Hello.
OPC UA has three basic message security modes (None, Sign, SignAndEncrypt), and with the latter two, various security policies can be used. What gets used is in the end an effect of a negotiation between the client and the server. With QuickOPC, unless you specify more, something that works will be chosen.
If you want to influence that, you need to set the "endpoint selection policy" that is part of the UAEndpointDescriptor passed to each EasyUAClient method call.
Read:
•
opclabs.doc-that.com/files/onlinedocs/OPCLabs-OpcStudio/Late...in%20Endpoint%20Selection.html
•
opclabs.doc-that.com/files/onlinedocs/OPCLabs-OpcStudio/Late...e.html#Server%20Endpoints.html
And mainly:
•
opclabs.doc-that.com/files/onlinedocs/OPCLabs-OpcStudio/Late...oint%20Selection%20Policy.html
By the default, all message security modes are enabled. If you want to pick some, or just one, you can do it e.g. like this:
var endpointDescriptor = new UAEndpointDescriptor("opc.tcp://opcua.demo-this.com:51210/UA/SampleServer")
{
EndpointSelectionPolicy = new UAEndpointSelectionPolicy(UAMessageSecurityModes.SecuritySignAndEncrypt)
};
object value = client.ReadValue(endpointDescriptor, "nsu=http://test.org/UA/Data/ ;ns=2;i=10305");The details of your questions are not clear, though. In OPC UA terminology, "secure channel" is *always* used. The secure channel may use "None" message security mode, so in fact it can be insecure - but it is still there. With "None" message security policy mode, certificates can be omitted, or they optionally can be used to identify (but not authenticate!) the other side of the communication.
With "true" secure channel (with message security mode Sign or SignOrEncrypt), certificates are *always* used to authenticate the client and the server.
I do not know what you mean by "local CA" and "remote CA" verification, Certificate verification and is *always* done locally and does not use the CA at all. The CA may be used to *issue* the certificates (in OPC UA world, possibly over the GDS, Global Discovery Server/Certificate Manager), though, and in such case it is irrelevant where it was running at the time it has issued the certificates. Perhaps you need to explain more about what you actually looking for.
Best regards
