Review an OPC UA trust change
Investigate a new application certificate and separate trust from authorization.
By Abdul Khadir Mahamed · Updated 3 November 2026
Independent guided exercise using synthetic evidence. No live industrial systems are connected.
Your scenario
An OPC UA server records a certificate trust-list change outside the maintenance window.
Evidence to examine
18:42 admin=svc-maint action=trust_add thumbprint=TRAINING-7A 18:44 application=NewClient session=accepted 18:45 user=operator1 action=write node=Line1.Setpoint Approved window: 12:00–13:00
Your investigation tasks
- Build a timeline and identify missing context.
- Explain why trusting an application certificate does not alone justify write permissions.
- Specify authentication, authorization, and change evidence to collect.
Debrief
Review the reasoning after completing the tasks
Review who used svc-maint, the certificate origin, application identity, user identity, and node permissions. Correlate the write with the process owner. Certificate trust, secure channel configuration, and user authorization are separate checks.
Take it back to the process
Separate observed facts from assumptions. Explain the operational consequence of your decision, name the evidence still needed, and identify who must approve or validate a real-world change.