# KEPServer Certificate Expired **URL:** \ **Category:** Ignition\ **Created:** [June 8, 2023, 5:58pm UTC](https://forum.inductiveautomation.com/t/kepserver-certificate-expired/74782 "2023-06-08T17:58:22Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Tyler\_Boyd](https://avatars.discourse-cdn.com/v4/letter/t/35a633/32.png) [@Tyler\_Boyd](https://forum.inductiveautomation.com/u/Tyler_Boyd)\ **Post date:** [June 8, 2023, 5:58pm UTC](https://forum.inductiveautomation.com/t/kepserver-certificate-expired/74782/1 "2023-06-08T17:58:22Z")
I have a KEPServer connected to Ignition that has a fault that says the certificate has expired or is not yet valid. This connection has been running for as long as I have been here with no issues and based on the experation date on the certificate in Ignition it shouldn't expire for another year. Any help would be great! Error Code UaException: status=Bad\_CertificateTimeInvalid, message=The Certificate has expired or is not yet valid. at org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientAcknowledgeHandler.onError(UascClientAcknowledgeHandler.java:258) at org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientAcknowledgeHandler.decode(UascClientAcknowledgeHandler.java:167) at io.netty.handler.codec.ByteToMessageCodec$1.decode(ByteToMessageCodec.java:42) at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:510) at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:449) at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:279) at io.netty.handler.codec.ByteToMessageCodec.channelRead(ByteToMessageCodec.java:103) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365) at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357) at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365) at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:722) at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:658) at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:584) at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:496) at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:995) at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) at java.base/java.lang.Thread.run(Unknown Source) 8.1.23 (b2022121308) Azul Systems, Inc. 11.0.16.1 ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [June 8, 2023, 6:04pm UTC](https://forum.inductiveautomation.com/t/kepserver-certificate-expired/74782/2 "2023-06-08T18:04:57Z")
Is Kepware's clock off by a year? Is Kepware's own certificate expired? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 8, 2023, 8:32pm UTC](https://forum.inductiveautomation.com/t/kepserver-certificate-expired/74782/3 "2023-06-08T20:32:20Z")
> [@Tyler\_Boyd](#): > > based on the experation date on the certificate in Ignition it shouldn't expire for another year. In addition to Phil's questions - are you sure you're looking at the right certificate? There is both an OPC UA client certificate and a server certificate. ---
**Author:** ![Tyler\_Boyd](https://avatars.discourse-cdn.com/v4/letter/t/35a633/32.png) [@Tyler\_Boyd](https://forum.inductiveautomation.com/u/Tyler_Boyd)\ **Post date:** [June 9, 2023, 12:29pm UTC](https://forum.inductiveautomation.com/t/kepserver-certificate-expired/74782/4 "2023-06-09T12:29:00Z")
All the time stamps in KEPServer logs show the correct date and time. Kepware is running on the same server as my gateway. To be honest I don't know if the certificate is expired in Kepware all I know is that I can monitor live values in the Kepware software. Unfortunately, the person who set it up is no longer with the company, so I have no admin access to Kepware to view licenses and configuration. I have a ticket in with Kepware for support. The only certificate I see in Ignition for KEPServer is for a client connection that has an expiration date of Mar 3, 2024. ---
**Author:** ![jasoncgould](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jasoncgould/32/29117_2.png) [@jasoncgould](https://forum.inductiveautomation.com/u/jasoncgould)\ **Post date:** [December 19, 2024, 6:28pm UTC](https://forum.inductiveautomation.com/t/kepserver-certificate-expired/74782/5 "2024-12-19T18:28:40Z")
Thanks to Kevin for pointing out the dual certificates. On my dev environment, under Config --\> OPC UA --\> Security --\> Server tab, my "Ignition OPC UA Client" cert was expired. I regenerated it and then trusted the new cert on the Kepware "OPC UA Configuration Manager" --\> "Trusted Clients" tab.