Fixing TRB140 OPC UA Client Security Mode Mismatch on S7-1500

Problem Overview

Connecting a Teltonika TRB140 cellular IoT gateway (acting as OPC UA client) to a Siemens SIMATIC S7-1500 CPU (acting as OPC UA server) frequently fails with a Security Mode Mismatch, Bad_SecurityModeRejected, or Bad_SecurityPolicyRejected status code reported in the TRB140 log (/var/log/opus_client.log) or the TIA Portal online diagnostics. The session open fails before any subscription or read/write operation can be issued, even though the server endpoint is reachable on TCP port 4840.

The failure is not a network problem. It is a configuration mismatch between the OPC UA SecurityPolicyUri, MessageSecurityMode, and certificate trust list that the TRB140 offers in its OpenSecureChannel request and what the S7-1500 server is configured to accept.

OPC UA Security Architecture

OPC UA Part 4 defines two independent parameters that govern session security. Both must match between client and server for a CreateSession and ActivateSession to succeed.

Per OPC UA specification, if SecurityPolicy is None, then MessageSecurityMode must also be None. Any combination of a non-None policy with Mode=None is rejected by a compliant server. This single rule accounts for a large share of "Security Mode Mismatch" errors observed when the S7-1500 is set to require encryption but the TRB140 default profile requests None.

Root Cause Analysis

The "Security Mode Mismatch" string reported by the TRB140 Web UI (Services → OPC UA → Status) is a composite of three distinct failure paths:

1. Policy rejection – the TRB140 advertises a policy the server has disabled (e.g., legacy Basic128Rsa15) or the S7-1500 advertises only Basic256Sha256 while the client lacks a SHA-256 capable certificate.
2. Mode rejection – the server demands SignAndEncrypt, but the client's stack is set to None (default on early TRB140 firmware), or vice versa.
3. Certificate rejection – the channel opens, but ActivateSession fails with Bad_CertificateInvalid or Bad_ApplicationUriInvalid because the client certificate is not in the S7-1500 trusted list, the Application URI in the certificate does not match the client configuration, or the chain is broken.

Open-source OPC UA stacks have reported this exact failure when the Application URI in the certificate subject alternative name does not match the ApplicationDescription.ApplicationUri advertised by the client at runtime – a validation strictly enforced by Siemens OPC UA server V3.5+ see open62541 issue #1316.

Siemens S7-1500 OPC UA Server Configuration

Enable the OPC UA server on the CPU and define which endpoints are exposed. In TIA Portal with the S7-1500 device selected, navigate to Properties → OPC UA → Server.

Compile and download the hardware configuration. The S7-1500 now exposes three to six EndpointDescription entries depending on which policy × mode combinations are enabled.

Configuring OPC UA Server Security in TIA Portal

Two further configuration steps are required before the S7-1500 will accept the TRB140 as a peer.

1. Define a server certificate. In Properties → OPC UA → Server → Certificates, select Self-signed or import a CA-issued certificate. The certificate's ApplicationUri field must match the DNS-style identifier TIA Portal auto-fills (typically urn:<CPU-name>:S7-1500:<serial>). Do not edit this URI manually.
2. Trusted client certificates. In Properties → OPC UA → Server → Trusted Clients → Certificate Trust List, add the DER-formatted client certificate exported from the TRB140 in step 4 below. Without this entry, every ActivateSession returns Bad_SecurityChecksFailed.

Teltonika TRB140 OPC UA Client Configuration

Access the TRB140 Web UI at https://<TRB140-LAN-IP> (default 192.168.2.1) and navigate to Services → OPC UA. The relevant fields are:

Endpoint URL Construction

The OPC UA discovery endpoint is always opc.tcp://<host>:<port>. From this base, GetEndpoints returns every supported policy/mode pair. The TRB140 walks this list in order and selects the first match. To force a deterministic match with the S7-1500, prefix the URL with the security policy token:

If the S7-1500 has been hardened to reject None, any request omitting the -sec flag fails immediately. This is the single most common reason the TRB140 logs a "Security Mode Mismatch" while the network path, username, and password are all valid.

Certificate Trust Chain Management

OPC UA requires that the client certificate be trusted by the server before any protected session can be activated.

1. Export the TRB140 client certificate (.der) via Services → OPC UA → Client certificate → Download.
2. In TIA Portal, open Properties → OPC UA → Server → Trusted Clients, click Add, and import the DER file.
3. Verify that the certificate's ApplicationUri matches the value auto-populated by the TRB140 (typically urn:teltonika:trb140:<IMEI>). Mismatched URIs trigger Bad_ApplicationUriInvalid even when the certificate itself is signed correctly; the open62541 project's documentation notes this is a "strict OPC UA compliant" check open62541 issue #1316.
4. If the S7-1500 uses a CA-issued certificate, install the CA chain in Trusted Roots on the TRB140 via System → Certificates.
5. Recompile and download the TIA Portal project; perform an online CPU stop/start to reload the OPC UA server's trust store.

Authentication Options

Three authentication modes are supported. Pair the TRB140 setting with a TIA Portal user that has been granted matching role-based permissions.

Common Error Codes and Mappings

Step-by-Step Resolution Procedure

1. Confirm reachability: from the TRB140 CLI, run nc -vz <S7-1500-IP> 4840. A successful TCP open rules out firewall problems.
2. Validate the server side: in TIA Portal, perform Online → Accessible nodes → OPC UA. The CPU must respond with its endpoints, confirming the OPC UA server is running.
3. Align policy and mode on the TRB140: set Security Policy = Basic256Sha256 and Security Mode = SignAndEncrypt, then Save & Apply. If the S7-1500 only supports Basic256 (firmware V2.5–V2.8), drop down to that policy.
4. Export the TRB140 client certificate, import it into the S7-1500 Trusted Clients list, and confirm the Application URI.
5. Create the OPC UA user in TIA Portal under Properties → OPC UA → Server → User management. Assign the role authenticatedUser with read/write permissions on the nodes the TRB140 will subscribe to.
6. On the TRB140, configure Username and Password; click Save & Apply. The Web UI status indicator should switch from Disconnected to Connected within 5 s.
7. If still failing, retrieve the TRB140 troubleshoot file (System → Maintenance → Troubleshoot) and inspect opus_client.log for the exact status code, then map to the table above.

Interoperability Notes for Older S7-1500 Firmware

CPU firmware V2.0–V2.6 ships with only Basic128Rsa15 and Basic256 enabled, and lacks the Basic256Sha256 policy required by the TRB140's default profile. Two workarounds are available:

• Downgrade the client policy: switch the TRB140 to Basic256 / SignAndEncrypt. The 3DES/SHA-1 suite in Basic128Rsa15 is unsupported on the TRB140 from firmware R_00.07.02 onward.
• Upgrade the CPU: a free firmware update to V2.9 (or later) enables SHA-256 across the board and removes the legacy ciphers, which is the recommended long-term path.

Verification and Testing

Confirm successful operation with the following sequence:

1. TRB140 Web UI: Services → OPC UA → Status shows Connected and the negotiated policy/mode.
2. Subscription: a configured tag reports a non-stale value (Quality = Good (192)) within the publishing interval.
3. TIA Portal diagnostic: Online & Diagnostics → OPC UA → Session list lists the TRB140 client, its certificate thumbprint, and active subscriptions.
4. Server-side counter: OPC UA server rejected session requests remains at zero in Diagnostics → Statistics.
5. Wireshark (optional): capture on port 4840; the OpenSecureChannel response should carry SecurityMode = SignAndEncrypt and the negotiated policy URI.

Forwarding and Firewall Considerations

Because the TRB140 typically operates behind a cellular NAT, every OPC UA transaction is initiated by the client. Ensure the S7-1500 has a static IP or DHCP reservation and that inbound UDP and TCP 4840 from the TRB140's WAN IP are allowed in the PLC's network ACL. The S7-1500 does not support OPC UA reverse tunneling, so a misordered firewall rule is a common secondary cause of intermittent "Security Mode Mismatch" errors that disappear when the firewall is bypassed.

Documentation References

Engineers verifying endpoint behavior should consult:

• Siemens TIA Portal – What you need to know about OPC UA clients
• SiePortal – OPC_UA_Connect not connecting
• SiePortal – OPC UA client error connecting
• SiePortal – OPC UA connection with security S7-1500 to WinCC

FAQ