Certificatesare digitally signed data structures that contain a Public Keyand the identity of a OPC UA Application. All SecurityProtocolsuse X.509 v3 Certificates(see X.509 v3) encoded using the DER format (see X690). Certificatesused by OPC UA applications shall also conform to RFC 5280which defines a profile for X.509 v3 Certificateswhen they are used as part of an Internet based application.

The ServerCertificateand ClientCertificateparameters used in the abstract OpenSecureChannelservice are instances of the ApplicationInstance Certificate DataType. Clause 6.2.2describes how to create an X.509 v3 Certificatethat can be used as an ApplicationInstance Certificate.

Certificatesare also used as form of UserIdentityTokenwhich identifies a user associated with a Session. Clause 6.2.3describes Certificatesused as UserIdentityTokens.