OPC UA Server Setup with Kepware

This guide walks through the complete process of configuring OPC UA server functionality in Kepware KEPServerEX. Once configured, OPC UA clients can securely connect to read and write process data from any device driver installed in KEPServerEX.

Prerequisites

• KEPServerEX v6.8 or later installed and running
• At least one channel and device already configured
• Administrative access to the KEPServerEX Administration tool
• OPC UA feature included in your license (or running in demo mode)
• Windows Firewall configured to allow the OPC UA port (default: 49320)

Step-by-Step Configuration

Step 1: Enable the OPC UA Server

1. Open KEPServerEX Administration.
2. Navigate to Settings then OPC UA in the project tree.
3. Set "OPC UA Server Enabled" to Yes.
4. Note the default endpoint URL: opc.tcp://[hostname]:49320
5. Click Apply to save the configuration.

Step 2: Configure Server Instance

1. Set the Server URI — The unique identifier for your server instance. Format: urn:[hostname]:Kepware:KEPServerEX
2. Configure the Server Name — A human-readable name for OPC UA client discovery (e.g., Plant01_KEPServer).
3. Set the Discovery Server URL if you have a Local Discovery Server (LDS): opc.tcp://[LDS-host]:4840

Step 3: Configure Security Policies

1. Navigate to OPC UA then Security Policies.
2. Enable the desired policies. For production environments, recommended minimum:
   • Basic256Sha256 — Sign and Encrypt (recommended minimum)
   • Aes128-Sha256-RsaOaep — Modern AES encryption
   • Aes256-Sha256-RsaPss — Highest security level
3. Disable None security policy in production (use only for testing).

Step 4: Generate and Manage Certificates

1. Navigate to OPC UA then Certificate Management.
2. Click "Generate New Certificate" if no server certificate exists.
3. Fill in the certificate fields:
   • Common Name (CN): KEPServerEX_Plant01
   • Organization (O): ASP OTOMASYON
   • Application URI: urn:[hostname]:Kepware:KEPServerEX
   • Validity Period: 3650 days (10 years)
4. Export the server certificate (.der file) to share with OPC UA clients for trust establishment.
5. Import trusted client certificates into the Trusted certificate store.

Step 5: Configure User Authentication

1. Navigate to OPC UA then User Authentication.
2. Enable Anonymous access only for testing. For production, use:
   • Certificate-based — Clients authenticate using X.509 certificates
   • Username/Password — Clients provide credentials defined in User Manager
3. Create specific user accounts with least-privilege access.

Step 6: Configure Namespace

1. Navigate to OPC UA then Namespace.
2. Choose namespace organization:
   • Flat — All tags in a single folder (simple, small deployments)
   • Hierarchical — Tags organized by channel and device (recommended)
3. Enable Data Access, Alarms and Conditions, and Historical Access as needed.

Step 7: Apply and Restart

1. Click Apply to save all OPC UA configuration changes.
2. Restart the KEPServerEX runtime: right-click the system tray icon, select Restart Runtime.
3. Verify in the Event Log that the OPC UA server started successfully.

Testing with an OPC UA Client

Use a generic OPC UA client to verify the server configuration:

1. Install a Test Client — Options: UaExpert (free, by Unified Automation), Prosys OPC UA Browser, or the OPC Foundation .NET sample client.
2. Create a Connection — Enter the server endpoint: opc.tcp://[hostname]:49320
3. Trust the Certificate — If using security, accept and save the server certificate when prompted.
4. Authenticate — Provide the configured credentials or certificate.
5. Browse the Namespace — Navigate the address space and verify that channels, devices, and tags are visible.
6. Read/Write Values — Subscribe to a few tags and verify that values update in real time.

Common Issues and Solutions

Configuration Summary

OPC UA Server Configuration Summary
====================================
Endpoint URL    : opc.tcp://plant01-server:49320
Server URI      : urn:plant01-server:Kepware:KEPServerEX
Server Name     : Plant01_KEPServer
Security Policy : Basic256Sha256 (Sign and Encrypt)
Auth Mode       : Certificate + Username/Password
Namespace       : Hierarchical (Channel - Device - Tag)
Discovery       : LDS at opc.tcp://discovery-server:4840
Firewall Port   : 49320/TCP (inbound)

ASP OTOMASYON A.Ş. and its subsidiaries OPCTurkey and ASP Dijital provide end-to-end industrial engineering solutions for process automation, data operations and AI.

References & Further Reading

1. PTC Kepware KEPServerEX — Official Documentation — Official product documentation covering installation, channel/device configuration, and OPC UA server setup in KEPServerEX.
2. OPC Foundation — OPC UA Security and Certificate Management — Official guidance on OPC UA X.509 certificate generation, trust establishment, and security policy configuration.
3. Unified Automation UaExpert — OPC UA Client Tool — Official page for the UaExpert OPC UA test client, widely used for testing OPC UA server connections and browsing address spaces.
4. Prosys OPC UA Browser — Official Prosys OPC UA client tool for server discovery, certificate management, and address space browsing.
5. PTC Kepware Support — OPC UA Configuration Knowledge Base — Official Kepware knowledge base articles covering OPC UA troubleshooting, certificate issues, and security policy configuration.

Primary references and further reading

Use the original specifications and product documentation for implementation details. The examples in this guide are illustrative engineering scenarios, not published project results.

• NIST SP 800-82 Rev. 3 — OT configuration and operational considerations
• ISA — Automation standards and committees