Use the OPC UA Server page to expose data from SIA Connect to OPC UA clients. You can create one or more server endpoints, choose their security and authentication settings, and organize mapped SIA Connect items into namespaces and folders.

Before you begin

Make sure that:

• The source Connector, instance, and items already exist in SIA Connect.
• The OPC UA client can reach the IP address or hostname of SIA Connect.
• The selected TCP port is permitted through the network and is not used by another service.
• You have a matching server certificate and private key if you plan to use secure modes or policies.
• The OPC UA Server Connector is version 0.2.0 or later. 

Open the OPC UA Servers page

1. Sign in to the Edge Portal.
2. In the sidebar, expand Data Interfaces.
3. Select OPC UA Servers.

The page lists each configured server with its port, status, enabled state, security modes, security policies, and number of configured nodes. Select a server to open its details and node tree.

Install or update the OPC UA Server Connector

If the Connector is not installed, the page displays Set up OPC UA Server support.

1. Select Install OPC UA Server connector.
2. Wait for the installation to finish.
3. Return to Data Interfaces > OPC UA Servers if the page does not refresh automatically.

If the installed version is earlier than 0.2.0, the page displays OPC UA Server Connector Version Unsupported. Select Go to Connectors, then update the Connector before creating a server.

Create an OPC UA server

1. On the OPC UA Servers page, select Add OPC UA Server.
2. Complete the Basics, Security, and Certificates steps.
3. Select Create Server.

The following sections explain the settings in each step.

Configure the Basics step

Configure the Security step

Select the message security modes and policies that the server makes available to OPC UA clients.

Security modes

Security policies

The server supports:

• None
• Basic128Rsa15
• Basic256
• Basic256Sha256
• AES128-SHA256-RSAOAEP
• AES256-SHA256-RSAPSS

All modes and policies are selected by default. Remove combinations that clients do not require, especially unsecured or older policies.

The form applies these rules:

• At least one security policy must be selected.
• A policy other than None requires Sign or Sign & Encrypt.
• Policy None cannot be combined only with Sign or Sign & Encrypt. Mode None must also be selected.
• If neither secure mode is selected, secure policies are disabled and policy None is selected.

Authentication

Allow anonymous user access is disabled by default. When it remains disabled, clients can authenticate in either of these ways:

• Use the username and password of an enabled local Edge Portal user.
• Present a user certificate that has been uploaded to the server.

Username and password tokens use the strongest enabled secure policy. If the server is configured only with policy None, the credentials are not protected by OPC UA message encryption.

Configure the Certificates step

Select the server certificate and its matching private key. The lists can include:

• SIA Connect certificate and SIA Connect key
• Server certificates and keys previously uploaded for the Connector
• None when the server uses only mode None and policy None

You can also upload a certificate or key from this step. Classify the files as Server certificate and Server key respectively.

Review the server and endpoint URLs

After the server is created, select it from the server list. The details page shows:

• The port and endpoint URLs
• The selected server certificate and key
• Enabled security modes and policies
• Whether anonymous access is enabled
• Available local users and uploaded user certificates
• The number of configured nodes

An endpoint normally follows this format:

opc.tcp://<ip-address-or-hostname>:<port>

Use an address that is reachable from the OPC UA client. Copy the appropriate endpoint into the client configuration.

Add a user certificate

User certificates allow an OPC UA client to authenticate with an X.509 identity certificate.

1. Open the server details page.
2. In Authentication, select the option to upload a user certificate.
3. Enter a file name and select the certificate file.
4. Upload the file.

The certificate appears under User certificates. During authentication, the client must present the same certificate. A user certificate assigned to this server is accepted by this server. A Connector file assigned to all instances can be accepted by every OPC UA server instance.

Organize the address space

The Server Node Tree represents the address space exposed to OPC UA clients. Use namespaces to separate logical address spaces and folders to organize nodes.

Add a namespace

1. At the root of the node tree, select Add Namespace.
2. Enter a folder name and optional description.
3. Enter the namespace URI. The default is http://sia-connect.com/Server/UA.
4. Select Create.

A namespace is represented by a root-level folder. Its URI is registered as an OPC UA namespace when the server starts.

Add a folder

1. Select the namespace or parent folder in the node tree.
2. Select Add folder.
3. Enter a name and optional description.
4. Review the generated Folder Path.
5. Select Create.

Child folders inherit the namespace of their parent. Use forward slashes to represent the folder hierarchy. Folder names should be unique within their parent.

Add data nodes

A data node exposes a source item through the OPC UA server. Creating a node also creates the mapping between the selected source item and the target server folder.

1. Select the target namespace or folder in the Server Node Tree.
2. Select Add node.
3. Under Select Device, choose the source instance.
4. Under Select Item, choose one or more items. Use Select all when every listed item is required.
5. Select Confirm.
6. Wait until the tree has finished updating. Do not close the dialog while nodes are being added.

Disabled source items are not exposed by the OPC UA server. If several source items are mapped through the same server item, their source item names are used to keep the nodes distinct.

Understand node behavior

Select a node to view its Node ID, mapped item, current value, timestamp, read interval, read/write state, and available item parameters. Use the copy control beside the Node ID when configuring a client.

Add a method

An OPC UA method lets a client invoke an action through a server item.

1. Select the target namespace or folder.
2. Select Add method.
3. Enter a unique Name.
4. Enter Method Inputs as a JSON array of argument definitions.
5. Enter Method Outputs using the same format.
6. Select Create.

Each argument contains a name and a type. For example:

[{"name":"deviceId","type":"String"},{"name":"targetPort","type":"Int32"}]

Supported method argument types are case-insensitive:

• Boolean or Bool
• SByte, Byte, Int16, UInt16, Int32, UInt32, Int64, and UInt64
• Float and Double
• String, ByteString, DateTime, and Guid

Append [] to define a one-dimensional array, such as String[] or UInt16[].

When a client calls the method, its input values are stored on the item as a JSON array of named objects. Method output is produced from the item's input template after SIA Connect encoding replacement.

• For one output, the template result is returned as that output.
• For several outputs, the result must be a JSON object whose keys match the output argument names.
• An empty output definition creates one String output named result.
• Enter [] to create a method with no outputs.

Example output definitions:

[{"name":"status","type":"Boolean"},{"name":"message","type":"String"}]

The matching template result is:

{"status":true,"message":"ok"}

Manage the node tree

Use the controls above the tree to:

• Search for nodes and folders.
• Expand or collapse the complete tree.
• Select multiple folders, nodes, or methods.
• Use Select all or Clear all.
• Select Delete selected to remove the selected entries.

Select an individual entry to inspect it. Folder details can be edited and saved. Nodes link back to their mapped source items. Methods display their inputs, outputs, Node ID, and latest timestamp.

Edit or delete a server

Open a server and use its actions to change the name, description, port, security configuration, certificate, key, or anonymous-access setting. The same validation rules used during creation also apply when editing.

Delete the server only when its endpoint and address space are no longer required. Deleting the server interrupts connected clients and removes its server configuration.

Verify the setup from an OPC UA client

1. Enter an endpoint URL shown on the server details page.
2. Select a security mode and policy that the server has enabled.
3. Trust the server certificate if the client requires approval.
4. Authenticate with an enabled Edge Portal user, an uploaded user certificate, or anonymously when anonymous access is enabled.
5. Connect and browse the configured namespace and folders.
6. Read a variable value.
7. If the node is intended to be writable, write a test value and confirm that the mapped source item receives it.

A successful network connection does not confirm that the selected security policy, certificate, or user identity is accepted. Check each layer separately if the client cannot create a session.

Troubleshoot the OPC UA server

The OPC UA Servers page asks you to install or update the Connector

Install the OPC UA Server Connector from the page. If the installed version is unsupported, update it to version 0.2.0 or later from Configuration > Connectors.

The server cannot be created

• Enter a name using only supported characters.
• Use a port between 1 and 65535.
• Select a port that is not used by another OPC UA server or service.
• Select at least one valid combination of security mode and policy.
• Select a matching certificate and key when secure modes or policies are enabled.

The UI can display errors such as This port is already in use by another OPC UA Server, Select at least one security policy, or Select a certificate when secure modes or policies are enabled.

The client cannot reach the endpoint

• Confirm that the client uses the correct SIA Connect IP address or hostname and the configured port.
• Confirm that the server instance is enabled and does not show an error.
• Check routing and firewall rules between the client and SIA Connect.
• Make sure another process has not claimed the port.

The client rejects the security configuration

• Select a mode and policy that are enabled on the server.
• Confirm that the client supports the selected policy.
• Verify that the server certificate is valid and matches the selected private key.
• Import or trust the server certificate in the client when required.

Authentication fails

• For username and password authentication, use an enabled local Edge Portal account and verify the credentials.
• For certificate authentication, upload the exact client identity certificate as a User certificate.
• Confirm that the user certificate is assigned to this server or to all OPC UA Server instances.
• For anonymous access, confirm that Allow anonymous user access is enabled.

A node is missing

• Confirm that the source item is enabled.
• Check that the mapping was created successfully.
• Search the complete node tree and expand the relevant namespace and folders.
• Confirm that the node name is unique within its namespace.
• Reload the page after the server tree has finished updating.

A node has the wrong type or cannot be written

• When Auto selects an unsuitable type, set an explicit OPC UA data type in the server item's Connector parameters.
• Confirm that the source value can be converted to the selected type.
• For writing, confirm that the source item is writable and the mapping synchronizes in both directions.

A method cannot be called or returns an invalid value

• Validate that the input and output definitions are JSON arrays containing name and type.
• Use only supported scalar types or one-dimensional arrays.
• For multiple outputs, make sure the template result is a JSON object with a value for every output name.
• Use Base64 for ByteString values, ISO 8601 with milliseconds or milliseconds since epoch for DateTime, and a canonical string for Guid.

The page cannot load server data

Retry the page, then check the system logs and Connector status. The page reports Error Loading OPC UA Server Data when it cannot retrieve the server instances.

Related articles

• Install and manage Connectors
• Manage and configure Connector files and certificates
• Manage users, roles, and permissions
• Create and edit items
• Create and edit mappings
• Troubleshoot Connectors, instance, item, and mapping errors
• Configure and review system logs