Managing OPC UA Certificates: Expiry, Revocation, and Trust in OPC Expert
OPC UA uses X.509 certificates to establish machine and application identity during the connection handshake. In OPC Expert Security Gateway, certificate trust is managed manually through the security settings interface. When a client connects, its certificate is either in the trusted list, the rejected list, or pending review. A certificate that is not trusted will prevent the connection from completing, regardless of whether the client supplies valid user credentials.
How OPC Expert Stores and Evaluates Certificates
When a client application connects to an OPC UA endpoint managed by OPC Expert Security Gateway for the first time, the gateway captures the certificate presented by that client. The certificate appears in the security configuration view where an administrator can choose to trust it or reject it. Once trusted, the certificate is added to the trusted certificate store and that client can connect automatically on future attempts without further administrator action.
If the gateway is configured to reject new certificates by default (which is the more security-conscious posture), no new client will be able to establish a session until an administrator explicitly reviews and trusts its certificate. This prevents unrecognized applications or machines from gaining even temporary access while awaiting review.
What Happens When a Certificate Expires
OPC UA certificates have a validity period defined when the certificate is created. The OPC Foundation specifies X.509 certificate usage within the OPC UA security model, and when a certificate passes its expiry date, OPC UA compliant implementations treat it as invalid. In a strict security configuration, an expired certificate will be rejected and the client will be unable to connect until the certificate is renewed and re-trusted in the gateway.
Organizations should track the expiry dates of certificates in use and plan for renewal before expiry occurs. When a client generates a new certificate after reinstallation or certificate renewal, it will appear as untrusted in OPC Expert Security Gateway and will require administrator approval before connectivity is restored.
What Happens When a Certificate Is Revoked or Replaced
If you need to revoke access for a specific client, you change the trust status of its certificate from trusted to rejected in the OPC Expert Security Gateway security settings. This takes effect immediately; any active session from that client will be terminated and future connection attempts will fail. This provides a direct mechanism to cut off access from a specific application or machine without changing any other security policies.
When a client is reinstalled or upgraded and generates a new certificate, the old certificate in the trusted list no longer matches the certificate the client presents. The new certificate will appear as a new untrusted entry and must be reviewed and trusted before the client can reconnect. The old certificate entry in the trusted list can be removed to keep the certificate store clean.
Planning for Certificate Maintenance
Certificate management in OPC UA environments requires the same operational discipline as certificate management in any other secured system. Track expiry dates for all certificates in use, establish a process for administrators to review and trust new or renewed certificates promptly when connectivity is interrupted, and periodically audit the trusted certificate store to remove entries no longer in use. OPC Expert Security Gateway surfaces these controls through its interface without requiring an external certificate authority, making certificate maintenance accessible to automation teams without deep PKI expertise.
Relevant Tools
OPC Security Gateway within OPC Expert is where certificate trust management is performed. Its security settings interface shows all known client certificates and allows administrators to trust, reject, or remove them.
OPC Viewer can assist in testing certificate trust by attempting connections with different client certificates to verify that the trust policies are enforced as configured.
Conclusion
OPC UA certificate management in OPC Expert Security Gateway is an administrator-controlled process: certificates must be explicitly trusted before a client can connect, and revoking access is as simple as rejecting the certificate. Track certificate validity periods and be prepared to trust a new certificate whenever a client application is reinstalled or its certificate is renewed, as this will interrupt connectivity until an administrator reviews and approves it.