OPC UA Certificate Is Trusted, but Login Still Fails? Check User Policy
Application trust and user authentication are separate parts of an OPC UA connection. A trusted certificate does not automatically authorize a user session.
Original connection-layer example; preserve the site security policy.
What is happening?
The selected endpoint specifies security settings and supported user-token policies. A client must use compatible options and valid credentials or tokens, then satisfy server authorization for the requested operation.
Check these five things
-
Record the exact failure stage and status code.
-
Compare the selected endpoint security settings.
-
Check supported user-token types.
-
Confirm the intended account or token with the server owner.
-
Distinguish session activation from read/write authorization.
Worked example
A teaching client establishes the secure channel with a trusted application certificate but submits a user-token type the endpoint does not support. Session activation fails even though certificate trust is correct. Changing certificate trust again would target the wrong layer.
Quick diagnostic reference
| Layer | Check |
|---|---|
| Application trust | Peer certificate |
| User authentication | Supported identity token |
| Authorization | Permitted operation |
The mistake to avoid
Do not disable security or switch to anonymous access to conceal an authentication problem. Correct the approved endpoint and identity configuration.
How to verify the fix
Verify session establishment and only the intended read/write permissions using approved test actions. Confirm failures remain clearly reported.
Field-work boundary: These are educational diagnostic guides. Use the exact equipment manuals and approved site procedures. Electrical testing and machinery changes belong to qualified, authorized personnel; control hazardous energy and validate affected functions before release.
Technical reference
OPC Foundation: UserIdentityToken parameters. The examples and diagnostic tables above are original teaching material; they do not replace the product manual.