# CertificateValidationUtil: KeyUsage keyCertSign bit set without BasicConstraint cA bit set

**URL:** <https://forum.inductiveautomation.com/t/certificatevalidationutil-keyusage-keycertsign-bit-set-without-basicconstraint-ca-bit-set/37796>\
**Category:** Ignition\
**Created:** [August 17, 2020, 8:37am UTC](https://forum.inductiveautomation.com/t/certificatevalidationutil-keyusage-keycertsign-bit-set-without-basicconstraint-ca-bit-set/37796 "2020-08-17T08:37:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![JantjeBeton](https://avatars.discourse-cdn.com/v4/letter/j/ea666f/32.png) [@JantjeBeton](https://forum.inductiveautomation.com/u/JantjeBeton)\
**Post date:** [August 17, 2020, 8:37am UTC](https://forum.inductiveautomation.com/t/certificatevalidationutil-keyusage-keycertsign-bit-set-without-basicconstraint-ca-bit-set/37796/1 "2020-08-17T08:37:59Z")

</div>

MY OPC UA connection is working but I see the following errors in the gateway-logging:  
CertificateValidationUtil  
‘O=Siemens,C=DE,CN=Urs/OPCUA-1-1’ violates RFC 5280: KeyUsage keyCertSign bit set without BasicConstraint cA bit set

We’re using the built in OPC-UA server in the S7 1500-PLC with Ignition Version: **8.0.12 (b2020042115)**

Is this a setting in the gateway or should this be fixed in the PLC?

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [August 17, 2020, 12:03pm UTC](https://forum.inductiveautomation.com/t/certificatevalidationutil-keyusage-keycertsign-bit-set-without-basicconstraint-ca-bit-set/37796/2 "2020-08-17T12:03:29Z")

</div>

It would be fixed on the PLC side by generating a new certificate, but I doubt there’s a setting that will influence that bit being set.

I wouldn’t worry about it. It’s just a warning and it turns out to be common enough that I think I changed that warning to be a DEBUG-level log instead.

---

<div class="post-metadata">

**Author:** ![JantjeBeton](https://avatars.discourse-cdn.com/v4/letter/j/ea666f/32.png) [@JantjeBeton](https://forum.inductiveautomation.com/u/JantjeBeton)\
**Post date:** [August 17, 2020, 12:27pm UTC](https://forum.inductiveautomation.com/t/certificatevalidationutil-keyusage-keycertsign-bit-set-without-basicconstraint-ca-bit-set/37796/3 "2020-08-17T12:27:21Z")

</div>

Thanks Kevin!

It looks like it’s not a recurring error, so I don’t mind if it comes only after a gateway startup.  
We’re not planning to do that quite often in production :- 😃

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [August 17, 2020, 12:50pm UTC](https://forum.inductiveautomation.com/t/certificatevalidationutil-keyusage-keycertsign-bit-set-without-basicconstraint-ca-bit-set/37796/4 "2020-08-17T12:50:45Z")

</div>

I think you’ll see it any time Ignition connects or reconnects to that server.