# No suitable endpoint found + BadIdentityTokenRejected **URL:** \ **Category:** General Discussion\ **Created:** [May 30, 2025, 12:29pm UTC](https://forum.inductiveautomation.com/t/no-suitable-endpoint-found-badidentitytokenrejected/106856 "2025-05-30T12:29:27Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![charlie.ye](https://avatars.discourse-cdn.com/v4/letter/c/85e7bf/32.png) [@charlie.ye](https://forum.inductiveautomation.com/u/charlie.ye)\ **Post date:** [May 30, 2025, 12:29pm UTC](https://forum.inductiveautomation.com/t/no-suitable-endpoint-found-badidentitytokenrejected/106856/1 "2025-05-30T12:29:27Z")
I cannot figure out why I get the error message (No suitable endpoint found + BadIdentityTokenRejected). Please help me out. Do I have a configuration error? Does my certificate have a problem? ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/a/b/abc742499f9782b62e096499d1299d069a61ed51.png) ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/5/6/566d617571c4dc511ac2596e6509c3427aa1aee5.png) ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/4/f/4f77f1c09acd41bc93c9352a5cce1b09ecb7bb80.png) ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/d/2d7cfc8dc6e45783a3bdc14a75c9b2cde1a07d7a.jpeg) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 30, 2025, 12:53pm UTC](https://forum.inductiveautomation.com/t/no-suitable-endpoint-found-badidentitytokenrejected/106856/2 "2025-05-30T12:53:02Z")
It looks like you've made some progress since the other day and now you have client certificate and your actually attempting to connect. Provide a Wireshark capture of the connection attempt and I'll take a look at it. You're not trying to connect without security any more - intentional? In the last post you had the Ignition server configured with just "None" for Security Policies. ---
**Author:** ![charlie.ye](https://avatars.discourse-cdn.com/v4/letter/c/85e7bf/32.png) [@charlie.ye](https://forum.inductiveautomation.com/u/charlie.ye)\ **Post date:** [May 30, 2025, 12:56pm UTC](https://forum.inductiveautomation.com/t/no-suitable-endpoint-found-badidentitytokenrejected/106856/3 "2025-05-30T12:56:02Z")
Yes, I make some progress! I am working with both client and Ignition apps on one local windows platform. I am still able to use wireshark? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 30, 2025, 12:56pm UTC](https://forum.inductiveautomation.com/t/no-suitable-endpoint-found-badidentitytokenrejected/106856/4 "2025-05-30T12:56:58Z")
Yes, Wireshark can capture traffic on loopback/localhost. ---
**Author:** ![charlie.ye](https://avatars.discourse-cdn.com/v4/letter/c/85e7bf/32.png) [@charlie.ye](https://forum.inductiveautomation.com/u/charlie.ye)\ **Post date:** [May 30, 2025, 2:16pm UTC](https://forum.inductiveautomation.com/t/no-suitable-endpoint-found-badidentitytokenrejected/106856/5 "2025-05-30T14:16:29Z")
Here is the file. [localhost\_data.pcapng](https://forum.inductiveautomation.com/uploads/short-url/ih2U2PqAortoop3a8o90XRwLIRb.pcapng) (72.7 KB) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 30, 2025, 2:20pm UTC](https://forum.inductiveautomation.com/t/no-suitable-endpoint-found-badidentitytokenrejected/106856/6 "2025-05-30T14:20:20Z")
Ah, looks like your client isn't getting as far as I thought. It's able to connect and call FindServers and GetEndpoints: ![Screenshot 2025-05-30 at 07.17.59 (2)](https://us1.discourse-cdn.com/inductiveautomation/original/3X/f/1/f11fe05b25ae1f7e4d25b47791d586b6804b0181.jpeg) It never tries to connect again after that. The endpoint has this UserTokenPolicy available: ```python [0]: UserTokenPolicy PolicyId: username UserTokenType: UserName (0x00000001) IssuedTokenType: [OpcUa Null String] IssuerEndpointUrl: [OpcUa Null String] SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256 ``` All I can infer from your logs is that this isn't a matching token policy for your client's configuration. I don't know enough about the SDK you're using to suggest anything else. ---
**Author:** ![charlie.ye](https://avatars.discourse-cdn.com/v4/letter/c/85e7bf/32.png) [@charlie.ye](https://forum.inductiveautomation.com/u/charlie.ye)\ **Post date:** [May 30, 2025, 2:29pm UTC](https://forum.inductiveautomation.com/t/no-suitable-endpoint-found-badidentitytokenrejected/106856/7 "2025-05-30T14:29:42Z")
```python I am using the SDK (https://github.com/open62541/open62541). Could you show me a correct UserTokenPolicy or SecurityPolicyUri: http://opcfoundation.org/UA/SecurityPolicy#Basic256? I am using the sample code at the site https://github.com/open62541/open62541/blob/6f2aeaf040b311d04a5561eb3d4e6400b118adbc/examples/client_connect.c ``` ```python -username cye -password Smash123@1 -securityMode 3 -cert D:\dev\MutexStudy\OpcUaTriggerCertificate.cer -key D:\dev\MutexStudy\OpcUaTriggerPrivateKey.pem -trustList D:\dev\MutexStudy\ignition-server.der -securityPolicy http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256 opc.tcp://localhost:62541/discovery ``` [localhost\_data\_02.pcapng](https://forum.inductiveautomation.com/uploads/short-url/yKkthXbJWWiawoVCzXXpEoFu6R5.pcapng) (96.3 KB) ---
**Author:** ![charlie.ye](https://avatars.discourse-cdn.com/v4/letter/c/85e7bf/32.png) [@charlie.ye](https://forum.inductiveautomation.com/u/charlie.ye)\ **Post date:** [May 30, 2025, 4:58pm UTC](https://forum.inductiveautomation.com/t/no-suitable-endpoint-found-badidentitytokenrejected/106856/8 "2025-05-30T16:58:34Z")
How can I disable the following security policy? ```python (http://opcfoundation.org/UA/SecurityPolicy#Basic256) ``` I finally find the reason. The particular security policy is removed from client SDK. See the below code snippet: ```python /* Basic128Rsa15 should no longer be used */ /* retval = UA_SecurityPolicy_Basic128Rsa15(&config->securityPolicies[config->securityPoliciesSize], */ /* localCertificate, decryptedPrivateKey, config->logging); */ /* if(retval == UA_STATUSCODE_GOOD) { */ /* ++config->securityPoliciesSize; */ /* } else { */ /* UA_LOG_WARNING(config->logging, UA_LOGCATEGORY_USERLAND, */ /* "Could not add SecurityPolicy#Basic128Rsa15 with error code %s", */ /* UA_StatusCode_name(retval)); */ /* } */ /* Basic256 should no longer be used */ /* retval = UA_SecurityPolicy_Basic256(&config->securityPolicies[config->securityPoliciesSize], */ /* localCertificate, decryptedPrivateKey, config->logging); */ /* if(retval == UA_STATUSCODE_GOOD) { */ /* ++config->securityPoliciesSize; */ /* } else { */ /* UA_LOG_WARNING(config->logging, UA_LOGCATEGORY_USERLAND, */ /* "Could not add SecurityPolicy#Basic256 with error code %s", */ /* UA_StatusCode_name(retval)); */ /* } */ ``` However, Ignition OPC UA server still returns the unsupported Basic256, which leads to BadIdentityTokenRejected. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 30, 2025, 5:05pm UTC](https://forum.inductiveautomation.com/t/no-suitable-endpoint-found-badidentitytokenrejected/106856/9 "2025-05-30T17:05:47Z")
This isn't something that you can change the configuration of in Ignition, but it has been changed to Basic256Sha256 in Ignition 8.3. ---
**Author:** ![charlie.ye](https://avatars.discourse-cdn.com/v4/letter/c/85e7bf/32.png) [@charlie.ye](https://forum.inductiveautomation.com/u/charlie.ye)\ **Post date:** [May 30, 2025, 5:23pm UTC](https://forum.inductiveautomation.com/t/no-suitable-endpoint-found-badidentitytokenrejected/106856/10 "2025-05-30T17:23:30Z")
> [@charlie.ye](#): > > `http://opcfoundation.org/UA/SecurityPolicy#Basic256` How can I get Ignition 8.3? I can only download [ignition-8.1.48-windows-64-installer.exe] ---
**Author:** ![charlie.ye](https://avatars.discourse-cdn.com/v4/letter/c/85e7bf/32.png) [@charlie.ye](https://forum.inductiveautomation.com/u/charlie.ye)\ **Post date:** [May 30, 2025, 5:32pm UTC](https://forum.inductiveautomation.com/t/no-suitable-endpoint-found-badidentitytokenrejected/106856/11 "2025-05-30T17:32:34Z")
See the below image. I set it to Basic256Sha256 by default. Why I still get the security policy Basic256 from Ignition server? ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/f/bf275b3d6ba8a952ff06c5221a935f1750e19471.png) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 30, 2025, 5:36pm UTC](https://forum.inductiveautomation.com/t/no-suitable-endpoint-found-badidentitytokenrejected/106856/12 "2025-05-30T17:36:11Z")
You are configuring Basic256Sha256 as the SecurityPolicy for the _SecureChannel_ The SecurityPolicy specified by the UserTokenPolicy can be different than the one used by the channel, and in this case it's configured as Basic256. > [@charlie.ye](#): > > How can I get Ignition 8.3? Ignition 8.3 is an upcoming release later this year, it's not available yet. ---
**Author:** ![charlie.ye](https://avatars.discourse-cdn.com/v4/letter/c/85e7bf/32.png) [@charlie.ye](https://forum.inductiveautomation.com/u/charlie.ye)\ **Post date:** [May 30, 2025, 5:44pm UTC](https://forum.inductiveautomation.com/t/no-suitable-endpoint-found-badidentitytokenrejected/106856/13 "2025-05-30T17:44:56Z")
I have to use the old open62541 SDK version 1.4.5 now instead of the latest version! ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 30, 2025, 5:47pm UTC](https://forum.inductiveautomation.com/t/no-suitable-endpoint-found-badidentitytokenrejected/106856/14 "2025-05-30T17:47:51Z")
You should ask the open62541 mailing list or whatever support they have if there's a way to enable it in the current version. It's very common for Clients to continue supporting the deprecated security policies. There's many old servers out there that will never be updated. It's one thing not to support them in a new Server product, but a different all together for a Client product.