OPC UA applications use Certificates to store the Public Keys needed for Asymmetric Cryptography operations. All SecurityProtocols use X.509 v3 Certificates (see X.509 v3) encoded using the DER format (see X690). Certificates used by OPC UA applications shall also conform to RFC 3280 which defines a profile for X.509 v3 Certificates when they are used as part of an Internet based application.

The ServerCertificate and ClientCertificate parameters used in the abstract OpenSecureChannel service are instances of the Application Instance Certificate Data Type. 6.2.2 describes how to create an X.509 v3 Certificate that can be used as an Application Instance Certificate.