How to Configure and Trust Security Certificates for OpenPCS 7 and WinCC OPC UA Servers

When connecting external .NET C# clients or third-party OPC UA clients to OpenPCS 7 or WinCC, connection failures occur because OPC UA mandates mutual X.509 certificate trust. On first connection, the server automatically rejects the unverified client certificate and moves it into the 'rejected\certs' folder under the Public Key Infrastructure (PKI) directory. To establish communication, navigate to 'C:\Program Files (x86)\Siemens\WinCC\opc\UAWrapper\PKI\CA\rejected\certs' (or the corresponding OpenPCS7 directory), move the rejected client certificate file into the 'certs' folder, and verify that firewall TCP port 4841 (OpenPCS 7) or 4862 (WinCC) is accessible.

OPC UA Security Architecture: Certificates and Mutual Authentication

Unlike legacy OPC DA (Data Access) which relied on Microsoft Windows DCOM authentication, OPC Unified Architecture (OPC UA) implements a platform-independent, cryptographically secured communication stack conforming to IEC 62541.

Central to OPC UA security is Mutual Authentication:
* Client Validation: The OPC UA Server must explicitly authenticate the identity of the connecting Client via an X.509 public key security certificate.
* Server Validation: The Client must validate the identity and hostname of the Server.
* Initial Connection Handshake: When an external application (such as a custom C# program built with the OPC Foundation .NET Standard SDK) connects for the first time, OpenPCS 7 does not recognize the client's self-signed certificate.
* By security design, OpenPCS 7 logs a security audit failure, rejects the connection token, and places the incoming certificate into a quarantine directory (rejected\certs).

PKI Directory Structures in OpenPCS 7 vs WinCC UAWrapper

In a SIMATIC PCS 7 installation, OPC UA endpoints are hosted in one of two locations depending on the installed software:
1. OpenPCS 7 Station:
* Installed on a dedicated PC or hosted on an OS Server.
* PKI Directory Path:
C:\Program Files (x86)\Siemens\OpenPCS7\opc\UAServer\PKI\CA\
* Subdirectories:
* certs\: Trusted certificates authorized to establish sessions.
* rejected\certs\: Quarantined certificates from unapproved callers.
2. WinCC Standalone OPC UA Wrapper:
* Used when accessing local WinCC tags directly without OpenPCS 7.
* PKI Directory Path:
C:\Program Files (x86)\Siemens\WinCC\opc\UAWrapper\PKI\CA\
* Subdirectories mirror the standard OpenPCS 7 PKI layout.

Step-by-Step Certificate Approval Workflow

To authenticate and trust a custom C# .NET OPC UA client:

Initiate First Connection Attempt:
* Launch your custom C# client application and attempt to connect to the server endpoint: opc.tcp://<Server_Hostname>:4841.
* The client will receive an error: BadSecurityChecksFailed or BadCertificateUntrusted. This behavior is expected.
Locate the Quarantined Certificate:
* On the OpenPCS 7 server, open Windows File Explorer.
* Navigate to: C:\Program Files (x86)\Siemens\OpenPCS7\opc\UAServer\PKI\CA\rejected\certs.
* Locate the certificate file corresponding to your application (e.g., CustomClient [thumbprint].der).
Move to Trusted Store:
* Cut or move the certificate file from rejected\certs into:
C:\Program Files (x86)\Siemens\OpenPCS7\opc\UAServer\PKI\CA\certs.
Trust Server Certificate on Client:
* In your C# client application, ensure the OpenPCS 7 server certificate (downloaded during the initial handshake) is added to the client's local trusted certificate store (AutoAcceptUntrustedCertificates = true for testing, or stored in the client's trusted directory for production).
Reconnect:
* Re-execute the connection in the C# client. The server verifies the presence of the certificate in the certs directory, validates signature cryptography, and establishes an active OPC UA session.

Endpoint Verification and Port Diagnostics via Telnet / PowerShell

If the client continues to report connection failures even after trusting certificates, test network layer reachability:

Verify Default Listening Ports:
OpenPCS 7 OPC UA Server: TCP Port 4841.
WinCC OPC UA Wrapper: TCP Port 4862.
PowerShell Diagnostics:
powershell # Run from the client workstation Test-NetConnection -ComputerName "PCS7_OS_SERVER" -Port 4841
If TcpTestSucceeded returns False, Windows Firewall or a managed industrial switch is blocking port 4841.
Firewall Rule Creation:
On the OpenPCS 7 server, open Windows Firewall with Advanced Security.
Create an Inbound Rule permitting TCP traffic on port 4841 across the Private/Domain network profile.

Comparison of OPC UA Security Profiles and Encryption Levels

The table below outlines the standard OPC UA security policies supported by OpenPCS 7.

Security PolicyMessage Security ModeSymmetric EncryptionAsymmetric SignatureProduction RecommendationNoneNoneNoneNoneTest bench / PLCSIM onlyBasic128Rsa15Sign & EncryptAES-128RSA-1024Legacy (Deprecated)Basic256Sign & EncryptAES-256RSA-2048Approved for standard networksBasic256Sha256Sign & EncryptAES-256RSA-2048 / SHA-256Recommended High Security

Verification

To confirm that the OPC UA client is successfully connected:
1. Run the custom C# client and verify that the connection status transitions to Connected.
2. Browse the OPC UA address space: confirm that the client can read the hierarchical plant tree under Objects > Server > SIMATIC PCS 7.
3. Create a monitored item subscription on an active analog tag: verify that live numeric updates arrive without quality bad indicators.
4. On the OpenPCS 7 server, check the OPC UA trace log (C:\ProgramData\Siemens\OpenPCS7\Trace\opcua_server.log) to confirm clean session initialization.

Limitations and Operational Precautions

Never operate production plants using Security Policy None; unencrypted OPC UA endpoints expose critical process setpoints to network packet sniffing and man-in-the-middle tampering.
Self-signed security certificates have finite expiration dates (typically 1 to 5 years); implement calendar reminders to rotate certificates before expiration to prevent sudden plant disconnections.
Ensure computer system clocks are synchronized via NTP; certificate validation will fail if clock drift between client and server exceeds the certificate validity timestamp.
When purchasing interface packages, validate licensing against the applicable Siemens catalog and authorized distributor quotation; OpenPCS 7 requires a dedicated server runtime license.

Engineer FAQ

Why did the OpenPCS 7 server reject my client certificate on the first connection?

OPC UA security mandates that unknown certificates must be rejected by default to prevent unauthorized access. The administrator must manually review and move the rejected certificate from rejected\certs to certs to establish trust.

Where is the UAServer folder in standard WinCC without OpenPCS 7?

In standard WinCC, the OPC UA server is implemented as the 'WinCC OPC UA Wrapper', and its certificates reside under C:\Program Files (x86)\Siemens\WinCC\opc\UAWrapper\PKI. The UAServer folder only exists when OpenPCS 7 is installed.

Can I connect an OPC UA client across a routed WAN connection?

Yes. Unlike legacy OPC DA which fails across NAT routers due to DCOM, OPC UA uses pure TCP/IP (port 4841) and traverses enterprise firewalls and routed layer-3 networks seamlessly.