Configure OPC UA client certificates on the OPC UA server

The next step in the of configuring OPC UA server and client certificates is to trust the OPC UA client certificate that has been installed on the OPC UA server node.

The easiest way is to attempt to connect an OPC UA client to the server. Since trust of the client certificate has not yet been established, the connection is expected to fail.

Once the connection fails, any OPC UA client certificates that are not installed on the OPC UA server are placed in the “Rejected Certificate” folder on the OPC UA Server.

By default, the folder location is:

C:\ProgramData\AVEVA\PCS\OPC UA Rejected Client Certificates\certs

Note: Access to this folder requires administrator rights, and the folder is hidden by default.

Import certificates placed in the Rejected Certificate folder

1. To import the OPC UA Client certificates, browse to the rejected certificate folder.

2. Right click on the certificate for the OPC UA Client that you want to trust and select “Install Certificate”. This opens the Import certificate Wizard.

3. Select the following options in the wizard:

   • Store location: Select "Local Machine," then select Next.

   • Certificate store: Select “Trusted People,” then select Next.

   • Completing the Certificate Import Wizard: Review the settings, the select Finish.