OPC UA Server
Purpose
This target exposes variables from a forwarding group through an embedded OPC UA server. External OPC UA clients can browse, read, and, when permitted, write the exposed nodes.
Configure the forwarding group and target through Data Forwarding. This page covers OPC UA endpoint, security, history targets, node mapping, and debug actions.
Open the plugin
Open Development Configuration → Data Forwarding and:
- Save the forwarding-group variable range; only included variables create OPC UA nodes.
- Add a target, choose OPC UA Server, and fill in the basic target information.
- Open Target properties and configure endpoints, identity, security, certificates, and history-target bindings.
- Save and enable the target, then configure data type and write permission in Variable properties.
Basic target information
| Setting | Default | Configuration |
|---|---|---|
| Group | - | Select a saved forwarding group. |
| Target name | - | Required and unique within the group. |
| Enable | Enabled | Disable to stop the OPC UA server. |
| Log level | Info | Temporarily use Debug for certificate, session, or node diagnostics. |
| Start timeout | 60 seconds | Valid range is 1 to 3600 seconds. |
Target properties
Endpoint
| Setting | Default | Configuration |
|---|---|---|
| Server address | opc.tcp://127.0.0.1:48410 | Separate multiple endpoint URLs with semicolons. Every URL must be reachable by the client. |
| Application name | ThingsGateway_OPC_UA_Server | Identify application name and subject used when the server certificate is generated. |
Security and authentication
| Setting | Default | Configuration |
|---|---|---|
| Security policy | Disabled | Disabled publishes only the None endpoint; enabled publishes modern SignAndEncrypt endpoints. |
| Allow certificate login | Disabled | Available on secure endpoints; enables X509 user-token login. |
| Client certificate trust mode | ManualTrustList | Manual mode uses the debug-maintained trust stores; SpecifiedCA accepts certificates issued by the selected CA. |
| Trusted client CA | Empty | Used only by SpecifiedCA; select the CA that issued client application and user certificates. |
| Username | Empty | Fixed username for username login; the client must submit a non-empty value. |
| Password | Empty | Password paired with the username. |
| Server certificate | Empty | Select a server certificate with private key; empty lets the system generate one from the application name. |
| Server issuer CA | Empty | Select the issuing CA when clients need the complete certificate chain. |
Write permission and history
| Setting | Default | Configuration |
|---|---|---|
| Allow RPC write | Enabled | Enables writes from external OPC UA clients. Variable and OPC UA user permissions must also allow the write. |
| Historical data target | Empty | Enter a stable target name in group/target form. Leave empty to disable OPC UA historical-data reads. |
| Historical alarm target | Empty | Enter a stable historical-alarm target name in group/target form. Leave empty to disable OPC UA historical-event reads. |
Target-variable properties
| Setting | Description |
|---|---|
| Data type | Object |
| Allow RPC write | Enabled |
The variable must already be included in the forwarding group's range. A target variable property does not add a variable to the group.
Functions
| Function | Purpose |
|---|---|
| Certificate store | Use Certificate store and review the returned result. |
| OPC UA server protocol debug | Use OPC UA server protocol debug to send or inspect protocol frames and view the device or target response. |
Target debug
Open Development Configuration → Data Forwarding, select the forwarding group and target, and open Debug.
Certificate stores
Use the certificate-store panel to maintain client trust certificates when the target uses a manual trust list. After adding or deleting certificates, restart the target when the page requests it.
OPC UA server protocol panel
Use the protocol panel to inspect the server endpoint and perform plugin-specific operations. Certificate changes, node writes, and client disconnect actions require the appropriate permission and site approval.
Debug checklist
- Confirm the endpoint address and target runtime state.
- Confirm the client certificate trust mode and selected certificates.
- Connect an OPC UA client and browse the exposed nodes.
- Read one node before testing any write.
Verify the target
- Start the target and connect with an OPC UA client.
- Browse the namespace and locate one variable included in the forwarding group.
- Read the value and compare it with the source variable.
- Test a write only when target, variable, client, and site permissions allow it.
- If history targets are configured, verify historical data or events with a time range that contains stored records.
Troubleshooting
| Symptom | Check |
|---|---|
| Client cannot connect | Server address, target state, firewall, security policy, server certificate, and client trust settings. |
| Client certificate is rejected | Trust mode, manual trust stores, selected CA, certificate chain, and certificate purpose. |
| Username login fails | Username/password, certificate-login setting, endpoint security policy, and account permissions. |
| Nodes are not visible | Forwarding group range, target variable properties, target restart state, and client namespace browse permissions. |
| Read value is incorrect | Source variable state, target variable data type, forwarding group membership, and target logs. |
| Write is rejected | Target RPC write, target variable RPC write, OPC UA user permission, node access level, and site safety policy. |
| Historical reads are empty | Historical target name, target type, stored records, and the query time range. |
Related links
- Data Forwarding: Forwarding groups, triggers, cache, redundancy, and common target operations.
- Certificate Management: Maintain server, client, and CA certificates.
- Plugin Manual Index: Other collection and data-forwarding plugins.