Configuring and Hardening OpenPCS 7 OPC UA Server Authentication and Certificates

Hardening the OpenPCS 7 OPC UA server against unauthorized industrial network access requires modifying the OpcUaServerOpenPCS7.xml configuration file to disable the unencrypted SecurityPolicy None profile and eliminate anonymous token policies. Once unauthenticated access is disabled, client connections (such as Siemens OPC Scout or third-party MES clients) must be authorized through cryptographic X.509 certificate exchange in the PKI directory and user authentication validated against the local SIMATIC HMI Windows security group.

Architecture of the OpenPCS 7 OPC UA Interface

In process automation, OpenPCS 7 functions as the standardized data gateway bridging the real-time OT control network with IT, MES, and enterprise historian systems.

The OpenPCS 7 server hosts an OPC Unified Architecture (OPC UA) server daemon:
* Default Endpoint: Accessible across the network at the standard URL opc.tcp://[HostName]:4863.
* Data Services: Exposes runtime process tags, historical archive trends (HDA), and alarm events (A&E) derived from the central PCS 7 WinCC OS database.
* Security Model: Adheres to IEC 62541-2 security standards, providing encrypted communication channels (Sign & Encrypt) based on asymmetric RSA public keys and X.509 digital certificates.

Default Security Vulnerabilities: None Policy and Anonymous Access

Upon initial installation, OpenPCS 7 prioritizes commissioning convenience over network security:
1. SecurityPolicy "None" Enabled: The server accepts unencrypted connections where credentials and process data transmit in cleartext across the network.
2. Anonymous Access Enabled: Any network host running a generic OPC UA client can connect and browse plant tags without providing user credentials or domain authorization.
3. Cybersecurity Risk: Under modern industrial cybersecurity standards (such as IEC 62443), running unencrypted, anonymous OPC UA interfaces on industrial control networks violates basic security baselines.

Step-by-Step Procedure: Hardening OpcUaServerOpenPCS7.xml

To secure the OpenPCS 7 server against unauthorized access:

Locate Configuration File:
* Open File Explorer and navigate to:
C:\Program Files (x86)\Siemens\OPENPCS7\OPC\UAServer\
* Create a backup copy of OpcUaServerOpenPCS7.xml named OpcUaServerOpenPCS7_backup.xml.
Disable SecurityPolicy None:
* Open OpcUaServerOpenPCS7.xml in a text editor as an Administrator.
* Locate the <SecurityPolicies> section.
* Find the profile entry for SecurityPolicy#None:
<ProfileUri>http://opcfoundation.org/UA/SecurityPolicy#None</ProfileUri>
* Change the enabled flag from true to false:
<Enabled>false</Enabled>
Remove Anonymous User Access:
* Locate the <UserTokenPolicies> block.
* Remove or comment out the Anonymous token policy:

Save Configuration and Restart Service:
* Save the modified XML file.
* Open Windows Services (services.msc).
* Locate OpcUaServerOpenPCS7, right-click, and select Restart. (If an initial Windows service timeout warning appears, acknowledge the dialog and verify that the process returns to Running status).

Managing Client Certificates in the PKI Directory Store

Once anonymous access is removed, client connections must be validated via digital certificates:

Initial Connection Attempt:
* Connect an OPC UA client (such as Siemens OPC Scout) pointing to opc.tcp://[HostName]:4863 using Basic256Sha256 - SignAndEncrypt.
* The client connection will be rejected initially because the server has not yet trusted the client certificate.
Accepting the Certificate:
* On the OpenPCS 7 station, navigate to:
C:\Program Files (x86)\Siemens\OPENPCS7\OPC\UAServer\PKI\CA\rejected\
* Identify the client's .der certificate file.
* Cut the certificate and paste it into the trusted store:
C:\Program Files (x86)\Siemens\OPENPCS7\OPC\UAServer\PKI\CA\certs\
User Authentication:
* In the OPC UA client, specify credentials for a valid Windows domain or local user account.
* Ensure the user account is an active member of the SIMATIC HMI Windows security group on the OpenPCS 7 host station.

Verification

Launch Siemens OPC Scout on a remote workstation.
Add the OpenPCS 7 UA server URL (opc.tcp://[HostName]:4863).
Select security endpoint Basic256Sha256 - SignAndEncrypt and enter authorized user credentials.
Verify successful connection establishment, browse the plant hierarchy tag tree, and confirm real-time tag data updates.
Attempt connecting anonymously: confirm that the server rejects the connection immediately with BadIdentityTokenRejected.

Limitations and Operational Precautions

Certificate Expiration: Monitor expiration dates on X.509 certificates; expired certificates will immediately disrupt external MES/ERP communications without prior alarm.
Firewall Rules: Ensure inbound TCP port 4863 is open in Windows Defender Firewall on the OpenPCS 7 station.
Group Membership: User accounts failing to belong to the local SIMATIC HMI group will be denied access regardless of password accuracy.

Engineer FAQ

What is the default TCP port for OpenPCS 7 OPC UA?
The default OPC UA communication port is TCP 4863.
Which XML file controls OpenPCS 7 OPC UA security policies?
Security settings are defined in C:\Program Files (x86)\Siemens\OPENPCS7\OPC\UAServer\OpcUaServerOpenPCS7.xml.
Where are untrusted client certificates placed by OpenPCS 7?
Rejected client certificates are placed in ...\OPENPCS7\OPC\UAServer\PKI\CA\rejected.
Which Windows group must client user accounts belong to?
User accounts must belong to the local or domain SIMATIC HMI security group.
Can OpenPCS 7 operate with both encrypted and unencrypted channels simultaneously?
Yes, if both None and encrypted profiles are enabled in the XML configuration, though disabling None is recommended.
Does modifying OpcUaServerOpenPCS7.xml require an OS reboot?
No, restarting the OpcUaServerOpenPCS7 Windows service applies the changes immediately.
What encryption algorithm is recommended for OpenPCS 7?
Basic256Sha256 with SignAndEncrypt is the standard recommended cryptographic profile.
Does OpenPCS 7 support OPC DA Classic simultaneously with OPC UA?
Yes, OpenPCS 7 supports legacy DCOM-based OPC DA/HDA alongside OPC UA.
Can OpenPCS 7 run on an OS Client station?
Yes, OpenPCS 7 can be installed on an OS Single Station, OS Server, or a dedicated OS Client.
Where should OpenPCS 7 software license keys be validated?
OpenPCS 7 server and station licenses must be confirmed in the Siemens Industry Mall.

Technical References

Siemens Manual: SIMATIC Process Control System PCS 7 OpenPCS 7 (A5E43360488-AA).
Siemens Industry Online Support Entry ID 109801081: Hardening OpenPCS 7 OPC UA Servers.
OPC Foundation Specification: OPC Unified Architecture Part 2: Security Model (IEC 62541-2).