Ecostruxure Process Expert [2021] Compatibility issue of OPC UA and OPC DA configuration on the same machine
This knowledge base explains the user on why the OPC UA and OPC DA is not recommended to configure on the same machine.
By default, Plant SCADA operates under the virtual user account (VSA) NT SERVICE\Citect Runtime Manager when running as a service. However, an OPC DA server uses specific DCOM settings that are not compatible with this VSA. To support this functionality at runtime, OPC DA server will have to be run as a service under a specific interactive user account.
However, to setup an OPC UA server, encryption has to be enabled. The OPC UA server needs to be run as a low privilege VSA to create encrypted outgoing connections using the PCS based certificates. When encryption is enabled, the OPC DA server cannot be run as an interactive user as it needs to access the private key of the certificate required for encryption. This causes the OPC DA server to stop if it runs as an interactive user. Permission to read the certificate cannot be granted to the interactive user and doing so, would introduce a potential security flaw. Because of these sharp contrast in the requirements, it is not recommended to configure OPC DA server and OPC UA server on the same machine.
The suggested workaround is to configure the OPC UA and OPC DA servers on different machines.
This is applicable to all versions of Plant Scada/Citect SCADA.
By default, Plant SCADA operates under the virtual user account (VSA) NT SERVICE\Citect Runtime Manager when running as a service. However, an OPC DA server uses specific DCOM settings that are not compatible with this VSA. To support this functionality at runtime, OPC DA server will have to be run as a service under a specific interactive user account.
However, to setup an OPC UA server, encryption has to be enabled. The OPC UA server needs to be run as a low privilege VSA to create encrypted outgoing connections using the PCS based certificates. When encryption is enabled, the OPC DA server cannot be run as an interactive user as it needs to access the private key of the certificate required for encryption. This causes the OPC DA server to stop if it runs as an interactive user. Permission to read the certificate cannot be granted to the interactive user and doing so, would introduce a potential security flaw. Because of these sharp contrast in the requirements, it is not recommended to configure OPC DA server and OPC UA server on the same machine.
The suggested workaround is to configure the OPC UA and OPC DA servers on different machines.
This is applicable to all versions of Plant Scada/Citect SCADA.
發佈於: 施耐德電機Taiwan
需要協助？
產品選型工具
快速輕鬆地為您的應用找到合適的產品和附件。
取得報價
立即線上提交您的銷售需求，專業團隊將主動聯繫您。
購買地點
輕鬆在您所在地區找到最近的施耐德電機經銷商。
支援中心
在同一位置找到滿足您所有需求的支援資源。