# Omron OPC UA Server rejects Ignition Client Certificate **URL:** \ **Category:** Ignition\ **Created:** [September 25, 2024, 10:27am UTC](https://forum.inductiveautomation.com/t/omron-opc-ua-server-rejects-ignition-client-certificate/96415 "2024-09-25T10:27:26Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Eskil\_Holum](https://avatars.discourse-cdn.com/v4/letter/e/cdc98d/32.png) [@Eskil\_Holum](https://forum.inductiveautomation.com/u/Eskil_Holum)\ **Post date:** [September 25, 2024, 10:27am UTC](https://forum.inductiveautomation.com/t/omron-opc-ua-server-rejects-ignition-client-certificate/96415/1 "2024-09-25T10:27:26Z")
Hi, we are having trouble with connecting to an Omron OPC server from Igntion. We have tested the connection with UA Expert, and know that it is working, but when we try to connect with igntion OPC client we get this error message. `[remote=/10.0.0.234:4840] Received error message: ErrorMessage{error=StatusCode{name=Bad_CertificateUseNotAllowed, value=0x80180000, quality=bad}, reason=null}` In the omron sofware we can see in the logs that the authentication attempt is made, but the certificate is seen as invalid and is rejected. I have tried to manually add the certificate to the omron PLC, and also tried to regenerate the certificate. I suspect that the omron server is very picky about some of the fields in the certificate, and that maybe the ignition may not conform to that. Anyone solved this before? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [September 25, 2024, 11:47am UTC](https://forum.inductiveautomation.com/t/omron-opc-ua-server-rejects-ignition-client-certificate/96415/2 "2024-09-25T11:47:32Z")
You may need to upgrade to 8.1.43 and then re-generate the client certificate after you’ve upgraded. ---
**Author:** ![Eskil\_Holum](https://avatars.discourse-cdn.com/v4/letter/e/cdc98d/32.png) [@Eskil\_Holum](https://forum.inductiveautomation.com/u/Eskil_Holum)\ **Post date:** [September 25, 2024, 12:57pm UTC](https://forum.inductiveautomation.com/t/omron-opc-ua-server-rejects-ignition-client-certificate/96415/3 "2024-09-25T12:57:50Z")
I am allready on 8.1.43, and have refreshed the Certificate Suspecting the field "Type", which is set to "-" while all other certs that it accepts is set to "CA". Is there any way to manipulate this? ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/7/e/7e1ac0d1f7bffc2ad10a543167055c30763b2835.png) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [September 25, 2024, 12:59pm UTC](https://forum.inductiveautomation.com/t/omron-opc-ua-server-rejects-ignition-client-certificate/96415/4 "2024-09-25T12:59:22Z")
Can you upload your certificate so I can take a look at it? I assumed that the Omron server was validating the certificate according to the latest OPC UA 1.05 requirements, which state that the BasicConstraints shall indicate CA=false, and your Ignition was out of date and creating with with CA=true, but it sounds like the opposite may be true. ---
**Author:** ![Eskil\_Holum](https://avatars.discourse-cdn.com/v4/letter/e/cdc98d/32.png) [@Eskil\_Holum](https://forum.inductiveautomation.com/u/Eskil_Holum)\ **Post date:** [September 25, 2024, 1:02pm UTC](https://forum.inductiveautomation.com/t/omron-opc-ua-server-rejects-ignition-client-certificate/96415/5 "2024-09-25T13:02:22Z")
[ignition-client.der](https://forum.inductiveautomation.com/uploads/short-url/pJ4XSyDkOxVrJUZ3NnWDBh0yOVq.der) (1.1 KB) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [September 25, 2024, 1:05pm UTC](https://forum.inductiveautomation.com/t/omron-opc-ua-server-rejects-ignition-client-certificate/96415/6 "2024-09-25T13:05:40Z")
Okay, yeah, this certificate looks good according to [UA Part 6: Mappings - 6.2.2 Application Instance Certificate](https://reference.opcfoundation.org/Core/Part6/v105/docs/6.2.2) There's nothing you can do to change how Ignition generates it. You could try installing an older version of Ignition in a VM or something and then copying out its client keystore file... Otherwise you just need to turn security off and contact Omron for support, because this is something they need to fix. (or point out what's wrong) ---
**Author:** ![Eskil\_Holum](https://avatars.discourse-cdn.com/v4/letter/e/cdc98d/32.png) [@Eskil\_Holum](https://forum.inductiveautomation.com/u/Eskil_Holum)\ **Post date:** [September 25, 2024, 1:12pm UTC](https://forum.inductiveautomation.com/t/omron-opc-ua-server-rejects-ignition-client-certificate/96415/7 "2024-09-25T13:12:12Z")
OK, thank you. Will try to remember to update this when we hear back from omron. ---
**Author:** ![Eskil\_Holum](https://avatars.discourse-cdn.com/v4/letter/e/cdc98d/32.png) [@Eskil\_Holum](https://forum.inductiveautomation.com/u/Eskil_Holum)\ **Post date:** [September 25, 2024, 1:20pm UTC](https://forum.inductiveautomation.com/t/omron-opc-ua-server-rejects-ignition-client-certificate/96415/8 "2024-09-25T13:20:05Z")
Just as a curiosity, i wonder if the Omron Certificate is up to spec? [ServerCertificate.der](https://forum.inductiveautomation.com/uploads/short-url/1EFndx0PHKBrGozS2G9bP2dCnAR.der) (1.2 KB) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [September 25, 2024, 1:22pm UTC](https://forum.inductiveautomation.com/t/omron-opc-ua-server-rejects-ignition-client-certificate/96415/9 "2024-09-25T13:22:57Z")
It's not, because its `cA` flag is set to `TRUE`, but we would accept it anyway for backwards compatibility: > The _[cA](https://reference.opcfoundation.org/search/359?t=cA)_ flag shall be FALSE for any _[ApplicationInstance](https://reference.opcfoundation.org/search/359?t=ApplicationInstance)_ _[Certificate](https://reference.opcfoundation.org/search/359?t=Certificate)_, however, TRUE shall be accepted to ensure backward interoperability when validating _[ApplicationInstance](https://reference.opcfoundation.org/search/359?t=ApplicationInstance)_ _[Certificates,](https://reference.opcfoundation.org/search/359?t=Certificates,)_ Prior to Ignition 8.1.43 this is what our generated certificates looked like as well.