CNC machine OPC UA certificate error

Ignition 8.1.23

Hi All

We have a fairly new CNC machine from DMG Mori. It is equipped with what Mori call an "IoT Connector". This is basically a box that makes machine data available via OPC-UA, MtConnect or MQTT.

The machine was commissioned over 6 months ago and since then we have been happily collecting OEE data using OPC-UA. On 12/06/2023 at 23:28, the comms stopped. Ignition is telling me that the certificate has a bad timestamp (either expired or not yet valid). We have many other OPC-UA enabled devices communicating with Ignition and no other issues. The CNC machine is still in production since all code is delivered via a separate system.

I have tried the following.:

  • Checked date & time on certificate. Looks good.
  • Checked date & time on CNC machine and ignition server. All good.
  • Checked the username and password.
  • Power cycled the CNC machine...
  • Re-created the OPC-UA connection in ignition. Ignition reports that an issue with the endpoint host and this has to be set to the actual IP. This was done during commissioning, and it seemed to work ok.
  • Connected to server with third party OPC-UA browser. Data can be read but the OPC browser is unable to retrieve certificate information.
  • Disabled certificate validation - same error message about bad certificate time.
  • Deleted the certificate from ignition's store, recreated connection. Same error.

Currently working from home but planning to temporarily disable OPC-UA authentication on the machine next.

Can anyone suggest anything else to check before I take a deep breath and contact the OEM? (There isn't much local knowledge on machine monitoring and all questions on the topic are indirectly routed to Germany...)

Cheers

Capture

UaException: status=Bad_CertificateTimeInvalid, message=The certificate has expired or is not yet valid.
	at org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientAcknowledgeHandler.onError(UascClientAcknowledgeHandler.java:258)
	at org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientAcknowledgeHandler.decode(UascClientAcknowledgeHandler.java:167)
	at io.netty.handler.codec.ByteToMessageCodec$1.decode(ByteToMessageCodec.java:42)
	at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:510)
	at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:449)
	at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:279)
	at io.netty.handler.codec.ByteToMessageCodec.channelRead(ByteToMessageCodec.java:103)
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
	at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)
	at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410)
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
	at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919)
	at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166)
	at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:722)
	at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:658)
	at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:584)
	at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:496)
	at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:995)
	at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
	at java.base/java.lang.Thread.run(Unknown Source)

8.1.23 (b2022121308)
Azul Systems, Inc. 11.0.16.1

This looks like the server rejecting the connection because the Ignition OPC UA client certificate has expired.

In the OPC UA > Security section of the gateway you can view and regenerate the client and server certificates.

2 Likes

Hi Kevin. Thanks for the reply. As mentioned previously, I have looked at the certificate and it is valid. See below for a screenshot of the certificate that I downloaded from the ignition webpage.

I'm baffled. Why would ignition complain about the certificate validity if the date checks out? Could it really be an issue with another field on the cert?

Cheers

Look at the "Valid From" start date on the image of the certificate you provided. It is not yet valid, which matches what the error message is saying.

Unless your date is day/month/year?

Ignition isn’t complaining about that server certificate, that server is complaining about the Ignition client certificate.

We're on day/month/year. Thanks

Kevin - you're right! I hadn't even looked there and missed the "client" bit from your first message. Thank you!

The connection to the CNC machine is now back up and running. Thanks

1 Like