Well ... so far basically there has been no demand to do it differently. Do you have a use-case where it would be of use?

Currently the logic is shared with MQTT-UADP. In MQTT it is likely that each Writer has a different Topic. It is not possible to publish to multiple topics in a single MQTT network message. Thus, at the moment the WriterGroup simply does loop all Writers and each Writer will produce the NetworkMessages related to it. The only scenario where multiple DataSetMessages would exist in a single NetworkMessage at the moment are for Event-DataSets.

P.S.
It is not related to the sequence number issue.

As far as I remember the U(A)DP logic didn't yet properly support wildcards, though it mostly appears to do so via common logic. A proper wildcard-supporting version would need to keep track of the numbers for each PublisherId+WriterId combination it sees. Though in reality probably something like last 100 seen to avoid memory leaks.

Adding few extra notes, though mostly it is as said above.

The configuration can be changed via PubSubSystem.updateConfiguration(..). That method will take a function, which receives the current live configuration as input (PubSubSystemConf) and it must output the desired new configuration (PubSubSystemConf) or throw PubSubException to abort. Once the function outputs the desired state, PubSubSystem will internally create/modify/remove connections/groups/writers/readers to match the new configuration (or throws PubSubException, if that fails for some reason).

The design was to allow multiple concurrent update operations from multiple threads. Due to intentional synchronizations, only one of the update-functions runs at a time, but they would always see the result of the previous function output as their input. This would have been a need for making an address space -based configuration, since each Write/Call operation happens on the blocking-work threads. Though, nowadays it mostly enables SDK itself updating the configuration as that is used to store received metadatas.

Thus, in general one PubSubSystem should be enough. If for some reason the updating doesn't work, let us know.

P.S.
Since the PubSubSystem takes the UaApplication (UaClient/UaServer), if you have multiples in a single application, then you would need a PubSubSystem for each. Skipping some details regarding Subscriber side for now. Skipping also some details regarding MQTT.

In the meantime I'm using the workaround above.

I'll make an issue on this as a possible future improvement.

It actually sounds like you have picked the wrong installer. Look for the separate macOS installer for Apple Silicon on the download page 🙂

BR, Jouni

I am running Prosys OPC UA Browser 2026.1.2-38 on Apple Silicon macOS 26.5.1.

macOS reports that the application will not be supported in a future macOS version. Inspection shows that both the bundled Java runtime and launcher are Intel-only:

/Applications/Prosys OPC UA Browser.app/Contents/PlugIns/jre.bundle/Contents/Home/bin/java: Mach-O 64-bit executable x86_64
/Applications/Prosys OPC UA Browser.app/Contents/MacOS/JavaApplicationStub: Mach-O 64-bit executable x86_64

My system Java is already native arm64 OpenJDK 21.0.8, but the app uses its bundled Intel runtime.

Do you provide, or plan to provide, a macOS Apple Silicon / Universal build with an arm64 bundled JRE and native launcher?

Best,

Matthias

Is there any way to accept a .pem file which contains both using the SDK?

This constructor expects the certificate and private key as separate files. The .der file is used as the certificate file, and the .pem file should contain only the private key. Therefore, removing the BEGIN CERTIFICATE / END CERTIFICATE block from the PEM file is the correct workaround.

OPC UA itself does not mandate this local PEM file layout. Tools such as UaExpert may accept a PEM file containing both certificate and private key, but this SDK constructor expects the private key file separately.

I checked the code and it seems like the current implementation never bundles values from different WriterGroups into the same NetworkMessage while the documentation states otherwise. I cannot however currently tell why this is, it's possible that this is a bug that hasn't been tested. Regardless, either the docs or the implementation needs to be adjusted.

Thanks for the report, I'll create an issue on this.

basically the creation of a UserIdentity using a .der and .pem file works.

But now I have a specific case, where the .der and .pem file is provided by the EQ vendor to be able to connect to the OpcUA server and it seems that the .pem file can not be loaded correctly.

The code to create the user identy (with SDK version 4.10.2-62) is following:

UserIdentity userIdentity = new UserIdentity(new File("UserCert.der"), new File("UserCert.pem"), "pwd");

The exception is:

org.bouncycastle.util.encoders.DecoderException: unable to decode base64 string: invalid characters encountered in base64 data
at org.bouncycastle.util.encoders.Base64.decode(Unknown Source)
at com.prosysopc.ua.stack.transport.security.BcCryptoProvider.base64Decode(SourceFile:78)
at com.prosysopc.ua.stack.utils.CryptoUtil.base64Decode(SourceFile:122)
at com.prosysopc.ua.stack.transport.security.PrivKey.load(SourceFile:117)
at com.prosysopc.ua.stack.transport.security.PrivKey.load(SourceFile:191)
at com.prosysopc.ua.SecureIdentity.a(SourceFile:473)
at com.prosysopc.ua.SecureIdentity.(SourceFile:235)
at com.prosysopc.ua.UserIdentity.(SourceFile:123)

The .der file looks like this (I've removed th middle part for better readability)

UserCert.der

0‚Ê0‚² ®É¢r®Vá,^0å}C¸n:Oê0
*†H†÷
....
5²fØad˾ò»‡º ×–_

The .pem file contains a 'BEGIN/END CERTIFICATE' section and a 'BEGIN/END PRIVATE KEY' section like shown here:

-----BEGIN CERTIFICATE-----
MIIGyjCCBLKgAwIBAgIUD67JonKuVuEsHV4w5X1DuG46T+owDQYJKoZIhvcNAQEL
....
ZMu+8rsDh7oaANeWAV8=
-----END CERTIFICATE-----
-----BEGIN PRIVATE KEY-----
MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQCcDX0o7ADB8gJb
....
bstj/beIj9MfXzAsgd84KMZCKK3m
-----END PRIVATE KEY-----

When I remove the 'BEGIN/END CERTIFICATE' section, the UserIdenty can be created.

So it seems that the .pem file shall contain only the 'BEGIN/END PRIVATE KEY' section, but not the CERTIFICATE, right?

Is there any specification that it should be like this?

Or is there any way to load the UserIdentity with a .der and .pem file which contains CERTIFICATE and PRIVATE KEY'

P.S. The UaExpert can load the UserIdentity using the .der and .pem (including CERTIFICATE and PRIVATE KEY) without problems.

Thank you for you help!

I have configured 2 DataSetWriters in a single WriterGroup (using the same publishingInterval). The UadpNetworkMessageContentMask does NOT contain the DataSetClassId (i.e. it is null). The DataSets only comprise 2 and 3 double values, respectively, which should fit well into the maxMessageSize of 4096 bytes.

What could be the reason for sending multiple networkmessages with one dataSet each instead of one networkMessage containing the dataSets from both dataSetWriters?

Some shortened log messages below. My expectation would be that a single networkmessage would transport both dataSets (dataSetWriterIds=[1,2]). Could this be related to the issue of the dataSet seqNos counting across all dataSetMessages? (see previous forum entry)

I can replicate this behavior when I create a new project without saving it to file and attempt to change the port number. Thank you for reporting this bug to us!

I've been using 2016.1.2 (Free Edition)

I think this here '... you should be prompted to save changes to your project...' was the clue

I did not use any specific project. I just used the simulation server with the default configuration (the case where it loads from the default.simconf).
In that case it did not ask to save after Apply & Close.

I've now used 'File//Save as' to save to a 'project.uasim' and then it loads correctly with the new assigned port.

Thank you!

I'm unable to reproduce this error using the latest version of Simulation Server, which is version 2016.1.2.

When you close Simulation Server after applying the change to the port using the Apply button, you should be prompted to save changes to your project and in this case the change is the new port (and any other changes you might have made to the configuration). If you choose to save the changes, Simulation Server should be using the new port when it is started for the next time.

Please, let us know if you have a different sequence of making changes to Simulation Server that causes persisting the changed port to fail.