# Ignition OPCUA Niagara 4 certificate **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [May 2, 2024, 11:42am UTC](https://forum.inductiveautomation.com/t/ignition-opcua-niagara-4-certificate/89820 "2024-05-02T11:42:56Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Romain\_Boyer](https://avatars.discourse-cdn.com/v4/letter/r/c2a13f/32.png) [@Romain\_Boyer](https://forum.inductiveautomation.com/u/Romain_Boyer)\ **Post date:** [May 2, 2024, 11:42am UTC](https://forum.inductiveautomation.com/t/ignition-opcua-niagara-4-certificate/89820/1 "2024-05-02T11:42:56Z")
Hi, I have Ignition 8.1.38, I try to connect Niagara 4 to Ignition but I have problem with certificate. During connection I see under certificate Niagara 4 certificate under Quarantined Certificates, I trust this certificate but under Niagara I have this error and connection doesn't working : > SEVERE [07:40:12 02-May-24 EDT][opcUaClient.certificateValidator] Certificate C=US,ST=CA,L=Folsom,OU=,O=Inductive Automation,CN=Ignition OPC UA Server failed trust validation: Unable to construct a valid chain > INFO [07:40:12 02-May-24 EDT][opcUaClient.certificateValidator] Exemption approved for host: 10.5.1.50:62541 > SEVERE [07:40:13 02-May-24 EDT][opcUaClient.client] Exception occurred during ping for device OpcUaDevice with appURI urn:localhost:OPCUA:NiagaraOpcUaClient: com.prosysopc.ua.client.ConnectException: Failed to create secure channel to server: : opc.tcp://10.5.1.50:62541 [[Profile Reporting Links](http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256,SignAndEncrypt)] ServiceResult=Bad\_SecurityChecksFailed (0x80130000) "An error occurred verifying security." Any idea ? Thanks ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 2, 2024, 12:12pm UTC](https://forum.inductiveautomation.com/t/ignition-opcua-niagara-4-certificate/89820/2 "2024-05-02T12:12:33Z")
You’ll have to share the ignition logs and your certificate as well. ---
**Author:** ![Romain\_Boyer](https://avatars.discourse-cdn.com/v4/letter/r/c2a13f/32.png) [@Romain\_Boyer](https://forum.inductiveautomation.com/u/Romain_Boyer)\ **Post date:** [May 2, 2024, 12:38pm UTC](https://forum.inductiveautomation.com/t/ignition-opcua-niagara-4-certificate/89820/3 "2024-05-02T12:38:27Z")
This is log ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/7/c/7c4264e685e9b56d7a4a70edb94c631ad47941ed.jpeg) and my certificate ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/e/bec158ce78549282a0acdaed0868e73ad2484b9a.png) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 2, 2024, 12:56pm UTC](https://forum.inductiveautomation.com/t/ignition-opcua-niagara-4-certificate/89820/4 "2024-05-02T12:56:06Z")
Can you upload that certificate file somewhere? DM or email it to me? ---
**Author:** ![Romain\_Boyer](https://avatars.discourse-cdn.com/v4/letter/r/c2a13f/32.png) [@Romain\_Boyer](https://forum.inductiveautomation.com/u/Romain_Boyer)\ **Post date:** [May 2, 2024, 1:03pm UTC](https://forum.inductiveautomation.com/t/ignition-opcua-niagara-4-certificate/89820/5 "2024-05-02T13:03:17Z")
I don't see DM section, can you give me your email ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 2, 2024, 1:09pm UTC](https://forum.inductiveautomation.com/t/ignition-opcua-niagara-4-certificate/89820/6 "2024-05-02T13:09:28Z")
It's my first name @inductiveautomation.com . ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 2, 2024, 1:29pm UTC](https://forum.inductiveautomation.com/t/ignition-opcua-niagara-4-certificate/89820/7 "2024-05-02T13:29:03Z")
This certificate is missing a `basicConstraints` extension, which is a mandatory (at this time, anyway...) field for certificate used as an OPC UA application instance certificate. You'll have to work with the vendor to generate a new one that has the required extension. [https://reference.opcfoundation.org/Core/Part6/v105/docs/6.2.2](https://reference.opcfoundation.org/Core/Part6/v105/docs/6.2.2) ---
**Author:** ![Romain\_Boyer](https://avatars.discourse-cdn.com/v4/letter/r/c2a13f/32.png) [@Romain\_Boyer](https://forum.inductiveautomation.com/u/Romain_Boyer)\ **Post date:** [May 2, 2024, 1:38pm UTC](https://forum.inductiveautomation.com/t/ignition-opcua-niagara-4-certificate/89820/8 "2024-05-02T13:38:48Z")
Ok so I need to add CA flag to basicConstraints ? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 2, 2024, 2:08pm UTC](https://forum.inductiveautomation.com/t/ignition-opcua-niagara-4-certificate/89820/9 "2024-05-02T14:08:36Z")
Yes ---
**Author:** ![Romain\_Boyer](https://avatars.discourse-cdn.com/v4/letter/r/c2a13f/32.png) [@Romain\_Boyer](https://forum.inductiveautomation.com/u/Romain_Boyer)\ **Post date:** [May 3, 2024, 5:26pm UTC](https://forum.inductiveautomation.com/t/ignition-opcua-niagara-4-certificate/89820/10 "2024-05-03T17:26:45Z")
Solution : Per [Section 6.2.2 of the OPC UA Reference](https://reference.opcfoundation.org/Core/Part6/6.2.2/), "Self-signed Certificates shall also include keyCertSign". Several OpcUa server implementations have interpreted this to mean, that they should reject any certificate that does not comply. To ensure compatibility, we devised a way to make our OpcUaClient implementation use a cert with the keyCertSign usage. Since our framework is currently designed to require a password on any cert that has the keyCertSign usage, the solution requires extra steps. 1. Use Niagara version 4.10u2, or 4.11u1, or newer. 2. Create the cert/key pair using one of the attached scripts. _gen-opc-cert.bat_ is a Windows batch script, and _[gen-opc-cert.sh](http://gen-opc-cert.sh/)_ is a bash script that can be run on Linux or in WSL. You can use either one, but both require that you have OpenSSL installed. 3. Import the PEM file (created in the previous step) into the User Key Store of the Certificate Management Service for the host, using a password for encryption. 4. In the _Certificate_ slot on the _ **Opc Ua Device** _, enter the name of the alias used for importing the cert/key above. 5. Using the HTML5 Property Sheet (or the AX Slot Sheet), add a new dynamic slot on the _ **Opc Ua Device** _ with the slot name _ **serverKeyPassword** _ where the Type is baja:Password. 6. Set the value of the _ **serverKeyPassword** _ property to be the encryption password that you specified when importing the certificate. Note: _ **global certificate password** _ is a functionality introduced in Niagara 4.13. In Niagara 4.13+, this feature can be utilized instead of the serverKeyPassword property. Script (.bat) ```python @echo off where openssl >nul 2>nul if %errorlevel% neq 0 ( echo OpenSSL not available. Please install and try again. >&2 exit /b 1 ) set /p hostname="Enter the client hostname [%COMPUTERNAME%]: " if [%hostname%] == [] ( set hostname=%COMPUTERNAME% ) set /p validity="Enter certificate validity in days [365]: " if [%validity%] == [] ( set validity="365" ) set /p pemfile="Enter destination file [.\client.pem]: " if [%pemfile%] == [] ( set "pemfile=.\client.pem" ) set "conffile=%tmp%\opc-cert-generator-%random%-openssl.cnf" ( echo ^ [req]^ distinguished_name = distinguished_name^ x509_extensions = exts echo: echo ^ [distinguished_name]^ countryName = Country Name ^(2 letter code^)^ countryName_default = US^ countryName_min = 2^ countryName_max = 2^ stateOrProvinceName = State or Province Name ^(full name^)^ localityName = Locality Name ^(eg, city^)^ 0.organizationName = Organization Name ^(eg, company^)^ organizationalUnitName = Organizational Unit Name ^(eg, section^)^ commonName = Common Name ^(e.g. server FQDN or YOUR name^)^ commonName_default = %hostname%^ commonName_max = 64^ emailAddress = Email Address^ emailAddress_max = 64 echo: echo ^ [exts]^ basicConstraints = critical, CA:TRUE^ subjectKeyIdentifier = hash^ authorityKeyIdentifier = keyid:always, issuer:always^ keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyCertSign^ extendedKeyUsage = clientAuth^ subjectAltName = URI.1:urn:localhost:OPCUA:NiagaraOpcUaClient ) > "%conffile%" set "certfile=%tmp%\opc-cert-generator-%random%-cert.pem" openssl req -x509 -newkey rsa:2048 -config "%conffile%" -keyout "%pemfile%" -out "%certfile%" -sha256 -days %validity% if %errorlevel% neq 0 ( echo error generating cert >&2 del "%certfile%" 2>nul del "%pemfile%" 2>nul del "%conffile%" 2>nul exit /b 1 ) type "%certfile%" >> "%pemfile%" echo Cert written to %pemfile% del "%certfile%" 2>nul del "%conffile%" 2>nul ```