Search code examples
opc-ua

Does signing and encryption bring any benefits for OCP UA over HTTPS?

I am reading the OPC UA specification and there is one thing I am confused about:

When using HTTPS as a transport protocol, the secure channel is already established by the TLS.

In this case, does it make sense to use any other security mode than None?

What would be the benefit to encrypt or sign the messages over an already secured channel?

Solution

  • The SecurityPolicy becomes mostly irrelevant when using HTTPS transport.

    From Part 6 when discussing HTTPS:

    The SecurityPolicy shall be specified, however, it only affects the algorithms used for signing the Nonces during the CreateSession/ActivateSession handshake. A SecurityPolicy of None indicates that the Nonces do not need to be signed.

    For what it's worth... the only transport you'll find widely supported in the real world is the OPC UA TCP transport with binary encoding. This is the only combination that is mandatory for implementations.