The model
Three layers, configured separately
OPC UA security is not one switch. Transport protection, application identity, and user identity are independent layers — and a deployment is only as strong as the weakest one you left at its default.
TRANSPORT SECURITY
Signing and encryption of every message between client and server, negotiated per connection. This is the layer the security mode and security policy settings control — and the one most often switched off.
APPLICATION AUTHENTICATION
Every OPC UA application holds an X.509 certificate. Client and server exchange and validate certificates before a session opens — each side only talks to applications in its trust list.
USER AUTHENTICATION & AUTHORISATION
Separate from the application layer: the session carries a user identity — anonymous, username/password, or a user certificate — which the server maps to read/write permissions on its address space.
Pro members only
The full guide is part of Control Signal Pro
Pro members get every deep-dive guide, plus the dashboard, asset register, and CVE alerts matched to the equipment they actually run. Sign in to upgrade, or start with a free account.