TDengine taosX gRPC Is Unencrypted by Default in OT-IT Links
Global – October 27, 2026 -- The taosX gRPC interface in TDengine TSDB Enterprise is unencrypted by default, so teams collecting OPC UA data across network zones must explicitly enable and verify TLS, according to TDengine's security documentation. The point is part of a wider OT/IT integration checklist: a working OPC UA client beside the server proves only that the endpoint and credentials work locally, not that the same path should be opened from an enterprise historian into the control network.
Zones and flows come before collector placement
Segmentation protects more than confidentiality. OPC UA protocol security provides application authentication, message integrity and confidentiality, while network controls provide routing boundaries, firewall policy, inspection and isolation. Neither replaces the other: an encrypted session can still cross an overbroad firewall rule, end on a compromised collector, or run under an over-privileged account.