How an OPC UA client connects to a server

Endpoint URL

opc.tcp://192.168.0.10:4840
opc.tcp://plc-line1.local:4840/path

opc.tcp is the binary TCP transport; 4840 is the registered default port, but servers may use others (for example 4841, 48010, 49320 in some products). The optional path selects one of several servers on the same port.

The sequence

1. GetEndpoints — the client opens an unsecured channel and asks the server which endpoints it offers. Each EndpointDescription contains: endpoint URL, server certificate, security mode, security policy URI, user token policies, transport profile.
2. Choose an endpoint — e.g. SignAndEncrypt + Basic256Sha256 + UserName.
3. OpenSecureChannel — asymmetric handshake using both application certificates; symmetric keys are derived for the rest of the communication.
4. CreateSession — the client sends its ApplicationDescription; the server returns its certificate and nonce; the session has a timeout.
5. ActivateSession — the client proves possession of its key and presents the user identity token.
6. Now Browse/Read/Write/Subscribe work. Sessions survive short network breaks: the client can re-open the channel and re-activate the session.

Discovery

A Local Discovery Server (LDS) on port 4840 of a host lists the servers installed there (FindServers). Many PLC servers are their own discovery endpoint. Global discovery (GDS) also manages certificates centrally.

Where it fails

Browsers are not OPC UA clients

A normal web page cannot open a raw TCP connection to opc.tcp://…. Web-based OPC UA tools always use a backend, a desktop agent or a WebSocket gateway. Tools in ASUTP Hub therefore work offline on strings, numbers and certificates — they never pretend to connect.