Security

OPC UA security rests on two layers: the SecureChannel protects the wire between client and server, and the Session authenticates the user on top of an open channel. open62541 ships with a complete, pluggable security stack covering both.

This section documents the parts you actually configure and operate:

• Supported Security Policies
• Crypto Backends
  • Backend selection
  • Hardware-backed key storage (TPM2)
  • Library version requirements
  • Registering policies
• Authentication
  • Identity token types
  • Default server configuration
• Certificates and Trust
  • CertificateGroup backends
  • Filestore PKI layout
  • Generate a certificate
  • Certificate utility functions
  • Revocation
• ECC Specifics
  • Supported curves
  • Certificate requirements
  • Generating ECC certificates

• Supported Security Policies – the standard OPC UA SecurityPolicies supported by open62541 and how to register them on a server.

• Crypto Backends – the underlying crypto library (mbedTLS, OpenSSL, or LibreSSL) and the build flags that select it.

• Authentication – the identity-token types used to authenticate Sessions (Anonymous, Username/Password, X.509, Issued Token).

• Certificates and Trust – X.509 certificate management: trust lists, the three CertificateGroup backends (AcceptAll, Memorystore, Filestore), and the UA_CreateCertificate helper.

• ECC Specifics – ECC specifics: supported curves, certificate requirements, generation, and the related examples.

For the protocol-level overview (SecureChannel, SecurityMode, Endpoint discovery) – see OPC UA Basics. This section focuses on the configuration and operational side.

For the auto-generated plugin API, see SecurityPolicy Plugin API and CertificateGroup Plugin API.