OPC UA certificate renewal is an operational change that can affect every client trusting an application. Plan the inventory, replacement, trust distribution, and validation before expiry. A new certificate with the same visible application name may still require changes in peer trust stores.
Design the requirement before the configuration
Record certificate owner, application URI, host names, issuer, expiry, trust model, and every dependent client or server. Distinguish application certificates from user authentication and from HTTPS certificates used by separate web services. Follow the product’s supported renewal procedure and protect private keys. For a CA-based design, understand chain and revocation handling. For directly trusted certificates, inventory the peers that must receive the replacement.
Worked scenario
An illustrative server replacement is trusted by one engineering client but rejected by a historian that still trusts the old certificate. A single successful browse test therefore does not validate the change. Use a dependency checklist and verify each client’s connection, intended permissions, data quality, and recovery behavior. Retain a product-supported recovery plan if the change cannot be completed.
What to verify
| Check | Evidence to record |
|---|---|
| Identity | Application URI, names, issuer, and validity period |
| Dependencies | All clients, servers, gateways, and trust stores |
| Change | Supported renewal procedure and secure key handling |
| Validation | Connections, roles, values, and reconnect behavior |
Acceptance and handover
Track expiry as an owned maintenance activity and exercise renewal in a test environment when possible. Do not fix a trust failure by enabling insecure endpoints or accepting every certificate. Investigate the validation result and correct the specific identity, trust, time, or policy issue.
Continue the engineering work
Use the related technical library for deeper background, or follow an ASP project guide to plan the implementation sequence.
Primary references and further reading
Use the original specifications and product documentation for implementation details. The examples in this guide are illustrative engineering scenarios, not published project results.