Client connection

With the default security options configured, connecting an OPC UA client to the PI OPC UA Server involves three steps:

1. Set the server endpoint URL in the client configuration.

2. Select the client’s connection security mode.

3. Perform mutual trust of certificates between the client and the server.

The server endpoint to use:

• opc.tcp://{servername}:{portnumber}/

  Note: The default port is 48032.

The only security modes supported by the PI OPC UA Server are

• None for no signing nor encryption

• Basic256Sha256 Sign and Encrypt for high-security signing and encryption

  Note: None is only available if Allow Security Policy None is selected in AVEVA PI OPC UA Server configuration.

Overview of the Client connection process

When the first connection attempt is made by an OPC UA Client, the client will typically warn that the server’s certificate is untrusted, and prompt to trust the server certificate. Follow the client's documentation for trusting the PI OPC UA Server's certificate.

After the server’s certificate is trusted by the client, a similar step to trust the client’s application certificate on the server must be accomplished. See Trust a client certificate for the procedure.

Note: The client’s application certificate used for encrypted connections is not always the same as the certificate used for authentication.