# Ignition OPC UA Server and Connection To OSI-PI OPC-UA Connector **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [December 13, 2021, 5:02pm UTC](https://forum.inductiveautomation.com/t/ignition-opc-ua-server-and-connection-to-osi-pi-opc-ua-connector/54060 "2021-12-13T17:02:53Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![dwaterfield](https://avatars.discourse-cdn.com/v4/letter/d/e36b37/32.png) [@dwaterfield](https://forum.inductiveautomation.com/u/dwaterfield)\ **Post date:** [December 13, 2021, 5:02pm UTC](https://forum.inductiveautomation.com/t/ignition-opc-ua-server-and-connection-to-osi-pi-opc-ua-connector/54060/1 "2021-12-13T17:02:53Z")
Dear Ignition Support I am fairly new to setting up OPC-UA connections and making the ignition OPC-UA Server visible to external OPC-UA clients but I am trying to setup a OPC-UA Connection from OSI-PI using their OPC-UA Connector to Ignition’s OPC-UA Server and doing some preliminary testing currently with this, but it seems something weird is being observed with certificates Upon setting up the OSI-PI OPC-UA Connector to the correct endpoint `opc.tcp://` `{IP Address or Hostname of Server}:62541, the Ignition server certificate is correctly passed to the OSI-PI UA Connector and therefore can then be manually trusted. The OPC-UA connection is setup and data is flowing between the Ignition OPC UA Server and OSI-PI via OPC-UA now but the OSI-PI certificate is not showing up in the quarantined certificates or trusted certificates in the OPC-UA Security setting of the Ignition Gateway. I have not manually downloaded the OSI-PI certificate or manually trusted it either. The security policy setup on the ignition server is set to either None, Basic256Sha256 Is this normal behaviour as I thought with OPC-UA connections both certificates are needed to be trusted at both ends before any data flow could occur regardless of security policy setup on the ignition gateway, is this correct? Kind Regards David Waterfield ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [December 13, 2021, 5:05pm UTC](https://forum.inductiveautomation.com/t/ignition-opc-ua-server-and-connection-to-osi-pi-opc-ua-connector/54060/2 "2021-12-13T17:05:06Z")
> [@dwaterfield](#): > > Is this normal behaviour as I thought with OPC-UA connections both certificates are needed to be trusted at both ends before any data flow could occur regardless of security policy setup on the ignition gateway, is this correct? My guess would be that OSI PI has connected without security. The only time you might need to trust the certificate even if the "None" SecurityPolicy is being used is when the client is connecting with a username and password. (edit: actually not sure if that's true, might only apply to the other direction) ---
**Author:** ![dwaterfield](https://avatars.discourse-cdn.com/v4/letter/d/e36b37/32.png) [@dwaterfield](https://forum.inductiveautomation.com/u/dwaterfield)\ **Post date:** [January 12, 2022, 10:47am UTC](https://forum.inductiveautomation.com/t/ignition-opc-ua-server-and-connection-to-osi-pi-opc-ua-connector/54060/3 "2022-01-12T10:47:43Z")
Hi Kevin, thanks issue has been resolved now ---
**Author:** ![c.turmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/c.turmel/32/67745_2.png) [@c.turmel](https://forum.inductiveautomation.com/u/c.turmel)\ **Post date:** [May 23, 2024, 8:15pm UTC](https://forum.inductiveautomation.com/t/ignition-opc-ua-server-and-connection-to-osi-pi-opc-ua-connector/54060/4 "2024-05-23T20:15:09Z")
Hi, any tips? I came accross the same issue. Thanks Using None works, put the point is to use security. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 23, 2024, 8:23pm UTC](https://forum.inductiveautomation.com/t/ignition-opc-ua-server-and-connection-to-osi-pi-opc-ua-connector/54060/5 "2024-05-23T20:23:05Z")
Looks like an issue others have had: [PI OPC UA Connector To Ignition OPC UA Server - #2 by Kevin.Herron](https://forum.inductiveautomation.com/t/pi-opc-ua-connector-to-ignition-opc-ua-server/55695/2) I think the punchline is that if you can't get connected with security by pointing OSI PI at the discovery endpoint URL then you need to get OSI PI involved, and potentially get them to fix their client. Ignition has an admittedly unusual endpoint setup re: security. This will be changing in 8.3 due to the trouble it seems to cause for some 3rd party clients. > [@Getting error trying to connect to Ignition OPC UA Server with security Basic256Sha256](https://forum.inductiveautomation.com/t/getting-error-trying-to-connect-to-ignition-opc-ua-server-with-security-basic256sha256/85242/7): > > There is a discovery endpoint at `opc.tcp://host:62541/discovery`. It accepts unsecured connections and implements the discovery services. The endpoints it returns contain URLs that point to the session endpoint at `opc.tcp://host:62541` (no /discovery). > > If your client / client library can't correctly use the endpoint URLs returned in the GetEndpoints response then it won't be able to connect. > > I've found that on order to connect broken clients like this to Ignition you have to enable the "None" security policy in the server and then point the client directly at the session endpoint instead.