Separate identity from permission
An OPC UA application certificate helps establish the identity of the application at the other end of a connection. Deciding which tags a user may read or write is a separate authorisation decision. Connecting to a trusted application does not mean every user should have every permission. Start with the read access needed for the use case. Apply a separate account, explicit scope and the plant's change procedure to write operations. Document why each permission is needed.
Manage the certificate lifecycle
Assign responsibility for certificate creation, distribution, trust-list approval, renewal and revocation. Verify fingerprints through a trusted channel. Do not enable automatic trust for every certificate simply to make an error disappear. Synchronised client and server clocks matter for validity checks and incident analysis. Recheck endpoint and certificate matching after machine or hostname changes. Record the renewal procedure while commissioning, when the people responsible for both ends of the connection are available.
Keep network boundaries intact
OPC UA security does not replace plant network design. Limit access to the systems that need it and avoid exposing controllers directly to the internet. Document data flows, firewall rules and ownership at the IT/OT boundary. Diagnose certificate, endpoint, DNS and permission failures separately instead of permanently disabling security to restore connectivity. Remove passwords and private keys from diagnostic packages shared with support. A temporary troubleshooting change needs an owner and an explicit reversal step.
Include negative acceptance tests
In a test environment, try an invalid certificate, an expired certificate, an unauthorised user and an incorrect endpoint. The system should reject them as intended and produce useful diagnostics. Also test reconnection after certificate renewal. Manage private-key backup, access and storage under the organisation's security policy. Add the certificate owner, expiry date and next review date to the commissioning record so security remains an operational process after the integrator leaves.
Technical references
Check manufacturer documentation for product capabilities. Project steps and examples were prepared by OPC Turkey.