# \[ERROR\] UascServerAsymmetricHandler **URL:** \ **Category:** Ignition Early Access\ **Created:** [January 11, 2019, 9:17am UTC](https://forum.inductiveautomation.com/t/error-uascserverasymmetrichandler/21810 "2019-01-11T09:17:06Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![andrea.morando](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/andrea.morando/32/8039_2.png) [@andrea.morando](https://forum.inductiveautomation.com/u/andrea.morando)\ **Post date:** [January 11, 2019, 9:17am UTC](https://forum.inductiveautomation.com/t/error-uascserverasymmetrichandler/21810/1 "2019-01-11T09:17:06Z")
Hi, in the beta build b2019010702, I found many errors in the gateway logs as: [remote=/127.0.0.1:49159] Exception caught; sent ErrorMessage{error=StatusCode{name=Bad\_SecurityChecksFailed, value=0x80130000, quality=bad}, reason=status=Bad\_SecurityChecksFailed, description=An error occurred verifying security.}. Any idea to solve this issue? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 11, 2019, 12:43pm UTC](https://forum.inductiveautomation.com/t/error-uascserverasymmetrichandler/21810/2 "2019-01-11T12:43:26Z")
These are errors connecting to an external OPC UA server. You’ll have to make sure Ignition’s certificate is trusted by the server as well as mark that server’s certificate trusted in Ignition. On the Ignition side, look under `data/opcua/client/security/pki` in the Ignition install directory and move the the server certificate from `rejected` to `trusted/certs`. There should be a UI available to do this before release. ---
**Author:** ![andrea.morando](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/andrea.morando/32/8039_2.png) [@andrea.morando](https://forum.inductiveautomation.com/u/andrea.morando)\ **Post date:** [January 11, 2019, 1:06pm UTC](https://forum.inductiveautomation.com/t/error-uascserverasymmetrichandler/21810/3 "2019-01-11T13:06:37Z")
Thank you Kevin. Actually I do not have a connection to an external OPC UA server. I have only the Ignition OPC UA Server connection, that is in the Connected status. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 11, 2019, 1:17pm UTC](https://forum.inductiveautomation.com/t/error-uascserverasymmetrichandler/21810/4 "2019-01-11T13:17:28Z")
Hmm, yes, I got that message backwards. Something appears to be connecting to the Ignition OPC UA server instead. See if there’s a certificate under `data/opcua/server/security/pki/rejected`. (note the change from client to server in path) ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [January 11, 2019, 1:19pm UTC](https://forum.inductiveautomation.com/t/error-uascserverasymmetrichandler/21810/5 "2019-01-11T13:19:22Z")
> [@Kevin.Herron](#): > > Something appears to be connecting to the Ignition OPC UA server instead. If you aren't expecting this, then your server is being probed, possibly maliciously. Is it exposed to the internet? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 11, 2019, 1:20pm UTC](https://forum.inductiveautomation.com/t/error-uascserverasymmetrichandler/21810/6 "2019-01-11T13:20:24Z")
> [@pturmel](#): > > If you aren’t expecting this, then your server is being probed, possibly maliciously. Is it exposed to the internet? Always worth looking into. In this case, however, the connection is from `/127.0.0.1:49159`, so it's either the loopback connection not working right or some other software on the machine. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [January 11, 2019, 1:24pm UTC](https://forum.inductiveautomation.com/t/error-uascserverasymmetrichandler/21810/7 "2019-01-11T13:24:32Z")
> [@Kevin.Herron](#): > > connection is from `/127.0.0.1:49159` Oops. Should have looked a little closer. ---
**Author:** ![andrea.morando](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/andrea.morando/32/8039_2.png) [@andrea.morando](https://forum.inductiveautomation.com/u/andrea.morando)\ **Post date:** [January 11, 2019, 2:08pm UTC](https://forum.inductiveautomation.com/t/error-uascserverasymmetrichandler/21810/8 "2019-01-11T14:08:29Z")
Yes, under `data/opcua/server/security/pki/rejected` there is a security certificate. ---
**Author:** ![andrea.morando](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/andrea.morando/32/8039_2.png) [@andrea.morando](https://forum.inductiveautomation.com/u/andrea.morando)\ **Post date:** [January 11, 2019, 2:29pm UTC](https://forum.inductiveautomation.com/t/error-uascserverasymmetrichandler/21810/9 "2019-01-11T14:29:09Z")
I moved that security certificate to the relative “trusted/certs” folder and then the error disappeared. Thank you. ---
**Author:** ![joe.friedrich](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/joe.friedrich/32/7505_2.png) [@joe.friedrich](https://forum.inductiveautomation.com/u/joe.friedrich)\ **Post date:** [August 28, 2019, 8:01pm UTC](https://forum.inductiveautomation.com/t/error-uascserverasymmetrichandler/21810/10 "2019-08-28T20:01:15Z")
Kevin, I’m getting **UascClientAcknowledgeHandler** [remote=/127.0.0.1:49320] Received error message: ErrorMessage{error=StatusCode{name=Bad\_SecurityChecksFailed, value=0x80130000, quality=bad}, reason=An error occurred verifying security.} I checked data/opcua/client/security/pki/rejected, but didn’t find anything. Is this a different connection? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 28, 2019, 8:09pm UTC](https://forum.inductiveautomation.com/t/error-uascserverasymmetrichandler/21810/11 "2019-08-28T20:09:18Z")
Joe, What version of Ignition are you using? That error (`Bad_SecurityChecksFailed`) is from a server you’re connecting to. Judging from the host and port, it’s Kepware on the local machine. You’ll have to go into KSE and tell it to trust Ignition’s client certificate. ---
**Author:** ![joe.friedrich](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/joe.friedrich/32/7505_2.png) [@joe.friedrich](https://forum.inductiveautomation.com/u/joe.friedrich)\ **Post date:** [August 28, 2019, 8:15pm UTC](https://forum.inductiveautomation.com/t/error-uascserverasymmetrichandler/21810/12 "2019-08-28T20:15:08Z")
8.0.2 (We’re upgrading to .3 later). ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 28, 2019, 8:23pm UTC](https://forum.inductiveautomation.com/t/error-uascserverasymmetrichandler/21810/13 "2019-08-28T20:23:37Z")
Okay. Well, you need to make sure Ignition’s client certificate is trusted in KSE. You also need to make sure KSE’s server certificate is trusted in Ignition. It’s on the gateway under Configure \> OPC UA \> Security. Then go to the _Client_ tab and you should see the KSE server certificate there with a button to mark it as trusted. Then, after all this, there’s a possibility you’re running a version of KSE with a bug that generates invalid application URIs in the certificate. This manifests as a Bad\_CertificateUriInvalid error, the same as described in [this post](http://forum.inductiveautomation.com/t/mx-opc-application-uri/27735). If this is happening you need to upgrade KSE to a 6.1+ version and generate the certificate.