,
    endpointMustExist: false,
  });

  await client.connect("opc.tcp://milo.digitalpetri.com:62541/milo");
  const session = await client.createSession();
  console.log("secure session established");

  await session.close();
  await client.disconnect();
})();

What it prints

secure session established
# ./pki/own/certs/  holds the generated certificate
# ./pki/rejected/  is where unknown peers land until you trust them

Notes

• The certificate manager generates a self-signed certificate on first run and stores it under rootFolder. That folder is your identity.
• In a container, mount ./pki on a persistent volume. Otherwise every restart regenerates the certificate and every peer's trust list goes stale on every deploy.
• Never ship automaticallyAcceptUnknownCertificate: true. It is a development convenience that removes the point of the security you configured.
• Trust is mutual: move your certificate into the server's trusted store, and put the server's certificate in ./pki/trusted.

What breaks first

Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.