Endpoint

The Endpoint URL specifies the transport protocol and network address. The scheme opc.tcp:// is the native, high-performance binary protocol, while https:// or opc.wss:// are used for web-friendly JSON Encoding over WebSockets.

• Format: opc.tcp://<hostname>:<port>/<path>
• Default Port: 4840 for opc.tcp
• Example: opc.tcp://plc-line3.corp:4840/
• Discovery: A Server's GetEndpoints service returns all available URLs

Each Endpoint is bound to a single Security Policy, which defines the cryptographic algorithms for signing and encrypting messages. A Server typically exposes multiple Endpoints with different policies to support diverse client capabilities.

• None: No security, plaintext communication
• Basic128Rsa15: Legacy policy, deprecated
• Basic256: AES-256 encryption, SHA-1 signing
• Basic256Sha256: AES-256 encryption, SHA-256 signing
• Aes128-Sha256-RsaOaep: Modern, recommended policy
• Aes256-Sha256-RsaPss: Highest security level

The Endpoint also specifies the User Token Policy, which dictates how a human user or application authenticates after the Secure Channel is established. This enables Role-Based Access Control on the Server's Address Space.

• Anonymous: No user identity required
• UserName: Authenticate with username and password
• X.509 Certificate: Authenticate with a user-specific digital certificate
• IssuedToken: Authenticate using an external token service like OAuth2 or JWT

The Endpoint's MessageSecurityMode determines the level of protection applied to each message on the wire. This is negotiated during the Secure Channel handshake.

• None: No application-layer security
• Sign: Messages are digitally signed for integrity and non-repudiation, but not encrypted
• SignAndEncrypt: Messages are both signed and encrypted, providing confidentiality and integrity

Clients discover available Endpoints by querying the Server's Discovery Endpoint, a well-known, typically unsecured endpoint used solely for bootstrapping.

1. Client connects to the Discovery Endpoint
2. Client calls the GetEndpoints service
3. Server returns a list of EndpointDescription structures
4. Each description contains the Endpoint URL, Security Policy, Security Mode, and User Token Policies
5. Client selects a compatible Endpoint and initiates a Secure Channel

During connection, the Client must validate the Server's X.509 Certificate presented by the Endpoint. This prevents man-in-the-middle attacks by ensuring the Server is who it claims to be.

• The certificate's hostname must match the Endpoint URL
• The certificate must be issued by a trusted Certificate Authority
• The certificate must not be expired or revoked
• Clients maintain a Trust List of accepted Server certificates

The transport-level connection established between an OPC UA application and a host. It provides encryption, message signing, and integrity for all data in transit. Before a Session can be created, a Secure Channel must be opened using the protocols and algorithms defined by the selected Security Policy. This layer ensures that even if packets are intercepted, they cannot be read or tampered with.

A long-lived logical connection between a Client and Server that operates over a Secure Channel. The Session manages user authentication, continuity, and state across multiple service requests. If the underlying Secure Channel breaks, a Session can be transferred to a new channel within a configurable timeout, preserving subscriptions and preventing data loss during network interruptions.

A named set of cryptographic algorithms and key lengths that define how an Endpoint secures communications. Each Endpoint advertises exactly one Security Policy, which specifies:

• Symmetric encryption algorithm (e.g., AES-256)
• Message signing algorithm (e.g., SHA-256)
• Key derivation function
• Asymmetric key wrap algorithm Clients must support the policy to connect.

A digital certificate conforming to the ITU-T X.509 standard, used during the Secure Channel handshake to establish application identity and trust. Each OPC UA application instance has a unique certificate. During the handshake, the Client and Server exchange certificates to prove their identities before any application data flows. Administrators must explicitly trust these certificates to authorize a connection.

A connectivity mechanism where the Server initiates the connection to a Client, reversing the typical TCP connection flow. This is critical for edge-to-cloud scenarios where a Server sits behind a firewall or NAT and cannot accept inbound connections. The Server connects to a known Client address, and the Client then establishes the Secure Channel and Session over this reversed transport.

A centralized registry that maintains a list of known OPC UA Servers and their discovery Endpoints. Instead of requiring Clients to know every Server's address, a Client queries the GDS to find available systems across a large, segmented network. The GDS returns the Discovery Endpoint URL for each registered Server, which the Client then uses to retrieve the full list of operational Endpoints.