For the Unified Automation UA SDK C++ Bundle 1.5.4 demo server, application certificate trust and user authentication are separate controls. Selecting Basic256Sha256 with Sign & Encrypt does not, by itself, establish mutual trust or configure user authorization.
Separate Secure-Channel Trust from User Authentication
| Control | Purpose | Required trust direction |
|---|---|---|
| Application certificate | Validates the OPC UA client or server application during connection establishment | Client trusts server, and server trusts client |
| User certificate | Identifies a user when the server supports a certificate-based user token | Server validates the user certificate under its authentication configuration |
| Private key | Proves possession of the identity associated with a certificate | Remains with its owning application or user; it is never copied to the counterpart |
The OPC UA connection procedure exchanges public certificates automatically. Each application then checks the counterpart certificate for technical validity and whether it is present in that application's trusted PKI store.
Configure Mutual Application Trust
- Configure the endpoint for
Basic256Sha256andSign & Encrypt. - Place
uaexpert.derin the server application trust store identified byServConfig.xml. The supplied server path isC:\ProgramData\UnifiedAutomation\UaSdkCppBundleSource\pkiserver\trusted\certs. - Make the server application certificate trusted in UaExpert. If the certificate is initially quarantined, verify its contents and move it from the UaExpert rejected store to its trusted store.
- Reconnect and confirm that both applications accept the counterpart certificate without a trust prompt or rejection.
Copying only the UaExpert certificate into the server trust store completes only server-to-client trust. Secure application communication also requires UaExpert to trust the demo server certificate. Manual approval is normally required only for the first connection between those application identities.
Keep Each Private Key with Its Owner
Do not copy uaexpert_key.pem into pkiserver or pkiuser. UaExpert keeps that key in C:/Users/User/AppData/Roaming/unifiedautomation/uaexpert/PKI/own/private/ and uses it locally with its certificate. The server needs the client's public certificate for trust validation, not the client's private key.
If “Cert/Private Key” in Server Settings refers to the server application's own certificate and key pair, configure the server-owned pair there and keep its private key on the server. The evidence does not define the exact field behavior in uaservercpp.exe, so verify in the SDK configuration whether that setting belongs to the server application identity or to certificate-based user authentication before assigning files.
Configure Certificate-Based User Authentication
Application trust does not automatically authorize a user. For certificate-based authentication, the server must support a user-certificate token, trust the user's public certificate through its user PKI configuration, and map the resulting identity to a configured user, group, or role. Permissions are then assigned to that role for the required data points or operations.
Copying uaexpert.der into pkiuser can explain why certificate-based authentication succeeded if pkiuser is the demo server's user-certificate trust store. The missing uaexpert_key.pem on the server is expected: the client retains that private key and proves possession during authentication. Confirm the interpretation by testing separately with the client certificate present and absent from pkiuser, while leaving application trust unchanged.
FAQ
Do I copy the UaExpert private key to the OPC UA server?
No. Keep uaexpert_key.pem in UaExpert's own private-key directory; copy only the public certificate where the server requires application or user trust.
Is copying uaexpert.der to pkiserver enough for Sign & Encrypt?
No. It establishes the server's trust in UaExpert, but UaExpert must also trust the demo server certificate before mutual application trust is complete.
Why did certificate authentication work without uaexpert_key.pem on the server?
The client retains the private key and uses it locally to prove possession. The server validates that proof with the trusted public certificate in its user PKI configuration.
