# OPC certificates expiration date management

**URL:** <https://forum.inductiveautomation.com/t/opc-certificates-expiration-date-management/114168>\
**Category:** Ignition\
**Tags:** opcua\
**Created:** [February 25, 2026, 12:09pm UTC](https://forum.inductiveautomation.com/t/opc-certificates-expiration-date-management/114168 "2026-02-25T12:09:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andrea\_Salmaso](https://avatars.discourse-cdn.com/v4/letter/a/4da419/32.png) [@Andrea\_Salmaso](https://forum.inductiveautomation.com/u/Andrea_Salmaso)\
**Post date:** [February 25, 2026, 12:09pm UTC](https://forum.inductiveautomation.com/t/opc-certificates-expiration-date-management/114168/1 "2026-02-25T12:09:14Z")

</div>

Hi.

On the page

> Config \> Opcua \> Security

I can see the list of all certificates along with their expiration dates.  
However, the problem is that I cannot directly associate each certificate with its corresponding OPC UA server.

o work around this, I have been querying the certificates located at:

> /data/opcua/client/pki/trusted/certs

with a Powershell script to extract the **Subject Alternative Name** and **ValidTo** fields.

This method does not always work for me, though, because sometimes the SAN value does not contain any identifier that helps me match the certificate to a specific OPC UA server.

Is there a simple way to determine the certificate expiration date for each OPC UA server connected to the gateway?  
Any insight would be appreciated.

Thank you

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [February 25, 2026, 12:15pm UTC](https://forum.inductiveautomation.com/t/opc-certificates-expiration-date-management/114168/2 "2026-02-25T12:15:56Z")

</div>

The URI from the SAN is the piece of information that definitively identifies a server, but unfortunately that URI is not stored as part of the connection configuration or anywhere else, so I’m not sure there’s a deterministic way to correlate certificates to servers.