# Bad\_Certificate **URL:** \ **Category:** Ignition\ **Tags:** perspective, vision\ **Created:** [April 28, 2023, 12:02pm UTC](https://forum.inductiveautomation.com/t/bad-certificate/73016 "2023-04-28T12:02:11Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Kfoldesi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kfoldesi/32/11327_2.png) [@Kfoldesi](https://forum.inductiveautomation.com/u/Kfoldesi)\ **Post date:** [April 28, 2023, 12:02pm UTC](https://forum.inductiveautomation.com/t/bad-certificate/73016/1 "2023-04-28T12:02:12Z")
**Inductive Automation** Are there any plans on fixing the annual certificate failures? Seams to me that if the server can generate a new certificate, it should have the authority to delete or add a new certification, if it notices the old one has expired. **Other users like myself** What does the 'brain trust' think? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [April 28, 2023, 12:36pm UTC](https://forum.inductiveautomation.com/t/bad-certificate/73016/2 "2023-04-28T12:36:05Z")
Are you talking about self-signed TLS certificates, OPC UA certificates, or something else? ---
**Author:** ![Kfoldesi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kfoldesi/32/11327_2.png) [@Kfoldesi](https://forum.inductiveautomation.com/u/Kfoldesi)\ **Post date:** [April 28, 2023, 12:53pm UTC](https://forum.inductiveautomation.com/t/bad-certificate/73016/3 "2023-04-28T12:53:20Z")
Yesterday, I had a clients plant shut down due to OPC UA certificate expiration. Could not find the directory to delete the offending certificate. Tech support pointed me the in the correct direction. But, if there are multiple certificate locations: Maybe you could publish a Tech-Note that shows a table of error codes and .the corresponding directories to delete, to get the server back up and running. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [April 28, 2023, 12:55pm UTC](https://forum.inductiveautomation.com/t/bad-certificate/73016/4 "2023-04-28T12:55:01Z")
I’ll ask them if there’s a KB article for it. In 8.1 there’s a UI in the gateway for managing and regenerating the certificates, including the option to set a custom expiration date when doing so. ---
**Author:** ![Kfoldesi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kfoldesi/32/11327_2.png) [@Kfoldesi](https://forum.inductiveautomation.com/u/Kfoldesi)\ **Post date:** [May 9, 2023, 2:00pm UTC](https://forum.inductiveautomation.com/t/bad-certificate/73016/5 "2023-05-09T14:00:49Z")
Well corporate has gotten involved. They don't like that the system went down - and may go down every 3 years... Not sure what is going to come of it. We have a Zoom tomorrow. It is a vision project. Even the client on the server couldn't operate the plant. They had to shut down for about 24 hours and wait for me to drive down there (air gaped network). If you have any information about avoiding this issue in the future, I would like to present that in the meeting. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [May 9, 2023, 2:06pm UTC](https://forum.inductiveautomation.com/t/bad-certificate/73016/6 "2023-05-09T14:06:20Z")
> [@Kfoldesi](#): > > If you have any information about avoiding this issue in the future, I would like to present that in the meeting. - Upgrade. Generate a new certificate using the new UI and specify a 50 year expiration or something else really long. - Generate your own certificate with OpenSSL (or similar tools) with a long expiration. ---
**Author:** ![Kfoldesi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kfoldesi/32/11327_2.png) [@Kfoldesi](https://forum.inductiveautomation.com/u/Kfoldesi)\ **Post date:** [May 9, 2023, 2:19pm UTC](https://forum.inductiveautomation.com/t/bad-certificate/73016/7 "2023-05-09T14:19:31Z")
You can generate a certificate for 10,000 days from now. I don't know if vision will have a problem with that, but web browsers won't except a certificate with more than 3 years. ---
**Author:** ![Kfoldesi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kfoldesi/32/11327_2.png) [@Kfoldesi](https://forum.inductiveautomation.com/u/Kfoldesi)\ **Post date:** [May 9, 2023, 2:21pm UTC](https://forum.inductiveautomation.com/t/bad-certificate/73016/8 "2023-05-09T14:21:07Z")
O yea, Apple is 1 year. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [May 9, 2023, 2:44pm UTC](https://forum.inductiveautomation.com/t/bad-certificate/73016/9 "2023-05-09T14:44:42Z")
OPC/UA isn't a browser. ---
**Author:** ![Kfoldesi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kfoldesi/32/11327_2.png) [@Kfoldesi](https://forum.inductiveautomation.com/u/Kfoldesi)\ **Post date:** [May 9, 2023, 4:44pm UTC](https://forum.inductiveautomation.com/t/bad-certificate/73016/10 "2023-05-09T16:44:51Z")
Point taken. So Vision will survive if I give the UA certificate a 2050 date! I would like to be able to report that in tomorrow’s meeting. @Kevin.Herron ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 9, 2023, 4:47pm UTC](https://forum.inductiveautomation.com/t/bad-certificate/73016/11 "2023-05-09T16:47:53Z")
Vision will survive as long as you're not using SSL/TLS on the Ignition Gateway, which has its own certificate that will expire and need renewal on its own timeline. Vision is not affected by the OPC UA certificates in any way, other than that if your OPC UA certs expire and the connection goes down you might see bad data overlays on Vision screens. ---
**Author:** ![Tim\_Carlton](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/tim_carlton/32/52835_2.png) [@Tim\_Carlton](https://forum.inductiveautomation.com/u/Tim_Carlton)\ **Post date:** [May 9, 2023, 5:23pm UTC](https://forum.inductiveautomation.com/t/bad-certificate/73016/12 "2023-05-09T17:23:06Z")
I always recommend adding "Check certificate [cert name] on server [server name]" to the monthly or yearly administration calendar. IT probably has such a task list for verifying that all the users still need access and old accounts are cleared out and security patches are applied or whatever else was identified by the SOC2 compliance audit...