# Introduction

> Concept: The concepts that every server development with the OPC UA .NET SDK builds on: starting and stopping the server, address, endpoints, and security.

> This content was machine translated and may contain errors. [Read in German](https://www.traeger.de/docs/development/opcua/server/introduction)

## The server

### Start

This is what happens when you call the `Start` method:

1. The server checks whether an address is set (property `OpcServer.Address`). If none is set, the server uses the address `opc.tcp://localhost:4840`. If all addresses have been unregistered again, `Start` throws an `InvalidOperationException`.
2. The server checks its license and changes its state (property `OpcServer.State`) to the value `Starting`. If the server is not in the `Created` or `Stopped` state, the call has no effect.
3. The server checks its configuration for validity and consistency.
4. Next, the server tries to create a host for each endpoint description.
5. Then the server starts all managers, for example the node managers and the `SessionManager`.
6. Finally, the server starts each host it created. The hosts handle the endpoint-specific communication with the clients.
7. The server changes its state (property `OpcServer.State`) to the value `Started`.

### Stop

This is what happens when you call the `Stop` method:

1. The server changes its state (property `OpcServer.State`) to the value `Stopping`.
2. The server stops all managers, for example the node managers and the `SessionManager`.
3. The server releases all acquired resources.
4. The server stops the hosts of the endpoint descriptions.
5. The server changes its state (property `OpcServer.State`) to the value `Stopped`.

You can also stop a server from the `Suspended` state.

### Suspend and resume

To mark the server as temporarily unavailable for maintenance without stopping it, call the `Suspend` method. The server then passes through the `Suspending` state into the `Suspended` state and reports the state `Suspended` to its clients through the server status. Its endpoints remain reachable. Beforehand, the server can tell the clients through the `OpcServer.EstimatedReturnTime` property when it expects to be available again. You can set this property only in the `Started` state. The `Resume` method returns the server to the `Started` state through `Starting`. Both methods take effect only from the matching state: `Suspend` from `Started`, `Resume` from `Suspended`.

```csharp
// Announce the expected end of the maintenance to the clients.
server.EstimatedReturnTime = DateTime.UtcNow.AddMinutes(10);
server.Suspend();
...
server.Resume();
```

```vbnet
'Announce the expected end of the maintenance to the clients.
server.EstimatedReturnTime = DateTime.UtcNow.AddMinutes(10)
server.Suspend()
...
server.Resume()
```

### Address and parameters

To let the server give clients access to its OPC UA services, set the right parameters. The server always needs the address at which it is reachable (property `OpcServer.Address`). The address is a URI (Uniform Resource Identifier) and gives all clients the essential information about the server. For example, the server address `opc.tcp://192.168.0.80:4840` contains the scheme `opc.tcp`. The scheme defines the protocol and the way the data is exchanged. The possible schemes are `opc.tcp` and `https`. For OPC UA servers in the local network, we recommend `opc.tcp`. For servers outside the local network, `https` can be a good choice. The address also states that the server runs on the computer with the IP address `192.168.0.80` and listens for requests on port `4840`. This is the default port for OPC UA, and custom port numbers are possible as well. Instead of the static IP address, you can also use the DNS name of the computer, for example `localhost` instead of `127.0.0.1`.

If the server should not provide an endpoint whose policy has the security mode `None`, configure at least one endpoint policy (property `OpcServer.Security.EndpointPolicies`). The other possible security modes are `Sign` and `SignAndEncrypt`. If the server does provide an endpoint with the policy `None`, a client can select it automatically for a simple and fast connection. The SDK assigns a policy level, a number, to each endpoint policy. The SDK calculates it from the security mode and the security algorithm and reports it to the clients (property `OpcSecurityPolicy.Level`). You cannot assign the level yourself. The OPC Foundation specifies that the higher the policy level of an endpoint, the better the endpoint. This is only a guideline that nobody checks or enforces.

If the server should use access control, for example through an ACL (access control list), define the valid identities of its users. This also works while the server is running. You can define user identities as a user name and password pair (class `OpcServerIdentity`) or as a certificate (class `OpcCertificateIdentity`). Pass the identities to the server with the `OpcServer.Security.UserNameAcl` and `OpcServer.Security.CertificateAcl` properties. For the server to apply these access control lists, enable them with their `IsEnabled` property. The access control list for anonymous users (property `OpcServer.Security.AnonymousAcl`) is only active as long as no other access control list is active, unless its `IsEnabled` property is set explicitly. So if you enable the `UserNameAcl`, for example, you turn off anonymous access. The [Secure servers](https://www.traeger.de/en/docs/development/opcua/security/server) page describes further options such as roles and custom access control lists.

### Endpoints

The endpoints result from the cross product of the base addresses of the server and the security policies that the server supports. Each base address results from a supported pair of scheme and port. For data exchange, you can set several schemes (`opc.tcp` and `https` are possible) on different ports. The policies combined with them define how data is exchanged. Each policy consists of the policy level, the security mode, and the security algorithm, and so defines the kind of secure data exchange.

Suppose the server supports two security policies:

- Security policy A: level 0, security mode `None`, security algorithm `None`
- Security policy B: level 1, security mode `Sign`, security algorithm `Basic256Sha256`

In addition, there are three base addresses for different schemes:

- Base address A: `https://mydomain.com/`
- Base address B: `opc.tcp://192.168.0.123:4840/`
- Base address C: `opc.tcp://192.168.0.123:12345/`

The cross product results in the following endpoint descriptions:

- Endpoint 1: address `https://mydomain.com/`, level 0, security mode `None`, security algorithm `None`
- Endpoint 2: address `https://mydomain.com/`, level 1, security mode `Sign`, security algorithm `Basic256Sha256`
- Endpoint 3: address `opc.tcp://192.168.0.123:4840/`, level 0, security mode `None`, security algorithm `None`
- Endpoint 4: address `opc.tcp://192.168.0.123:4840/`, level 1, security mode `Sign`, security algorithm `Basic256Sha256`
- Endpoint 5: address `opc.tcp://192.168.0.123:12345/`, level 0, security mode `None`, security algorithm `None`
- Endpoint 6: address `opc.tcp://192.168.0.123:12345/`, level 1, security mode `Sign`, security algorithm `Basic256Sha256`

The server always defines the address part of the endpoint, either through the constructor or through the `Address` property. As long as no policy is configured, the server defines one endpoint with the security mode `None`. If the server should use other policies instead or in addition, configure them with the `OpcServer.Security.EndpointPolicies` property.

## Certificates and security

The SDK aims to make getting started with OPC UA as easy as possible. For this reason, the connection between client and server is not fully secured unless you configure the server further. As soon as you have implemented and tested the final [spike](https://en.wikipedia.org/wiki/Spike_%28software_development%29), you should turn to security:

- The [Understand certificates](https://www.traeger.de/en/docs/development/opcua/security/certificates) page describes how certificates identify client and server, where they are stored, and how the applications check them.
- The [Users and roles](https://www.traeger.de/en/docs/development/opcua/security/users-roles) page describes how users log on and which permissions they receive.
- The [Harden for production](https://www.traeger.de/en/docs/development/opcua/security/server#harden-for-production) section contains all settings for production and a checklist.