Skip to content
Start free evaluation

OPC UA quickstart

On this page you unpack the OPC UA SDK package, create application certificates and open your first secure connection with the example server and the C client. It takes about ten minutes. The commands are for macOS on Apple silicon.

Before you begin

Section titled “Before you begin”
  • The PDComm OPC UA SDK native package, pdcomm-opcua-native-darwin-arm64.tar.gz. Packages for other operating systems are named pdcomm-opcua-native-<os>-<arch>.
  • CMake 3.21 or later and a C11 and C++17 compiler (the Xcode Command Line Tools on macOS).
  • The OpenSSL 3 command-line tool, for example Homebrew openssl@3.
  • An evaluation or developer license file. In both terminals that run the server and the client, set its path, for example export PDCOMM_LICENSE_FILE="$HOME/pdcomm/pdcomm.license". See Install and check a license.

1. Unpack the package

Section titled “1. Unpack the package”

Compare the package’s hash with the SHA-256 value you received:

터미널 창
shasum -a 256 pdcomm-opcua-native-darwin-arm64.tar.gz

Unpack the package and change to the SDK root:

터미널 창
tar -xzf pdcomm-opcua-native-darwin-arm64.tar.gz
cd pdcomm-opcua-native-darwin-arm64

The SDK root contains:

Path Contents
include/pdcomm/opcua/ The C header pdcomm_opcua.h and the C++ header pdcomm_opcua.hpp
lib/ libpdcomm_opcua_ffi.dylib and the OpenSSL 3 runtime
examples/opcua/ Example sources, the CMake project and certificate templates (pki/*.cnf)
licenses/, NOTICE.txt Third-party licenses
manifest.json Package profile, ABI version, exported functions and the SHA-256 of every file

You can move the SDK directory anywhere, including paths with spaces. Rebuild the examples after you move it.

2. Create application certificates

Section titled “2. Create application certificates”

The example server accepts secure connections only, and each side trusts exactly one peer certificate. Create self-signed server and client certificates from the templates:

터미널 창
cd examples/opcua/pki
openssl req -x509 -new -config server.cnf -newkey rsa:2048 -sha256 -days 365 -noenc \
  -keyout server.key.pem -out server.cert.pem
openssl x509 -in server.cert.pem -outform DER -out server.der
openssl req -x509 -new -config client.cnf -newkey rsa:2048 -sha256 -days 365 -noenc \
  -keyout client.key.pem -out client.cert.pem
openssl x509 -in client.cert.pem -outform DER -out client.der
chmod 600 server.key.pem client.key.pem
cd ../../..

The pki directory now holds the certificates (*.cert.pem, *.der) and private keys (*.key.pem). If your openssl isn’t OpenSSL 3, use the OpenSSL 3 binary directly, such as /opt/homebrew/opt/openssl@3/bin/openssl. PKI and trust setup explains the templates and how to adapt them.

3. Build the examples

Section titled “3. Build the examples”

Build the examples from the SDK root. They find the SDK that contains them automatically.

터미널 창
cmake -S examples/opcua -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build --config Release

The build directory now has opcua_server, opcua_client and opcua_browse_call (C), and opcua_server_cpp and opcua_client_cpp (C++).

4. Start the server

Section titled “4. Start the server”

Open a terminal and run the example server from the SDK root:

터미널 창
build/opcua_server 127.0.0.1:4840 opc.tcp://localhost:4840/pdcomm \
  examples/opcua/pki/server.der examples/opcua/pki/server.key.pem examples/opcua/pki/client.der

The arguments are the listen address, the endpoint URL to advertise, the server certificate, the server private key and the client certificate to trust. When the server is ready, it prints:

Listening on 127.0.0.1:4840

The server hosts three variables in namespace 2:

NodeId Name Access Initial value
ns=2;i=1001 Value Public including anonymous, writable Int32 42
ns=2;i=1002 Limit Public, read-only Int32 100
ns=2;i=1003 Protected Authenticated users only, Int32 7

5. Connect and read

Section titled “5. Connect and read”

Open a second terminal and run the client from the SDK root:

터미널 창
build/opcua_client opc.tcp://localhost:4840/pdcomm \
  examples/opcua/pki/client.der examples/opcua/pki/client.key.pem examples/opcua/pki/server.der

The arguments are the endpoint URL, the client certificate, the client private key and the server certificate to trust. The client prints the endpoint list, opens a session over an Aes256_Sha256_RsaPss SignAndEncrypt channel, activates it anonymously and reads ns=2;i=1001:

PDComm OPC UA ABI 0x00000002
Endpoint opc.tcp://localhost:4840/pdcomm mode=Sign policy=http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
Endpoint opc.tcp://localhost:4840/pdcomm mode=SignAndEncrypt policy=http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
Endpoint opc.tcp://localhost:4840/pdcomm mode=Sign policy=http://opcfoundation.org/UA/SecurityPolicy#Aes128_Sha256_RsaOaep
Endpoint opc.tcp://localhost:4840/pdcomm mode=SignAndEncrypt policy=http://opcfoundation.org/UA/SecurityPolicy#Aes128_Sha256_RsaOaep
Endpoint opc.tcp://localhost:4840/pdcomm mode=Sign policy=http://opcfoundation.org/UA/SecurityPolicy#Aes256_Sha256_RsaPss
Endpoint opc.tcp://localhost:4840/pdcomm mode=SignAndEncrypt policy=http://opcfoundation.org/UA/SecurityPolicy#Aes256_Sha256_RsaPss
Session activated (anonymous)
Read ns=2;i=1001 value=42 service=0x00000000 status=0x00000000
Session closed

service is the service result and status is the StatusCode of the value. Both 0x00000000 (Good) means success, and the exit code is 0.

6. Write a value

Section titled “6. Write a value”

Write a value with --write and read it back:

터미널 창
build/opcua_client opc.tcp://localhost:4840/pdcomm \
  examples/opcua/pki/client.der examples/opcua/pki/client.key.pem examples/opcua/pki/server.der --write 7

The last three lines of the output are:

Write ns=2;i=1001 value=7 service=0x00000000 status=0x00000000
Read ns=2;i=1001 value=7 service=0x00000000 status=0x00000000
Session closed

7. Clean up

Section titled “7. Clean up”

Press Ctrl+C in the server’s terminal. The server prints the last value and exits:

Final Value=7
Server stopped

If something goes wrong

Section titled “If something goes wrong”
Error text Cause and fix
Error: discover failed (SDK status 5): OPC UA I/O: connection refused (os error 61) The server isn’t running, or the port differs. Check the server’s terminal and the port in the URL.
Error: connect failed (SDK status 5): OPC UA security CertificateUntrusted The server certificate you passed to the client isn’t the one the server uses. Pass the server’s server.der.
Error: connect failed (SDK status 5): OPC UA status: 0x80130000 The server doesn’t trust this client certificate (BadSecurityChecksFailed). Change the server’s last argument to the client’s client.der and restart the server.
Error: cannot read the certificate, private key or trusted server certificate A file path is wrong or a file is empty. Check that you’re running from the SDK root.

Find more errors in Troubleshooting.

Next steps

Section titled “Next steps”

Privacy Policy