# Connecting to ibaPDA OPC UA server, Bad\_CertificateUriInvalid

**URL:** <https://forum.inductiveautomation.com/t/connecting-to-ibapda-opc-ua-server-bad-certificateuriinvalid/99164>\
**Category:** Ignition\
**Tags:** opcua\
**Created:** [November 27, 2024, 2:46am UTC](https://forum.inductiveautomation.com/t/connecting-to-ibapda-opc-ua-server-bad-certificateuriinvalid/99164 "2024-11-27T02:46:58Z")\
**Posts on this page:** 8\
**Page:** 2

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [November 28, 2024, 2:59am UTC](https://forum.inductiveautomation.com/t/connecting-to-ibapda-opc-ua-server-bad-certificateuriinvalid/99164/22 "2024-11-28T02:59:48Z")

</div>

Ok, that one's Ignition, but now you have different 2 clients seeing ~~the exact same~~ a similar issue... maybe it's time to get the Server vendor involved.

Ignition gets `BadIdentityTokenRejected`, not `BadIdentityTokenInvalid`, though... which might again suggest you just have the wrong username/password.

---

<div class="post-metadata">

**Author:** ![Felix\_Cheah](https://avatars.discourse-cdn.com/v4/letter/f/e99b99/32.png) [@Felix\_Cheah](https://forum.inductiveautomation.com/u/Felix_Cheah)\
**Post date:** [November 28, 2024, 7:54pm UTC](https://forum.inductiveautomation.com/t/connecting-to-ibapda-opc-ua-server-bad-certificateuriinvalid/99164/23 "2024-11-28T19:54:29Z")

</div>

where can i find the certificates used by the ignition OPC UA client?

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [November 28, 2024, 8:15pm UTC](https://forum.inductiveautomation.com/t/connecting-to-ibapda-opc-ua-server-bad-certificateuriinvalid/99164/24 "2024-11-28T20:15:16Z")

</div>

You can download it from the Ignition Gateway under something like `Config > OPC UA > Security`, on the Certificates tab.

---

<div class="post-metadata">

**Author:** ![Felix\_Cheah](https://avatars.discourse-cdn.com/v4/letter/f/e99b99/32.png) [@Felix\_Cheah](https://forum.inductiveautomation.com/u/Felix_Cheah)\
**Post date:** [November 28, 2024, 10:52pm UTC](https://forum.inductiveautomation.com/t/connecting-to-ibapda-opc-ua-server-bad-certificateuriinvalid/99164/25 "2024-11-28T22:52:25Z")

</div>

Is there a way to also get the .pfx file?

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [November 28, 2024, 11:16pm UTC](https://forum.inductiveautomation.com/t/connecting-to-ibapda-opc-ua-server-bad-certificateuriinvalid/99164/26 "2024-11-28T23:16:28Z")

</div>

It's on disk at `$IGNITION/data/opcua/client/security/certificates.pfx`. Not accessible via web UI.

The passwords are all "password".

---

<div class="post-metadata">

**Author:** ![Felix\_Cheah](https://avatars.discourse-cdn.com/v4/letter/f/e99b99/32.png) [@Felix\_Cheah](https://forum.inductiveautomation.com/u/Felix_Cheah)\
**Post date:** [November 29, 2024, 12:15am UTC](https://forum.inductiveautomation.com/t/connecting-to-ibapda-opc-ua-server-bad-certificateuriinvalid/99164/27 "2024-11-29T00:15:34Z")

</div>

![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/1/b1686367e8304c56228360a033faef60fd76ef7e.png)  
is there a way to change the URL here?

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [November 29, 2024, 12:17am UTC](https://forum.inductiveautomation.com/t/connecting-to-ibapda-opc-ua-server-bad-certificateuriinvalid/99164/28 "2024-11-29T00:17:37Z")

</div>

Technically yes, but it will look exactly like that except with another UUID in place of the one at the end. It's not otherwise customizable.

That also appears to be the Ignition server certificate rather than the client.

What are you up to here?

---

<div class="post-metadata">

**Author:** ![diamond](https://avatars.discourse-cdn.com/v4/letter/d/e79b87/32.png) [@diamond](https://forum.inductiveautomation.com/u/diamond)\
**Post date:** [November 29, 2024, 9:01am UTC](https://forum.inductiveautomation.com/t/connecting-to-ibapda-opc-ua-server-bad-certificateuriinvalid/99164/29 "2024-11-29T09:01:19Z")

</div>

@Felix_Cheah, I have suffered this before. I recommend you to go for a traditional user/pass authentication in ibaPDA.

[Previous page](https://forum.inductiveautomation.com/t/connecting-to-ibapda-opc-ua-server-bad-certificateuriinvalid/99164.md?page=1)