# Ignition edge - Siemens S7-1500 certificates

**URL:** <https://forum.inductiveautomation.com/t/ignition-edge-siemens-s7-1500-certificates/88869>\
**Category:** Ignition\
**Created:** [April 16, 2024, 9:58am UTC](https://forum.inductiveautomation.com/t/ignition-edge-siemens-s7-1500-certificates/88869 "2024-04-16T09:58:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Richard\_Giske](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/richard_giske/32/41906_2.png) [@Richard\_Giske](https://forum.inductiveautomation.com/u/Richard_Giske)\
**Post date:** [April 16, 2024, 9:58am UTC](https://forum.inductiveautomation.com/t/ignition-edge-siemens-s7-1500-certificates/88869/1 "2024-04-16T09:58:08Z")

</div>

Got a Ignition Edge, communicating with a Siemens S7-1500 as a OPC client connection.

When I added the siemens client, I marked it as "Trust Certificate", and using the security mode/policys.  
 ![bilde](https://us1.discourse-cdn.com/inductiveautomation/original/3X/8/f/8fc1288fe9217edc973d5000a187d7ae1611a7cf.png)  
I saw the certificate getting added under _"C:\Program Files\Inductive Automation\Ignition\data\opcua\client\security\pki\trusted\certs"_

_ **When all is configured, I'm getting the error :** _  
_Exception caught: UaException: status=Bad\_SecurityChecksFailed, message=java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty_

This causes the connection to "Fault".  
By unchecking the Certificate Validation Enabled, the communication starts working.

 ![bilde](https://us1.discourse-cdn.com/inductiveautomation/original/3X/f/8/f8de91b18e1454cc8c81277f8b40b43e94fd5de2.png)

I'm not all to well versed in certificate config, I can't see what to do next to get this working with the enable checked. What am I missing?

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [April 16, 2024, 11:05am UTC](https://forum.inductiveautomation.com/t/ignition-edge-siemens-s7-1500-certificates/88869/2 "2024-04-16T11:05:13Z")

</div>

I would think it means the S7's OPC Server is using an unsigned certificate.

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [April 16, 2024, 1:05pm UTC](https://forum.inductiveautomation.com/t/ignition-edge-siemens-s7-1500-certificates/88869/3 "2024-04-16T13:05:34Z")

</div>

Can you share the certificate? It might mean the certificate is not a self-signed certificate, in which case the CA/root cert is needed as well.

---

<div class="post-metadata">

**Author:** ![Richard\_Giske](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/richard_giske/32/41906_2.png) [@Richard\_Giske](https://forum.inductiveautomation.com/u/Richard_Giske)\
**Post date:** [April 16, 2024, 1:19pm UTC](https://forum.inductiveautomation.com/t/ignition-edge-siemens-s7-1500-certificates/88869/4 "2024-04-16T13:19:10Z")

</div>

The certificate is self-signed.  
I'm not able to get the certificate at the moment

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [April 16, 2024, 1:20pm UTC](https://forum.inductiveautomation.com/t/ignition-edge-siemens-s7-1500-certificates/88869/5 "2024-04-16T13:20:31Z")

</div>

Ok, leave the validation option disabled for now, and when you're able to get the certificate to continue troubleshooting let us know.