Policies and modes

open62541-all-security (port 24841) advertises every RSA security policy supported by the open62541 build at the UA_ENABLE_ENCRYPTION=OPENSSL flag.

Policies the build supports

For ECC tests, use uanetstandard-test-suite's opcua-ecc-nist (4848) or opcua-ecc-brainpool (4849).

With the build flags in this repo, the count is 11 valid (policy, mode) combinations — see Endpoint count below for the breakdown.

Modes

Valid (policy, mode) combinations

None/None is the only valid combination with policy None.

Identity tokens

For every endpoint, the server advertises:

This mirrors uanetstandard-test-suite's opcua-userpass and opcua-all-security for the username path.

UserName token's securityPolicyUri. server.c passes a single userTokenPolicyUri to UA_AccessControl_default — the URI of the last entry in the server's policy array (typically the strongest one, e.g. Aes256_Sha256_RsaPss). Every endpoint therefore advertises a UserName token policy whose securityPolicyUri is that same single URI, not one per endpoint. A client sending a UserNameIdentityToken must encrypt the password with that policy — except on the None / None endpoint, where allowNonePolicyPassword = true lets the password go through unencrypted.

Endpoint count

GetEndpoints on opc.tcp://localhost:24841 returns one EndpointDescription per valid (policy, mode) combination:

Total: 11 endpoints. Same shape as uanetstandard-test-suite port 4843.

SecurityPolicy URIs

Each endpoint reports a URI of the form:

http://opcfoundation.org/UA/SecurityPolicy#<PolicyName>

Examples:

• http://opcfoundation.org/UA/SecurityPolicy#None
• http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
• http://opcfoundation.org/UA/SecurityPolicy#Aes256_Sha256_RsaPss

Your client's library typically exposes constants for these.

Plain-text passwords over None

A deliberate behaviour for this test server:

config->allowNonePolicyPassword = true;

This allows clients to send plain-text username/password over a SecurityPolicy#None channel. open62541 rejects this by default — turning it on means a test client doesn't need to encrypt the password with the server's RSA public key on the unsecured channel.

In production this is bad — anyone sniffing the wire reads the password. Test-only. See Trust posture.

Recommended test combinations

A useful subset for client-side test matrices:

A test that iterates these against the server is a strong "security layer works against open62541" battery.

Where to read next

• Trust posture — why this server accepts any client cert.
• User accounts — the four logins.