Read OPC UA tags securely with a bot

1. Ask for a read-only identity

Have the server owner create a user (or certificate identity) whose role can browse and read only the needed nodes. No write, no method calls, no history update.

2. Require SignAndEncrypt

Connect with security policy Basic256Sha256 (or a newer policy your server supports) and mode SignAndEncrypt. Refuse None. Add the bot's client certificate to the server's trust list and the server's certificate to yours.

openssl req -x509 -newkey rsa:2048 -nodes -days 365 \
  -keyout bot-key.pem -out bot-cert.pem \
  -subj "/CN=ops-bot" -addext "subjectAltName=URI:urn:site:ops-bot"

3. Read tags with Python (asyncua)

Install asyncua from your offline wheel cache:

import asyncio, os
from asyncua import Client

URL = "opc.tcp://scada01.ops.local:4840"
NODES = ["ns=2;s=Line1.Filler.Speed", "ns=2;s=Line1.Filler.RejectCount"]

async def main():
    c = Client(URL)
    await c.set_security_string(
        "Basic256Sha256,SignAndEncrypt,bot-cert.pem,bot-key.pem,server-cert.pem")
    c.set_user("ops-bot-ro")
    c.set_password(os.environ["OPCUA_RO_PASSWORD"])   # never hard-code it
    async with c:
        for n in NODES:
            node = c.get_node(n)
            print(n, await node.read_value())

asyncio.run(main())

4. Browse instead of guessing node IDs

Use a GUI client or asyncua's browse functions to export the node list once, review it with the controls engineer, and give the bot only that allow-list.

5. Check that writes really fail

On a test server, confirm the account gets BadUserAccessDenied on a write. Record the result in your validation notes. Never perform this test on production.

Where these facts come from

• ISA/IEC 62443 series: zones, conduits and security levels for industrial automation
• NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) security
• CISA: Industrial Control Systems: advisories and recommended practices
• Modbus Organization specifications: function codes and the TCP transport
• OPC Foundation: OPC UA specifications and security modes
• llama.cpp on GitHub: building and running local GGUF models on Linux

Checked Oct 29, 2026. Tutorials are educational. Follow your site's safety procedures, management-of-change process and the equipment maker's manual. Never test against live production equipment without authorization.