OPC UA was designed with security built into the specification rather than added on afterward, relying on certificates, encryption, and configurable security policies to protect data in transit. These terms describe how that security model works in practice.
| Term | Definition |
|---|---|
| Application Instance Certificate | A digital certificate that uniquely identifies a specific OPC UA client or server application instance for authentication purposes. |
| Certificate Authority (CA) | A trusted entity that issues and signs digital certificates used to establish identity and trust between OPC UA applications. |
| Security Policy | A named set of cryptographic algorithms an OPC UA endpoint uses for signing and encrypting messages. |
| Security Mode | The level of message protection applied to an OPC UA session: None, Sign, or Sign & Encrypt. |
| X.509 | The standard format used for digital certificates, including those used to authenticate OPC UA applications. |
| User Token | The credential type, such as a username/password, certificate, or issued token, an OPC UA client presents to authenticate a user to a server. |
| TLS (Transport Layer Security) | A cryptographic protocol that encrypts network communication, used in some OPC UA transport bindings. |
| Trust List | A server- or client-maintained list of certificates and certificate authorities it considers trustworthy. |
| Revocation List | A list of certificates that have been invalidated before their expiration date, typically due to compromise. |
| OPC Security | An OPC Classic-era specification defining how to control client access to servers and protect sensitive process data. |