How to manage OPC UA Server during project run time

These are tips and tricks for managing the OPC UA Server module during project runtime.

Deleting and recreating the server certificate files

When the project is run and the OPC UA Server Runtime task is started, it checks whether the server certificate files exist and are located in the project folder at:

<project name>\Config\uaserver\own\studio.der

<project name>\Config\uaserver\own\studio.pem

(The .der file is the certificate itself, and the .pem file is the associated key. Both files must be present for the certificate to be valid.)

If the files do exist, the project uses them as is. If the files do not exist, the OPC UA server creates them using the certificate information you entered when you configured the OPC UA Server communication settings.

It is important to remember the certificate information can include the special strings [ServerName] and [NodeName], which automatically get the host name of the actual computer or device that hosts the project. As such, if you test your project on your development workstation, the certificate files will be created using the host name of that computer, and then those files may be included with the rest of the project files when you download your project to another computer. When the OPC UA server tries to use those files, the certificate information may be incorrect for that computer and the server may not be able to establish secure communication with clients.

You should delete the existing certificate files — by clicking Delete server certificate, in the OPC UA Server communication settings — before you download your project from your development workstation to another computer. If you do not, you will need to manually delete the files on that computer so that the OPC UA server can recreate them with the correct certificate information.

Trusting and rejecting client certificates

Each OPC UA client that attempts to connect to and communicate with the OPC UA server will present its own client certificate. Your project will automatically trust or reject those certificates depending on whether you selected or cleared the Automatically trust client certificate option, in the OPC UA Server communication settings. The certificate files are saved in the appropriate folders in your project's certificate store at:

<project name>\Config\uaserver\rejected\

<project name>\Config\uaserver\trusted\

In many cases, you will want to manage the certificates on a client-by-client basis, trusting some and rejecting others. This software includes a small utility program called OPC UA Server Certificate Store Management (OPCUAServerCertStore.exe), which helps you to view client certificates and move them between folders in the certificate store. If you have the full AVEVA Edge software installed, you can open the program by clicking Certificate Store Management in the OPC UA Server communication settings. The program will automatically open the certificate store for the current project:

Trusted, Rejected

These lists display the respective contents of the trusted and rejected folders in your project's certificate store. To move a certificate from one list to the other, select it and then click > or < as needed.

Issued To, Client URI

Certificate information extracted from the selected certificate. This information cannot be edited.

Add New Certificate

Click to add a new certificate to the Trusted list. You will be asked to locate and open the certificate file. You should be familiar with certificate file names and extensions, as defined by the X.509 standard, so that you can locate the correct file. The file will be copied to the trusted folder in your project's certificate store.

Remove

Click to remove the selected certificate; the certificate file will be deleted from your project's certificate store, regardless of which list/folder it is in. Be aware that removing a certificate does not prevent a client from presenting the same certificate again in the future. If you want to reject the certificate, move it to the Rejected list.

Tip: It is often useful to add client certificates to your project's certificate store while you are still developing your project, so that they can be downloaded with the rest of the project files. However, this assumes you know in advance which clients will try to connect to the server.

If the AVEVA Edge software is licensed for Runtime only — that is, if it is installed on another computer and running only as the SCADA runtime edition for Windows — you might not be able to access the OPC UA Server communication settings in order to open the Certificate Store Management program. In this case, you can manually run the program by locating it in the program folder and then double-clicking it. The program file should be located at:

C:\Program Files (x86)\AVEVA\AVEVA Edge 2026\Bin\OPCUAServerCertStore.exe

When you open the Certificate Store Management program in this way, it will first ask you to locate and open your project file (<project name>.app). Otherwise, the program behaves the same as if you opened it from the OPC UA Server communication settings.

If your project is running in Embedded HMI on a Windows Embedded device, be aware the Certificate Store Management program is not installed with that software. You can copy the program (for example, over the network or on a USB thumb drive) from your development workstation to the device and then run it there, or you can manually move the certificate files between folders in the project's certificate store.

If your project is running in IoT View on a POSIX-compliant operating system (for example, Linux), you cannot use the Certificate Store Management program. You must manually move the certificate files between folders in the project's certificate store.

Regardless of how you move the certificate files, you should restart the OPC UA Server Runtime task after you make any changes. This is to make sure rejected clients that were previously trusted are properly disconnected from the server. You do not need to restart the entire project, thanks to the project runtime server's task-based architecture.

Connecting to the server and browsing for tags

When a project is running and the OPC UA Server Runtime task is started, OPC UA clients should be able to find the server on the network at the endpoint URL that is configured in the OPC UA Server communication settings. If you kept the default node name and port number, that URL should be:

opc.tcp://<host name>:48010

Clients should also be able to find the server at its IP address instead of its node name. For example:

opc.tcp://192.168.0.15:48010

Assuming the endpoint URL is valid, the server and client have a security policy in common, and the server trusts the client certificate, the client should be able to connect to the server and then browse tags in the project tags database.

For more information, see the documentation for your OPC UA client software.

Communication and server logs

The OPC UA communication stack can generate trace messages, which are saved in a log file in the project folder at:

<project name>\Config\uaserver\uaserver.log

These trace messages comprise errors, warnings, and other information generated during normal OPC UA communication. The level of verbosity is determined by the Stack trace level option in the OPC UA Server communication settings. Be aware that the log file can become very large over time, depending on the level you select.

The OPC UA Server Runtime task can also generate its own messages, separate from the OPC UA communication stack. These messages comprise errors, warnings, and other information about the performance of the task itself as a part of the project runtime server. The messages are included with the rest of the project runtime server's log messages, in the Output/LogWin module. For more information, see Configure the log settings for the Output window.