# MX OPC Application URI **URL:** \ **Category:** Ignition\ **Created:** [August 23, 2019, 9:42pm UTC](https://forum.inductiveautomation.com/t/mx-opc-application-uri/27735 "2019-08-23T21:42:11Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![andrew.smagala](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@andrew.smagala](https://forum.inductiveautomation.com/u/andrew.smagala)\ **Post date:** [August 23, 2019, 9:42pm UTC](https://forum.inductiveautomation.com/t/mx-opc-application-uri/27735/1 "2019-08-23T21:42:11Z")
In our facility we use Mitsubishi Q Series PLC’s to control our process. We are attempting to use MX OPC, software by Mitsubishi, to enable OPC-UA based communications. However, when I try and connect the Ignition client to they system I get a connection fault. The error that is displayed is: status=Bad\_CertificateUriInvalid, description=The URI specified in the ApplicationDescription does not match the URI in the Certificate. When i check the product settings for MX OPC it shows the ApplicationURI field as blank. Should there be an application URI or is this something that I need to fix with the security certificates? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 23, 2019, 9:46pm UTC](https://forum.inductiveautomation.com/t/mx-opc-application-uri/27735/2 "2019-08-23T21:46:00Z")
It needs to match whatever the application URI in the certificate is. If you can get the certificate and upload it here I can take a look at it. ---
**Author:** ![andrew.smagala](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@andrew.smagala](https://forum.inductiveautomation.com/u/andrew.smagala)\ **Post date:** [August 23, 2019, 10:08pm UTC](https://forum.inductiveautomation.com/t/mx-opc-application-uri/27735/3 "2019-08-23T22:08:00Z")
Since I just made this account it will not let me upload files to the forum. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 23, 2019, 10:19pm UTC](https://forum.inductiveautomation.com/t/mx-opc-application-uri/27735/4 "2019-08-23T22:19:19Z")
Upload here: [https://www.dropbox.com/request/GhoqmbGaOHTb0eQtZn39](https://www.dropbox.com/request/GhoqmbGaOHTb0eQtZn39) ---
**Author:** ![andrew.smagala](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@andrew.smagala](https://forum.inductiveautomation.com/u/andrew.smagala)\ **Post date:** [August 23, 2019, 10:20pm UTC](https://forum.inductiveautomation.com/t/mx-opc-application-uri/27735/5 "2019-08-23T22:20:47Z")
Uploaded. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 23, 2019, 10:23pm UTC](https://forum.inductiveautomation.com/t/mx-opc-application-uri/27735/6 "2019-08-23T22:23:31Z")
Ok, so the URI in the certificate is “urn:USNV021S0217:Mitsubishi:MX OPC Server UA” So, in theory, you’d want your application URI to match that. The reality, though, is that it’s an invalid URI, and Ignition (8.0, anyway) won’t be able to connect until you can get the server to generate a certificate that contains a valid URI. URIs are not allowed to contain spaces unless they’re encoded as %20. ---
**Author:** ![andrew.smagala](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@andrew.smagala](https://forum.inductiveautomation.com/u/andrew.smagala)\ **Post date:** [August 23, 2019, 10:25pm UTC](https://forum.inductiveautomation.com/t/mx-opc-application-uri/27735/7 "2019-08-23T22:25:25Z")
Ok thank you for the help. Sounds like an issue I need to address with Mitsubishi. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 23, 2019, 10:26pm UTC](https://forum.inductiveautomation.com/t/mx-opc-application-uri/27735/8 "2019-08-23T22:26:25Z")
That’s probably best. I’m not familiar with their software so I don’t know if you can regenerate the certificate with the config tool or if you can influence the URI that gets put into the certificate. It might turn out that if you can regenerate the cert after setting a correct URI in the spot you mentioned previously that will be enough. ---
**Author:** ![andrew.smagala](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@andrew.smagala](https://forum.inductiveautomation.com/u/andrew.smagala)\ **Post date:** [August 23, 2019, 10:26pm UTC](https://forum.inductiveautomation.com/t/mx-opc-application-uri/27735/9 "2019-08-23T22:26:49Z")
How can i check the certificate URI after I regenerate it? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 23, 2019, 10:28pm UTC](https://forum.inductiveautomation.com/t/mx-opc-application-uri/27735/10 "2019-08-23T22:28:05Z")
It’s a component of the Subject Alternative Name extension on the certificate. Your OS may be able to view certificates in enough detail to find it. If not, I use a tool called KeyStore Explorer, which while not primarily meant for viewing certificates, does allow you to do so. ---
**Author:** ![andrew.smagala](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@andrew.smagala](https://forum.inductiveautomation.com/u/andrew.smagala)\ **Post date:** [August 23, 2019, 10:51pm UTC](https://forum.inductiveautomation.com/t/mx-opc-application-uri/27735/11 "2019-08-23T22:51:22Z")
Ya cant change how it makes that URI doesn’t seem like that location does anything. Just when i thought i found a way to enable OPC-UA with my mitsubishi PLC’s… ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 23, 2019, 10:53pm UTC](https://forum.inductiveautomation.com/t/mx-opc-application-uri/27735/12 "2019-08-23T22:53:10Z")
Kepware has a Mitsubishi driver. ---
**Author:** ![andrew.smagala](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@andrew.smagala](https://forum.inductiveautomation.com/u/andrew.smagala)\ **Post date:** [August 23, 2019, 11:17pm UTC](https://forum.inductiveautomation.com/t/mx-opc-application-uri/27735/13 "2019-08-23T23:17:08Z")
Ya unfortunately Kepware needs the mitsubishi cpu to be configured to output data in the binary format but ours are configured to use ascii. would cause major MES disruptions to change that. ---
**Author:** ![andrew.smagala](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@andrew.smagala](https://forum.inductiveautomation.com/u/andrew.smagala)\ **Post date:** [August 23, 2019, 11:20pm UTC](https://forum.inductiveautomation.com/t/mx-opc-application-uri/27735/14 "2019-08-23T23:20:53Z")
Was trying to find a method that didn’t require significant network changes or downtime to production but its starting to seem like we might just have to bite that bullet. ---
**Author:** ![andrew.smagala](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@andrew.smagala](https://forum.inductiveautomation.com/u/andrew.smagala)\ **Post date:** [August 28, 2019, 1:02pm UTC](https://forum.inductiveautomation.com/t/mx-opc-application-uri/27735/15 "2019-08-28T13:02:28Z")
So I think i was successfully able to change the ApplicationUri and the ServerUri, found the fields buried in an XML document. When i try to connect using the new certificate i get a “status=Bad\_SecurityChecksFailed, description=An error occurred verifying security.” do i need to update the certificate on the ignition end? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 28, 2019, 3:10pm UTC](https://forum.inductiveautomation.com/t/mx-opc-application-uri/27735/16 "2019-08-28T15:10:45Z")
You probably need to trust the certificates in both applications now. In Ignition, it’s on the gateway under Configure \> OPC UA \> Security. Then go to the _Client_ tab and you should see the MX OPC server certificate there with a button to mark it as trusted. ---
**Author:** ![andrew.smagala](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@andrew.smagala](https://forum.inductiveautomation.com/u/andrew.smagala)\ **Post date:** [August 28, 2019, 4:03pm UTC](https://forum.inductiveautomation.com/t/mx-opc-application-uri/27735/17 "2019-08-28T16:03:22Z")
So i think the security certificate issue has been resolved but now I am getting this error not sure how to handle it. connection closed UaException: status=Bad\_ConnectionClosed, message=connection closed at org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientMessageHandler.channelInactive(UascClientMessageHandler.java:152) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:242) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:228) at io.netty.channel.AbstractChannelHandlerContext.fireChannelInactive(AbstractChannelHandlerContext.java:221) at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:390) at io.netty.handler.codec.ByteToMessageDecoder.channelInactive(ByteToMessageDecoder.java:355) at io.netty.handler.codec.ByteToMessageCodec.channelInactive(ByteToMessageCodec.java:118) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:242) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:228) at io.netty.channel.AbstractChannelHandlerContext.fireChannelInactive(AbstractChannelHandlerContext.java:221) at io.netty.channel.DefaultChannelPipeline$HeadContext.channelInactive(DefaultChannelPipeline.java:1403) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:242) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:228) at io.netty.channel.DefaultChannelPipeline.fireChannelInactive(DefaultChannelPipeline.java:912) at io.netty.channel.AbstractChannel$AbstractUnsafe$8.run(AbstractChannel.java:827) at io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:163) at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:404) at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:495) at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:905) at java.base/java.lang.Thread.run(Unknown Source) 8.0.0 (b2019040718) Azul Systems, Inc. 11.0.2 ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 28, 2019, 4:07pm UTC](https://forum.inductiveautomation.com/t/mx-opc-application-uri/27735/18 "2019-08-28T16:07:26Z")
This still might be a security issue. Can you look in the gateway logs for additional messages that might be related? You might also want to get upgraded to 8.0.3 ASAP. ---
**Author:** ![andrew.smagala](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@andrew.smagala](https://forum.inductiveautomation.com/u/andrew.smagala)\ **Post date:** [August 28, 2019, 4:10pm UTC](https://forum.inductiveautomation.com/t/mx-opc-application-uri/27735/19 "2019-08-28T16:10:49Z")
I will upgrade to 8.03 now. Looks like still a certificate issue. UcascClientMessageHandler io.netty.handler.codec.DeoderException: UaException: status=Bad\_SecurityChecksFailed, message=certificate path validation failed