# Authentication to Ignition OPC UA Server **URL:** \ **Category:** Ignition\ **Tags:** ignition80\ **Created:** [June 10, 2020, 2:41pm UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502 "2020-06-10T14:41:23Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![mogundipe](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@mogundipe](https://forum.inductiveautomation.com/u/mogundipe)\ **Post date:** [June 10, 2020, 2:41pm UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502/1 "2020-06-10T14:41:23Z")
I’m assuming theres something really simple that I am missing here. A colleague of mine is atttempting to connect to an ignition OPC UA server using a third party application(embarcadero using Kassls dOPC Toolkit). I believe we have everything set up on the ignition side properly as you can see in the images attached we are getting a “no public certificate found” error. We have the Security mode in the third party application set for Sign and Encrypt with the Basic256Sha256 security policy enabled & downloaded the certificate file from the ignition gateway under the client tab and used that file in the embarcadero application for the cerficate file. We have also typed the credentials for the OPC UA user that we configured under the user tab. Could someone point me in the right direction to figure out what I am missing here? I am using version 8.013. ![ignition images](https://us1.discourse-cdn.com/inductiveautomation/original/2X/7/7a0676cd66db5e7a108b9e7a8d0a19fe5c2303c5.png) ![ignition images2](https://us1.discourse-cdn.com/inductiveautomation/original/2X/6/6926ab0e747773f12529247a9b3a163c4ce3c1a4.png) ![ignition images3](https://us1.discourse-cdn.com/inductiveautomation/original/2X/3/3cda4432469568f879ace55bf629e378d4df8954.png) ![ignition images4](https://us1.discourse-cdn.com/inductiveautomation/original/2X/9/91d2ccc7a21ab7e2fc02f93a312345b7045bc96e.png) ![ignition images5](https://us1.discourse-cdn.com/inductiveautomation/original/2X/9/949fb8a5c0d2ecdb2a8ab985193f8170a877ef77.png) ![ignition images6](https://us1.discourse-cdn.com/inductiveautomation/original/2X/b/b551b259fedc8c96ef073c207365c62fc3c2d8f6.png) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 10, 2020, 3:02pm UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502/2 "2020-06-10T15:02:49Z")
Doesn’t sound like you’ve got anything set up wrong. Your screenshot didn’t make it as an attachment. If you made any changes to Ignition’s OPC UA server settings you do need to restart the module or gateway for them to take effect. What endpoint URL are you configuring the client with? ---
**Author:** ![mogundipe](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@mogundipe](https://forum.inductiveautomation.com/u/mogundipe)\ **Post date:** [June 10, 2020, 3:09pm UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502/3 "2020-06-10T15:09:04Z")
Sorry, original Images have been added, We just tried restarting the pc a few minutes ago, but havent had any luck. ![ignition images7](https://us1.discourse-cdn.com/inductiveautomation/original/2X/c/cd26520d00af185ddd6277002fd8c157cec75057.png) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 10, 2020, 3:10pm UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502/4 "2020-06-10T15:10:11Z")
I think you might need to contact the vendor for this client. Try using UaExpert to connect as a sanity check. I can tell you that the endpoint at `opc.tcp://localhost:62541/discovery` _does not_ have a certificate, and that’s intentional. The discovery endpoint is unsecured. The endpoints it returns will point to `opc.tcp://localhost:62541`, which _do_ have a certificate, and if you have not enabled the “None” security policy, will _only_ offer secured endpoints. If the client you’re using can’t do discovery against one URL and then actually follow the URLs returned in the endpoints then it’s deficient and needs to be fixed by the vendor. You might try pointing your client directly at `opc.tcp://localhost:62541` and see if it works. ---
**Author:** ![jr.landeen](https://avatars.discourse-cdn.com/v4/letter/j/8797f3/32.png) [@jr.landeen](https://forum.inductiveautomation.com/u/jr.landeen)\ **Post date:** [June 10, 2020, 9:38pm UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502/5 "2020-06-10T21:38:57Z")
Make sure your OPC URL endpoint is set up correctly and that the server isn’t faulted in Config \> OPC Client \> OPC Connections. ---
**Author:** ![nminchin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nminchin/32/6911_2.png) [@nminchin](https://forum.inductiveautomation.com/u/nminchin)\ **Post date:** [June 11, 2020, 5:36am UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502/6 "2020-06-11T05:36:09Z")
Are you sure you need the colon before the port? ![20200611_150532](https://us1.discourse-cdn.com/inductiveautomation/original/2X/a/a6ec6bc5eb67fb577b4a35b9c32cd6c3f47f42c1.jpeg) ---
**Author:** ![mogundipe](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@mogundipe](https://forum.inductiveautomation.com/u/mogundipe)\ **Post date:** [June 18, 2020, 2:08pm UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502/7 "2020-06-18T14:08:46Z")
Thanks, Reached out to the vendor, And made some progress, but still having issues. I attached an image of the security settings on the gateway & the error message that I am receiving when trying to validate the connection. ![IgnitionImage1](https://us1.discourse-cdn.com/inductiveautomation/original/2X/a/a1b51c37989447cce11fe5bc161d622361d7dade.png) [IgnitionImage1|690x69](https://forum.inductiveautomation.com/uploads/short-url/n4wTM5lIYWISMf3lTjugZIjkgyi.png) ![IgnitionImage2](https://us1.discourse-cdn.com/inductiveautomation/original/2X/1/1207e212d457f306bd854d8578c01ace75f1ec68.png) ![IgnitionImage3](https://us1.discourse-cdn.com/inductiveautomation/original/2X/2/2def267fc37187340cb934d0b6d06816c062ffd0.png) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 18, 2020, 3:26pm UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502/8 "2020-06-18T15:26:12Z")
Can you click the “+” next to the UascServerAsymmetricHandler error and copy/paste everything here? Is it possible for you to get a Wireshark capture of this also? ---
**Author:** ![jr.landeen](https://avatars.discourse-cdn.com/v4/letter/j/8797f3/32.png) [@jr.landeen](https://forum.inductiveautomation.com/u/jr.landeen)\ **Post date:** [June 18, 2020, 8:23pm UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502/9 "2020-06-18T20:23:47Z")
your bind port in the screenshot of the gateway settings is 62541 yet you are trying to access through 4840. ---
**Author:** ![mogundipe](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@mogundipe](https://forum.inductiveautomation.com/u/mogundipe)\ **Post date:** [June 19, 2020, 12:59pm UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502/10 "2020-06-19T12:59:55Z")
![image](https://us1.discourse-cdn.com/inductiveautomation/original/2X/1/137c6279db076094df37770d3434c9c7ead74861.png) Working with My colleague to get a wireshark capture. Will post when he is able to. ---
**Author:** ![mogundipe](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@mogundipe](https://forum.inductiveautomation.com/u/mogundipe)\ **Post date:** [June 19, 2020, 1:00pm UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502/11 "2020-06-19T13:00:49Z")
That is for discovery, it is auto populated as soon as the window is open, it is not the actual port that we are using to connect. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 19, 2020, 1:03pm UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502/12 "2020-06-19T13:03:29Z")
The discovery endpoint (when the URL ends with “/discovery”) does not offer security but your client is trying to connect with security. Have you tried removing “/discovery” from the endpoint URL you use to connect? Did you ever modify the Ignition server configuration to allow unsecured connections or is it still security only? ---
**Author:** ![mogundipe](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@mogundipe](https://forum.inductiveautomation.com/u/mogundipe)\ **Post date:** [July 7, 2020, 3:00pm UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502/13 "2020-07-07T15:00:59Z")
Sorry, I’ve been in and out, of the office, and was finally able to get a wireshark capture from my coworker. Also, When I said discovery Earlier in reference to Point 4840, that section of the window is for searching for a list available UA servers on the port that you type in to that field. When you find a valid one and select it, it will populate the fields at the bottom(Server). In response to Kevin, we tried removing the /disocvery, but received the same error message. attached is a wireshark capture([WireSharkData.zip](https://forum.inductiveautomation.com/uploads/short-url/toXRkVAQKSvcRzgHwEym2rQFre9.zip) (4.9 KB) .pcapng file). Not sure if this is the file format you need, please let me know how you would like it to be formatted. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 7, 2020, 3:37pm UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502/14 "2020-07-07T15:37:03Z")
This client is still trying to open a secure channel against the discovery endpoint (opc.tcp://127.0.0.1:62541/discovery) for some reason. Did you get in touch with the vendor of this client yet? ---
**Author:** ![mogundipe](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@mogundipe](https://forum.inductiveautomation.com/u/mogundipe)\ **Post date:** [July 17, 2020, 12:22pm UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502/15 "2020-07-17T12:22:47Z")
> [@Error installing security token](http://forum.inductiveautomation.com/t/error-installing-security-token/35562/8): > > You should be editing the server settings under OPC UA \> Server Settings, not editing your client connection to the local server. If anyone is curious, I Ended up finding the solution to the Security Token Issue that I was having in this post. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [July 17, 2020, 12:50pm UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502/16 "2020-07-17T12:50:44Z")
> [@mogundipe](#): > > If anyone is curious I suspect if anyone is curious, they'll also be curious about _ **how** _ you solved it. Details, please? ---
**Author:** ![mogundipe](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@mogundipe](https://forum.inductiveautomation.com/u/mogundipe)\ **Post date:** [July 17, 2020, 12:55pm UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502/17 "2020-07-17T12:55:08Z")
> [@Error installing security token](https://forum.inductiveautomation.com/t/error-installing-security-token/35562/4): > > Okay, it’s what I suggested. By default Ignition’s OPC UA server only accepts secured connections at `opc.tcp://10.122.220.204:62541` . Unsecured discovery services can be found running at `opc.tcp://10.122.220.204:62541/discovery` . > > Some clients are defective and can’t handle this kind of setup. If that’s the case here, you change the configuration of Ignition’s server to allow `None,Basic256Sha256` for its security policies (and restart) then this client will probably be able to connect. Changing the config of the server to allow 'None,Basic256Sha256' for the security policy got rid of my issue. ---
**Author:** ![Jason\_Coutee](https://avatars.discourse-cdn.com/v4/letter/j/a9a28c/32.png) [@Jason\_Coutee](https://forum.inductiveautomation.com/u/Jason_Coutee)\ **Post date:** [October 10, 2024, 7:56pm UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502/18 "2024-10-10T19:56:47Z")
My only issue with this is that your allowing unsecured connections to your opc endpoint. I'd suggest being very careful about slamming None into your opc-ua server endpoint config. I have a ticket right now open with ignition about this. As of 8.1 it appears the endpoint always issues a server cert you need to accept on the client regardless of the security mode. If you accept this cert store it in UaExpert and export the client cert and store it in the ignitoin client store as trusted update the security mode back to Basic256Sha256 it should work as UaExpert has already trusted the server cert and you've manually added the client cert. However all you get is a BadConnection status and the same logged error as the OP. Something is wrong on the OPC-UA module's side. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [October 10, 2024, 8:26pm UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502/19 "2024-10-10T20:26:09Z")
There's nothing actually wrong with the OPC UA module, it's just configured in a way that exposed a bunch of clients that didn't know what they were doing ☹ This configuration is changing for 8.3. > [@Error installing security token](https://forum.inductiveautomation.com/t/error-installing-security-token/35562/4): > > Okay, it’s what I suggested. By default Ignition’s OPC UA server only accepts secured connections at opc.tcp://10.122.220.204:62541. Unsecured discovery services can be found running at opc.tcp://10.122.220.204:62541/discovery. Some clients are defective and can’t handle this kind of setup. If that’s the case here, you change the configuration of Ignition’s server to allow None,Basic256Sha256 for its security policies (and restart) then this client will probably be able to connect. > [@Failed to connect Ignition OPC-UA server using Sign And Encrypt mechanism via Python OPC-UA client](https://forum.inductiveautomation.com/t/failed-to-connect-ignition-opc-ua-server-using-sign-and-encrypt-mechanism-via-python-opc-ua-client/16865/16): > > It looks like the most recent error in the logs doesn’t have anything to do with certificates now: E [o.e.m.o.s.s.t.u.UascServerAsymmetricHandler] [12:54:16]: Error installing security token: StatusCode{name=Bad\_SecurityChecksFailed, value=0x80130000, quality=bad} org.eclipse.milo.opcua.stack.core.UaException: no matching endpoint found: transportProfile=TCP\_UASC\_UABINARY, endpointUrl=opc.tcp://192.168.47.128:62541/discovery, securityPolicy=Basic256Sha256, securityMode=SignAndEncrypt at org.… > [@OPC-UA Client connection issues](https://forum.inductiveautomation.com/t/opc-ua-client-connection-issues/79799/2): > > You may need to point the software at the discovery endpoint instead: opc.tcp://host:62541/discovery. This is at least what you would need to do with UaExpert via its "custom discovery" flow. The server has two endpoints: one for discovery, one for sessions. The discovery endpoint is unsecured, and the session endpoint only allows secured connections by default. You're pointing your software at the session endpoint, and despite configuring it to use security, it's probably trying to start with … ---
**Author:** ![Jason\_Coutee](https://avatars.discourse-cdn.com/v4/letter/j/a9a28c/32.png) [@Jason\_Coutee](https://forum.inductiveautomation.com/u/Jason_Coutee)\ **Post date:** [October 10, 2024, 8:45pm UTC](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502/20 "2024-10-10T20:45:54Z")
Thank you very much for the context Kevin! I better understand the issue now. Also I see that UaExpert handles the connection differently using the discovery wizard vs manually entering the endpoint in the advanced section. My advice going forward is to add the discovery endpoint in the wizard with None then trust the ignition server cert it throws at you anyway. Remove the None from your ignition opc-ua server settings and restart your module then let UaExpert attempt to connect using the Basic256Sha256 security mode. You'll now see the cert for your client show up under the quarantine certification section in ignition. Trust it. Should now be good to go. [Next page](https://forum.inductiveautomation.com/t/authentication-to-ignition-opc-ua-server/35502.md?page=2)