Ecostruxure Process Expert [2021] Compatibility issue of OPC UA and OPC DA configuration on the same machine
This knowledge base explains the user on why the OPC UA and OPC DA is not recommended to configure on the same machine.
By default, Plant SCADA operates under the virtual user account (VSA) NT SERVICE\Citect Runtime Manager when running as a service. However, an OPC DA server uses specific DCOM settings that are not compatible with this VSA. To support this functionality at runtime, OPC DA server will have to be run as a service under a specific interactive user account.
However, to setup an OPC UA server, encryption has to be enabled. The OPC UA server needs to be run as a low privilege VSA to create encrypted outgoing connections using the PCS based certificates. When encryption is enabled, the OPC DA server cannot be run as an interactive user as it needs to access the private key of the certificate required for encryption. This causes the OPC DA server to stop if it runs as an interactive user. Permission to read the certificate cannot be granted to the interactive user and doing so, would introduce a potential security flaw. Because of these sharp contrast in the requirements, it is not recommended to configure OPC DA server and OPC UA server on the same machine.
The suggested workaround is to configure the OPC UA and OPC DA servers on different machines.
This is applicable to all versions of Plant Scada/Citect SCADA.
By default, Plant SCADA operates under the virtual user account (VSA) NT SERVICE\Citect Runtime Manager when running as a service. However, an OPC DA server uses specific DCOM settings that are not compatible with this VSA. To support this functionality at runtime, OPC DA server will have to be run as a service under a specific interactive user account.
However, to setup an OPC UA server, encryption has to be enabled. The OPC UA server needs to be run as a low privilege VSA to create encrypted outgoing connections using the PCS based certificates. When encryption is enabled, the OPC DA server cannot be run as an interactive user as it needs to access the private key of the certificate required for encryption. This causes the OPC DA server to stop if it runs as an interactive user. Permission to read the certificate cannot be granted to the interactive user and doing so, would introduce a potential security flaw. Because of these sharp contrast in the requirements, it is not recommended to configure OPC DA server and OPC UA server on the same machine.
The suggested workaround is to configure the OPC UA and OPC DA servers on different machines.
This is applicable to all versions of Plant Scada/Citect SCADA.
Опубліковано для: Schneider Electric Україна
Потрібна допомога?
Почніть тут!
Знайдіть відповіді зараз. Шукайте рішення самостійно або зверніться до нашого експерта.
Звернутися до служби підтримки
Якщо вам потрібна допомога, додаткова інформація чи технічна підтримка або ви хочете подати скаргу, зв’яжіться з нашою командою з обслуговування клієнтів.
Де придбати?
Зручний пошук найближчого дистриб’ютора, магазина або спеціалізованого партнера Schneider Electric у вашому регіоні.
Переглянути відповіді на поширені запитання
Отримайте необхідну інформацію, переглянувши відповіді на поширені запитання за відповідними темами.