# Where can we change SecureChannelLifeTime setting for OPC client on Ignition? **URL:** \ **Category:** Ignition\ **Created:** [March 12, 2024, 4:22am UTC](https://forum.inductiveautomation.com/t/where-can-we-change-securechannellifetime-setting-for-opc-client-on-ignition/87164 "2024-03-12T04:22:03Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![apurva\_mishra](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@apurva\_mishra](https://forum.inductiveautomation.com/u/apurva_mishra)\ **Post date:** [March 12, 2024, 4:22am UTC](https://forum.inductiveautomation.com/t/where-can-we-change-securechannellifetime-setting-for-opc-client-on-ignition/87164/1 "2024-03-12T04:22:03Z")
Hi, We are trying to troubleshoot an issue where whenever our OPC client on ignition sends a request to renew the Secure Channel to an OPC server on Siemens S-7 1200 PLC, the OPC server does not respond for anywhere from 9sec to 14sec. Since the request to renew secure channel is sent out every 45 minutes ( 75% of security token life of 1 hour) we have to WAIT a lot to debug and want to reduce Lifetime down to 5 minutes. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 12, 2024, 12:41pm UTC](https://forum.inductiveautomation.com/t/where-can-we-change-securechannellifetime-setting-for-opc-client-on-ignition/87164/2 "2024-03-12T12:41:47Z")
This value isn't configurable in Ignition. The channel lifetime is something of a negotiation, and the server has a chance to revise the value requested by the client. Can configure the maximum allowed value for your server down to 5 minutes? ---
**Author:** ![apurva\_mishra](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@apurva\_mishra](https://forum.inductiveautomation.com/u/apurva_mishra)\ **Post date:** [March 18, 2024, 4:31am UTC](https://forum.inductiveautomation.com/t/where-can-we-change-securechannellifetime-setting-for-opc-client-on-ignition/87164/3 "2024-03-18T04:31:07Z")
Hi Kevin, This what we have been able to zero down the problem too: Establishing an OPC UA connection with a security policy other than "No Security" on Siemens S7 OPC UA server requires Ignition OPC UA client to renew the Secure Channel at an interval of 45 minutes. [UA Part 4: Services - 5.5.2 OpenSecureChannel (opcfoundation.org)](https://reference.opcfoundation.org/Core/Part4/v104/docs/5.5.2) Our Siemens PLC CPU/OPC server takes ~6-14 seconds to establish/secure/renew a connection/channel as per our WireShark Logs. For our setup we have chosen Basic256Sha256-Sign&Encrypt security policy for OPC UA secure channel on the PLC and exchanged self-signed OPC UA certificates between the client and server. Normally, OPC UA should use asymmetric encryption to secure the initial connection. Once the channel is secure, then in order to work around the slower communication performance with asymmetric encryption, a symmetric encryption key is exchanged for communications. [Exploring OPC UA - Symmetric vs Asymmetric Encryption (softwaretoolbox.com)](https://blog.softwaretoolbox.com/exploring-opc-ua-part-2-symmetric-asymmetric-encryption#:~:text=This%20means%20that%20when%20you,key%20is%20exchanged%20for%20communications.) Is this also true for renewing a secure channel using OpenSecureChannel service? Is the renewal of a secure channel using **asymmetric** **encryption or symmetric encryption**? Renewal of secure channel takes place at the communication layer level: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/d/6/d67b586f4f0fc3c4e8e23a9c2c8e83a9c2eccd71.png) What we have observed is that the longer the length of the OpenSecureChannel request message from Ignition (PC) to PLC for “renewing the existing Secure Channel”, the longer it takes for PLC’s CPU to process and respond to the request. In our setup, no data is received from PLC OPC UA Server while it’s processing the renewal request. All publish request to the PLC during this “request and response window” go unanswered and all data/commands being sent to the PLC are lost. We have found the length of Secure Channel renewal request message to vary between two identical machine with same OPC UA Server Security settings. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/0/c/0c528ce05150848e2b1f80c67605edbd8fda44c3.png) Wireshark analysis has divulged the following results: - Secure Channel renewal request message packet length of **1768 bytes** for **Basic256Sha256** security policy takes **16.59 seconds** for PLC OPC server to process and respond to on **machine 1**. - Secure Channel renewal request message packet length of **308 bytes** for **Basic256Sha256** security policy takes **7.64 seconds** for PLC OPC server to process and respond to on **machine 2**. Wireshark logs for the corresponding frames attached. - Secure Channel renewal request message packet length of **186 bytes** for **No** **security** policy takes **10 milliseconds** for PLC OPC server to process and respond to on **machine 1**. We don’t have an issue with session timeouts or with setting up a session as listed here ["BadTimeout during OpenSecureChannel" message in the OPC UA client when trying to... - ID: 109825991 - Industry Support Siemens](https://support.industry.siemens.com/cs/document/109825991/-badtimeout-during-opensecurechannel-message-in-the-opc-ua-client-when-trying-to-establish-a-secure-connection-to-the-opc-ua-server-of-the-s7-1200-cpu?dti=0&lc=en-LT) . Changing max session timeout and max number of OPC UA sessions setting in OPC UA on TIA has had no effect either. Our Communication Load setting in TIA is at 50%. **What we want to know:** 1. Is the amount of processing time required for renewing a secure channel a **limitation** of the OPC UA server on S7-1200 PLC **or** of SIMANTICC OPC UA S7-1200 Basic Runtime Licence? 2. Is it possible to change the Secure Channel renewal request message packet length on Ignition(Client) or Server side OPC UA ? 3. How do we change OPC UA value for SecureChannelLifetime on PLC? Its currently defaulted to 3600000 ms. 4. How do we speed up renewal of SecureChannel ? 5. How do we implement or cross check a hybrid process that automatically switches from very secure, asymmetric encryption (RSA) when a connection is established to high-performance, symmetric encryption for actual communications after connection is established? We are running 180 instances of Ignition edge on 180 PC connected to 180 S7-1200 PLC's ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 18, 2024, 12:59pm UTC](https://forum.inductiveautomation.com/t/where-can-we-change-securechannellifetime-setting-for-opc-client-on-ignition/87164/4 "2024-03-18T12:59:03Z")
> [@apurva\_mishra](#): > > Is the amount of processing time required for renewing a secure channel a **limitation** of the OPC UA server on S7-1200 PLC **or** of SIMANTICC OPC UA S7-1200 Basic Runtime Licence? It's probably a limitation of the hardware/CPU. RSA encryption is slow for embedded devices. Using a weaker security policy may speed it up. This is why ECC-based security policies have been in development for future OPC UA versions. > [@apurva\_mishra](#): > > Is it possible to change the Secure Channel renewal request message packet length on Ignition(Client) or Server side OPC UA ? The only thing that would change the size of the packet is the size of the client application instance certificate. It seems unlikely that the certificate size would vary greatly between Ignition client's unless maybe on one of your gateways you're using a CA-signed certificate and the other a self-signed certificate. > [@apurva\_mishra](#): > > How do we change OPC UA value for SecureChannelLifetime on PLC? Its currently defaulted to 3600000 ms. I don't know if it's possible, you'd have to ask Siemens support. > [@apurva\_mishra](#): > > How do we speed up renewal of SecureChannel ? Use a weaker security policy, not sure there's anything else you can do. > [@apurva\_mishra](#): > > How do we implement or cross check a hybrid process that automatically switches from very secure, asymmetric encryption (RSA) when a connection is established to high-performance, symmetric encryption for actual communications after connection is established? You don't need to do this, this is already how OPC UA communication works. Asymmetric encryption is only used for secure channel creation and renewal. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 18, 2024, 1:27pm UTC](https://forum.inductiveautomation.com/t/where-can-we-change-securechannellifetime-setting-for-opc-client-on-ignition/87164/5 "2024-03-18T13:27:50Z")
> [@apurva\_mishra](#): > > Secure Channel renewal request message packet length of **308 bytes** for **Basic256Sha256** security policy takes **7.64 seconds** for PLC OPC server to process and respond to on **machine 2**. Wireshark logs for the corresponding frames attached. This capture doesn't show a packet length of 308, it shows a packet length of 1714. You have to look at the reassembled data. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/5/5/5595f67ab6138aa33bb67b0079470932184889ff.png) ---
**Author:** ![apurva\_mishra](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@apurva\_mishra](https://forum.inductiveautomation.com/u/apurva_mishra)\ **Post date:** [March 18, 2024, 11:48pm UTC](https://forum.inductiveautomation.com/t/where-can-we-change-securechannellifetime-setting-for-opc-client-on-ignition/87164/6 "2024-03-18T23:48:30Z")
Hi Kevin, Thanks for clarifying all our questions! One follow on question: 1. Can we see major jump in performance if use Siemens Profinet drivers (available with our edge licencing) ? I think to do this an OPC Server and Client is setup on on ignition side of things and comms is handled thru Siemens Profinet drivers. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 19, 2024, 12:09am UTC](https://forum.inductiveautomation.com/t/where-can-we-change-securechannellifetime-setting-for-opc-client-on-ignition/87164/7 "2024-03-19T00:09:33Z")
Ignition doesn't have Profinet drivers, only S7 over ethernet. There are major trade offs involved when choosing between the Siemens PLC's built-in OPC UA server and Ignition's S7 driver - primarily that there is no browsing or symbolic access. There's also no security or encryption when using S7, and if that's acceptable, you might as well just turn it off for the OPC connection. ---
**Author:** ![apurva\_mishra](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@apurva\_mishra](https://forum.inductiveautomation.com/u/apurva_mishra)\ **Post date:** [April 12, 2024, 2:55am UTC](https://forum.inductiveautomation.com/t/where-can-we-change-securechannellifetime-setting-for-opc-client-on-ignition/87164/8 "2024-04-12T02:55:50Z")
Hi Kevin, Do you know of any way we can encrypt the data being sent to S7 over ethernet when using Ignition S7 drivers for Siemen, if we do decide to switch from OPC to Ignition's S7 driver? Any Plugin or something else ? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [April 12, 2024, 2:57am UTC](https://forum.inductiveautomation.com/t/where-can-we-change-securechannellifetime-setting-for-opc-client-on-ignition/87164/9 "2024-04-12T02:57:51Z")
No, not possible. ---
**Author:** ![apurva\_mishra](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@apurva\_mishra](https://forum.inductiveautomation.com/u/apurva_mishra)\ **Post date:** [April 12, 2024, 4:04am UTC](https://forum.inductiveautomation.com/t/where-can-we-change-securechannellifetime-setting-for-opc-client-on-ignition/87164/10 "2024-04-12T04:04:41Z")
Hi Kevin, [Getting Started with the Siemens S7 Plus Ethernet Driver w/Security - YouTube](https://www.youtube.com/watch?v=YrJ4R_v_HU4) At 2:30 mark it says "Siemens S7 Plus Ethernet" driver allows for secure communication ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/4/24f6a279ebefa7662f80c1d72c574fa99d7b89bd.jpeg) So I guessing Ignition supports "Siemens S7 Ethernet" driver and not "Siemens S7 Plus Ethernet"? Are there any plans to support "Plus" drivers anytime soon? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [April 12, 2024, 4:06am UTC](https://forum.inductiveautomation.com/t/where-can-we-change-securechannellifetime-setting-for-opc-client-on-ignition/87164/11 "2024-04-12T04:06:37Z")
Ignition 8.3 will include a new “S7 Plus” driver that does symbolic access and will support security if enabled on the PLC.