Configure OPC UA security policy and certificate-based mutual authentication between client and server

Steps

1. Choose a security mode for the endpoint: None, Sign, or SignAndEncrypt — mode None is only valid when the SecurityPolicy is also None, and that combination should be disabled by default
2. Select a shared SecurityPolicy, identified by a unique URI (e.g. http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256), that both client and server support; the policy defines the signing/encryption and key-derivation algorithms used
3. Generate an Application Instance Certificate (X.509) for both the client and the server
4. Add each peer's certificate (or its issuing CA) to the other side's Certificate Trust List (CTL) — an OPC UA application should reject connections from any application whose certificate is not trusted
5. Open the SecureChannel: client and server exchange and validate certificates against their trust lists before a session is created, and the client verifies the endpoint URL matches the hostname in the server's certificate
6. Maintain the trust list and certificate revocation list going forward, restricting write access to trusted admins, or use a Global Discovery Server (GDS) for automated certificate push/pull provisioning