# Certificate Path Validation Failed **URL:** \ **Category:** Ignition\ **Created:** [June 19, 2019, 8:50pm UTC](https://forum.inductiveautomation.com/t/certificate-path-validation-failed/25965 "2019-06-19T20:50:19Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![B\_Graham](https://avatars.discourse-cdn.com/v4/letter/b/779978/32.png) [@B\_Graham](https://forum.inductiveautomation.com/u/B_Graham)\ **Post date:** [June 19, 2019, 8:50pm UTC](https://forum.inductiveautomation.com/t/certificate-path-validation-failed/25965/1 "2019-06-19T20:50:19Z")
I am having an issue with OPC Server connection. I am communicating to a Prosoft PLX32 OPC, MODBUS, ETH IP module. I had this all set up and working with Version 7.8 and decided to upgrade to 8.0 for further application development. I struggled with certificates with the original 7.8 set up, so i believe this will be something similar. I will take any guidance or suggestions!! -Blake ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 19, 2019, 8:55pm UTC](https://forum.inductiveautomation.com/t/certificate-path-validation-failed/25965/2 "2019-06-19T20:55:26Z")
In the Ignition gateway config section, go to `OPC UA > Security`. On the Client tab you should see a Quarantined Certificates section with an entry for the certificate of the server you’re connecting to. You’ll need to mark that as trusted. There may be a similar procedure you need to go through with the configuration software for the server you’re connecting to. ---
**Author:** ![B\_Graham](https://avatars.discourse-cdn.com/v4/letter/b/779978/32.png) [@B\_Graham](https://forum.inductiveautomation.com/u/B_Graham)\ **Post date:** [June 20, 2019, 8:33pm UTC](https://forum.inductiveautomation.com/t/certificate-path-validation-failed/25965/3 "2019-06-20T20:33:03Z")
Thanks for the speedy response yesterday!! I am just now looking at this again. On the client security page I see a trusted certificate and a quarantined certificate with the same fingerprint. If i trust the quarantined one it comes back within a minute. The best i can tell I have completed this with the OPC server as well. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 20, 2019, 8:41pm UTC](https://forum.inductiveautomation.com/t/certificate-path-validation-failed/25965/4 "2019-06-20T20:41:59Z")
On the [logging page](https://docs.inductiveautomation.com/display/DOC80/Gateway+Diagnostics#GatewayDiagnostics-Logs) in the gateway you can set log levels for the various loggers. Search for “CertificateValidationUtil” on log level config dialog and turn it to DEBUG level. It’s possible that even though you’ve added the server certificate to the trust list it’s invalid for some other reason. ---
**Author:** ![B\_Graham](https://avatars.discourse-cdn.com/v4/letter/b/779978/32.png) [@B\_Graham](https://forum.inductiveautomation.com/u/B_Graham)\ **Post date:** [June 20, 2019, 8:50pm UTC](https://forum.inductiveautomation.com/t/certificate-path-validation-failed/25965/5 "2019-06-20T20:50:39Z")
I guess I should clarify. I am in ignition 8. I have this all working currently on 7.6 In the logger in 8, with set to debug, i get certificate path validation failed: unable to find valid cert path to requested target. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 20, 2019, 8:54pm UTC](https://forum.inductiveautomation.com/t/certificate-path-validation-failed/25965/6 "2019-06-20T20:54:51Z")
Can you try turning the logger for “DefaultCertificateValidator” onto DEBUG as well? Also, if you look under wherever Ignition is installed, then `data/opcua/client/security/pki/trusted/certs` is the server’s certificate in there? Also if you’re not on version 8.0.2 it might be worth upgrading just in case. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 20, 2019, 8:58pm UTC](https://forum.inductiveautomation.com/t/certificate-path-validation-failed/25965/7 "2019-06-20T20:58:49Z")
Also, if you can send the server certificate to me I can take a look at it real quick and see if there’s anything weird. ---
**Author:** ![B\_Graham](https://avatars.discourse-cdn.com/v4/letter/b/779978/32.png) [@B\_Graham](https://forum.inductiveautomation.com/u/B_Graham)\ **Post date:** [June 20, 2019, 9:25pm UTC](https://forum.inductiveautomation.com/t/certificate-path-validation-failed/25965/8 "2019-06-20T21:25:11Z")
I sent you the cert in an email ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 20, 2019, 9:27pm UTC](https://forum.inductiveautomation.com/t/certificate-path-validation-failed/25965/9 "2019-06-20T21:27:02Z")
Did you send it to kevin at [inductiveautomation.com](http://inductiveautomation.com)? I don’t see anything. ---
**Author:** ![B\_Graham](https://avatars.discourse-cdn.com/v4/letter/b/779978/32.png) [@B\_Graham](https://forum.inductiveautomation.com/u/B_Graham)\ **Post date:** [June 20, 2019, 9:28pm UTC](https://forum.inductiveautomation.com/t/certificate-path-validation-failed/25965/10 "2019-06-20T21:28:35Z")
I replied to your email from yesterday ---
**Author:** ![B\_Graham](https://avatars.discourse-cdn.com/v4/letter/b/779978/32.png) [@B\_Graham](https://forum.inductiveautomation.com/u/B_Graham)\ **Post date:** [June 20, 2019, 9:28pm UTC](https://forum.inductiveautomation.com/t/certificate-path-validation-failed/25965/11 "2019-06-20T21:28:54Z")
‘Kevin Herron via Inductive Automation Forum’ [no-reply@inductiveautomation.com](mailto:no-reply@inductiveautomation.com) ---
**Author:** ![B\_Graham](https://avatars.discourse-cdn.com/v4/letter/b/779978/32.png) [@B\_Graham](https://forum.inductiveautomation.com/u/B_Graham)\ **Post date:** [June 20, 2019, 9:29pm UTC](https://forum.inductiveautomation.com/t/certificate-path-validation-failed/25965/12 "2019-06-20T21:29:11Z")
ooops. Ill send it to you! ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 20, 2019, 9:41pm UTC](https://forum.inductiveautomation.com/t/certificate-path-validation-failed/25965/13 "2019-06-20T21:41:36Z")
Okay, this certificate is not correctly indicating that it’s a self-signed certificate (the Certificate Authority Basic Constraint is not set). This worked in ~~7.6~~ 7.8 because there was no validation or trust chain verification happening back then. If you can’t get that server to generate a certificate that correctly indicates it’s self-signed (or is actually signed by another certificate) then you’ll probably need to connect without security as the workaround. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 21, 2019, 12:25am UTC](https://forum.inductiveautomation.com/t/certificate-path-validation-failed/25965/14 "2019-06-21T00:25:14Z")
Ah, I took another look at this certificate, and it _is_ signed by another certificate, and is not self-signed. The issuing certificate is the “ProSoft OPC UA Server Configuration Manager - Certificate Authority”. If you can place that certificate into the trusted certs dir I think you’ll be able to connect. ---
**Author:** ![B\_Graham](https://avatars.discourse-cdn.com/v4/letter/b/779978/32.png) [@B\_Graham](https://forum.inductiveautomation.com/u/B_Graham)\ **Post date:** [June 24, 2019, 1:00pm UTC](https://forum.inductiveautomation.com/t/certificate-path-validation-failed/25965/15 "2019-06-24T13:00:06Z")
This worked!! I was able to export the certificate and place it in the Ignition Trusted certs dir, as instructed. We are now communicating with Ignition 8.0 to our microprocessor with the Prosoft module. Thanks for your time! -Blake ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 24, 2019, 3:12pm UTC](https://forum.inductiveautomation.com/t/certificate-path-validation-failed/25965/16 "2019-06-24T15:12:59Z")
Glad you got this working. I made a change so that the entire certificate chain gets added to the rejected certificate list, which should make it much more obvious what’s happening in situations like this. ---
**Author:** ![robert2](https://avatars.discourse-cdn.com/v4/letter/r/e8c25b/32.png) [@robert2](https://forum.inductiveautomation.com/u/robert2)\ **Post date:** [July 23, 2019, 6:23pm UTC](https://forum.inductiveautomation.com/t/certificate-path-validation-failed/25965/17 "2019-07-23T18:23:22Z")
Running into the same issue here… Created a self-signed X509 certificate using openssl tool and Ignition is reporting a validation issue.