# BadIdentityTokenRejected without using client certificate and private key at client side **URL:** \ **Category:** General Discussion\ **Created:** [May 28, 2025, 3:33pm UTC](https://forum.inductiveautomation.com/t/badidentitytokenrejected-without-using-client-certificate-and-private-key-at-client-side/106773 "2025-05-28T15:33:21Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![charlie.ye](https://avatars.discourse-cdn.com/v4/letter/c/85e7bf/32.png) [@charlie.ye](https://forum.inductiveautomation.com/u/charlie.ye)\ **Post date:** [May 28, 2025, 3:33pm UTC](https://forum.inductiveautomation.com/t/badidentitytokenrejected-without-using-client-certificate-and-private-key-at-client-side/106773/1 "2025-05-28T15:33:21Z")
I have a difficulty to make a connection using a user id and password to a local Ignition OPC UA server without certificate and private key at now. Both client and Ignition server are running locally at a windows platform. Here is my code snippet. Can you help me figure out the problem? ```python void test_Ignition_OPC_UA_Secure_Connection() { static const char* const defaultUrl = "opc.tcp://localhost:62541"; UA_Client* client = UA_Client_new(); UA_ClientConfig* cfg = UA_Client_getConfig(client); UA_StatusCode status = UA_ClientConfig_setDefault(cfg); assert(status == UA_STATUSCODE_GOOD); cfg->securityMode = UA_MESSAGESECURITYMODE_NONE; status = UA_Client_connectUsername(client, defaultUrl, "cye", "Smash123@1"); assert(status == UA_STATUSCODE_GOOD); // status == BadIdentityTokenRejected UA_Client_delete(client); } ``` ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/1/11497492830c02a00543bbd7c8b4dcd724426461.png) ![None-Anonymous-Enabled](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/d/2db37a6b6827d50cf525c17e48789211165ec58d.jpeg) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 28, 2025, 3:37pm UTC](https://forum.inductiveautomation.com/t/badidentitytokenrejected-without-using-client-certificate-and-private-key-at-client-side/106773/2 "2025-05-28T15:37:14Z")
Any change to the Ignition OPC UA server settings required a restart to take effect. If you just now enabled anonymous access go ahead and restart. edit: ah, oops, you are trying to connect _with_ a username password. the "No matching UserTokenPolicy" in your logs threw me off track. You must have a certificate and private key configured to connect with a username/password, the password is encrypted before being sent to the server. ---
**Author:** ![charlie.ye](https://avatars.discourse-cdn.com/v4/letter/c/85e7bf/32.png) [@charlie.ye](https://forum.inductiveautomation.com/u/charlie.ye)\ **Post date:** [May 28, 2025, 3:43pm UTC](https://forum.inductiveautomation.com/t/badidentitytokenrejected-without-using-client-certificate-and-private-key-at-client-side/106773/3 "2025-05-28T15:43:07Z")
Yes, I know the trick. After making a change using localhost:8088, I did restarting the Ignition service. Could you check my code? What is the error message 'No suitable endpoint found'? What configuration do I have to make? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 28, 2025, 3:43pm UTC](https://forum.inductiveautomation.com/t/badidentitytokenrejected-without-using-client-certificate-and-private-key-at-client-side/106773/4 "2025-05-28T15:43:36Z")
> [@charlie.ye](#): > > What is the error message 'No suitable endpoint found'? What configuration do I have to make? > [@Kevin.Herron](#): > > You must have a certificate and private key configured to connect with a username/password, the password is encrypted before being sent to the server See ^ ---
**Author:** ![charlie.ye](https://avatars.discourse-cdn.com/v4/letter/c/85e7bf/32.png) [@charlie.ye](https://forum.inductiveautomation.com/u/charlie.ye)\ **Post date:** [May 28, 2025, 3:49pm UTC](https://forum.inductiveautomation.com/t/badidentitytokenrejected-without-using-client-certificate-and-private-key-at-client-side/106773/5 "2025-05-28T15:49:01Z")
I have to use certificate, private key, user id and password together for making a connection. If so, could you show me a tutorial site to guide me with detailed steps? How can I encrypt a password? Can you show me some code snippet? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 28, 2025, 3:51pm UTC](https://forum.inductiveautomation.com/t/badidentitytokenrejected-without-using-client-certificate-and-private-key-at-client-side/106773/6 "2025-05-28T15:51:07Z")
You don't need to encrypt it, the SDK you're using will do it for you. Try the open62541 client examples if that's the SDK you use: [open62541/examples/client\_connect.c at 6f2aeaf040b311d04a5561eb3d4e6400b118adbc · open62541/open62541 · GitHub](https://github.com/open62541/open62541/blob/6f2aeaf040b311d04a5561eb3d4e6400b118adbc/examples/client_connect.c) Or find your own tutorial on Google. I can answer Ignition and OPC UA questions but I'm not going to try to teach you how to use an SDK I've never even used myself. ---
**Author:** ![charlie.ye](https://avatars.discourse-cdn.com/v4/letter/c/85e7bf/32.png) [@charlie.ye](https://forum.inductiveautomation.com/u/charlie.ye)\ **Post date:** [May 28, 2025, 4:03pm UTC](https://forum.inductiveautomation.com/t/badidentitytokenrejected-without-using-client-certificate-and-private-key-at-client-side/106773/7 "2025-05-28T16:03:24Z")
What is configuration I have to do for certfile.der and keyfile.der? What requirements are for the two files?