# OPC-UA Certificate Trust Error While Connecting Machine to Ignition Server **URL:** \ **Category:** Ignition\ **Created:** [January 14, 2026, 11:42am UTC](https://forum.inductiveautomation.com/t/opc-ua-certificate-trust-error-while-connecting-machine-to-ignition-server/113278 "2026-01-14T11:42:14Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![amapatil](https://avatars.discourse-cdn.com/v4/letter/a/b3f665/32.png) [@amapatil](https://forum.inductiveautomation.com/u/amapatil)\ **Post date:** [January 14, 2026, 11:42am UTC](https://forum.inductiveautomation.com/t/opc-ua-certificate-trust-error-while-connecting-machine-to-ignition-server/113278/1 "2026-01-14T11:42:14Z")
Hi @Kevin.Herron I am trying to connect an **machine** to the **Ignition Server** using an **OPC-UA card** , but I am encountering the following error on the server side: **sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target** ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/3/8/38a7d0ac18cc60c4a2bee96cf25caddbb673c57d.png) I have tested the same scenario in a **local environment** by connecting the machine directly to a laptop, and the communication works successfully. That setup is not restricted by any network security policies. However, when I attempt to connect the machine to the **Ignition Server within the server/network environment** , the connection fails with the above error. Thank you. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 14, 2026, 12:53pm UTC](https://forum.inductiveautomation.com/t/opc-ua-certificate-trust-error-while-connecting-machine-to-ignition-server/113278/2 "2026-01-14T12:53:34Z")
What does the rest of the error / stack trace say? Click “Show Full Details”. Most likely one side of the connecton needs to trust the other side. ---
**Author:** ![amapatil](https://avatars.discourse-cdn.com/v4/letter/a/b3f665/32.png) [@amapatil](https://forum.inductiveautomation.com/u/amapatil)\ **Post date:** [January 14, 2026, 2:56pm UTC](https://forum.inductiveautomation.com/t/opc-ua-certificate-trust-error-while-connecting-machine-to-ignition-server/113278/3 "2026-01-14T14:56:20Z")
This the full details UaException: status=Bad\_SecurityChecksFailed, message=sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at org.eclipse.milo.opcua.stack.core.util.validation.CertificateValidationUtil.buildCertPath(CertificateValidationUtil.java:400) at org.eclipse.milo.opcua.stack.core.util.validation.CertificateValidationUtil.buildTrustedCertPath(CertificateValidationUtil.java:120) at org.eclipse.milo.opcua.stack.client.security.DefaultClientCertificateValidator.validateCertificateChain(DefaultClientCertificateValidator.java:64) at org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientMessageHandler.onOpenSecureChannel(UascClientMessageHandler.java:469) at org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientMessageHandler.decodeMessage(UascClientMessageHandler.java:394) at org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientMessageHandler.decode(UascClientMessageHandler.java:382) at io.netty.handler.codec.ByteToMessageCodec$1.decode(ByteToMessageCodec.java:42) at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:530) at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:469) at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) at io.netty.handler.codec.ByteToMessageCodec.channelRead(ByteToMessageCodec.java:103) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) at org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientAcknowledgeHandler.decode(UascClientAcknowledgeHandler.java:171) at io.netty.handler.codec.ByteToMessageCodec$1.decode(ByteToMessageCodec.java:42) at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:530) at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:469) at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) at io.netty.handler.codec.ByteToMessageCodec.channelRead(ByteToMessageCodec.java:103) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788) at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:724) at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:650) at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562) at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997) at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) at java.base/java.lang.Thread.run(Unknown Source) Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source) at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source) at java.base/java.security.cert.CertPathBuilder.build(Unknown Source) at org.eclipse.milo.opcua.stack.core.util.validation.CertificateValidationUtil.buildCertPath(CertificateValidationUtil.java:398) ... 34 more 8.1.42 (b2024061810) Azul Systems, Inc. 17.0.11 ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 14, 2026, 2:58pm UTC](https://forum.inductiveautomation.com/t/opc-ua-certificate-trust-error-while-connecting-machine-to-ignition-server/113278/4 "2026-01-14T14:58:28Z")
Go to the security area and make sure the server certificate is trusted. If the server is using a certificate chain and not just a self-signed certificate, the root/CA cert must also be trusted. > **[Upload a Trusted Certificate​ - OPC UA Security | Ignition User Manual](https://docs.inductiveautomation.com/docs/8.1/ignition-modules/opc-ua/opc-ua-security#upload-a-trusted-certificate)** > > On the OPC UA security page you can manage OPC UA certificates for the client and server. Trusted certificates can be imported and quarantined certificates can be marked as trusted.