An OPC UA connection working today does not prove it will work after a certificate renewal. Application identities, trust lists, expiry dates and change ownership belong in the operating plan. The OPC Foundation identifies application certificates as a core part of the UA security model.
Establish trust deliberately
Record which application and environment each certificate belongs to. Keep test and production records distinct. Automatically trusting every incoming certificate undermines the purpose of authentication. Trust-list changes need authorized review and approval. Confirm the options supported by the installed product version in vendor documentation.
Treat renewal as an operational task
A certificate register should include application owner, expiry, renewal owner and dependent clients. Identify affected connections in advance. Prepare a test and rollout plan aligned with the site change calendar. Include dependencies such as time synchronization and certificate chains in the review.
Make failures visible
If an application continues displaying an old value after a client disconnects, an operator may misinterpret it. Review connection state, data quality and time information together. After certificate changes, verify the required data and its quality as well as successful connection. Associate test evidence with the certificate revision.
Review with your team
- Are certificate owners and expiry dates recorded?
- Are clients affected by renewal identified?
- Are trust-list changes approved?
Next step
To map these points to your plant scope, use the project preparation checklist. An engineering discussion can review installed conditions, open questions and priorities together.
