Skip to main content
Version: 5.6

OPC UA Server via HTTPS

The OPC Router’s OPC UA server can be made accessible via an HTTPS endpoint (see Configuration – HTTPS port). When connecting a client via HTTPS, there are a few special considerations that differ from a connection using the standard OPC UA TCP protocol (opc.tcp://).

Client-Side Requirements​

No Anonymous Logins​

Anonymous connections are not permitted over HTTPS. The client must log in with a username and password. The corresponding user must have been created beforehand in the [User Management](opc_ua_server_configuration.md#user management) of the OPC UA Server plug-in.

Set SecurityPolicy to “None”​

The SecurityPolicy must be set to None on the client side.

note

The security settings in the OPC UA Server plug-in (Basic128 Rsa15, Basic256 Sha256, etc.) apply exclusively to connections via opc.tcp:// and have no effect on HTTPS connections. For HTTPS connections, TLS handles transport encryption; additional OPC UA message encryption (MessageSecurity) is therefore not required and must be set to None.

Example: Configuration in UA Expert

  1. Open the Connection Wizard and enter the server’s HTTPS endpoint address (e.g., https://172.20.10.220/services/UA/UA-Server).
  2. In the Security Settings section, set the SecurityPolicy to None.
  3. Set the authentication type to Username and enter the username and password.

Consider a Reverse Proxy​

If the OPC UA server is accessible via a reverse proxy, the “Enable Mutual TLS” option must be disabled in the HTTPS settings of the OPC UA server plug-in.

If this option is enabled, the server expects the TLS client certificate and the OPC UA application certificate to match. Behind a reverse proxy, this mapping is not always unambiguous. The connection may then fail despite correct configuration.

Special Note for the Siemens Industrial Edge Web Management Endpoint​

If the OPC UA server is accessible via the web management endpoint of a Siemens Industrial Edge device, the endpoint address must be specified on the client side without the prefix /opcrouter.

Display in the plug-inSpecify in the client
https://172.20.10.220/opcrouter/services/UA/UA-Serverhttps://172.20.10.220/services/UA/UA-Server

In this case as well, the "Enable Mutual TLS" option must be disabled, since the web management endpoint acts as a reverse proxy.