# Connect an OPC UA server > Connect an OPC UA server to Synnax, with its login and security settings. An OPC UA server makes the values of a PLC or a SCADA system available as nodes. In Synnax, an OPC UA server is one endpoint with its login and security settings. The [read task](https://docs.synnaxlabs.com/reference/hardware/opc-ua/read-task) and the [write task](https://docs.synnaxlabs.com/reference/hardware/opc-ua/write-task) add the nodes. ## Prerequisites * Supported WindowsmacOSLinuxNI Linux RTDocker - A running Driver that can reach the server on the network. Synnax Desktop runs one for you. ## Connect a server [Enterprise](https://docs.synnaxlabs.com/reference/get-started/editions "Needs Synnax Enterprise") **Console** 1. In the [devices toolbar](https://docs.synnaxlabs.com/reference/hardware/devices#devices-toolbar), click (**Connect device**), then select **OPC UA server**. You can also run the “Connect OPC UA server” command. 2. Enter a name for the server. 3. In **Endpoint**, enter the address of the server, for example `opc.tcp://192.168.1.50:4840`. 4. In **Connect from**, select the Driver that connects to the server. If only one running Driver has OPC UA enabled, the Console selects it for you. 5. If the server needs a login, enter the **Username** and the **Password**. 6. Set the [security](https://docs.synnaxlabs.com/reference/hardware/opc-ua/connect-server#security). 7. Click **Connect**. The Console asks the Driver to connect to the server before it saves the server. If the test fails or takes more than 10 seconds, the dialog shows the error and keeps your entries. [](https://synnax.nyc3.cdn.digitaloceanspaces.com/docs/device-drivers/opc-ua/connect-server/connect-server-dark.mp4#t=0.001) **Python** ```python from synnax import opcua rack = client.racks.retrieve_embedded_rack() device = client.devices.create( opcua.Device( name="Line 1 PLC", endpoint="opc.tcp://192.168.1.50:4840", location="opc.tcp://192.168.1.50:4840", rack=rack.key, ) ) ``` Python does not test the connection. Pass the key of a rack, or the device has no Driver. **TypeScript** ```typescript const rack = await client.racks.retrieve({ name: "Node 1 Embedded Driver" }); await client.devices.create({ key: crypto.randomUUID(), name: "Line 1 PLC", rack: rack.key, location: "opc.tcp://192.168.1.50:4840", make: "opc", model: "OPC UA server", configured: true, properties: { version: "1.0.0", connection: { endpoint: "opc.tcp://192.168.1.50:4840", securityMode: "None", securityPolicy: "None", }, read: { indexes: [], channels: {} }, write: { channels: {} }, }, }); ``` TypeScript does not test the connection. ## Security In the **Security** section, the **Mode** and the **Policy** protect the connection between the Driver and the server. Set them to values that the server accepts. * **Mode** -> **None**, **Sign**, or **Sign and encrypt**. * **Policy** -> the algorithms. The field shows when the mode is not **None**. When you change the mode from **None**, the Console selects **Basic 256-bit with SHA-256**. Select a deprecated policy only when the server supports no other policy. * **Client certificate** and **Client private key** -> the certificate that the Driver sends to the server, and its key. The fields show when the mode is not **None**. In Python and TypeScript, set a policy other than `"None"` when the mode is not `"None"`. With the policy at `"None"`, the Driver does not load the certificates, even when the mode is `"Sign"`. The certificate and key are file paths on the computer that runs the Driver: * In Synnax Desktop, the Console and the Driver run on the same computer, so the file picker gives a correct path. * When the Driver runs on a different computer, the picker gives a path on your computer. Set the paths in Python or TypeScript instead. * The Console in a web browser cannot pick files. Set the paths in Python or TypeScript. In Python and TypeScript, set a policy other than `"None"` when the mode is not `"None"`. With the policy at `"None"`, the Driver does not load the certificates, even when the mode is `"Sign"`. The private key must not have a password. The server reads the application URI of the Driver from the URI in the client certificate. Without a client certificate, the URI is `urn:synnax.opcua.client`. The Driver accepts every server certificate. The **Server certificate** field has no effect. The Driver logs in to the server as an anonymous user, or with the **Username** and **Password** when you enter one of them. It cannot log in with a user certificate. ## Connection options | Console label | Python field | Default | Notes | | ------------------ | -------------------- | -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | Connect from | `rack` | | The key of the rack that runs the Driver. | | Endpoint | `endpoint` | `opc.tcp://localhost:4840` | Required in Python. | | Username | `username` | Empty | Empty for an anonymous login. | | Password | `password` | Empty | | | Mode | `security_mode` | None | `"None"`, `"Sign"`, or `"SignAndEncrypt"`. | | Policy | `security_policy` | None | `"None"` goes only with the mode `"None"`. See [security policies](https://docs.synnaxlabs.com/reference/hardware/opc-ua/connect-server#security-policies). | | Client certificate | `client_cert` | Empty | A path on the Driver computer. | | Client private key | `client_private_key` | Empty | A path on the Driver computer. No password. | | Server certificate | `server_cert` | Empty | Has no effect. | In TypeScript, the fields are in `properties.connection` in camel case, such as `securityMode`, `clientCertificate`, and `serverCertificate`. ### Security policies | Console label | Value | | ------------------------------ | ------------------------- | | Basic 256-bit with SHA-256 | `"Basic256Sha256"` | | AES 128-bit with SHA-256 | `"Aes128_Sha256_RsaOaep"` | | AES 256-bit with SHA-256 | `"Aes256_Sha256_RsaPss"` | | Basic 256-bit (deprecated) | `"Basic256"` | | Basic 128-bit RSA (deprecated) | `"Basic128Rsa15"` | ## Troubleshooting * [Failed to reach server](https://docs.synnaxlabs.com/reference/hardware/opc-ua/connect-server#failed-to-reach-server) * Cause The Driver checks each server every 5 seconds. The status shows “Failed to reach server” when the Driver cannot connect. The description shows the reason. * Fix 1. Check the **Endpoint**, including the port. 2. Make sure that the computer that runs the Driver can reach the server. * [The Driver paused new connections to the server after too many failed attempts in a row.](https://docs.synnaxlabs.com/reference/hardware/opc-ua/connect-server#the-driver-paused-new-connections-to-the-server-after-too-many-f) * Cause The Driver failed to connect three times in a row, so it waits 5 seconds before it tries again. * Fix 1. Fix the cause of the first error. 2. Try again. * [Failed to configure encryption](https://docs.synnaxlabs.com/reference/hardware/opc-ua/connect-server#failed-to-configure-encryption) * Cause The Driver could not use the certificate, the key, or the policy. * Fix 1. Make sure that the paths are correct on the computer that runs the Driver. 2. Remove the password from the private key. 3. Select a policy that the server supports. * [The certificate is not trusted.](https://docs.synnaxlabs.com/reference/hardware/opc-ua/connect-server#the-certificate-is-not-trusted) * Cause The server rejected the client certificate. * Fix Add the client certificate to the trust list of the server. * [The URI specified in the ApplicationDescription does not match the URI in the certificate.](https://docs.synnaxlabs.com/reference/hardware/opc-ua/connect-server#the-uri-specified-in-the-applicationdescription-does-not-match-t) * Cause The URI in the client certificate is different from the URI that the server expects. * Fix Create a certificate whose URI matches the server configuration. * [User does not have permission to perform the requested operation.](https://docs.synnaxlabs.com/reference/hardware/opc-ua/connect-server#user-does-not-have-permission-to-perform-the-requested-operation) * Cause The server rejected the **Username** or the **Password**. Some servers show “The user identity token is valid but the server has rejected it.” for the same cause. * Fix Enter a **Username** and a **Password** that the server accepts. * [The user identity token is not valid.](https://docs.synnaxlabs.com/reference/hardware/opc-ua/connect-server#the-user-identity-token-is-not-valid) * Cause The server does not accept an anonymous login. * Fix Enter a **Username** and a **Password**. For other problems, see [Troubleshoot hardware](https://docs.synnaxlabs.com/reference/hardware/troubleshooting).