I'll make an issue on this as a possible future improvement.

It actually sounds like you have picked the wrong installer. Look for the separate macOS installer for Apple Silicon on the download page 🙂

BR, Jouni

I am running Prosys OPC UA Browser 2026.1.2-38 on Apple Silicon macOS 26.5.1.

macOS reports that the application will not be supported in a future macOS version. Inspection shows that both the bundled Java runtime and launcher are Intel-only:

/Applications/Prosys OPC UA Browser.app/Contents/PlugIns/jre.bundle/Contents/Home/bin/java: Mach-O 64-bit executable x86_64
/Applications/Prosys OPC UA Browser.app/Contents/MacOS/JavaApplicationStub: Mach-O 64-bit executable x86_64

My system Java is already native arm64 OpenJDK 21.0.8, but the app uses its bundled Intel runtime.

Do you provide, or plan to provide, a macOS Apple Silicon / Universal build with an arm64 bundled JRE and native launcher?

Best,

Matthias

Is there any way to accept a .pem file which contains both using the SDK?

This constructor expects the certificate and private key as separate files. The .der file is used as the certificate file, and the .pem file should contain only the private key. Therefore, removing the BEGIN CERTIFICATE / END CERTIFICATE block from the PEM file is the correct workaround.

OPC UA itself does not mandate this local PEM file layout. Tools such as UaExpert may accept a PEM file containing both certificate and private key, but this SDK constructor expects the private key file separately.

I checked the code and it seems like the current implementation never bundles values from different WriterGroups into the same NetworkMessage while the documentation states otherwise. I cannot however currently tell why this is, it's possible that this is a bug that hasn't been tested. Regardless, either the docs or the implementation needs to be adjusted.

Thanks for the report, I'll create an issue on this.

basically the creation of a UserIdentity using a .der and .pem file works.

But now I have a specific case, where the .der and .pem file is provided by the EQ vendor to be able to connect to the OpcUA server and it seems that the .pem file can not be loaded correctly.

The code to create the user identy (with SDK version 4.10.2-62) is following:

UserIdentity userIdentity = new UserIdentity(new File("UserCert.der"), new File("UserCert.pem"), "pwd");

The exception is:

org.bouncycastle.util.encoders.DecoderException: unable to decode base64 string: invalid characters encountered in base64 data
at org.bouncycastle.util.encoders.Base64.decode(Unknown Source)
at com.prosysopc.ua.stack.transport.security.BcCryptoProvider.base64Decode(SourceFile:78)
at com.prosysopc.ua.stack.utils.CryptoUtil.base64Decode(SourceFile:122)
at com.prosysopc.ua.stack.transport.security.PrivKey.load(SourceFile:117)
at com.prosysopc.ua.stack.transport.security.PrivKey.load(SourceFile:191)
at com.prosysopc.ua.SecureIdentity.a(SourceFile:473)
at com.prosysopc.ua.SecureIdentity.(SourceFile:235)
at com.prosysopc.ua.UserIdentity.(SourceFile:123)

The .der file looks like this (I've removed th middle part for better readability)

UserCert.der

0‚Ê0‚² ®É¢r®Vá,^0å}C¸n:Oê0
*†H†÷
....
5²fØad˾ò»‡º ×–_

The .pem file contains a 'BEGIN/END CERTIFICATE' section and a 'BEGIN/END PRIVATE KEY' section like shown here:

-----BEGIN CERTIFICATE-----
MIIGyjCCBLKgAwIBAgIUD67JonKuVuEsHV4w5X1DuG46T+owDQYJKoZIhvcNAQEL
....
ZMu+8rsDh7oaANeWAV8=
-----END CERTIFICATE-----
-----BEGIN PRIVATE KEY-----
MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQCcDX0o7ADB8gJb
....
bstj/beIj9MfXzAsgd84KMZCKK3m
-----END PRIVATE KEY-----

When I remove the 'BEGIN/END CERTIFICATE' section, the UserIdenty can be created.

So it seems that the .pem file shall contain only the 'BEGIN/END PRIVATE KEY' section, but not the CERTIFICATE, right?

Is there any specification that it should be like this?

Or is there any way to load the UserIdentity with a .der and .pem file which contains CERTIFICATE and PRIVATE KEY'

P.S. The UaExpert can load the UserIdentity using the .der and .pem (including CERTIFICATE and PRIVATE KEY) without problems.

Thank you for you help!

I have configured 2 DataSetWriters in a single WriterGroup (using the same publishingInterval). The UadpNetworkMessageContentMask does NOT contain the DataSetClassId (i.e. it is null). The DataSets only comprise 2 and 3 double values, respectively, which should fit well into the maxMessageSize of 4096 bytes.

What could be the reason for sending multiple networkmessages with one dataSet each instead of one networkMessage containing the dataSets from both dataSetWriters?

Some shortened log messages below. My expectation would be that a single networkmessage would transport both dataSets (dataSetWriterIds=[1,2]). Could this be related to the issue of the dataSet seqNos counting across all dataSetMessages? (see previous forum entry)

I can replicate this behavior when I create a new project without saving it to file and attempt to change the port number. Thank you for reporting this bug to us!

I've been using 2016.1.2 (Free Edition)

I think this here '... you should be prompted to save changes to your project...' was the clue

I did not use any specific project. I just used the simulation server with the default configuration (the case where it loads from the default.simconf).
In that case it did not ask to save after Apply & Close.

I've now used 'File//Save as' to save to a 'project.uasim' and then it loads correctly with the new assigned port.

Thank you!

I'm unable to reproduce this error using the latest version of Simulation Server, which is version 2016.1.2.

When you close Simulation Server after applying the change to the port using the Apply button, you should be prompted to save changes to your project and in this case the change is the new port (and any other changes you might have made to the configuration). If you choose to save the changes, Simulation Server should be using the new port when it is started for the next time.

Please, let us know if you have a different sequence of making changes to Simulation Server that causes persisting the changed port to fail.

I tried to change the port (in the endpoints tab) from 53530 to 4999.

After click on Apply button, the simulation server restart with port 4999

But when I close the simulation sever and restart it again it is back to port 53530

Is there any way to change the port permanently to 4999?

Thank you!

Use of opc.https is not recommended in products developed with our SDK. We recommend using opc.tcp endpoints instead. Support for opc.https is deprecated, so new integrations should not rely on it.

You seem to be correct. Looking at the code, the DataSetReader implementation currently holds only one lastDataSetSequenceNumber, which is used when producing that warning log. Consequently, if multiple DataSetWriters are received by the same DataSetReader, the implementation does not distinguish the source of the sequence number.

Based on this, the sequence number validation should likely be tracked at least per DataSetWriter, even when the DataSetReader is the same.

I’ll create an issue for this. Thanks for the report.