Global – October 27, 2026 -- The taosX gRPC interface in TDengine TSDB Enterprise is unencrypted by default, so teams collecting OPC UA data across network zones must explicitly enable and verify TLS, according to TDengine's security documentation. The point is part of a wider OT/IT integration checklist: a working OPC UA client beside the server proves only that the endpoint and credentials work locally, not that the same path should be opened from an enterprise historian into the control network.
Zones and flows come before collector placement
Segmentation protects more than confidentiality. OPC UA protocol security provides application authentication, message integrity and confidentiality, while network controls provide routing boundaries, firewall policy, inspection and isolation. Neither replaces the other: an encrypted session can still cross an overbroad firewall rule, end on a compromised collector, or run under an over-privileged account.
Each flow should be documented with its initiator, source and destination addresses, configured port, protocol, security mode, identity and operational owner. Firewall rules should follow the deployed configuration, not a generic OPC UA port list, because endpoints vary by vendor and discovery can return addresses that are not routable from another zone. NIST guidance for operational technology calls for architectures that account for performance, reliability and safety, and an industrial DMZ is one acceptable pattern among several.
Certificates and user identity need separate controls
Application certificates authenticate peers and establish secure channels, while a user token identifies the account within the session. For production collection, the guidance calls for:
- a security policy and message mode supported by both applications and allowed by site policy;
- validated certificates and trust lists, with no permanent acceptance of unknown certificates to speed commissioning;
- a dedicated least-privilege identity limited to the required nodes;
- planned issuance, renewal, revocation, backup and time synchronization.
Validation failures can follow a hostname change, certificate renewal, trust-store reset or clock problem. Disabling validation hides the symptom and removes a security control.
Reconnection, buffering and history backfill are not interchangeable
Reconnection restores a session but does not prove that values produced during the outage were captured. A local agent can buffer only data it actually received, so an upstream queue cannot recreate samples lost when the agent-to-server link fails. A persistent local queue covers a different failure: the agent still collects but cannot forward to the central platform. OPC UA historical access is a third mechanism, available only if the server supports it and the product uses it.
TDengine's Agent initiates outbound connections, with documented limits
TDengine TSDB Enterprise offers taosX-Agent for sources taosX cannot reach directly. The Agent sits near the source and initiates access both to the data source and to the taosX gRPC service. The documented default gRPC port is 6055, but architects should use the configured endpoint and limit the rule to required hosts.
Optional Store and Forward, available for supported real-time sources including OPC UA, persists data locally during an Agent-to-taosX interruption and resumes forwarding after recovery. It is disabled by default, consumes disk space and can raise end-to-end latency. It does not recover values the Agent never collected and does not promise zero loss under every failure.
Commissioning tests must cross the real network boundaries
Acceptance testing should confirm name resolution, routes, endpoint URLs and only approved firewall flows from the actual collector host. It should also verify the negotiated security policy, certificate identities and readable node scope. Teams should then measure normal latency and load and test firewall closure, source restart, collector restart and upstream interruption. Buffer limits, replay order, duplicate handling and the historian's visible gap behavior need confirmation, and OT security and operations teams should sign off on acceptance. A path that cannot be safely patched, monitored or isolated is not production-ready.