# Creating secure OPC-UA connection with Rockwell Factory Talk Policy Manager **URL:** \ **Category:** Ignition\ **Tags:** opcua\ **Created:** [December 6, 2024, 3:45pm UTC](https://forum.inductiveautomation.com/t/creating-secure-opc-ua-connection-with-rockwell-factory-talk-policy-manager/99530 "2024-12-06T15:45:02Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Ian\_McArdle](https://avatars.discourse-cdn.com/v4/letter/i/f1d935/32.png) [@Ian\_McArdle](https://forum.inductiveautomation.com/u/Ian_McArdle)\ **Post date:** [December 6, 2024, 3:45pm UTC](https://forum.inductiveautomation.com/t/creating-secure-opc-ua-connection-with-rockwell-factory-talk-policy-manager/99530/1 "2024-12-06T15:45:03Z")
Hi, has anyone here had success creating a secure connection between an Allen Bradley PLC (acting as the OPC-UA client) and an Ignition OPC-UA server? My research so far suggests that it is necessary to create a trust relationship in the Rockwell Factory Talk Policy Manager software. I believe I have to create a "Zone" and add both the OPC-UA server and client as "Devices" in the same Zone. However, I can't get the software to accept the Ignition server's URL - it simply says "Cannot verify connection to this server. Try adding again in Discovery pane or verify the URL and refresh the endpoint list". I'm running the FTPM software on the same machine as Ignition and so my URL is opc.tcp://localhost:62541 (I also tried adding /discovery on the end but got the same result). My security settings are the default Basic256Sha256 and anonymous. I try pressing the refresh button but nothing appears in the endpoint list and the above message remains just below the URL. A further issue (maybe related, I don't know) is that I cannot import the server's certificate into FTPM. It says "Cannot import certificate to the OPC UA server - Factory Talk System Services does not have permissions to access file.". Is there a client certificate for FTPM that needs to be imported and trusted by Ignition? Or does it need a certificate from the PLC? And where would I find that? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [December 6, 2024, 3:50pm UTC](https://forum.inductiveautomation.com/t/creating-secure-opc-ua-connection-with-rockwell-factory-talk-policy-manager/99530/2 "2024-12-06T15:50:04Z")
> [@Ian\_McArdle](#): > > My security settings are the default Basic256Sha256 and anonymous anonymous access is not enabled by default on the Ignition OPC UA server. If you enabled it at some point then make sure you've restarted the Ignition Gateway. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [December 6, 2024, 3:51pm UTC](https://forum.inductiveautomation.com/t/creating-secure-opc-ua-connection-with-rockwell-factory-talk-policy-manager/99530/3 "2024-12-06T15:51:24Z")
> [@Ian\_McArdle](#): > > Is there a client certificate for FTPM that needs to be imported and trusted by Ignition? If you get far enough into the connection process it will show up in the Gateway under `Config > OPC UA > Security` on the Server tab, where you can mark it trusted. You can also import it ahead of time in the same place. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [December 7, 2024, 12:12am UTC](https://forum.inductiveautomation.com/t/creating-secure-opc-ua-connection-with-rockwell-factory-talk-policy-manager/99530/4 "2024-12-07T00:12:18Z")
> [@Ian\_McArdle](#): > > so my URL is opc.tcp://localhost:62541 That definitely won't be right for the PLC to make a direct client connection. ---
**Author:** ![Ian\_McArdle](https://avatars.discourse-cdn.com/v4/letter/i/f1d935/32.png) [@Ian\_McArdle](https://forum.inductiveautomation.com/u/Ian_McArdle)\ **Post date:** [December 9, 2024, 8:17am UTC](https://forum.inductiveautomation.com/t/creating-secure-opc-ua-connection-with-rockwell-factory-talk-policy-manager/99530/5 "2024-12-09T08:17:05Z")
Hi Kevin. Thanks for the reminder about restarting the server after making changes to the configuration. That still catches me out from time to time. Just a suggestion, but it might be helpful to have some visual indication in the gateway when there are pending config changes that require a restart. In my case, I don't think that was the cause of my problem. I have restarted many times while trying out different things to solve it. ---
**Author:** ![Ian\_McArdle](https://avatars.discourse-cdn.com/v4/letter/i/f1d935/32.png) [@Ian\_McArdle](https://forum.inductiveautomation.com/u/Ian_McArdle)\ **Post date:** [December 9, 2024, 8:19am UTC](https://forum.inductiveautomation.com/t/creating-secure-opc-ua-connection-with-rockwell-factory-talk-policy-manager/99530/6 "2024-12-09T08:19:00Z")
Hmm. Nothing showing in the quarantined certificates area yet. ---
**Author:** ![Ian\_McArdle](https://avatars.discourse-cdn.com/v4/letter/i/f1d935/32.png) [@Ian\_McArdle](https://forum.inductiveautomation.com/u/Ian_McArdle)\ **Post date:** [December 9, 2024, 8:33am UTC](https://forum.inductiveautomation.com/t/creating-secure-opc-ua-connection-with-rockwell-factory-talk-policy-manager/99530/7 "2024-12-09T08:33:32Z")
Hi pturmel, My PLC is not configured with that URL. Localhost is used only in the FTPM software, which is running on the same PC as the Ignition server. I'm still trying to understand exactly how the Rockwell/AB security model works but it looks as though you configure the Zones and Devices in FTPM before "deploying" the security settings to the PLC. FTPM presumably needs to verify the connection to the OPC-UA server. So, from that point of view, it is a localhost connection. In the PLC, I have it configured with the IP address of the server, rather than localhost. And that works fine until I turn on the security - then, thanks to Rockwell/AB's approach, things get a whole lot more complicated and I have to use the FTPM software, apparently. I have tried using the IP address and hostname in FTPM too - but get the same error message. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [December 9, 2024, 1:02pm UTC](https://forum.inductiveautomation.com/t/creating-secure-opc-ua-connection-with-rockwell-factory-talk-policy-manager/99530/8 "2024-12-09T13:02:05Z")
Try putting FTPM in a different machine. ---
**Author:** ![Ian\_McArdle](https://avatars.discourse-cdn.com/v4/letter/i/f1d935/32.png) [@Ian\_McArdle](https://forum.inductiveautomation.com/u/Ian_McArdle)\ **Post date:** [December 10, 2024, 9:07am UTC](https://forum.inductiveautomation.com/t/creating-secure-opc-ua-connection-with-rockwell-factory-talk-policy-manager/99530/9 "2024-12-10T09:07:18Z")
Thanks for the suggestion - I will give that a try. Do you know if FTPM has to be running constantly in the production environment, or can I deploy the security model to the PLC and then remove FTPM from the environment? My reason for asking is that we only have one PC in our production system - and that's the one that is running Ignition, of course. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [December 10, 2024, 1:29pm UTC](https://forum.inductiveautomation.com/t/creating-secure-opc-ua-connection-with-rockwell-factory-talk-policy-manager/99530/10 "2024-12-10T13:29:53Z")
> [@Ian\_McArdle](#): > > Do you know No, sorry. I only use Rockwell Software to deploy/maintain PLC and related hardware, not as any part of a production system. (Because I don't put production-critical software on Windows, and Rockwell is still in an unholy union with Microsoft.) ---
**Author:** ![Ian\_McArdle](https://avatars.discourse-cdn.com/v4/letter/i/f1d935/32.png) [@Ian\_McArdle](https://forum.inductiveautomation.com/u/Ian_McArdle)\ **Post date:** [February 7, 2025, 8:32am UTC](https://forum.inductiveautomation.com/t/creating-secure-opc-ua-connection-with-rockwell-factory-talk-policy-manager/99530/11 "2025-02-07T08:32:41Z")
Hi all, Just a quick update regarding this issue. Hopefully it will benefit anyone else who faces the same problem. I received a reply from Rockwell about it, and they seemed to confirm that FactoryTalk Policy Manager has an issue with the discovery mechanism that is implemented by Ignition. They told me that it will be fixed in the next release V6.51 which is due at the end of April. There is no known workaround, unfortunately. So, we will have to wait a bit longer for a solution. ---
**Author:** ![serraed](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@serraed](https://forum.inductiveautomation.com/u/serraed)\ **Post date:** [February 20, 2026, 7:05pm UTC](https://forum.inductiveautomation.com/t/creating-secure-opc-ua-connection-with-rockwell-factory-talk-policy-manager/99530/13 "2026-02-20T19:05:22Z")
Were you able to try the connection with the new FactoryTalk Policy Manager V6.51? And did it work?