OPC UA uses X.509 certificates to authenticate applications (both client and server): each application holds its own certificate, and trust is established mutually through the exchange that happens during the SecureChannel handshake.

Each OPC UA application owns an Application Instance Certificate together with its private key. During the SecureChannel handshake the client presents its certificate, the server presents its own, and each side checks the other against its local Trust List (accepted certificates) and Rejected List (explicitly refused certificates). The first connection attempt from a new client typically fails with BadCertificateUntrusted; the administrator then moves the certificate from the Rejected to the Trusted folder and the second attempt succeeds. This two-way model means there is no central authority required for small deployments.

Always export the server certificate fingerprint from the engineering tool and verify it on the device front panel before approving trust: copy-pasting trust without checking the fingerprint defeats the whole mutual-authentication design.