Finding the cryptography inside an OPC UA deployment

OPC UA is the OT protocol most likely to be doing real public-key cryptography in a pipeline control center, and every security policy it currently defines relies on quantum-vulnerable RSA or elliptic-curve cryptography. No post-quantum OPC UA security policy exists yet, so the practical goal is to know exactly where each policy is in use. This note explains how OPC UA secure channels use public-key cryptography and shows four places to find it: endpoint configuration, certificate stores and trust lists, the OpenSecureChannel handshake (whose security policy and certificate are readable even on encrypted channels), and the embedded cryptographic library. It defines inventory fields for OPC UA applications and lists six actions, including removing deprecated SHA-1 policies, closing None endpoints, and moving certificate issuance to a Global Discovery Server or internal CA. Issue 03 (November 2026 slot) of Quantum-Safe Pipeline Notes, a monthly technical blog on post-quantum cryptography and OT security for U.S. pipelines. Uses public sources only; views are the author's own and do not represent any employer or client.