# \[IGN-14345\] Downloading OPC-UA server certificate in v8.3

**URL:** <https://forum.inductiveautomation.com/t/ign-14345-downloading-opc-ua-server-certificate-in-v8-3/110761>\
**Category:** Ignition\
**Created:** [September 18, 2025, 3:53pm UTC](https://forum.inductiveautomation.com/t/ign-14345-downloading-opc-ua-server-certificate-in-v8-3/110761 "2025-09-18T15:53:50Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![dom.dynamic](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/dom.dynamic/32/78825_2.png) [@dom.dynamic](https://forum.inductiveautomation.com/u/dom.dynamic)\
**Post date:** [September 18, 2025, 3:53pm UTC](https://forum.inductiveautomation.com/t/ign-14345-downloading-opc-ua-server-certificate-in-v8-3/110761/1 "2025-09-18T15:53:51Z")

</div>

Just installed official release of Ignition v8.3 and I’m trying to set up OPCUA connection with another SCADA software. Is there a way to download OPC-UA server certificate from the gateway page?

In the older version of Ignition (ex. v.8.1.38), there is a ‘Download’ button to download the server certificate (Ignition OPC UA Server). But in v8.3, there is no visible download button.

v8.1.38

 ![v8.1.38 Download Server Certificate](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/1/11fe5987b7b7c91df001f0a713b4b98e9f48153e.png)

v8.3

 ![v8.3 Server Certificate](https://us1.discourse-cdn.com/inductiveautomation/original/3X/5/4/54f51be5e89e6bed929288cfbacf929b0fb19028.png)

---

<div class="post-metadata">

**Author:** ![ryan.white](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryan.white/32/73193_2.png) [@ryan.white](https://forum.inductiveautomation.com/u/ryan.white)\
**Post date:** [September 18, 2025, 4:09pm UTC](https://forum.inductiveautomation.com/t/ign-14345-downloading-opc-ua-server-certificate-in-v8-3/110761/2 "2025-09-18T16:09:30Z")

</div>

Anything in the meatball menu on the far right?

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/0/1/01cbe63c328c439a5937aee1c05e75db29a19428.png)

---

<div class="post-metadata">

**Author:** ![dom.dynamic](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/dom.dynamic/32/78825_2.png) [@dom.dynamic](https://forum.inductiveautomation.com/u/dom.dynamic)\
**Post date:** [September 18, 2025, 4:12pm UTC](https://forum.inductiveautomation.com/t/ign-14345-downloading-opc-ua-server-certificate-in-v8-3/110761/3 "2025-09-18T16:12:37Z")

</div>

Three dots didn’t do anything for me. And the gear icon only shows column visibility options.

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/3/3/33afc50941ab7f61d4e5e04dc3980e49a2cbb470.png)

---

<div class="post-metadata">

**Author:** ![schenk](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@schenk](https://forum.inductiveautomation.com/u/schenk)\
**Post date:** [September 18, 2025, 5:45pm UTC](https://forum.inductiveautomation.com/t/ign-14345-downloading-opc-ua-server-certificate-in-v8-3/110761/4 "2025-09-18T17:45:36Z")

</div>

You can now use your servers [openapi](http://localhost:8088/openapi) to download the certificate. Specifically, [this one](http://localhost:8088/data/opc-ua/api/v1/server/certificate/download).

---

<div class="post-metadata">

**Author:** ![diamond](https://avatars.discourse-cdn.com/v4/letter/d/e79b87/32.png) [@diamond](https://forum.inductiveautomation.com/u/diamond)\
**Post date:** [September 19, 2025, 7:36pm UTC](https://forum.inductiveautomation.com/t/ign-14345-downloading-opc-ua-server-certificate-in-v8-3/110761/5 "2025-09-19T19:36:44Z")

</div>

Change your browser

---

<div class="post-metadata">

**Author:** ![ggross](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ggross/32/12668_2.png) [@ggross](https://forum.inductiveautomation.com/u/ggross)\
**Post date:** [September 19, 2025, 9:07pm UTC](https://forum.inductiveautomation.com/t/ign-14345-downloading-opc-ua-server-certificate-in-v8-3/110761/6 "2025-09-19T21:07:33Z")

</div>

While I will get a bug in for not being able to do it from the Certificates tab, Ignition does have to trust it's own certificates. You are able to download the needed certificates from the Client and Server tabs.

Garth

---

<div class="post-metadata">

**Author:** ![ziad](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ziad/32/6841_2.png) [@ziad](https://forum.inductiveautomation.com/u/ziad)\
**Post date:** [September 23, 2025, 11:27pm UTC](https://forum.inductiveautomation.com/t/ign-14345-downloading-opc-ua-server-certificate-in-v8-3/110761/7 "2025-09-23T23:27:45Z")

</div>

@ggross How do we regenerate an expired OPC-UA certificate in 8.3?

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [September 24, 2025, 12:04am UTC](https://forum.inductiveautomation.com/t/ign-14345-downloading-opc-ua-server-certificate-in-v8-3/110761/8 "2025-09-24T00:04:35Z")

</div>

Hmm, I think it's supposed to be in the "meatball" menus mentioned above, but they don't seem to do anything for me.

You can always delete the keystore file on disk and then restart.

- `$IGNITION/data/config/resources/local/com.inductiveautomation.opcua/client-keystore`
- `$IGNITION/data/config/resources/local/com.inductiveautomation.opcua/server-keystore`

---

<div class="post-metadata">

**Author:** ![ziad](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ziad/32/6841_2.png) [@ziad](https://forum.inductiveautomation.com/u/ziad)\
**Post date:** [September 24, 2025, 1:36am UTC](https://forum.inductiveautomation.com/t/ign-14345-downloading-opc-ua-server-certificate-in-v8-3/110761/9 "2025-09-24T01:36:41Z")

</div>

Thanks Kevin. We tried that but they still came back as expired Feb 2025.

---

<div class="post-metadata">

**Author:** ![avaughn](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/avaughn/32/38972_2.png) [@avaughn](https://forum.inductiveautomation.com/u/avaughn)\
**Post date:** [September 24, 2025, 1:37pm UTC](https://forum.inductiveautomation.com/t/ign-14345-downloading-opc-ua-server-certificate-in-v8-3/110761/10 "2025-09-24T13:37:33Z")

</div>

I tested deleting the keystores and new certs get correctly regenerated for me on restart.

Can you confirm you deleted the keystores at `$IGNITION/data/config/resources/local/com.inductiveautomation.opcua` and not the certificate directories located in `$IGNITION/data/config/local/com.inductiveautomation.opcua`? This would just delete all previously trusted or rejected certificates and then on restart the Ignition OPC-UA client and server certs will be automatically trusted again.

---

<div class="post-metadata">

**Author:** ![ziad](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ziad/32/6841_2.png) [@ziad](https://forum.inductiveautomation.com/u/ziad)\
**Post date:** [September 24, 2025, 9:23pm UTC](https://forum.inductiveautomation.com/t/ign-14345-downloading-opc-ua-server-certificate-in-v8-3/110761/11 "2025-09-24T21:23:06Z")

</div>

Thanks very much. We weren’t deleting the resources.json file, only the keystore certificate. Deleting both works now :).

---

<div class="post-metadata">

**Author:** ![avaughn](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/avaughn/32/38972_2.png) [@avaughn](https://forum.inductiveautomation.com/u/avaughn)\
**Post date:** [September 24, 2025, 10:38pm UTC](https://forum.inductiveautomation.com/t/ign-14345-downloading-opc-ua-server-certificate-in-v8-3/110761/12 "2025-09-24T22:38:58Z")

</div>

A little more effort if you haven’t already set up an API Key but there are also endpoints for certificate management that you could use, including one for regenerating certificates. The plus side is this wouldn’t require a gateway restart to take affect and might be useful even after the bug in the UI is fixed.

OpenApi Route: `hostname:8088/openapi#tag/certificate-management`

[OpenAPI docs page](https://docs.inductiveautomation.com/docs/8.3/platform/gateway/openapi)

---

<div class="post-metadata">

**Author:** ![ggross](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ggross/32/12668_2.png) [@ggross](https://forum.inductiveautomation.com/u/ggross)\
**Post date:** [October 6, 2025, 4:21pm UTC](https://forum.inductiveautomation.com/t/ign-14345-downloading-opc-ua-server-certificate-in-v8-3/110761/13 "2025-10-06T16:21:58Z")

</div>

As the fix for this won't be part of 8.3.1, running the following from the **browser console** when **logged into the Gateway** will perform the noted action. The change will take effect immediately without having to restart the Gateway.

**Regenerate the Ignition OPC UA Server Certificate** :

```python
var csrf;

await fetch('/data/app/session', {
    method: 'get',
    headers: {'Accept': 'application/json', 'Content-Type': 'application/json'},
}).then(response => response.json()).then(data => {csrf = data['csrfToken'];});

await fetch('/data/opc-ua/api/v1/server/certificate/regenerate', {
    method: 'post',
    body: JSON.stringify({validPeriodDays: 1095}),
    headers: {'Content-Type': 'application/json', 'X-CSRF-Token': csrf}
}).then(response => response.json()).then(console.log);

```

**Regenerate the OPC UA Client Certificate** :

```python
var csrf;

await fetch('/data/app/session', {
    method: 'get',
    headers: {'Accept': 'application/json', 'Content-Type': 'application/json'},
}).then(response => response.json()).then(data => {csrf = data['csrfToken'];});

await fetch('/data/opc-ua/api/v1/client/certificate/regenerate', {
    method: 'post',
    body: JSON.stringify({validPeriodDays: 1095}),
    headers: {'Content-Type': 'application/json', 'X-CSRF-Token': csrf}
}).then(response => response.json()).then(console.log);

```

---

<div class="post-metadata">

**Author:** ![rdgerken](https://avatars.discourse-cdn.com/v4/letter/r/53a042/32.png) [@rdgerken](https://forum.inductiveautomation.com/u/rdgerken)\
**Post date:** [November 4, 2025, 12:50pm UTC](https://forum.inductiveautomation.com/t/ign-14345-downloading-opc-ua-server-certificate-in-v8-3/110761/14 "2025-11-04T12:50:36Z")

</div>

Hi Garth - Do you know how I can specify a custom DNS in the SAN when needing to regenerate the Server certificate while the UI is broken? I’m guessing it’s another field in the body, but I’m not sure the syntax.

Thanks!

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [November 4, 2025, 1:06pm UTC](https://forum.inductiveautomation.com/t/ign-14345-downloading-opc-ua-server-certificate-in-v8-3/110761/15 "2025-11-04T13:06:52Z")

</div>

The JSON object should accept `dnsNames` and `ipAddresses` fields.

In this version of Ignition where the UI is broken, these should contain a scalar String value that is a comma-separated list. In the fixed version it's expecting an array of Strings.