Skip to main content
Version: 5.6

https_zugriff

title: OPC UA Server via HTTPS sidebar_position: 2​

OPC UA Server via HTTPS

The OPC Router's OPC UA Server can be made accessible via HTTPS (see Configuration – HTTPS Port). When connecting a client via HTTPS, there are a few special considerations that differ from a connection using the standard OPC UA TCP protocol (opc.tcp://).

Client-Side Requirements​

No Anonymous Login​

Anonymous connections are not permitted via HTTPS. The client must log in with a username and password. The corresponding user must have been created beforehand in the User Management of the OPC UA Server Plug-in.

Set SecurityPolicy to "None"​

The SecurityPolicy must be set to None on the client side.

note

The security settings in the OPC UA Server Plug-in (Basic128 Rsa15, Basic256 Sha256, etc.) apply exclusively to connections via opc.tcp:// and have no effect on HTTPS connections. For HTTPS connections, TLS handles transport encryption; additional OPC UA message encryption (MessageSecurity) is therefore not provided and must be set to None.

Example: Configuration in UA Expert

  1. Open the Connection Wizard and enter the server’s HTTPS endpoint address (e.g., https://172.20.10.220/services/UA/UA-Server).
  2. In the Security Settings section, set the SecurityPolicy to None.
  3. Set the authentication type to Username and enter the username and password.

Consider a Reverse Proxy​

If the OPC UA Server is accessible via a reverse proxy, the "Enable Mutual TLS" option must be disabled in the HTTPS settings of the OPC UA Server plug-in.

If this option is enabled, the server expects the TLS client certificate and the OPC UA application certificate to match. Behind a reverse proxy, this mapping is not always unambiguous. The connection may then fail despite correct configuration.

Special Note for Siemens Industrial Edge​

If the OPC UA server is accessible via the management endpoint of a Siemens Industrial Edge device, the address must be specified on the client side without the prefix /opcrouter.

Display in the plug-inTo be specified in the client
https://172.20.10.220/opcrouter/services/UA/UA-Serverhttps://172.20.10.220/services/UA/UA-Server

In this case as well, the “Enable Mutual TLS” option must be disabled, as the management endpoint acts as a reverse proxy.

note

Change as part of Issue 146: The documentation has been updated to clearly describe login via username and password, the required SecurityPolicy None, behavior behind reverse proxies, and the specific feature in Siemens Industrial Edge for HTTPS connections of the OPC UA Server plug-in.