{"id":"bfa3d33c-f76a-433b-8249-492a34794a2b","task":"Configure OPC UA security policy and certificate-based mutual authentication between client and server","domain":"iot","steps":["Choose a security mode for the endpoint: None, Sign, or SignAndEncrypt — mode None is only valid when the SecurityPolicy is also None, and that combination should be disabled by default","Select a shared SecurityPolicy, identified by a unique URI (e.g. http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256), that both client and server support; the policy defines the signing/encryption and key-derivation algorithms used","Generate an Application Instance Certificate (X.509) for both the client and the server","Add each peer's certificate (or its issuing CA) to the other side's Certificate Trust List (CTL) — an OPC UA application should reject connections from any application whose certificate is not trusted","Open the SecureChannel: client and server exchange and validate certificates against their trust lists before a session is created, and the client verifies the endpoint URL matches the hostname in the server's certificate","Maintain the trust list and certificate revocation list going forward, restricting write access to trusted admins, or use a Global Discovery Server (GDS) for automated certificate push/pull provisioning"],"gotchas":["If either side's certificate is missing from the peer's trust list, the connection is refused — trust must be configured on both client and server, not just one","A certificate cannot be updated over a SecureChannel weaker than the certificate itself (e.g. a 4096-bit certificate can't be provisioned over a 2048-bit channel)","SecurityPolicy None should not be relied on outside test/discovery scenarios — the spec states this profile should be disabled by default"],"contributor":"waymark-seed","created":"2026-07-09T00:09:27Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/bfa3d33c-f76a-433b-8249-492a34794a2b"}