# OPC UA Bad\_CertificateUseNotAllowed **URL:** \ **Category:** Ignition\ **Created:** [March 30, 2023, 9:03pm UTC](https://forum.inductiveautomation.com/t/opc-ua-bad-certificateusenotallowed/71862 "2023-03-30T21:03:33Z")\ **Posts on this page:** 10\ **Page:** 2
**Author:** ![Adam\_Ruck](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@Adam\_Ruck](https://forum.inductiveautomation.com/u/Adam_Ruck)\ **Post date:** [April 7, 2023, 7:41pm UTC](https://forum.inductiveautomation.com/t/opc-ua-bad-certificateusenotallowed/71862/21 "2023-04-07T19:41:09Z")
![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/f/7/f79f0517dd244e710cfaf23419751c679e21b1fb.png) It appears to be working now with the latest nightly build. ---
**Author:** ![Adam\_Ruck](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@Adam\_Ruck](https://forum.inductiveautomation.com/u/Adam_Ruck)\ **Post date:** [April 7, 2023, 7:44pm UTC](https://forum.inductiveautomation.com/t/opc-ua-bad-certificateusenotallowed/71862/22 "2023-04-07T19:44:08Z")
This is the new re-generated cert that works [Ignition OPC UA Client.cer](https://forum.inductiveautomation.com/uploads/short-url/tnQPrSZQdeF8dtTzb0pUVoo7Z3L.cer) (1.1 KB) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [April 7, 2023, 7:49pm UTC](https://forum.inductiveautomation.com/t/opc-ua-bad-certificateusenotallowed/71862/23 "2023-04-07T19:49:10Z")
Great, thanks for confirming. ---
**Author:** ![Adam\_Ruck](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@Adam\_Ruck](https://forum.inductiveautomation.com/u/Adam_Ruck)\ **Post date:** [April 7, 2023, 7:57pm UTC](https://forum.inductiveautomation.com/t/opc-ua-bad-certificateusenotallowed/71862/24 "2023-04-07T19:57:23Z")
I think that is the fastest I have ever seen a bug fixed in a large software suite like Ignition. Very impressive. Now back to the Ignition University courses for me, hopefully Ill have a chance to use this software more in the future. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [April 7, 2023, 9:29pm UTC](https://forum.inductiveautomation.com/t/opc-ua-bad-certificateusenotallowed/71862/25 "2023-04-07T21:29:45Z")
> [@Adam\_Ruck](#): > > fastest I have ever seen a bug fixed in a large software suite Hang around! It'll start to feel normal, and your opinion of other brands will plummet. ---
**Author:** ![ammar201031](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@ammar201031](https://forum.inductiveautomation.com/u/ammar201031)\ **Post date:** [July 13, 2023, 2:58am UTC](https://forum.inductiveautomation.com/t/opc-ua-bad-certificateusenotallowed/71862/26 "2023-07-13T02:58:36Z")
Hi Kevin, This thread is about three months old, but I the same issue with another OPC UA server. The ignition version is 8.1.28 which I assume had this certificate issue resolved. However in my case, when I disable the certificate validation, it works. Would that be ignition client or the UA server causing the issue? Thank you. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 13, 2023, 3:05am UTC](https://forum.inductiveautomation.com/t/opc-ua-bad-certificateusenotallowed/71862/27 "2023-07-13T03:05:32Z")
If you can connect after disabling certificate validation then it's not the same issue - it's the Ignition client that is rejecting the server certificate for some reason. Setting the logger you find searching for "CertificateValidationUtil" and then forcing the connection attempt again (edit/save) might yield some helpful log messages. It would also be useful if you could upload your server's certificate for me to look at. ---
**Author:** ![ammar201031](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@ammar201031](https://forum.inductiveautomation.com/u/ammar201031)\ **Post date:** [July 13, 2023, 3:41am UTC](https://forum.inductiveautomation.com/t/opc-ua-bad-certificateusenotallowed/71862/28 "2023-07-13T03:41:02Z")
Here is the server certificate: [c7d3290359be604aac662625c691cbee4277311a [CN%3DNodeOPCUA-TEST].der](https://forum.inductiveautomation.com/uploads/short-url/3rHGpY0HsLbHPx9co3PRAjC3Fz3.der) (1.1 KB) One of the logger messages is "certificate path: [CN=NodeOPCUA-TEST,O=NodeOPCUA,L=Paris,ST=IDF,C=FR]", The are other two messages but they have sensitive information and I cannot share here. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 13, 2023, 3:46am UTC](https://forum.inductiveautomation.com/t/opc-ua-bad-certificateusenotallowed/71862/29 "2023-07-13T03:46:35Z")
This certificate is not a valid OPC UA certificate because it's missing some of the required keyUsage extensions. See [UA Part 6: Mappings](https://reference.opcfoundation.org/Core/Part6/v105/docs/6.2.2:) > For RSA keys, the keyUsage shall include digitalSignature, nonRepudiation, keyEncipherment and dataEncipherment. This certificate only has: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/9/d/9d79dc0acd8bf3a591588797a130b0afdbbeefca.jpeg) ---
**Author:** ![ammar201031](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@ammar201031](https://forum.inductiveautomation.com/u/ammar201031)\ **Post date:** [July 13, 2023, 3:49am UTC](https://forum.inductiveautomation.com/t/opc-ua-bad-certificateusenotallowed/71862/30 "2023-07-13T03:49:15Z")
I will bring this issue to the vendor attention. Thank you for the help. [Previous page](https://forum.inductiveautomation.com/t/opc-ua-bad-certificateusenotallowed/71862.md?page=1)