# About Kepware certificate being automatically added under OPC UA Client Certificate **URL:** \ **Category:** Ignition\ **Tags:** opcua, ignition81\ **Created:** [June 12, 2026, 11:16am UTC](https://forum.inductiveautomation.com/t/about-kepware-certificate-being-automatically-added-under-opc-ua-client-certificate/115957 "2026-06-12T11:16:14Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![m\_tanaka](https://avatars.discourse-cdn.com/v4/letter/m/8dc957/32.png) [@m\_tanaka](https://forum.inductiveautomation.com/u/m_tanaka)\ **Post date:** [June 12, 2026, 11:16am UTC](https://forum.inductiveautomation.com/t/about-kepware-certificate-being-automatically-added-under-opc-ua-client-certificate/115957/1 "2026-06-12T11:16:14Z")
Hello, I have a question about OPC UA security (Client Security) in Ignition.Recently, I configured an OPC UA connection from Ignition to Kepware (KEPServerEX). After that, I checked the following page in the Gateway Web UI:Gateway \> Config \> OPC UA Security \> Client Certificate and noticed that a Kepware certificate had been added, even though I did not manually register it. Could you please confirm whether my understanding is correct: in OPC UA, in order to establish secure communication (Sign/Encrypt), the client and server exchange certificates during connection establishment, and the certificates are then placed into a trust/reject list where the user can decide whether to trust or reject them? Also, how should I determine whether the certificate is an official / legitimate certificate (i.e., whether it is the correct certificate for that Kepware server)? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 12, 2026, 11:40am UTC](https://forum.inductiveautomation.com/t/about-kepware-certificate-being-automatically-added-under-opc-ua-client-certificate/115957/2 "2026-06-12T11:40:03Z")
When you went through the "wizard" adding the connection, you marked it trusted at this point: ![Screenshot 2026-06-12 at 04.38.43](https://us1.discourse-cdn.com/inductiveautomation/original/3X/5/7/5743d9ca3ccf42bb08d170e287067f38a4f35a41.png) You can instead select No there and it should end up in the "quarantine" area for you to further verify if you'd like. ---
**Author:** ![m\_tanaka](https://avatars.discourse-cdn.com/v4/letter/m/8dc957/32.png) [@m\_tanaka](https://forum.inductiveautomation.com/u/m_tanaka)\ **Post date:** [June 15, 2026, 1:34am UTC](https://forum.inductiveautomation.com/t/about-kepware-certificate-being-automatically-added-under-opc-ua-client-certificate/115957/3 "2026-06-15T01:34:22Z")
I see! Thank you.