A comprehensive, ready-to-use OPC UA suite built specifically for integration testing of OPC UA client libraries. Built on the OPC Foundation UA-.NETStandard library (.NET 10.0), it provides 10 pre-configured server instances covering every major security policy (RSA and ECC), authentication method, and communication mode defined by the OPC UA specification.
Whether you're building an OPC UA client in Rust, C#, Python, Go, Java, PHP, or any other language, this suite gives you a realistic test environment with ~300 nodes, 12 callable methods, dynamic variables, events, alarms, historical data, structured objects, and custom extension objects — all running with a single docker compose up.
Note: This project is the evolution of
php-opcua/opcua-test-suite(v1.1.5), which was based on Node.js and node-opcua. The switch to UA-.NETStandard was made because it is the reference implementation maintained directly by the OPC Foundation — the same organization that defines the OPC UA specification. This makes it the de facto standard for OPC UA server implementations: protocol behavior, encoding, and security are as close to the spec as possible, giving you higher confidence that your client tests reflect real-world interoperability.
| Port | Server | What it tests |
|---|---|---|
| 4840 | No Security | Basic connectivity, anonymous access |
| 4841 | Username/Password | Encrypted channel + credential authentication |
| 4842 | Certificate Auth | X.509 certificate-based authentication |
| 4843 | All Security | Every RSA policy, every mode, every auth method |
| 4844 | Discovery | OPC UA Discovery Server (FindServers) |
| 4845 | Auto-Accept | Encrypted with auto-trust for any client cert |
| 4846 | Sign Only | Message signing without encryption |
| 4847 | Legacy Security | Deprecated policies (Basic128Rsa15, Basic256) |
| 4848 | ECC NIST | ECC_nistP256, ECC_nistP384 |
| 4849 | ECC Brainpool | ECC_brainpoolP256r1, ECC_brainpoolP384r1 |
| 14850 (UDP) | PubSub Publisher + relay | UADP NetworkMessages over UDP — subscriber-side testing (Part 14) |
| 4851 | Security Key Service | OPC UA Part 14 §8.4.2 GetSecurityKeys for PubSub group-key rotation tests |
The 10 classic client/server instances share the same rich address space:
- 21 scalar data types (Boolean through LocalizedText) in read/write and read-only variants
- 20 array types + 14 empty arrays + 6 read-only arrays
- 3 multi-dimensional matrices (2D and 3D)
- 12 methods — arithmetic, string ops, arrays, async, error handling, event generation
- 13 dynamic variables — counters, sine/sawtooth/triangle waves, random values, status cycling
- 3 custom event types with periodic emission
- 3 alarm types — ExclusiveLimit, NonExclusiveLimit, OffNormal
- 4 historical variables with HistoryRead support (1000ms recording interval)
- Structured objects with nesting up to 10 levels deep
- 2 extension objects with binary-encoded ExtensionObject values
- 50 access control variables covering every combination of type and access level
- 4 OPC UA Views for filtered browsing
This suite covers the most common OPC UA testing scenarios out of the box, but every industrial environment is different. Need to simulate a SCADA system with hundreds of registers? An HVAC controller with multi-zone temperature loops? A fleet of PLCs on a factory floor? A smart energy meter with real-time power readings?
Fork this repository and build exactly the OPC UA environment you need.
The codebase was designed from the ground up to be extended. Each feature — methods, events, alarms, historical data, structures — lives in its own independent builder class under src/TestServer/AddressSpace/. You can modify any of them, remove the ones you don't need, or add entirely new builders without touching the rest. Adding a new variable is a few lines of C#. Adding a whole new address space section is a single class and two lines of wiring.
The Customization Guide walks you through everything step by step:
- Adding variables, methods, events, alarms, and historical nodes
- Creating new address space builders from scratch
- Adding new server instances with custom configurations
- Complete simulation examples (PLC, HVAC, energy meter, device network)
If you build something useful on top of this, consider opening a PR or sharing your fork — the OPC UA community benefits from better testing tools.
If the default suite already covers what you need, you're good to go. Jump straight to the Quick Start below, check the full Documentation for every node, method, and alarm available, or head to the CI Integration Guide to plug it into your pipeline in one step.
docker compose up -dThat's it. Ten client/server instances are running on ports 4840-4849 with auto-generated certificates (RSA + ECC), a Security Key Service is ready on port 4851, and a PubSub publisher + relay pair delivers UADP frames on UDP port 14850 of the physical host.
# Connect to the simplest server
# Endpoint: opc.tcp://localhost:4840/UA/TestServer
# Stop everything
docker compose downopc.tcp://localhost:4840/UA/TestServer # No Security
opc.tcp://localhost:4841/UA/TestServer # Username/Password
opc.tcp://localhost:4842/UA/TestServer # Certificate
opc.tcp://localhost:4843/UA/TestServer # All Security
opc.tcp://localhost:4844 # Discovery
opc.tcp://localhost:4845/UA/TestServer # Auto-Accept
opc.tcp://localhost:4846/UA/TestServer # Sign Only
opc.tcp://localhost:4847/UA/TestServer # Legacy
opc.tcp://localhost:4848/UA/TestServer # ECC NIST (P-256, P-384)
opc.tcp://localhost:4849/UA/TestServer # ECC Brainpool (P-256r1, P-384r1)
opc.udp://127.0.0.1:14850 # PubSub Publisher (UADP, via relay on host port 14850)
opc.tcp://localhost:4851/UA/TestServer # Security Key Service (GetSecurityKeys)
Certificates are auto-generated on first startup in certs/:
certs/ca/- Certificate Authoritycerts/server/- Server certificate (PEM, DER, PFX)certs/client/- Client certificate (PEM, DER, PFX)certs/self-signed/- Untrusted self-signed (for rejection testing)certs/expired/- Expired certificate (for expiration testing) All server instances (RSA and ECC) auto-generate their own application certificates viaCheckApplicationInstanceCertificates()on startup. The pre-generated certificates incerts/are used for client authentication and trust store configuration.
To regenerate all certificates:
rm -rf certs/ca certs/server certs/client certs/trusted certs/self-signed certs/expired certs/pki
docker compose down && docker compose up -d| Username | Password | Role |
|---|---|---|
| admin | admin123 | admin |
| operator | operator123 | operator |
| viewer | viewer123 | viewer |
| test | test | admin |
This repository is also a reusable GitHub Action. Add a single step to your workflow and all test servers are ready:
steps:
- uses: actions/checkout@v4
- uses: php-opcua/uanetstandard-test-suite@v1.1.0
- run: dotnet test # or cargo test, npm test, pytest, etc.You can select which servers to start, set timeouts, and access the generated certificates:
- id: opcua
uses: php-opcua/uanetstandard-test-suite@v1.1.0
with:
servers: 'no-security,userpass,certificate'
wait-timeout: '90'
- run: dotnet test
env:
OPCUA_CERTS_DIR: ${{ steps.opcua.outputs.certs-dir }}For real-world usage examples, see the CI workflows in opcua-client, opcua-session-manager, and laravel-opcua.
For the full integration guide with all options, certificate usage, version pinning, and examples for other CI systems (GitLab, Jenkins), see docs/ci-integration/.
Full documentation is available in docs/. Highlights:
| Section | Covers |
|---|---|
| Getting started — Overview · Installation · Quick start · First connection | Concepts, install, smoke test |
| Server instances — Overview · Classic RSA & ECC · Special-purpose | The 10 servers explained |
| Security — Policies & modes · Certificates · Trust flow | Security policies, certificates, trust |
| Authentication — User accounts & roles · Certificate authentication | Auth methods and role matrix |
| Address space — Overview · Browse paths & access levels | Address-space navigation |
| Data features — Scalar types · Arrays & matrices · Structures & extension objects · Access control | Data types and structured data |
| Runtime features — Methods · Dynamic variables · Events · Alarms · Historical data | Live behaviour and history |
| Special features — Views · Security Key Service · PubSub publisher | Views, SKS, PubSub |
| CI integration — GitHub Action · Docker Compose & other CI | Plug into CI pipelines |
| Testing patterns — Basic tests · Subscription & method tests · Security tests | Recommended test recipes |
| Customization — Forking & adding nodes · Adding server instances · Simulation recipes | Build your own variant |
| Reference — Environment variables · Ports & endpoints · Troubleshooting | Reference tables |
| AI Reference | Single-file machine-readable reference for AI tools (kept at repo root) |
- Runtime: .NET 10.0 (Alpine)
- OPC UA Stack: OPCFoundation.NetStandard.Opc.Ua.Server 1.5.378.134 (pinned — see
src/TestServer/TestServer.csprojfor the rationale) - Configuration: Environment variables
- Certificates: OpenSSL auto-generation + server self-signed via
CheckApplicationInstanceCertificates() - Docker image:
ghcr.io/php-opcua/uanetstandard-test-suite
For bug reports, feature requests, or questions, please open an issue on GitHub Issues.
This project was built in part with the assistance of Claude (Anthropic). The AI contributed to code generation, documentation writing, and architecture decisions. All outputs were reviewed and validated by the author. The AI Reference document was specifically designed to be consumed by AI coding assistants working with this project.
This project is licensed under the MIT License.