Kepware OPCUA certificate

[WY_14406740]

1. 使用者希望使用有效期限為10 年或更長的自簽名憑證。使用原有的KEPServerEX客戶端時，只需一個憑證即可實現雙向通訊。然而，由於架構較為複雜，目前似乎無法在多個系統間重複使用自簽名憑證。請確認自簽名客戶端憑證是否可以被多個伺服器使用。

2. OPC UA證書會自動續約或延長有效期限嗎？

3. 如果用戶端憑證過期，是否會影響現有系統？例如，是否會導致EAP無法連線等問題？

• The user would like to use a self-signed certificate with a validity period of 10 years or longer. With the original KEPServerEX client, only one certificate is needed for mutual communication.
  However, it seems that a self-signed certificate cannot currently be reused across multiple systems, possibly due to the more complex architecture. Please confirm whether a self-signed client certificate can be used by multiple servers.

• Will **OPC UA certificates automatically renew or extend their validity period?

• If the client certificate expires, will it affect the existing system? For example, could it cause issues such as EAP being unable to connect?

[ntripathi]

Greetings @WY_14406740,

I hope this email finds you well.

I am writing to inform you that the OPC UA certificate generated by the Kepware Server is created by default with a validity period of 3 years. After this 3‑year period, the certificate cannot be extended and must be reissued. For detailed information, please refer to the article Article - CS368928 - Is it possible to extend the expiration of OPC UA certificate generated by Kepware?

Please note the following important points:

• OPC UA certificates do not renew automatically.
  There is no built‑in mechanism in Kepware or OPC UA to extend or auto‑renew an existing certificate.

• When an OPC UA client certificate expires, the secure connection will fail immediately.

Thanks
Naveen

[ntripathi · Accepted solution]

Hello @WY_14406740,

I would like to inform you that self‑signed certificates cannot typically be used across multiple servers. In most environments, self‑signed certificates operate on a one‑to‑one trust relationship, meaning each server generally requires its own certificate to establish a secure and trusted connection.

Whether a certificate can be reused depends on the issuing Certificate Authority (CA).

[WY_14406740]

Thank you Ntripathi for the reply. I previously explained this to the customer as well—the certificate mechanism is designed this way for security and mutual trust. I understand now. Thank you for your assistance.