Docs
DEEN

How-to guide

Deploy the application

Deploy a client application: files and dependencies, network, your own application certificate, XML configuration, and licensing.

This content was machine translated and may contain errors. Read in German

How-to guide

Deploy the application ​

This is how you prepare your OPC UA client application for production.

Ship the files ​

The OPC UA .NET SDK consists of a single assembly per target framework. The OPC UA stack and the other libraries of the SDK are included in it. The Requirements page lists the target frameworks. No installation or registration of the SDK on the target computer is required.

Depending on the target framework, the package depends on other NuGet packages, for example Newtonsoft.Json and BouncyCastle.Cryptography. As of version 2.59, BouncyCastle.Cryptography (version 2.7.0) replaces the package Portable.BouncyCastle. If your application deploys the assemblies itself, therefore deploy BouncyCastle.Cryptography.dll instead of BouncyCastle.Crypto.dll. The full list per target framework is on the package page at nuget.org (Opc.UaFx.Client, Opc.UaFx.Advanced). These packages are part of the application: dotnet publish and the build directory include them automatically. Therefore, ship the complete output directory, not only your own assembly and the SDK assembly.

By default, the SDK creates the certificate stores as directories under the application path (folder CertificateStores, see Application certificate).

Available on Windows only:

  • OPC Classic: Access to OPC Classic servers through COM and DCOM requires the package Opc.UaFx.Advanced and the OPC Classic runtime installed on the target computer (see OPC Classic).
  • Windows certificate stores: The SDK uses them only if the path of a certificate store starts with CurrentUser\ or LocalMachine\.

Allow network access ​

The client establishes the connection to the server itself. Therefore, allow the outgoing connection to the port of the server endpoint in the firewall of the target computer and in the network, that is, to the port in the server address (for example 4840 in opc.tcp://localhost:4840). For remote OPC Classic servers, the DCOM settings apply (see Remote servers and DCOM security).

Use your own application certificate ​

In production, do not use a certificate that the SDK creates automatically.

If you already have a suitable certificate, load your PFX-based certificate from any location through the OpcCertificateManager and assign it to the client instance:

csharp
var certificate = OpcCertificateManager.LoadCertificate("MyClientCertificate.pfx");
client.Certificate = certificate;
vbnet
Dim certificate = OpcCertificateManager.LoadCertificate("MyClientCertificate.pfx")
client.Certificate = certificate

The certificate must contain the name of the application as its "Common Name" (CN). The name must match the value of the AssemblyTitle attribute of the application:

csharp
[assembly: AssemblyTitle("<Common Name (CN) in Certificate>")]
vbnet
<Assembly: AssemblyTitle("<Common Name (CN) in Certificate>")>

If it does not, set the name used in the certificate through the ApplicationName property of the client instance. If you assign the certificate directly through the Certificate property as shown above, the client does not search for it by name:

csharp
client.ApplicationName = "<Common Name (CN) in Certificate>";
vbnet
client.ApplicationName = "<Common Name (CN) in Certificate>"

You do not have to set the ApplicationUri property. When it connects, the client takes the value from the Subject Alternative Name of the certificate.

If you do not have a suitable certificate yet that you can use as the application certificate of your client, create at least a self-signed certificate. Deploy it with the application and load it as shown above. You create the certificate with the OpcCertificateManager class. You define the properties of the certificate through an instance of the OpcCertificateSettings class. These include, for example, the name of the application, the ApplicationUri, the validity in months, or the names of the domains in which the client runs:

csharp
// The lifetime is specified in months, the default is 600.
var settings = new OpcCertificateSettings("MyClientAppName") {
    ApplicationUri = new Uri("urn:localhost:MyClientAppName"),
    Lifetime = 60
};
 
settings.DomainNames.Add("localhost");
 
var certificate = OpcCertificateManager.CreateCertificate(settings);
OpcCertificateManager.SaveCertificate("MyClientCertificate.pfx", certificate);
vbnet
'The lifetime is specified in months, the default is 600.
Dim settings = New OpcCertificateSettings("MyClientAppName") With { _
    .ApplicationUri = New Uri("urn:localhost:MyClientAppName"), _
    .Lifetime = 60 _
}

settings.DomainNames.Add("localhost")

Dim certificate = OpcCertificateManager.CreateCertificate(settings)
OpcCertificateManager.SaveCertificate("MyClientCertificate.pfx", certificate)

As the name of the application, use the value of the AssemblyTitle attribute, or set the same value through the ApplicationName property of the client instance. If the client should use the certificate from the store for application certificates instead of loading it directly, save it in the ApplicationStore. By default, this is the CertificateStores\App folder next to the application, see Application certificate.

Ship the XML configuration files ​

If you configure the application through an XML file, deploy this file with the application. The application must be able to reach the file:

  • If the application loads the configuration through LoadClientConfigFile, the file must be at the path specified there.
  • If the application loads the configuration through LoadClientConfig, the file <Name>.Config.xml (for example Opc.UaFx.Client.Config.xml) must be in the working directory of the application. The working directory is not necessarily the directory of the application, for example if the application runs as a service.

The client does not evaluate the App.config of the application for its configuration (see Configuration through an XML file).

Deploy on UWP ​

On UWP (Universal Windows Platform), strict requirements apply to applications, similar to mobile applications. To let the UWP app work as an OPC UA client application, set the following capabilities in the project:

  • internetClient
  • privateNetworkClientServer

On UWP, the SDK cannot automatically create the application certificate that it also needs. Therefore, create the application certificate manually outside the UWP application. You can then deploy it as part of the Assets of the application and load it from there. The sample OPC UA .NET Samples: UWP Client shows how you can structure a UWP project.

Enter the license ​

Enter the license key in the application before you deploy the client application. Otherwise, it runs with the trial license, which stops after 30 minutes per application start. The page Set up the license describes how to enter the key, query the license in use, and check the license at startup.