Prosys Forum - Forum: OPC UA SDK for Java

rocket science on Subscription Transfer with KEP Server EX

Tue, 14 Apr 2026 01:22:05 +0300

Bjarne Boström said
Are you absolutely sure that the server did crash?

Not 100% sure. I just assumed this from the logs because of:

2026-04-10 01:17:48,349 onStatusChange: status=null statusCode=Bad_Timeout (0x800A0000) “The operation timed out.”

and the fact that read operations did no more work beginning at this time.

So I assumed the server was restartet at ~ 02:08 when the client got connection again - but I have to re-check if this was the case or the server was basically still running somehow.

Bjarne Boström said
CreateSubscrpitionResponse shows that the server created Subscription with id 45. Now depending how the server chooses them (they need to be unique for the server), it is possible by luck it was 45.
Or if other clients (if any) also connected it might not have been the initial one. Or in theory might be some weird result of TransferSubscription using that id (it would have been e.g. the highest)??

Yeah, this is somehow strange.

Bjarne Boström said
Does more than one client connect to the server? Do you (+they) use Anonymous user access?
- Asking because most ids are +2, but 45 was 44+1, typically these are +1 for the previous one.

Yes, there are 2 clients connected to this server. The other client has also 6 subscription and had basically the same problem at the same time (but I have to check the logs for the other in detail)
Both clients use Anonymous access.

Bjarne Boström said
There are some oddities. If the server crashed, it would be extremely unlikely that it would have any knowledge of Subscriptions prior to the crash, though not impossible
(but I'm not aware of such implementation; plus the UA Spec Durable Subscriptions would need to be enabled by the client, which we do not do). So, any TransferSubscriptions call should thus fail.

Now then, IF other clients would be connecting to the same server, then there are some scenarios where depending on the implementation and other stuff it might be possible
to Transfersubscription another clients Subscription, which in this case would be something they just have made. Though this should only happen for Anonymous Sessions, if for any.

The timeout and lifetimeout do depend on delta to Subscription.getLastAlive() (vs. publishinterval and respective keepalive/lifetime), which is updated if anything is done, e.g.
server sends keepalive or data for the Subscription (or if data is received that indicates an update was missed and is being RePublished).

Note that UaClient will keep sending PublishRequests as long as it has Subscription.isAlive() subscriptions and PublishRequests are not keyed to any subscription.

You're right, if the server would have crashed completly it would have started by SuscriptionId 1 (at least I would have expected this)

I will check tomorrow what happened to the other client at the same time, and take a look at the SubscriptionId's there.

Bjarne Boström said
Does the "Server sent a previously acknowledged sequence number" numbers keep rising or stay 1? Though you showed one line that has also 2 for id 36.

Maybe the TransferSubscriptions somehow resulted in the server making some subscription objects that do nothing, but send keepalives. Or maybe they do send data,
but they started as-if they were new ones, so the sequence number is wrong (and thus you see those logs for very long while until they catch up the number the server send prev to the crash).

Yes, thats also somehow weird here, some numbers are increasing from time to time, but some stay on 2.
E.g. Subscription 36 stays on 2
and Subscription 38 stays on 97 some time but increases later to 98 followed to increase to 99

Here are some logs a few hours later:

Bjarne Boström on Bad_DecodingError (0x80070000) "Decoding halted because of invalid data in the stream."

Mon, 13 Apr 2026 20:38:02 +0300

First a note that this topic is somewhat complicated. Also, this answer is based on the 5.x. Though, it is mostly the same in 4.x.

When dealing with Structures for which you do not know the exact type in code, it is best to treat them as the raw 'Structure' interface. It does have methods for getting and setting fields in a generic way, see https://documentation.prosysop.....cture.html. Alternatively for known types for which you do have an information model NodeSet XML file, you could use the included Codegen tool to create java classes that represent the Structures.

The SDK has special metadata classes StructureSpecification and FieldSpecification that model the Structure types that they can be handled in a generic way. Nowadays, you could mostly think them as "better versions" of StructureDefinition and FieldDefinition from the DataTypeDefinition Attribute, though StructureSpecification and FieldSpecification do pre-date them. Basically they were first used with what we now call legacy DataTypeDictionaries (the server has a node that has a big XML document). Now depending what the server supports we either use the DataTypeDefinition Attribute or the legacy dictionaries (or both), but the "SDK user API" is still the same with StructureSpecification and FieldSpecification regardless of which one was used.

See
https://documentation.prosysop.....ation.html
https://documentation.prosysop.....ation.html
you can use com.prosysopc.ua.stack.builtintypes.Structure.specification() to get the StructureSpecification and then getFields on that to get FieldSpecification, one per each field, these tell e.g. the field name and datatype which helps when using e.g. com.prosysopc.ua.stack.builtintypes.Structure.set(String, Object).

If you do not have any Structure instance to .specification(), you can use com.prosysopc.ua.client.UaClient.getEncoderContext()+ com.prosysopc.ua.stack.encoding.EncoderContext.getStructureSpecification(UaNodeId) to get the StructureSpecification of that type, then com.prosysopc.ua.typedictionary.StructureSpecification.toInstanceBuilder() will give a Structure.Builder that can be used to build the Structure instances of that type.

In 5.x the concept was generalized in a way all datatypes, in 4.x it is mostly just Structures and Enumerations (https://downloads.prosysopc.co.....sion-5-0-0)

We should probably improve the documentation at some point, maybe the best existing example is in the SampleConsoleServer example com.prosysopc.ua.samples.server.MyNodeManager.createCustomStructure(), https://documentation.prosysop.....l#line.415. Though start around https://documentation.prosysop.....l#line.467 as the start of the method is creating the type itself.

Bjarne Boström on Subscription Transfer with KEP Server EX

Mon, 13 Apr 2026 20:04:18 +0300

Hi,

Most likely you would need to contact the server vendor. But to theoretize something...

Are you absolutely sure that the server did crash?

For the one Subscription that did fail the TransferSubscription, the id was 45. This is a server-given id. The "createSubscription: subscription=" lines show other numbers than 45. A failed TransferSubscription does reset the number in our client side i.e. it becomes 0; which is otherwise invalid id, this is seen in the createSubscription. However, then the CreateSubscrpitionResponse shows that the server created Subscription with id 45. Now depending how the server chooses them (they need to be unique for the server), it is possible by luck it was 45. Or if other clients (if any) also connected it might not have been the initial one. Or in theory might be some weird result of TransferSubscription using that id (it would have been e.g. the highest)??

Does more than one client connect to the server? Do you (+they) use Anonymous user access?
- Asking because most ids are +2, but 45 was 44+1, typically these are +1 for the previous one.

There are some oddities. If the server crashed, it would be extremely unlikely that it would have any knowledge of Subscriptions prior to the crash, though not impossible (but I'm not aware of such implementation; plus the UA Spec Durable Subscriptions would need to be enabled by the client, which we do not do). So, any TransferSubscriptions call should thus fail.

Now then, IF other clients would be connecting to the same server, then there are some scenarios where depending on the implementation and other stuff it might be possible to Transfersubscription another clients Subscription, which in this case would be something they just have made. Though this should only happen for Anonymous Sessions, if for any.

The timeout and lifetimeout do depend on delta to Subscription.getLastAlive() (vs. publishinterval and respective keepalive/lifetime), which is updated if anything is done, e.g. server sends keepalive or data for the Subscription (or if data is received that indicates an update was missed and is being RePublished).

Note that UaClient will keep sending PublishRequests as long as it has Subscription.isAlive() subscriptions and PublishRequests are not keyed to any subscription.

Does the "Server sent a previously acknowledged sequence number" numbers keep rising or stay 1? Though you showed one line that has also 2 for id 36.

Maybe the TransferSubscriptions somehow resulted in the server making some subscription objects that do nothing, but send keepalives. Or maybe they do send data, but they started as-if they were new ones, so the sequence number is wrong (and thus you see those logs for very long while until they catch up the number the server send prev to the crash).

devaskim on Bad_DecodingError (0x80070000) "Decoding halted because of invalid data in the stream."

Mon, 13 Apr 2026 19:48:57 +0300

Many thanks, Bjarne!
After fixing definition the issue is gone and data is deserialized to DynamicStructure object.
Last question: is there any example how to deal with such objects in Java?

Bjarne Boström on Bad_DecodingError (0x80070000) "Decoding halted because of invalid data in the stream."

Mon, 13 Apr 2026 19:20:20 +0300

That does explain. The ValueRanks are incorrect, they should be -1, not 0. See https://reference.opcfoundatio...../docs/8.51 "ValueRank Int32 The value rank for the field. It shall be Scalar (-1) or a fixed rank Array (>=1).". In OPC UA the ValueRank is a bit ... compliacted, but it is the number of dimensions when 1+, but 0 and some negative numbers have special meaning, see Variable NodeClass as an Attribute, see https://reference.opcfoundatio.....5/docs/5.6. However, Structures need fixed number of things (so scalar or fixed known dimension), at least so far.

So, basically our parser will ignore this DataType as the definition is incorrect, thus later decodings will also fail. If you can correct this on the server or ask the maintainers of it to correct it should start to work. Possibly UaExpert has done the check in a way that incorrectly allows 0 to work (such as scalar).

devaskim on Bad_DecodingError (0x80070000) "Decoding halted because of invalid data in the stream."

Mon, 13 Apr 2026 18:49:07 +0300

Here is output of our DataType using Prosys OPC UA Browser

DataTypeDefinition StructureDefinition [DefaultEncodingId="ns=1;i=1004", BaseDataType="i=22", StructureType="Structure", Fields="[
StructureField [Name="Max", Description="", DataType="i=5", ValueRank="0", ArrayDimensions="[]", MaxStringLength="0", IsOptional="false"],
StructureField [Name="Min", Description="", DataType="i=5", ValueRank="0", ArrayDimensions="[]", MaxStringLength="0", IsOptional="false"],
StructureField [Name="Status", Description="", DataType="i=5", ValueRank="0", ArrayDimensions="[]", MaxStringLength="0", IsOptional="false"]]"]

Bad_AttributeIdInvalid error are only in RolePermissions, UserRolePermissions and AccessRestrictions attributes.

rocket science on Connect to server with security mode NONE and user/password

Mon, 13 Apr 2026 18:44:27 +0300

I understand. Thank you for that detailed explanation!

rocket science on Subscription Transfer with KEP Server EX

Mon, 13 Apr 2026 18:42:37 +0300

Hi,

I had an issue where KEPServerEX crashed and after restart of KEP Server EX it seemed that only 1 out of 6 subscription did work.

Before the KEPServer crash I got onAlive for all 6 subscriptions and also onStatusChange messages:

2026-04-10 01:17:18,234 Subscription onAlive(): Subscription id=40 PublishingInterval=1000.0 isPublishingEnabled=true priority=0 lifetimeCount=60 maxKeepAliveCount=20 maxNotificationsPerPublish=0
2026-04-10 01:17:18,234 Subscription onAlive(): Subscription id=42 PublishingInterval=1000.0 isPublishingEnabled=true priority=0 lifetimeCount=60 maxKeepAliveCount=20 maxNotificationsPerPublish=0
2026-04-10 01:17:27,236 Subscription onAlive(): Subscription id=45 PublishingInterval=1000.0 isPublishingEnabled=true priority=0 lifetimeCount=60 maxKeepAliveCount=20 maxNotificationsPerPublish=0
2026-04-10 01:17:28,236 Subscription onAlive(): Subscription id=44 PublishingInterval=1000.0 isPublishingEnabled=true priority=0 lifetimeCount=60 maxKeepAliveCount=20 maxNotificationsPerPublish=0
2026-04-10 01:17:29,238 Subscription onAlive(): Subscription id=38 PublishingInterval=1000.0 isPublishingEnabled=true priority=0 lifetimeCount=60 maxKeepAliveCount=20 maxNotificationsPerPublish=0
2026-04-10 01:17:33,242 Subscription onAlive(): Subscription id=36 PublishingInterval=1000.0 isPublishingEnabled=true priority=0 lifetimeCount=60 maxKeepAliveCount=20 maxNotificationsPerPublish=0

2026-04-10 01:17:35,346 onStatusChange: status=ServerStatusDataType [StartTime="04/08/26 10:34:23.0326081 GMT", CurrentTime="04/10/26 08:17:35.3377350 GMT", State="Running", BuildInfo="BuildInfo [ProductUri="urn:XXX:Kepware.KEPServerEX.V6:UA%20Server", ManufacturerName="Kepware", ProductName="KEPServerEX", SoftwareVersion="6.17", BuildNumber="269", BuildDate="03/11/25 11:39:45.0000000 GMT"]", SecondsTillShutdown="0", ShutdownReason=""] statusCode=GOOD (0x00000000) "The operation succeeded."
2026-04-10 01:17:36,347 onStatusChange: status=ServerStatusDataType [StartTime="04/08/26 10:34:23.0326081 GMT", CurrentTime="04/10/26 08:17:36.3388048 GMT", State="Running", BuildInfo="BuildInfo [ProductUri="urn:XXX:Kepware.KEPServerEX.V6:UA%20Server", ManufacturerName="Kepware", ProductName="KEPServerEX", SoftwareVersion="6.17", BuildNumber="269", BuildDate="03/11/25 11:39:45.0000000 GMT"]", SecondsTillShutdown="0", ShutdownReason=""] statusCode=GOOD (0x00000000) "The operation succeeded."

Then the KEP Server crashed:

2026-04-10 01:17:48,349 onStatusChange: status=null statusCode=Bad_Timeout (0x800A0000) "The operation timed out."

For the 6 subscriptions I'm seeing also the onTimeOut and onLifetimeTimeOut

2026-04-10 01:17:48,449 Subscription onTimeout(): Subscription id=40 PublishingInterval=1000.0 isPublishingEnabled=true priority=0 lifetimeCount=60 maxKeepAliveCount=20 maxNotificationsPerPublish=0
2026-04-10 01:17:48,449 Subscription onTimeout(): Subscription id=42 PublishingInterval=1000.0 isPublishingEnabled=true priority=0 lifetimeCount=60 maxKeepAliveCount=20 maxNotificationsPerPublish=0
2026-04-10 01:19:38,671 Subscription onTimeout(): Subscription id=36 PublishingInterval=1000.0 isPublishingEnabled=true priority=0 lifetimeCount=60 maxKeepAliveCount=20 maxNotificationsPerPublish=0
2026-04-10 01:19:38,671 Subscription onTimeout(): Subscription id=38 PublishingInterval=1000.0 isPublishingEnabled=true priority=0 lifetimeCount=60 maxKeepAliveCount=20 maxNotificationsPerPublish=0
2026-04-10 01:19:38,671 Subscription onTimeout(): Subscription id=44 PublishingInterval=1000.0 isPublishingEnabled=true priority=0 lifetimeCount=60 maxKeepAliveCount=20 maxNotificationsPerPublish=0
2026-04-10 01:19:38,671 Subscription onTimeout(): Subscription id=45 PublishingInterval=1000.0 isPublishingEnabled=true priority=0 lifetimeCount=60 maxKeepAliveCount=20 maxNotificationsPerPublish=0

2026-04-10 01:19:38,671 Subscription onLifetimeTimeout(): Subscription id=36 PublishingInterval=1000.0 isPublishingEnabled=true priority=0 lifetimeCount=60 maxKeepAliveCount=20 maxNotificationsPerPublish=0
2026-04-10 01:19:38,671 Subscription onLifetimeTimeout(): Subscription id=38 PublishingInterval=1000.0 isPublishingEnabled=true priority=0 lifetimeCount=60 maxKeepAliveCount=20 maxNotificationsPerPublish=0
2026-04-10 01:19:38,671 Subscription onLifetimeTimeout(): Subscription id=40 PublishingInterval=1000.0 isPublishingEnabled=true priority=0 lifetimeCount=60 maxKeepAliveCount=20 maxNotificationsPerPublish=0
2026-04-10 01:19:38,671 Subscription onLifetimeTimeout(): Subscription id=42 PublishingInterval=1000.0 isPublishingEnabled=true priority=0 lifetimeCount=60 maxKeepAliveCount=20 maxNotificationsPerPublish=0
2026-04-10 01:19:38,671 Subscription onLifetimeTimeout(): Subscription id=44 PublishingInterval=1000.0 isPublishingEnabled=true priority=0 lifetimeCount=60 maxKeepAliveCount=20 maxNotificationsPerPublish=0
2026-04-10 01:19:38,671 Subscription onLifetimeTimeout(): Subscription id=45 PublishingInterval=1000.0 isPublishingEnabled=true priority=0 lifetimeCount=60 maxKeepAliveCount=20 maxNotificationsPerPublish=0

When the server was back online (restarted); i can see that a subscription transfer happens:

In the log it shows the TransferSubscriptionsResponse with disconnectSubscriptions for 5 subscriptions GOOD and for 1 Bad

2026-04-10 02:08:35,238|SecureChannelTcp|DEBUG|Response: TransferSubscriptionsResponse
2026-04-10 02:08:35,238|UaClient|DEBUG|disconnectSubscriptions:
[TransferResult [StatusCode="GOOD (0x00000000) "The operation succeeded."", AvailableSequenceNumbers="[]"],
TransferResult [StatusCode="GOOD (0x00000000) "The operation succeeded."", AvailableSequenceNumbers="[]"],
TransferResult [StatusCode="GOOD (0x00000000) "The operation succeeded."", AvailableSequenceNumbers="[]"],
TransferResult [StatusCode="GOOD (0x00000000) "The operation succeeded."", AvailableSequenceNumbers="[]"],
TransferResult [StatusCode="GOOD (0x00000000) "The operation succeeded."", AvailableSequenceNumbers="[]"],
TransferResult [StatusCode="Bad_SubscriptionIdInvalid (0x80280000) "The subscription id is not valid."", AvailableSequenceNumbers="[]"]]

I see an onAfterCreate only for 1 subscription

2026-04-10 02:08:35,241 onAfterCreate(): Subscription id=45 PublishingInterval=1000.0 isPublishingEnabled=true priority=0 lifetimeCount=60 maxKeepAliveCount=20 maxNotificationsPerPublish=0

2026-04-10 02:08:35,241|UaClient|INFO |reconnect: Reconnected to server (new session)

From that point on, I'm getting only onAlive() for this subscription but not of the other 5

2026-04-10 02:08:36,233 onAlive(): Subscription id=45 PublishingInterval=1000.0 isPublishingEnabled=true priority=0 lifetimeCount=60 maxKeepAliveCount=20 maxNotificationsPerPublish=0

I'm also not getting onDataChanges for the 5 subscription, but only the one for id=45

Instead I can see a lot of this loggings:

I'm also logging the subscription isConnected() and isAlive() periodically and it seems that both are true (even it seems that I do no more get onDataChanges)

02:12:52,359 Subscription id=36 isConnected(true), isAlive(true)
02:12:52,359 Subscription id=38 isConnected(true), isAlive(true)
02:12:52,359 Subscription id=40 isConnected(true), isAlive(true)
02:12:52,359 Subscription id=42 isConnected(true), isAlive(true)
02:12:52,359 Subscription id=44 isConnected(true), isAlive(true)
02:12:52,359 Subscription id=45 isConnected(true), isAlive(true)

Could it be possible that KEPServerEX has some problem here with subscription transfer?

Based on the logging during 'transferSubscriptions' for me it looked like that 5 subscription could be transferred and one of them could not. The one that could not gets recreated but unfortunatly this was the only one for which I'm getting onDataChanges. Somehow for the other 5 it seems that the server did somehow not handled the transfer correctly

What do you think about that?

Bjarne Boström on Connect to server with security mode NONE and user/password

Mon, 13 Apr 2026 18:30:32 +0300

Sorry, we might not have a bug, since I missed one place re-set the Server's certificate to the EndpointDescription after the CreateSessionResponse..

Anyway, now that we see the UserTokenPolicies it is obivious, the server requires a certificate in this case.
...
[0]: EndpointDescription
...
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#None
UserIdentityTokens: Array of UserTokenPolicy
ArraySize: 3
[0]: UserTokenPolicy
PolicyId: anonymous
UserTokenType: Anonymous (0x00000000)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: [OpcUa Null String]
[1]: UserTokenPolicy
PolicyId: username
UserTokenType: UserName (0x00000001)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
[2]: UserTokenPolicy
PolicyId: certificate
UserTokenType: Certificate (0x00000002)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
...

Thus, the None security endpoint contains a single UserName UserTokenPolicy, that defines security must be used for the token (SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256), thus therefore also a Certificate from the server is required in order to use this UserTokenPolicy, so that the password is encrypted.

IF it would have instead been defined like
[1]: UserTokenPolicy
PolicyId: username
UserTokenType: UserName (0x00000001)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: null

[1]: UserTokenPolicy
PolicyId: username
UserTokenType: UserName (0x00000001)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#None

then it would not need a Certificate and the password would be in plain-txt over the wire for the NONE endpoint (null basically means use the same policy as the channel). Though I would need to test does this work with our SDK.

Also, that being said, with our SDK, IF it there would be more than one UserTokenPolicy whose type is UserName, then basically the first one of those would be used. It is not possible to currently select it manually.

rocket science on Connect to server with security mode NONE and user/password

Mon, 13 Apr 2026 18:00:21 +0300

sure, here is the complete CreateSessionResponse:

OpcUa Binary Protocol
Message Type: MSG
Chunk Type: F
Message Size: 3670
SecureChannelId: 1754025483
Security Token Id: 50795
Sequence Number: 2
RequestId: 2
Message: Encodeable Object
TypeId: ExpandedNodeId
NodeId EncodingMask: Four byte encoded Numeric (0x01)
NodeId Namespace Index: 0
NodeId Identifier Numeric: CreateSessionResponse (464)
CreateSessionResponse
ResponseHeader: ResponseHeader
Timestamp: Apr 13, 2026 13:58:39.653954400 Mitteleuropäische Sommerzeit
RequestHandle: 0
ServiceResult: 0x00000000 [Good]
ServiceDiagnostics: DiagnosticInfo
EncodingMask: 0x00
.... ...0 = has symbolic id: False
.... ..0. = has namespace: False
.... .0.. = has localizedtext: False
.... 0... = has locale: False
...0 .... = has additional info: False
..0. .... = has inner statuscode: False
.0.. .... = has inner diagnostic info: False
StringTable: Array of String
ArraySize: -1
AdditionalHeader: ExtensionObject
TypeId: NodeId
.... 0000 = EncodingMask: Two byte encoded Numeric (0x0)
Identifier Numeric: 0
EncodingMask: 0x00
.... ...0 = has binary body: False
.... ..0. = has xml body: False
SessionId: NodeId
.... 0011 = EncodingMask: String (0x3)
Namespace Index: 1
Identifier String: Session:08eb0d7e-8db5-4c58-98aa-4a892447a8bf
AuthenticationToken: NodeId
.... 0101 = EncodingMask: Opaque (0x5)
Namespace Index: 0
Identifier ByteString: 5b0c5625cbf57d7c9e8a14e83a6578fc94cdd22c4e643381398ea5d3003cd421
RevisedSessionTimeout: 30000
ServerNonce: d2db1e18e1361a06afa29e46a241fdda1a9b844b58550ec021582cc51648f2ef
ServerCertificate: [OpcUa Null ByteString]
ServerEndpoints: Array of EndpointDescription
ArraySize: 7
[0]: EndpointDescription
EndpointUrl: opc.tcp://milo.digitalpetri.com:62541/milo
Server: ApplicationDescription
ApplicationUri: urn:opc:eclipse:milo:opc-ua-demo-server:b5122493-db3c-4d9e-b574-9e3b971f729e
ProductUri: [OpcUa Null String]
ApplicationName: LocalizedText
EncodingMask: 0x00
.... ...0 = has locale information: False
.... ..0. = has text: False
ApplicationType: Server (0x00000000)
GatewayServerUri: [OpcUa Null String]
DiscoveryProfileUri: [OpcUa Null String]
DiscoveryUrls: Array of String
ArraySize: -1
ServerCertificate: [OpcUa Null ByteString]
MessageSecurityMode: None (0x00000001)
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#None
UserIdentityTokens: Array of UserTokenPolicy
ArraySize: 3
[0]: UserTokenPolicy
PolicyId: anonymous
UserTokenType: Anonymous (0x00000000)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: [OpcUa Null String]
[1]: UserTokenPolicy
PolicyId: username
UserTokenType: UserName (0x00000001)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
[2]: UserTokenPolicy
PolicyId: certificate
UserTokenType: Certificate (0x00000002)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
TransportProfileUri: http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary
SecurityLevel: 32
[1]: EndpointDescription
EndpointUrl: opc.tcp://milo.digitalpetri.com:62541/milo
Server: ApplicationDescription
ApplicationUri: urn:opc:eclipse:milo:opc-ua-demo-server:b5122493-db3c-4d9e-b574-9e3b971f729e
ProductUri: [OpcUa Null String]
ApplicationName: LocalizedText
EncodingMask: 0x00
.... ...0 = has locale information: False
.... ..0. = has text: False
ApplicationType: Server (0x00000000)
GatewayServerUri: [OpcUa Null String]
DiscoveryProfileUri: [OpcUa Null String]
DiscoveryUrls: Array of String
ArraySize: -1
ServerCertificate: [OpcUa Null ByteString]
MessageSecurityMode: Sign (0x00000002)
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Aes128_Sha256_RsaOaep
UserIdentityTokens: Array of UserTokenPolicy
ArraySize: 3
[0]: UserTokenPolicy
PolicyId: anonymous
UserTokenType: Anonymous (0x00000000)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: [OpcUa Null String]
[1]: UserTokenPolicy
PolicyId: username
UserTokenType: UserName (0x00000001)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
[2]: UserTokenPolicy
PolicyId: certificate
UserTokenType: Certificate (0x00000002)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
TransportProfileUri: http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary
SecurityLevel: 68
[2]: EndpointDescription
EndpointUrl: opc.tcp://milo.digitalpetri.com:62541/milo
Server: ApplicationDescription
ApplicationUri: urn:opc:eclipse:milo:opc-ua-demo-server:b5122493-db3c-4d9e-b574-9e3b971f729e
ProductUri: [OpcUa Null String]
ApplicationName: LocalizedText
EncodingMask: 0x00
.... ...0 = has locale information: False
.... ..0. = has text: False
ApplicationType: Server (0x00000000)
GatewayServerUri: [OpcUa Null String]
DiscoveryProfileUri: [OpcUa Null String]
DiscoveryUrls: Array of String
ArraySize: -1
ServerCertificate: [OpcUa Null ByteString]
MessageSecurityMode: SignAndEncrypt (0x00000003)
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Aes128_Sha256_RsaOaep
UserIdentityTokens: Array of UserTokenPolicy
ArraySize: 3
[0]: UserTokenPolicy
PolicyId: anonymous
UserTokenType: Anonymous (0x00000000)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: [OpcUa Null String]
[1]: UserTokenPolicy
PolicyId: username
UserTokenType: UserName (0x00000001)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
[2]: UserTokenPolicy
PolicyId: certificate
UserTokenType: Certificate (0x00000002)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
TransportProfileUri: http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary
SecurityLevel: 132
[3]: EndpointDescription
EndpointUrl: opc.tcp://milo.digitalpetri.com:62541/milo
Server: ApplicationDescription
ApplicationUri: urn:opc:eclipse:milo:opc-ua-demo-server:b5122493-db3c-4d9e-b574-9e3b971f729e
ProductUri: [OpcUa Null String]
ApplicationName: LocalizedText
EncodingMask: 0x00
.... ...0 = has locale information: False
.... ..0. = has text: False
ApplicationType: Server (0x00000000)
GatewayServerUri: [OpcUa Null String]
DiscoveryProfileUri: [OpcUa Null String]
DiscoveryUrls: Array of String
ArraySize: -1
ServerCertificate: [OpcUa Null ByteString]
MessageSecurityMode: Sign (0x00000002)
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
UserIdentityTokens: Array of UserTokenPolicy
ArraySize: 3
[0]: UserTokenPolicy
PolicyId: anonymous
UserTokenType: Anonymous (0x00000000)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: [OpcUa Null String]
[1]: UserTokenPolicy
PolicyId: username
UserTokenType: UserName (0x00000001)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
[2]: UserTokenPolicy
PolicyId: certificate
UserTokenType: Certificate (0x00000002)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
TransportProfileUri: http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary
SecurityLevel: 72
[4]: EndpointDescription
EndpointUrl: opc.tcp://milo.digitalpetri.com:62541/milo
Server: ApplicationDescription
ApplicationUri: urn:opc:eclipse:milo:opc-ua-demo-server:b5122493-db3c-4d9e-b574-9e3b971f729e
ProductUri: [OpcUa Null String]
ApplicationName: LocalizedText
EncodingMask: 0x00
.... ...0 = has locale information: False
.... ..0. = has text: False
ApplicationType: Server (0x00000000)
GatewayServerUri: [OpcUa Null String]
DiscoveryProfileUri: [OpcUa Null String]
DiscoveryUrls: Array of String
ArraySize: -1
ServerCertificate: [OpcUa Null ByteString]
MessageSecurityMode: SignAndEncrypt (0x00000003)
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
UserIdentityTokens: Array of UserTokenPolicy
ArraySize: 3
[0]: UserTokenPolicy
PolicyId: anonymous
UserTokenType: Anonymous (0x00000000)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: [OpcUa Null String]
[1]: UserTokenPolicy
PolicyId: username
UserTokenType: UserName (0x00000001)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
[2]: UserTokenPolicy
PolicyId: certificate
UserTokenType: Certificate (0x00000002)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
TransportProfileUri: http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary
SecurityLevel: 136
[5]: EndpointDescription
EndpointUrl: opc.tcp://milo.digitalpetri.com:62541/milo
Server: ApplicationDescription
ApplicationUri: urn:opc:eclipse:milo:opc-ua-demo-server:b5122493-db3c-4d9e-b574-9e3b971f729e
ProductUri: [OpcUa Null String]
ApplicationName: LocalizedText
EncodingMask: 0x00
.... ...0 = has locale information: False
.... ..0. = has text: False
ApplicationType: Server (0x00000000)
GatewayServerUri: [OpcUa Null String]
DiscoveryProfileUri: [OpcUa Null String]
DiscoveryUrls: Array of String
ArraySize: -1
ServerCertificate: [OpcUa Null ByteString]
MessageSecurityMode: Sign (0x00000002)
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Aes256_Sha256_RsaPss
UserIdentityTokens: Array of UserTokenPolicy
ArraySize: 3
[0]: UserTokenPolicy
PolicyId: anonymous
UserTokenType: Anonymous (0x00000000)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: [OpcUa Null String]
[1]: UserTokenPolicy
PolicyId: username
UserTokenType: UserName (0x00000001)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
[2]: UserTokenPolicy
PolicyId: certificate
UserTokenType: Certificate (0x00000002)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
TransportProfileUri: http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary
SecurityLevel: 72
[6]: EndpointDescription
EndpointUrl: opc.tcp://milo.digitalpetri.com:62541/milo
Server: ApplicationDescription
ApplicationUri: urn:opc:eclipse:milo:opc-ua-demo-server:b5122493-db3c-4d9e-b574-9e3b971f729e
ProductUri: [OpcUa Null String]
ApplicationName: LocalizedText
EncodingMask: 0x00
.... ...0 = has locale information: False
.... ..0. = has text: False
ApplicationType: Server (0x00000000)
GatewayServerUri: [OpcUa Null String]
DiscoveryProfileUri: [OpcUa Null String]
DiscoveryUrls: Array of String
ArraySize: -1
ServerCertificate: [OpcUa Null ByteString]
MessageSecurityMode: SignAndEncrypt (0x00000003)
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Aes256_Sha256_RsaPss
UserIdentityTokens: Array of UserTokenPolicy
ArraySize: 3
[0]: UserTokenPolicy
PolicyId: anonymous
UserTokenType: Anonymous (0x00000000)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: [OpcUa Null String]
[1]: UserTokenPolicy
PolicyId: username
UserTokenType: UserName (0x00000001)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
[2]: UserTokenPolicy
PolicyId: certificate
UserTokenType: Certificate (0x00000002)
IssuedTokenType: [OpcUa Null String]
IssuerEndpointUrl: [OpcUa Null String]
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
TransportProfileUri: http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary
SecurityLevel: 136
ServerSoftwareCertificates: Array of SignedSoftwareCertificate
ArraySize: 0
ServerSignature: SignatureData
Algorithm: [OpcUa Null String]
Signature: [OpcUa Null ByteString]
MaxRequestMessageSize: 2097152

Bjarne Boström on Connect to server with security mode NONE and user/password

Mon, 13 Apr 2026 17:56:16 +0300

I wrote the previous without noticing the new post.

Thanks. Based on the links you gave would indicate that we sort of have a bug. Though, it will result in the inverse of the problem mentioned in the first post of this topic. In short if CreateSessionResponse EndpointDescriptions do NOT contain a Certificate, then other than Anonymous user wont work, in most cases at least. This is because internally the client side Session will start to use the EndpointDescription from the CreateSessionResponse.

It should be noted that specification-wise it is ok to null certain fields, including the certificate. https://reference.opcfoundatio.....docs/5.7.2, " It is recommended that Servers only include the server.applicationUri, endpointUrl, securityMode, securityPolicyUri, userIdentityTokens, transportProfileUri and securityLevel with all other parameters set to null or empty. " as the other info is already obtained in GetEndpoints phase. Though our implementation uses the same logic for both GetEndpoints and CreateSessionResponse so it does not null them out.

Bjarne Boström on Connect to server with security mode NONE and user/password

Mon, 13 Apr 2026 17:31:08 +0300

Hi,

Could you please also show the 'UserIdentityTokens: Array of UserTokenPolicy' as expanded. It is technically possible to define one that doesn't need the certificate. However, in general I wouldn't recommend that as then the password would be transmitted in plaintxt so anyone being able to observe the network also then knows it. The certificates would typically be used even with NONE for the purposes of encrypting user passwords. However, the error you did see would indicate something else than null/NONE was configured for the user token policy, so not 100% sure what happens here.

rocket science on Connect to server with security mode NONE and user/password

Mon, 13 Apr 2026 17:04:37 +0300

I found the solution.

Milo SDK has not included the ServerCertificate in the CreateSessionRespons - see https://github.com/eclipse-mil.....ssues/1693

The Milo Online Demo Server seemed to use a SDK Version < 1.1.1 - when trying locally with the Milo Demo Server and SDK 1.1.2 it worked, and the CreateSessionResponse included also the Server Certificate.

But one question anyway - is there a way to connect to a server using security mode NONE when the server does not provide a Server Certificate using user/password?

rocket science on Connect to server with security mode NONE and user/password

Mon, 13 Apr 2026 16:48:52 +0300

Hi,

I'm trying to connect to the Milo Demo Server (opc.tcp://milo.digitalpetri.com:62541/milo) using security mode NONE and user/password

The ProsysBrowser gives me following error:

Bad_CertificateInvalid (code=0x80120000, description="The Server Certificate was null. To enable activating a Session with Username/Password, the Server must provide a Server Certificate that is used for encrypting the password.")

When trying the same with e.g. UaExport it works - so somehow it seems that UaExport can connect using user/password and securityMode NONE without having the ServerCertificate, but Proys Browser cannot.

The reason seems to be that Milo does not send the ServerCertificate on CreateSessionResponse

CreateSessionResponse
ResponseHeader: ResponseHeader
SessionId: NodeId
AuthenticationToken: NodeId
RevisedSessionTimeout: 30000
ServerNonce: 3b9a4a200506b3931638903d91e10b161d65861795d02d28499a9b6628b09a1f
ServerCertificate: [OpcUa Null ByteString]
ServerEndpoints: Array of EndpointDescription
ArraySize: 7
[0]: EndpointDescription
EndpointUrl: opc.tcp://milo.digitalpetri.com:62541/milo
Server: ApplicationDescription
ServerCertificate: [OpcUa Null ByteString]
MessageSecurityMode: None (0x00000001)
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#None
UserIdentityTokens: Array of UserTokenPolicy
TransportProfileUri: http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary
SecurityLevel: 32
[1]: EndpointDescription
EndpointUrl: opc.tcp://milo.digitalpetri.com:62541/milo
Server: ApplicationDescription
ServerCertificate: [OpcUa Null ByteString]
MessageSecurityMode: Sign (0x00000002)
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Aes128_Sha256_RsaOaep
UserIdentityTokens: Array of UserTokenPolicy
TransportProfileUri: http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary
SecurityLevel: 68
[2]: EndpointDescription
EndpointUrl: opc.tcp://milo.digitalpetri.com:62541/milo
Server: ApplicationDescription
ServerCertificate: [OpcUa Null ByteString]
MessageSecurityMode: SignAndEncrypt (0x00000003)
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Aes128_Sha256_RsaOaep
UserIdentityTokens: Array of UserTokenPolicy
TransportProfileUri: http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary
SecurityLevel: 132
[3]: EndpointDescription
EndpointUrl: opc.tcp://milo.digitalpetri.com:62541/milo
Server: ApplicationDescription
ServerCertificate: [OpcUa Null ByteString]
MessageSecurityMode: Sign (0x00000002)
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
UserIdentityTokens: Array of UserTokenPolicy
TransportProfileUri: http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary
SecurityLevel: 72
[4]: EndpointDescription
EndpointUrl: opc.tcp://milo.digitalpetri.com:62541/milo
Server: ApplicationDescription
ServerCertificate: [OpcUa Null ByteString]
MessageSecurityMode: SignAndEncrypt (0x00000003)
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
UserIdentityTokens: Array of UserTokenPolicy
TransportProfileUri: http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary
SecurityLevel: 136
[5]: EndpointDescription
EndpointUrl: opc.tcp://milo.digitalpetri.com:62541/milo
Server: ApplicationDescription
ServerCertificate: [OpcUa Null ByteString]
MessageSecurityMode: Sign (0x00000002)
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Aes256_Sha256_RsaPss
UserIdentityTokens: Array of UserTokenPolicy
TransportProfileUri: http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary
SecurityLevel: 72
[6]: EndpointDescription
EndpointUrl: opc.tcp://milo.digitalpetri.com:62541/milo
Server: ApplicationDescription
ServerCertificate: [OpcUa Null ByteString]
MessageSecurityMode: SignAndEncrypt (0x00000003)
SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Aes256_Sha256_RsaPss
UserIdentityTokens: Array of UserTokenPolicy
TransportProfileUri: http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary
SecurityLevel: 136
ServerSoftwareCertificates: Array of SignedSoftwareCertificate
ServerSignature: SignatureData
MaxRequestMessageSize: 2097152

Is there any possibility to connect using Prosys SDK to the Milo Demo Server (in such a case that there is no Server Certiicate) - or might this a bug on side of the Milo-Server-SDK ?

Bjarne Boström on Bad_DecodingError (0x80070000) "Decoding halted because of invalid data in the stream."

Mon, 13 Apr 2026 15:48:25 +0300

That would indicate there is some issue that they wont get decoded, thus Browser basically knows nothing about them. Thus, there is some issue in the latest SDK or with the server in a way that it works with UaExpert (this sometimes happens if there is more than one path to solution). Or (though unlikely here) it could be that there is some feature of OPC UA being used that we do not support yet (some abstract types were semi-recently allowed as Structure fields, though your 'object=[6] 0x000000000000' rules that out as Variant form would be used in the data and it would cause non-0 output).

Is it possible to navigate to your Structure DataType (assuming named UDT_RANGE, based on the output), below Types/DataTypes/BaseDataType/Structure/, and show the value of the DataTypeDefinition Attribute, it should look something like this (/Root/Types/DataTypes/BaseDataType/Structure/AxisInformation):
StructureDefinition [DefaultEncodingId="i=12089", BaseDataType="i=22", StructureType="Structure", Fields="[StructureField [Name="EngineeringUnits", Description="", DataType="i=887", ValueRank="-1", ArrayDimensions="null", MaxStringLength="0", IsOptional="false"], StructureField [Name="EURange", Description="", DataType="i=884", ValueRank="-1", ArrayDimensions="null", MaxStringLength="0", IsOptional="false"], StructureField [Name="Title", Description="", DataType="i=21", ValueRank="-1", ArrayDimensions="null", MaxStringLength="0", IsOptional="false"], StructureField [Name="AxisScaleType", Description="", DataType="i=12077", ValueRank="-1", ArrayDimensions="null", MaxStringLength="0", IsOptional="false"], StructureField [Name="AxisSteps", Description="", DataType="i=11", ValueRank="1", ArrayDimensions="[0]", MaxStringLength="0", IsOptional="false"]]"].

It is possible that it shows Bad_AttributeIdInvalid (0x80350000) "The attribute is not supported for the specified Node.", then it would mean it uses an older DataTypeDictionary system, though explaining that is a bit more complicated, thus best if you send email to jsdk-support@prosysopc.com if that happens (include the node-opcua script, though I cannot promise we would look that).

P.S.
While viewing the DataType node, in the Attribute and References, for the References, you should see forward HasEncoding Reference whose target is "Default Binary", if you expand that tree-table-view node, it should show a NodeId in a namespaceindex that is equivalent to the nsu=urn:localhost:opcua:demo-server, can you see the NamespaceUri if you expand the NodeId, and the value part should be i=1004. That is the value being transmitted in the ExtensionObject and used to link it to the Structure type (and then the DataTypeDefinition tells how to decode it).