On tab 2. Machine data:

1. Server address: the OPC UA endpoint, such as opc.tcp://127.0.0.1:49380 for TOP Server on the same PC. For a server elsewhere, use its IP address and port, for example opc.tcp://10.0.2.5:4840.
2. User and Password: an account on the OPC UA server. A read-only account is enough; Nexa Edge never writes.
3. Tick Remember the password on this PC so the service can sign in by itself after a restart. It is stored encrypted for this PC.
4. Click Test connection to the server. The first time, the server usually refuses the app’s certificate: trust it, then test again.

Each OPC UA server must trust Nexa Edge’s certificate once. The app creates one the first time it connects; it is shown under This app’s certificate, with Open folder to find the file. Use Choose… only to reuse a certificate that a server already trusts (a .der file, with its .pem key next to it).

1. Run Test connection to the server once, so TOP Server sees the certificate.
2. Open OPC UA Configuration and go to Trusted Clients.
3. Select the Nexa Edge certificate and click Trust.
4. Back in Nexa Edge, test again.

Every OPC UA server has a list of rejected and trusted client certificates. Run the test once, find Nexa Edge in the rejected list, and move it to trusted. If the server can import a certificate instead, give it the .der file from Open folder.

One gateway can read a whole plant, even when its machines sit behind several OPC UA servers. Under Other OPC UA servers on the plant network, click Add a server… and fill in:

• Key: a short name for the server, such as line2. Nexa shows it next to each tag, so keep it once tags are linked.
• Server address, User and Password, as for the main server. Click Test, then Save.

Each server has its own connection: one going down leaves gaps on its own machines only. Each one must trust the certificate too. Next, send their tags to Nexa.