OPC-10000-14 Security Key Service Trust Anchor|OPC UA Standard|Forum|OPC Foundation

Hi!

I am reading OPC-10000-14 PubSub V1.05.06.

Section "5.4.5.3 Key acquisition handshakes" states:

"The Publisher or Subscriber use keys provided by a Security Key Service (SKS) to secure messages exchanged via the Message Oriented Middleware. [...] To pull keys, the Publisher or Subscriber creates an encrypted connection and provides credentials that allow it access to the SecurityGroup."

Pushing the keys via the SetSecurityKeys Method also talks about the establishment of this encrypted connection between SKS and key-target.

My Question: are there any details on how exactly this encrypted connection is to be established? Is this like the default OPC UA secure channel between Client and Server that is mutually authenticated with Application Instance Certificates? Meaning, prior to using PubSub, any Publisher/Subscriber needs to connect with an SKS via Client/Server secure channel to get the keys for subsequent PubSub use? If this is so, then would the onboarding procedure described in OPC-10000-21 to provision new applications with Application Instance Certificates also apply to devices wishing to use the PubSub architecture? Do Publishers and Subscribers need an Application Instance Certificate? Or does PubSub specify a different onboarding procedure to establish the initial trust anchor for new devices?

I'd appreciate any clarification 🙂