Easily Manage OPC UA Endpoint and Security Settings

Comprehensive management for OPC UA endpoints and security settings

The TOP Server OPC UA Configuration Manager is accessible through the TOP Server Administration system tray icon and provides centralized management of all OPC UA server endpoints, their associated ports and supported security and encryption settings and management for trust relationships with OPC UA servers and clients.

The OPC UA Configuration Manager is also key to managing secure certificates whether you're self-issuing an OPC UA certificate or importing a certificate from a third-party firm.

Configuring the OPC UA Project Properties

The first step of configuring OPC UA access for TOP Server is located in the TOP Server Configuration under the Project Properties under the OPC UA section. Most settings here can be left at the default - the key settings of interest here are the following:

• Enable - Defaults to No for secure-out-of-the-box operations. You'll need to set this to "Yes" if you plan to use the OPC UA server interface for connectivity from your OPC UA client applications.
• Log Diagnostics - Defaults to No - Only set this to "Yes" if you need to troubleshoot OPC UA client connection issues - this allows OPC UA calls to be logged to the OPC Diagnostics and does result in some additional resource usage while enabled.
• Allow Anonymous Login - Defaults to No - Only set this to "Yes" if you absolutely sure your company and/or control network is secure from external access as this allows OPC UA client connections without requiring a username and password (see TOP Server User Manager for details on defining users). It is recommended to consult your IT and/or cybersecurity departments prior to changing this setting.

The Client Sessions and Browsing sections are described in detail in the help file and control how the TOP Server behaves when OPC UA clients attempt to connect to the TOP Server. For most applications, these can remain at the defaults.

OPC UA Server Endpoint Configuration

An OPC UA server endpoint is a URL that OPC UA clients use to access the OPC UA server (if you're more familiar with OPC DA Classic, this is the OPC UA equivalent of a ProgID). Most OPC UA servers (including TOP Server) can support multiple endpoints for different purposes including different levels of security and whether the endpoint is accessible from an external machine or not.

The server endpoint is where you can define the following parameters for connecting an OPC UA client application:

• Network Adapter - Allows you to specify the NIC that should be used for OPC UA communications with this endpoint - this will determine the IP Address and Host Name associated with this endpoint for external access.  Specifying "Localhost Only" restricts access to this endpoint to only OPC UA clients installed on the same machine as TOP Server.
• Port Number - This port number is configurable and is included as part of the server endpoint URL used by the OPC UA client. For successful OPC UA communications with this endpoint through a secure firewall, you will need to discuss the necessary port requirements for your company with your IT department.
• Security Policies - These settings define the encryption and signing behavior supported by this endpoint.
  • Policies:
    • None (Disabled by default)
    • Basic128Rsa15 (Enabled by default)
    • Basic256 (Enabled by default)
  • Signing/Encryption Options:
    • Sign
    • Sign and Encrypt
    • Sign; Sign and Encrypt (Default)

The most secure encrypted endpoint would enable only Basic256 with Sign and Encrypt (with other options disabled), for example.  The least secure endpoint would enable only None (with other options disabled), for example - this is NOT recommended.

For a more in-depth explanation of how OPC UA encryption and signing keeps your process data secure, review our blog series on Exploring OPC UA.

OPC UA Discovery Servers Configuration

Any OPC UA server (including TOP Server) may register with an OPC UA Discovery Server in order to make its endpoint information available to OPC UA clients for browsing purposes. In order to perform this registration, TOP Server must know what endpoint or endpoints to use for registering with that Discovery Server.

The certificate of the Discovery Server must be obtained and stored in TOP Server's trusted certificate store.

In the same fashion, the TOP Server's UA server certificate must be obtained and stored in the UA Discovery Server's trusted certificate store.

The OPC UA Configuration Manager provides the ability to import, remove and view trusted Discovery Server endpoints that will be identified to the UA server interface.

NOTE: While TOP Server does NOT install with its own OPC UA Discovery Server, registering with third-party OPC UA Discovery Servers is supported.

OPC UA Instance Certificates Configuration

This section allows management of the OPC UA security certificates for both the TOP Server OPC UA server interface and the OPC UA Client driver. This section makes it possible to do the following for both server and client interfaces:

• View certificate - these buttons open the properties of the respective certificate including who it was issued to, who it was issued by, how long it's valid until, the security policy used and other details.
• Export certificate - these buttons allow you to export the server certificate for import into an OPC UA client or to export the client certificate for import into an OPC UA server.
• Reissue certificate - these buttons allow you to reissue the self-signed certificates issued by TOP Server for either interface. This invalidates the previous certificate, effectively invalidating the trust relationship for any OPC UA client or server you have previous established with the previous certificate and you will need to reestablish that trust to connect again successfully.
• Import certificate - these buttons allow you to import a certificate to be used for the respective client or server interface. Certificates must be in the PKCS12 format (.pfx extension) and must contain both the instance certificate and private key (they may also be password protected). This makes it possible to use certificates from third-party certificate authorities such as Verisign or others.