Book an Idako Demo
Early concept: gauging interest

A Certificate Authority built for OPC UA.

Stop clicking "Trust" on self-signed certificates. Get CA-signed application instance certificates for your OPC UA clients and servers from a CA that understands OPC UA, starting with simple on-request issuing and growing into automated provisioning and full GDS support.

Tell us you're interested See the roadmap
Home at opcua.ca. One-Way Automation owns the domain opcua.ca, a perfect fit for an OPC UA Certificate Authority, since "CA" stands for both. Only Canadian companies and residents can register a .ca domain.
The problem

OPC UA security works. Managing its certificates is the hard part.

Most OPC UA deployments run on self-signed certificates that are trusted one pair at a time. That's fine for three machines and painful for three hundred. Running your own PKI properly takes time and specialist skills that most automation teams don't have to spare.

Trust one CA, not every peer

Put the CA certificate in each trust list once. Every certificate it issues is trusted automatically, with no pairwise trust lists to maintain.

Renewals & revocation handled

Track expiry, reissue on time, and revoke compromised or retired devices with published CRLs, without spreadsheets or surprises.

OPC UA-correct certificates

Application URIs, SANs, key usages and key sizes that match the OPC UA security profiles, so certificates are accepted the first time.

How it would roll out

Three phases, from on-request to fully managed

We plan to start simple and deliver value early. Your feedback decides how far and how fast this goes.

Phase 1

Certificates on request

  • Authenticated, authorized customers request certificates
  • Submit a CSR, or let us generate the key pair
  • Request manually through a web portal, or with Python scripts
  • Dedicated issuing CA per customer, with CRL publishing
First release
Phase 2

Automated provisioning

  • Python client library & CLI for unattended provisioning
  • Automatic renewal before expiry
  • Bulk issuing for commissioning many devices at once
  • Fits into CI/CD, Ansible and device image builds
Next
Phase 3

OPC UA GDS support

  • Global Discovery Server Certificate Manager (OPC 10000-12)
  • Push & pull certificate management
  • Trust list distribution to applications
  • Works with any GDS-aware OPC UA client or server
Later
Scriptable from day one

A few lines of Python

Phases 1 and 2 are designed for the way automation engineers already work. A small Python package would handle authentication, CSR creation and certificate download, so provisioning can go into your commissioning scripts.

Illustrative only. The API is not final and we'd like your input on it.

from opcua_ca import Client
ca = Client(api_key="…")  # your account token
cert = ca.request_certificate(
    application_uri="urn:acme:line3:gateway",
    common_name="Line3-PLC-Gateway",
    dns=["gw-line3.acme.local"],
    ip=["10.20.3.15"],
    key_type="RSA-2048",
)
cert.save("pki/own/certs/", "pki/own/private/")
ca.save_trust_list("pki/trusted/")  # CA cert + CRL
Who it's for

Built for the people who deploy OPC UA

End users & plant operators

Secure your plant-floor OPC UA connections without having to build and run an in-house PKI.

System integrators

Deliver projects with proper certificate management and hand over a setup your customer can maintain.

OEMs & product vendors

Provision certificates for devices and software at build or commissioning time, at scale.

Help shape it

Would you use this?

We are deciding whether to build this service and what to build first. A short message through our contact form helps a lot. There's no commitment and no newsletter, and we'll contact you only about this project.

In your message, it helps to mention:

  1. "OPC UA CA" in the subject or first line
  2. Your role: end user, system integrator, OEM / vendor
  3. Which phases matter to you: on request, automation, GDS
  4. Roughly how many certificates per year
  5. Hosted service or on-premises product
  6. OPC UA products you use and any compliance needs (IEC 62443…)
Go to the contact form
FAQ

Questions you might have

Is this available today?

Not yet. This page is here to find out whether there is enough interest to build it. If you register interest, you'll be among the first contacted for early access to Phase 1.

Will my private keys leave my network?

They don't have to. The recommended flow is for your application to generate its own key pair and send only a Certificate Signing Request (CSR). Server-side key generation would be optional, for devices that can't create a CSR.

Who can request certificates?

Only authenticated and authorized users of your organization's account. Each customer gets its own issuing CA, so your certificates, and the trust they grant, stay separate from every other customer's.

What is an OPC UA GDS?

The Global Discovery Server, defined in OPC 10000-12, includes a Certificate Manager that OPC UA applications use to get certificates and trust lists through standard OPC UA methods, in push or pull mode. Phase 3 brings this, so GDS-aware products can manage their certificates automatically.

Does it work with my OPC UA products?

Any OPC UA application that accepts CA-signed certificates and a trust list with CRLs will work. That covers most commercial and open-source stacks. Tell us which products you use when you contact us so we can make sure they're covered.

Could this run on-premises?

That's one of the things we want to learn. Let us know through the contact form whether you'd prefer a hosted service or an on-premises product.

OPC UA is a trademark of the OPC Foundation.