# Client access > The certificates of the OPC UA applications that dial this station: enrolling a client, reviewing and trusting or blocking certificates, the connection addresses, the Windows Firewall rule, the live sessions and the trusted roster. Client access is the third row of the OPC UA SERVER group on the Settings page. It is the roster of application certificates the embedded server has met and what you decided about each: an unknown certificate is refused on its first attempt and kept here for review, trusting it lets the application reach the server, blocking it keeps it out quietly. The card head says it: "A client certificate identifies the application asking to connect. Trust only a fingerprint you have verified with the person commissioning that client." Opening the page takes the **Change settings** permission; every decision on this card is taken on the station's own desktop. Under the head a principle stands: "Certificate trust and sign-in are separate checks. Trust allows this application certificate to reach the server. The Client authentication setting above still decides whether it connects anonymously or with the configured username and password. Certificate names are claimed by the client; the SHA-256 fingerprint is the identity to verify." ## Who may decide {#who-may-decide} Every button on the card obeys one rule, and its tooltip says which part refused: "Client access can only be changed in the station's desktop app." in a browser on another device (the card also shows the banner "Open the desktop app to change client access": remote browsers can inspect the roster, not change it); "Your current role cannot change station settings." for a role without Change settings; "Configuration is locked while a Unit is running." or "Runtime stopped" for the two locks; "Another client-access change is in progress." while a decision, an import or the firewall command runs. A press that gets through anyway is answered with the same sentence in the status bar, where every outcome on this card lands. ## Add client {#add-client} | Command | What it does | Greyed when (situation) | Not drawn when (role) | | --- | --- | --- | --- | | Add client | Opens a five-minute listening window: "Add-client window opened for five minutes. Start the connection in the OPC UA client; if it first asks you to trust this station, confirm it there and retry." While it is open the head shows the remaining time (mm:ss) with a pulse. | By the rule above. | Drawn while no window is open. | | Cancel | Closes the window: "Add-client window closed. Unknown certificates remain disconnected." | By the rule above. | Drawn while a window is open. | The window explains an attempt; it never identifies one and never trusts anything. While it is open the card carries the caution banner "Waiting for a client certificate · mm:ss": "Start the connection in the OPC UA client now. If that client first rejects this station's server certificate, confirm that it is this Ganter Lab station, trust it in the client and retry. The client's certificate will then appear under Pending approval; Ganter Lab trusts nothing automatically." The window expires on its own at the deadline. ### Is this the client you are adding? {#is-this-the-client-you-are-adding} A certificate that arrives while the window is open is shown in a banner of that title: "A client presented this certificate while Add client was open. Check it against the client you are commissioning before this station calls it expected. Until you answer, it stays an unknown certificate in the list below and remains disconnected.", with its Name, Subject and Fingerprint. | Command | What it does | | --- | --- | | This is the client | Marks it as the client you meant and closes the window: "`` is confirmed as the client you are adding, and the add-client window is closed. It stays disconnected until you trust it below." It still has to be trusted under Pending approval. | | Not this one | Leaves it an ordinary unknown certificate and keeps listening: "`` stays an unknown certificate waiting for review. The add-client window is still listening." | Only your answer or the deadline closes the window, so an attempt from anyone else can neither spend it nor borrow its wording. A new window forgets the unanswered asks of the previous one. ## Pending approval {#pending-approval} The group is drawn while at least one certificate waits, headed "Unknown applications remain disconnected until you decide." with the count. Each row shows an amber dot, the name the certificate claims, "Claimed application identity", the SHA-256 fingerprint, "Last attempt `` · N connection attempt(s)", and a **Certificate details** disclosure with Subject, Issuer, Application URI, Domain names, Valid from, Valid until and First seen. The row a notification's Review led to is marked "Selected for review" and scrolled into view. | Command | What it does | Greyed when (situation) | | --- | --- | --- | | Trust | Moves the certificate to Trusted clients and refreshes the live validator, so the client can retry at once: "`` is trusted. The client can retry its connection." | By the rule above. | | Block | Moves it to Blocked clients, disconnects any session using it and keeps refusing it without further prompts: "`` is blocked. Future attempts from this certificate will remain rejected." | By the rule above. | | Discard all pending certificates (on the group head, in the danger ink) | Asks "Discard the certificate waiting for review?" or "Discard the N certificates waiting for review?" ("Nothing is trusted or blocked by this: the requests are removed and the list makes room again. A client that connects after this appears here as a new request."), with **Discard** and **Keep the list**. Then "N certificates waiting for review were discarded." | By the rule above. | A certificate stays disconnected until you decide; retries update its attempt count and last-attempt time without a second notification. ### The review list is full {#the-review-list-is-full} The list holds at most 100 certificates. While it is full, a further unknown certificate is still refused but not retained, and the card says so in a caution banner: "The review list below is full. While it is, a new certificate is rejected without being added here, so the client you are waiting for may never appear. Discard the certificates waiting for review to make room.", or, once drops happened, "…and 1 certificate has been rejected without being added here since it filled. The client you are waiting for may be that one…" or "…and N certificates have been rejected…". Every such refusal is also journaled. The counter resets when there is room again. ## Connection addresses {#connection-addresses} "Use the address that matches where the client runs." Two read-only addresses: **This computer**, `opc.tcp://localhost:/UA/GanterLab`, for a client on the station itself, and **Local network**, `opc.tcp://:/UA/GanterLab`, for a client elsewhere on the LAN. The port is the one on [Configuration](settings-opcua-configuration). ## Windows Firewall {#windows-firewall} A dot and a sentence state whether the app-owned inbound rule allows the current port, with one action when it does not. | State | Text | | --- | --- | | Allowed (green) | "Inbound OPC UA connections are allowed on port N for private and domain networks." | | Not configured (amber) | "Network clients may be blocked because no app-owned rule allows port N." The **Allow local network** button is drawn. | | Unsupported (grey) | "This launch cannot manage Windows Firewall. Configure inbound access in the operating system if needed." A development, portable or demo launch, or any run that is not the installed application. | | Unknown (grey) | "Windows Firewall status could not be determined." | | Command | What it does | Greyed when (situation) | | --- | --- | --- | | Allow local network | Starts the app's own helper elevated, so Windows asks for administrator approval, and adds the rule for the port, scoped to the Private and Domain profiles and the local subnet. Reads "Applying…" meanwhile, then "Windows Firewall now allows OPC UA connections on port N." or the state text as an error; a cancelled approval prompt leaves the state Not configured. | By the rule above (a browser on another device cannot press it). | The state is read again when the page opens and whenever the configuration changes; a port change therefore shows Not configured until you allow the new port. The rule covers only the OPC UA port; the web dashboard has its own rule, applied automatically by [Remote access](settings-remote-access). ## Connected now {#connected-now} "Live OPC UA sessions accepted by the server.", with the count. A table lists each session: Status (a green dot, "Live"), Session (the name the client gave it), Claimed client (the application or host the client reports), User (the identity it signed in as, or Anonymous) and Connected (the time of day it connected). With none: "No OPC UA clients connected." The list is read fresh every second and is empty while the server is stopped. ## Trusted clients {#trusted-clients} "Certificates allowed to establish future secure connections.", with the count. Each row shows a neutral dot, the claimed name, "Claimed application identity · Trusted by `` on ``" (or "at this station" when nobody was signed in), the fingerprint, and a details disclosure with Subject, Issuer, Application URI, Domain names, Valid until and Last seen. With none: "No client certificates trusted." | Command | What it does | Greyed when (situation) | | --- | --- | --- | | Import certificate (on the group head) | Opens a file picker for the client's public certificate (`.der`, `.cer`, `.crt` or `.pem`, up to 64 KB) and trusts it before its first connection: "`` is trusted from ``. Check the fingerprint below against the one the client reports." A larger file is refused: "`` is larger than a client certificate. Import the public certificate file (.der, .cer or .pem), not an archive."; a file that is not a certificate: "`` could not be imported: …". | By the rule above. | | Revoke (on the row, danger ink) | Asks "Revoke ``?": "This certificate will no longer be trusted and any current sessions using it will be disconnected. The client must be reviewed again before it can reconnect.", with **Revoke** and **Keep trusted**. Then the certificate is blocked, its sessions are closed and the validator refreshed: "Trust was revoked for ``. New sessions and reconnects are blocked; the server also requested closure of matching active sessions." | By the rule above. | The hint under the head says why the import exists: "Have the client's public certificate already? Import it here to trust it before its first connection, instead of letting the connection fail once. Check the fingerprint it adds against the one the client reports." Importing a certificate that was blocked lifts the block. ## Blocked clients {#blocked-clients} A collapsed disclosure, "Blocked clients" with the count, drawn only while at least one exists. Each row shows a red dot, the claimed name, "Claimed application identity · Blocked by `` on ``", the fingerprint, and **Unblock**, which returns the certificate to Pending approval without trusting it: "`` is unblocked and has returned to pending review." A blocked certificate raises no repeated prompts and stays out until you decide again. ## How you learn of an attempt {#how-you-learn-of-an-attempt} A first attempt from an unknown application raises one sticky notification card in the shell, "OPC UA client awaiting approval" (or "N OPC UA clients awaiting approval"), naming the latest certificate and the first characters of its fingerprint, with a **Review** action that opens this section on that row. For a hidden window a Windows notification says "OPC UA connection attempt blocked", or "OPC UA certificate waiting for your check" when the attempt arrived during Add client. The card follows the list: it is replaced as certificates arrive and dismissed when nothing is pending; a start with requests already waiting restores one quiet summary card and no Windows notification. The client itself sees a certificate-untrusted error until you trust it. ## Where the decisions live {#where-the-decisions-live} The stores are OPC UA directory stores under `ua\pki` in the station's data root (`trusted`, `pending`, `blocked`, the SDK's own `rejected` diagnostic store, and `own` for the station's certificate), with attempt counts and decisions in `client-access.json`. A decision is written to the store before it is announced, so the screen and the live validator can never disagree; the stores are reconciled at every start, and an explicit block always outranks trust, which outranks a pending request. They are not part of a configuration [backup](settings-backups). ## What this section does not do {#what-this-section-does-not-do} Nothing is trusted automatically, ever: no empty store enables acceptance, and there is no discovery server integration. The card does not create certificates for clients, does not disconnect one session without revoking its certificate, does not grant per-client rights (a trusted application has the rights the authentication mode gives), and does not manage the certificates of equipment the station dials, which are on [Equipment access](settings-opcua-equipment).