Give data to another system with the OPC UA server
The OPC UA server driver publishes every active signal of the project as an OPC UA node. At the end of this page an OPC UA client of another system is connected to YTCC with a user name, over an encrypted connection, and reads the values. All parameters of the driver are described in OPC UA server.
Before you begin
- The project is open in the configuration editor, and you may edit it.
- You know the network address of the YTCC server, and the client system can reach it.
- You can open the YTCC installation folder on the server, for the certificate step.
Steps
1. Add the OPC UA server driver
In the Drivers view, click New row above the Drivers grid and enter the driver key opcua_srv, the driver
type opc_ua_server and the name OPC UA Server. Click Add, then Apply (1), Apply and OK. The steps are
the same as for any driver; see Add drivers and devices.
A new server starts with secure parameters: only the Basic256Sha256 policy, no anonymous access, no automatic trust
of client certificates and one user ytcc with a random password. While the project runs, the driver starts by itself
after the apply.
2. Check the endpoint
Select opcua_srv in the Drivers grid. The lower part says This driver type has no devices (server role), and
the right side shows Driver parameters — opcua_server_instance.
With the default Port 4840 and Endpoint path /scada, the client connects to
opc.tcp://<server>:4840/scada. Change the port if another program on the server uses 4840 or if a second OPC UA
server runs on the same machine.
3. Choose the security policy
Security policies lists one endpoint per entry. Keep ["Basic256Sha256"]: the client signs and encrypts every
message, and the password travels encrypted. Add None only for a test with a client that cannot encrypt:
["None", "Basic256Sha256"]. Other policies are not accepted.
4. Set the users
Users holds the user names and passwords of the clients as a JSON list. Replace the generated user with one user per client system, for example:
[{ "user": "mes", "password": "<a long random password>" }]
Leave Allow anonymous and Trust client certs off.
5. Save and restart the driver
Click Save (preview). Change preview shows the driver with requires a restart. Click Apply, then OK.
In the strip Drivers that must restart to load the new configuration: click Restart next to opcua_srv.
The server reads its parameters only when it starts. Repeat this step after every change of a parameter.
6. Open the port in the firewall
The server listens on every network interface of the machine. In the firewall of the YTCC server, allow incoming TCP on port 4840 (or your port) from the client systems only.
7. Connect from the client
In the OPC UA client, enter the endpoint URL opc.tcp://<server>:4840/scada and choose:
| Setting in the client | Value |
|---|---|
| Security policy | Basic256Sha256 |
| Message security mode | Sign & Encrypt |
| Identity | User name and password of step 4 |
The client must trust the certificate of the server. YTCC creates it at the first start of the server as
pki-opcua-server\own\cert.der in the YTCC installation folder; most clients show it at the first connection and ask
whether to trust it.
8. Trust the client certificate
The first connection of a new client is refused: the server does not know the client's certificate yet and puts it in
pki-opcua-server\rejected in the YTCC installation folder. Check that the certificate belongs to the client system,
then move the file from rejected to pki-opcua-server\trusted. Connect again. The server reads the folder at every
connection; no restart is needed.
Result
The client shows the signals in the Objects folder, without subfolders. Each node is named by the full path of
its signal, for example ns=2;s=Station.OutletFlow; resolve the namespace index from the namespace URI
urn:ytcc:scada, because it is assigned at the start. Values change in the client as they change in YTCC, with the
status code from the quality of the signal. The client reads only: every write is refused with
BadUserAccessDenied.
Troubleshooting
| Symptom | Cause | Solution |
|---|---|---|
| The client cannot reach the server | Firewall, wrong port or endpoint path, or the driver is not running | Check steps 2 and 6; check the driver log |
| The secure connection is refused | The client certificate is in rejected, or the client does not trust the server certificate | Step 8; trust the server certificate in the client |
| The user is rejected | Wrong user or password, or the driver was not restarted after the change | Steps 4 and 5 |
| A node is missing | The signal is inactive or was added after the start of the driver | Activate the signal; restart the driver |
More causes are listed under Diagnostics on the OPC UA server page.
Good to know
The folder pki-opcua-server is shared by all OPC UA servers of the installation: a client certificate trusted once
is trusted by every server.
Next steps
- OPC UA server: address space, data types, status codes and limits
- Validate, apply and restore