{"data":{"slug":"opc-ua-security-best-practices","title":"OPC UA Security Best Practices","summary":"OPC UA was designed with security as a foundational requirement, not an afterthought.","category":{"slug":"opc-solutions","name":"OPC Solutions"},"url":"https://wiki.aspotomasyon.com/article/opc-ua-security-best-practices","markdown_url":"https://wiki.aspotomasyon.com/article/opc-ua-security-best-practices.md","api_url":"https://wiki.aspotomasyon.com/api/v1/articles/opc-ua-security-best-practices","published":"2026-07-21T14:45:28+00:00","modified":"2026-09-13T11:07:23+00:00","reading_minutes":4,"word_count":860,"image":"https://wiki.aspotomasyon.com/assets/social/opc-ua-security-best-practices-8eff8da783a4.png","html":"

OPC UA was designed with security as a foundational requirement, not an afterthought. The specification includes a comprehensive security model covering authentication, authorization, encryption, and audit logging. However, realizing these security capabilities requires deliberate configuration and ongoing management. This article covers the essential security practices for deploying OPC UA in industrial environments.

\"A
A conceptual OPC UA client/server path. Application certificates establish application trust; user authorization controls what a connected user may do. View full size
\n\n

OPC UA Security Architecture

\n\n

The OPC UA security model operates at two levels:

\n\n\n\n

Security Policies (Message Security Modes)

\n\n\n \n \n \n \n \n \n \n \n
ModeEncryptionSigningUse Case
NoneNoNoTrusted networks only (not recommended for production)
SignNoYesIntegrity verification without confidentiality (low-latency requirements)
SignAndEncryptYesYesRecommended for all production deployments
\n\n

OPC UA supports multiple security policies that define the cryptographic algorithms used:

\n\n\n\n

Certificate Management

\n\n

OPC UA uses X.509 certificates for application authentication and secure channel establishment. Proper certificate management is the most critical and most challenging aspect of OPC UA security:

\n\n\n\n

PKI Options

\n\n \n \n \n \n \n \n \n \n
ApproachDescriptionBest For
Self-signed certificatesEach application generates its own certificate. Trust is established by manually exchanging certificates.Small deployments (<20 applications), isolated networks.
Private CAAn internal Certificate Authority issues and manages certificates for all OPC UA applications.Medium to large enterprises with IT/OT convergence.
Public CACertificates issued by a trusted public Certificate Authority.Multi-vendor, multi-site deployments requiring cross-organizational trust.
\n\n

User Authentication

\n\n

OPC UA supports three user authentication mechanisms:

\n\n\n\n

Network Security Recommendations

\n\n\n\n

OPC UA over TSN and 5G Security Considerations

\n\n

As OPC UA extends to Time-Sensitive Networking (TSN) and 5G networks for real-time and mobile applications, additional security considerations apply:

\n\n\n\n

ASP OTOMASYON implements secure OPC UA architectures for industrial clients, including certificate lifecycle management, security policy configuration, and network segmentation aligned with IEC 62443 requirements.

Treat certificate expiry as an operational dependency

Maintain an inventory of application certificates, their owners, expiry dates, and dependent peers. Test the supported renewal procedure before the maintenance window. Keep user authorization separate from application trust and verify both after the change. Investigate identity or trust failures directly instead of enabling insecure endpoints to make a connection appear healthy.

Continue with the related practical guide.

Apply this to your project

Follow an ASP project guide to connect the fundamentals with implementation and acceptance.

\"Engineering
Engineering review sequence: Discover → Authenticate → Subscribe → Recover. Keep the recorded evidence with the accepted configuration. View full size

Primary references and further reading

Use the original specifications and product documentation for implementation details. The examples in this guide are illustrative engineering scenarios, not published project results.

","markdown":"# OPC UA Security Best Practices\n\n> OPC UA was designed with security as a foundational requirement, not an afterthought.\n\n- Canonical URL: https://wiki.aspotomasyon.com/article/opc-ua-security-best-practices\n- Publisher: ASP OTOMASYON A.Ş. (ASP OTOMASYON Wiki)\n- Category: OPC Solutions\n- Published: 2026-07-21 · Updated: 2026-09-13\n- Reading time: 4 min · Language: English\n\nOPC UA was designed with security as a foundational requirement, not an afterthought. The specification includes a comprehensive security model covering authentication, authorization, encryption, and audit logging. However, realizing these security capabilities requires deliberate configuration and ongoing management. This article covers the essential security practices for deploying OPC UA in industrial environments.\n\n![A conceptual OPC UA client/server path. Application certificates establish application trust; user authorization controls what a connected user may do.](https://wiki.aspotomasyon.com/assets/diagrams/opc-solutions-context.svg)\n\n*A conceptual OPC UA client/server path. Application certificates establish application trust; user authorization controls what a connected user may do.*\n\n## OPC UA Security Architecture\n\nThe OPC UA security model operates at two levels:\n\n- **Channel security** — Protects the communication channel between client and server using encryption and message signing.\n- **Application security** — Authenticates and authorizes users and applications through user tokens and application certificates.\n\n## Security Policies (Message Security Modes)\n\n| Mode | Encryption | Signing | Use Case |\n| --- | --- | --- | --- |\n| **None** | No | No | Trusted networks only (not recommended for production) |\n| **Sign** | No | Yes | Integrity verification without confidentiality (low-latency requirements) |\n| **SignAndEncrypt** | Yes | Yes | Recommended for all production deployments |\n\nOPC UA supports multiple security policies that define the cryptographic algorithms used:\n\n- **Basic128Rsa15** — AES-128 encryption, SHA-1 signatures, RSA-1024 key exchange. Legacy support only.\n- **Basic256** — AES-256 encryption, SHA-1 signatures, RSA-1024/2048 key exchange. Legacy support only.\n- **Basic256Sha256** — AES-256 encryption, SHA-256 signatures, RSA-2048 key exchange. **Recommended minimum for new deployments.**\n- **Aes128-Sha256-RsaOaep** — AES-128 encryption, SHA-256 signatures, RSA-OAEP key exchange.\n- **Aes256-Sha256-RsaPss** — AES-256 encryption, SHA-256 signatures, RSA-PSS key exchange. Highest security level.\n\n## Certificate Management\n\nOPC UA uses X.509 certificates for application authentication and secure channel establishment. Proper certificate management is the most critical and most challenging aspect of OPC UA security:\n\n- **Application instance certificates** — Each OPC UA application (client and server) must have a unique certificate that identifies it. The certificate's Subject Name and Application URI must match the application's identity.\n- **Trust lists** — Each application maintains a trust list of certificates it accepts. Unknown certificates are rejected by default (reject-before-accept model).\n- **Certificate validation** — Certificates are validated against the trust list, checked for expiration, and verified against a Certificate Revocation List (CRL) if available.\n- **Private key protection** — Application private keys must be stored securely. On embedded devices, use hardware security modules (HSM) or trusted platform modules (TPM) where available.\n\n### PKI Options\n\n| Approach | Description | Best For |\n| --- | --- | --- |\n| **Self-signed certificates** | Each application generates its own certificate. Trust is established by manually exchanging certificates. | Small deployments (<20 applications), isolated networks. |\n| **Private CA** | An internal Certificate Authority issues and manages certificates for all OPC UA applications. | Medium to large enterprises with IT/OT convergence. |\n| **Public CA** | Certificates issued by a trusted public Certificate Authority. | Multi-vendor, multi-site deployments requiring cross-organizational trust. |\n\n## User Authentication\n\nOPC UA supports three user authentication mechanisms:\n\n- **Anonymous** — No user identification. Should be disabled in production environments.\n- **Username/password** — Authenticates against a local user store or external directory (LDAP, Active Directory). Passwords are transmitted encrypted over the secure channel.\n- **X.509 user certificate** — The client presents a user certificate for authentication. Provides stronger assurance than passwords and enables certificate-based access control.\n\n## Network Security Recommendations\n\n- **Network segmentation** — Place OPC UA servers and clients in dedicated OT network segments. Use firewalls to restrict access to OPC UA ports (typically 4840 for OPC UA TCP).\n- **Disable unused security policies** — Only enable the security policies you actually use. Disable \"None\" mode in production.\n- **Session timeout** — Configure appropriate session timeouts to limit the window of exposure from abandoned sessions.\n- **Audit logging** — Enable OPC UA audit logging to record security-relevant events: session creation, certificate validation failures, denied access attempts, and user authentication events.\n- **Rate limiting** — Configure connection limits and request rate limits to protect against denial-of-service attacks.\n- **Secure discovery** — Use LDS (Local Discovery Server) with certificate-based registration rather than unsecured multicast discovery in production.\n\n## OPC UA over TSN and 5G Security Considerations\n\nAs OPC UA extends to Time-Sensitive Networking (TSN) and 5G networks for real-time and mobile applications, additional security considerations apply:\n\n- **TSN** — OPC UA Pub/Sub over TSN uses the same application-layer security (SignAndEncrypt) but must also consider TSN network configuration security (IEEE 802.1Qci for per-stream filtering).\n- **5G** — OPC UA over 5G leverages 5G network slicing for isolation and 5G authentication mechanisms, but application-layer OPC UA security should still be applied for end-to-end protection.\n\n> ASP OTOMASYON implements secure OPC UA architectures for industrial clients, including certificate lifecycle management, security policy configuration, and network segmentation aligned with IEC 62443 requirements.\n\n## Treat certificate expiry as an operational dependency\n\nMaintain an inventory of application certificates, their owners, expiry dates, and dependent peers. Test the supported renewal procedure before the maintenance window. Keep user authorization separate from application trust and verify both after the change. Investigate identity or trust failures directly instead of enabling insecure endpoints to make a connection appear healthy.\n\nContinue with [the related practical guide](https://wiki.aspotomasyon.com/article/opc-ua-certificate-renewal-plan).\n\n## Apply this to your project\n\n- Record the endpoint, supported security policies, application identity, certificate expiry, and user permissions.\n- Verify the value, engineering unit, StatusCode, and source timestamp together at the receiving application.\n- Test disconnection and recovery with representative subscriptions; preserve evidence of any data gaps or repeated values.\n\n[Follow an ASP project guide](https://wiki.aspotomasyon.com/guides) to connect the fundamentals with implementation and acceptance.\n\n![Engineering review sequence: Discover → Authenticate → Subscribe → Recover. Keep the recorded evidence with the accepted configuration.](https://wiki.aspotomasyon.com/assets/diagrams/opc-solutions-review.svg)\n\n*Engineering review sequence: Discover → Authenticate → Subscribe → Recover. Keep the recorded evidence with the accepted configuration.*\n\n## Primary references and further reading\n\nUse the original specifications and product documentation for implementation details. The examples in this guide are illustrative engineering scenarios, not published project results.\n\n- [OPC Foundation — OPC UA Part 4: Services](https://reference.opcfoundation.org/specs/OPC-10000-4/)\n- [OPC Foundation — OPC UA Part 2: Security Model](https://reference.opcfoundation.org/specs/OPC-10000-2/)\n\n---\n\nCite the canonical article: https://wiki.aspotomasyon.com/article/opc-ua-security-best-practices (OPC UA Security Best Practices, ASP OTOMASYON, updated 2026-09-13).\n","headings":[{"id":"opc-ua-security-architecture","title":"OPC UA Security Architecture"},{"id":"security-policies-message-security-modes","title":"Security Policies (Message Security Modes)"},{"id":"certificate-management","title":"Certificate Management"},{"id":"user-authentication","title":"User Authentication"},{"id":"network-security-recommendations","title":"Network Security Recommendations"},{"id":"opc-ua-over-tsn-and-5g-security-considerations","title":"OPC UA over TSN and 5G Security Considerations"},{"id":"treat-certificate-expiry-as-an-operational-dependency","title":"Treat certificate expiry as an operational dependency"},{"id":"apply-this-to-your-project","title":"Apply this to your project"},{"id":"primary-references-and-further-reading","title":"Primary references and further reading"}],"faq":[],"references":[{"name":"OPC Foundation — OPC UA Part 4: Services","url":"https://reference.opcfoundation.org/specs/OPC-10000-4/"},{"name":"OPC Foundation — OPC UA Part 2: Security Model","url":"https://reference.opcfoundation.org/specs/OPC-10000-2/"}],"related":[{"slug":"opc-ua-discovery-lds-gds","title":"OPC UA Discovery: LDS, LDS-ME, and Global Discovery Server Explained","summary":"OPC UA discovery lets clients find servers and their endpoints through a local discovery server on each host, a multicast extension, or a global discovery…","category":{"slug":"opc-solutions","name":"OPC Solutions"},"url":"https://wiki.aspotomasyon.com/article/opc-ua-discovery-lds-gds","markdown_url":"https://wiki.aspotomasyon.com/article/opc-ua-discovery-lds-gds.md","api_url":"https://wiki.aspotomasyon.com/api/v1/articles/opc-ua-discovery-lds-gds","published":"2026-10-11T11:46:21+00:00","modified":"2026-10-11T11:46:21+00:00","reading_minutes":9,"word_count":1844,"image":"https://wiki.aspotomasyon.com/assets/social/opc-ua-discovery-lds-gds-c305c85ac14a.png"},{"slug":"opc-ua-protocol-overview","title":"OPC UA Protocol Overview","summary":"OPC Unified Architecture (OPC UA) , defined by IEC 62541, is the platform-independent, service-oriented architecture for secure, reliable data exchange in…","category":{"slug":"opc-solutions","name":"OPC Solutions"},"url":"https://wiki.aspotomasyon.com/article/opc-ua-protocol-overview","markdown_url":"https://wiki.aspotomasyon.com/article/opc-ua-protocol-overview.md","api_url":"https://wiki.aspotomasyon.com/api/v1/articles/opc-ua-protocol-overview","published":"2026-05-12T12:47:31+00:00","modified":"2026-09-13T11:07:23+00:00","reading_minutes":4,"word_count":873,"image":"https://wiki.aspotomasyon.com/assets/social/opc-ua-protocol-overview-eae98061a685.png"},{"slug":"opc-ua-server-setup-with-kepware","title":"OPC UA Server Setup with Kepware","summary":"This guide walks through the complete process of configuring OPC UA server functionality in Kepware KEPServerEX. Once configured, OPC UA clients can securely…","category":{"slug":"technical-guides","name":"Technical Guides"},"url":"https://wiki.aspotomasyon.com/article/opc-ua-server-setup-with-kepware","markdown_url":"https://wiki.aspotomasyon.com/article/opc-ua-server-setup-with-kepware.md","api_url":"https://wiki.aspotomasyon.com/api/v1/articles/opc-ua-server-setup-with-kepware","published":"2026-05-12T12:47:31+00:00","modified":"2026-09-13T11:07:23+00:00","reading_minutes":5,"word_count":962,"image":"https://wiki.aspotomasyon.com/assets/social/opc-ua-server-setup-with-kepware-34ec46e25fac.png"},{"slug":"opc-da-to-ua-migration-guide","title":"Migrating from OPC DA to OPC UA","summary":"Migrating from OPC DA to OPC UA is one of the most common infrastructure projects in industrial IT. OPC DA (Data Access) has served industry for more than two…","category":{"slug":"opc-solutions","name":"OPC Solutions"},"url":"https://wiki.aspotomasyon.com/article/opc-da-to-ua-migration-guide","markdown_url":"https://wiki.aspotomasyon.com/article/opc-da-to-ua-migration-guide.md","api_url":"https://wiki.aspotomasyon.com/api/v1/articles/opc-da-to-ua-migration-guide","published":"2026-08-06T12:26:37+00:00","modified":"2026-09-13T11:07:23+00:00","reading_minutes":5,"word_count":999,"image":"https://wiki.aspotomasyon.com/assets/social/opc-da-to-ua-migration-guide-4dc7a9d57cd5.png"}],"citation":"ASP OTOMASYON. OPC UA Security Best Practices. Updated 2026-09-13. https://wiki.aspotomasyon.com/article/opc-ua-security-best-practices"}}