<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Auditing OPC UA Security — API & Tool Reference

> Quick reference for tools, commands, and APIs used in auditing-opc-ua-security.

## Tools

### `asyncua` (Python)

Python OPC UA client library for endpoint discovery and security auditing.

**Usage:**
```python
from asyncua import Client
client = Client("opc.tcp://10.0.0.1:4840")
endpoints = await client.connect_and_get_server_endpoints()
```

**Key Methods:**
  - `connect_and_get_server_endpoints()`: discover all endpoints
  - `get_namespace_array()`: list namespaces
  - `get_root_node().get_children()`: browse address space

---

### `openssl`

Certificate inspection and validation for OPC UA server certificates.

**Usage:**
```bash
openssl x509 -in cert.pem -noout -text
```

**Key Flags:**
  - `-subject`: show certificate subject
  - `-issuer`: show issuer (check self-signed)
  - `-dates`: show validity period
  - `verify`: validate certificate chain

---

### `nmap`

Service discovery for OPC UA servers.

**Usage:**
```bash
nmap -sV -p 4840,4843 <target>
```

---

### `tshark`

OPC UA traffic capture and protocol analysis.

**Usage:**
```bash
tshark -r <pcap> -Y "opcua"
```

**Key Flags:**
  - `-Y "opcua.security.tokentype == 0"`: filter anonymous auth
  - `-e opcua.security.policy`: extract security policy

---

## Integration Notes

- OPC UA servers default to port 4840 but may use non-standard ports
- Always test for None security policy — it should be disabled in production
- Certificate validation requires understanding of OPC UA trust model (per-application)

## See Also

- Parent skill: [OT/ICS Security](../../../SKILL.md)
- OPC Foundation: OPC UA Security Model (Part 2)
