Securing OPC UA Connections With Certificates and User Authentication

Securing an OPC UA connection between a PLC data source and a visualization client requires layering three distinct controls: restricting which encryption endpoints are available, establishing certificate-based machine trust, and requiring authenticated user credentials. OPC Expert Security Gateway manages all three layers from a single interface, allowing you to configure them independently or in any combination based on your security requirements.

Layer One: Encryption Endpoint Restrictions

OPC UA servers expose multiple connection endpoints, each corresponding to a different security policy such as no security, sign only, sign and encrypt with 128-bit keys, or sign and encrypt with 256-bit keys. By default, many OPC UA servers leave all of these endpoints active, including the unsecured “None” endpoint. Any client that can reach the server can connect with no encryption and no authentication.

The first step in hardening an OPC UA connection is to remove the endpoints you do not want to offer. In OPC Expert Security Gateway, you navigate to the security settings of the OPC UA server you are publishing through the gateway and remove the endpoint policies that do not meet your requirements. For example, you might remove the “None” endpoint and all 128-bit options so that only 256-bit sign and encrypt connections are permitted. Clients that attempt to connect using a lower security policy will be unable to establish a session.

Layer Two: Certificate Trust Management

Even after you restrict the encryption endpoints, any client with a valid certificate can still connect. Certificate trust management adds a second control: you explicitly decide which client certificates you accept. When a client connects, OPC Expert Security Gateway displays the certificate it presented. You can then mark that certificate as trusted or rejected. A rejected certificate cannot complete the connection regardless of whether the client provides correct credentials.

You can also configure the gateway to reject all new certificates by default, requiring an administrator to manually review and trust each new client certificate before it can connect. This is particularly useful in environments where you want to prevent unrecognized applications or machines from ever establishing a session, even temporarily. The certificate is tied to a specific application and machine, so trusting a certificate from one computer does not automatically trust the same application running on a different computer.

Layer Three: User Account Authentication

Certificate trust verifies the machine and application. User account authentication verifies the individual operator or process connecting through that machine. OPC Expert Security Gateway supports Windows user accounts, OPC-specific user accounts you create directly in the gateway, and anonymous access. You can create OPC user accounts with individual usernames and passwords without needing to create Windows accounts on the server machine, which is useful in environments with strict IT policies around account management. The OPC Foundation defines the authentication model and certificate specifications that the gateway implements.

User accounts are also the mechanism through which folder-level and item-level access restrictions are applied. You assign permissions to specific users or user groups for particular branches of the OPC namespace. A user who authenticates successfully but lacks permission to a specific folder will not see that folder when browsing, and any attempt to read or write items in that folder will be denied.

Relevant Tools

OPC Security Gateway within OPC Expert provides endpoint management, certificate trust controls, and user account creation all in one interface. It applies these controls to both OPC UA and OPC Classic connections coming into the gateway.

OPC Viewer, another OPC Expert module, can be used to verify and test the connection policies you have configured, allowing you to simulate a client connection and confirm that the correct data is visible or restricted based on the credentials used.

, explicitly trusting only known client certificates, and requiring authenticated user credentials. OPC Expert Security Gateway implements all three controls independently so you can apply exactly the combination your environment requires, from basic encryption enforcement to fully granular per-user, per-item access control.